EFForg/rayhunter
Rayhunter
Rayhunter is an IMSI catcher detection tool and cellular network monitor designed to identify cell-site simulators and fake base stations. It functions as an SDR signal analyzer that tracks tower connectivity, logs GPS locations, and monitors for network downgrades or disabled encryption on mobile hardware.
The system distinguishes itself through heuristic-based traffic analysis used to detect suspicious identity requests, malformed system information, and the use of null ciphers. It includes a remote device management interface consisting of a REST API and web dashboard for controlling detection daemons.
The project covers broad capabilities in wireless signal capturing, remote device administration via ADB or telnet, and hardware integration for rendering status through LEDs and physical button triggers. It also provides network management utilities, including dual-mode WiFi operation and automated driver recovery.
Software is deployed to supported mobile devices through automated daemon installation and can be updated using source packages or pre-built binaries.
Features
- IMSI Catcher Detection - Provides specialized tools to identify rogue base stations and cell-site simulators through signal analysis.
- Heuristic Analysis - Uses heuristic-based pattern recognition on cellular signal logs to identify fake base stations and IMSI catchers.
- Cellular Network Monitors - Tracks tower connectivity and monitors for network downgrades or disabled encryption on mobile hardware.
- Network Security Analysis - Processes captured traffic files using heuristics to identify potential IMSI catchers and simulators.
- GPS Coordinate Loggers - Logs GPS coordinates and timestamps alongside cellular traffic captures for spatial mapping of base stations.
- Wireless Signal Recorders - Provides a web interface to control recording and manage logs of raw radio frequency data.
- Hardware Shell Access - Provides a command-line interface for direct access to device hardware for system interaction and troubleshooting.
- Mobile Hardware Shell Bridges - Ships bridge utilities for transferring files and opening remote command shells on mobile hardware.
- SDR Signal Analysis - Provides a framework for processing signal captures and applying detection logic to identify suspicious cellular behavior.
- Authentication Bypass Detections - The analysis of identity request patterns that bypass authentication to identify potential cell-site simulators.
- Cellular Simulator Detections - The analysis of cellular signals to identify simulators and catchers utilizing compatible modem hardware.
- Cipher Suite Detection - Identifies base stations requesting null ciphers to transmit data without encryption.
- Fake Base Station Detections - The detection of incomplete system information block chains that indicate the presence of a fake base station.
- Network Downgrade Detection - Monitors base stations that force devices from secure 4G connections to less secure 2G networks.
- Cellular Traffic Analysis - Processes mobile traffic captures using heuristic analysis to detect suspicious identity requests and encryption disablement.
- Remote Access Utilities - Provides administrative command-line access to mobile hardware via ADB or Telnet bridges.
- ADB Device Managers - Uses ADB-based toolsets for deploying software and managing system interactions on mobile hardware.
- Mobile Device Management - Manages, configures, and monitors detection daemons on mobile device hardware.
- Driver Recovery Mechanisms - Automatically detects kernel module failures and reloads the wireless driver to maintain network connectivity.
- Root-Level System Integration - Provides root-level access for direct interfacing with system binaries and protected internal APIs.
- Detection - Implements a web server interface for remote management of the background detection process via HTTP.
- Driver Recovery Loops - Automatically detects wireless driver failures and re-initializes the network stack to maintain connectivity.
- Cellular Connection Logging - Generates diagnostic logs for cellular tower connections and disconnections to assist in network capture analysis.
- Remote Device Management - Provides a centralized interface for configuring and monitoring detection daemons on remote devices.
- Telnet Remote Management - Implements administrative interfaces providing remote command execution via the Telnet protocol.
- Traffic Analysis - Provides a command-line tool to apply detection heuristics to captured traffic files offline on a desktop.
- REST APIs - Provides a REST API for the programmatic management of detection daemons via a web interface.
- Seguridad y privacidad - IMSI catcher detection tool.
