ultrasecurity/Storm-Breaker
Storm Breaker
Storm-Breaker is a browser-based surveillance toolkit designed to silently capture sensor data from visitors without their knowledge or consent. It combines device fingerprinting, network-based geolocation tracking, and WebRTC exploitation to access a remote device’s camera, microphone, and system information without triggering native permission prompts.
The toolkit achieves this by leveraging legacy browser APIs and network-based geolocation (IP, Wi-Fi) that do not require explicit user permission. It abuses WebRTC and media stream APIs to activate camera and microphone streams, while also collecting hardware and software details through stealth fingerprinting. All captured data is exfiltrated to a remote server via HTTP or WebSocket connections, orchestrated from a single-page web interface.
Storm-Breaker provides capabilities for webcam feed capture, microphone audio recording, device location tracking, and hardware/software reconnaissance, all operating outside standard consent workflows. The project is presented as a self-contained tool for exploring these browser API exploitations.
Features
- Surveillance Toolkits - A browser-based surveillance toolkit that captures webcam, microphone, and device information without consent.
- Client-Side Exfiltration Channels - Transmits captured sensor data to a remote server via HTTP or WebSocket connections.
- Permissionless - Determines a device's approximate geographical location using IP and Wi-Fi signals for surveillance.
- Permissionless Geolocation Trackers - Estimates a device's location using IP addresses and network signals without explicit permission.
- Permissionless Network Geolocation - Uses network-based geolocation (IP, Wi-Fi) to determine approximate location without permission.
- Permissionless Microphone Access - Records audio from a remote device's microphone using browser APIs without permission prompts.
- Permissionless Microphone Recording - Records audio from a device's microphone without alerting the user or requesting permission.
- Permissionless Webcam Streaming - Activates and streams a remote device's camera through a browser without the user's knowledge.
- Permissionless Webcam Capture - Activates the camera on a remote device and captures live video for streaming or recording.
- Network-Based Location Tracking - Tracks a device's geographic location using network-based methods without user notification.
- WebRTC Media Hijacking - Abuses WebRTC and media stream APIs to activate camera and microphone without permission dialogs.
- Sensor Hijacking Scripts - Uses unsecured JavaScript APIs to capture camera, microphone, and location data from visitors.
- Device Fingerprinting - Gathers detailed device information like OS, browser version, and hardware specs without user consent.
- Stealth Fingerprinting Techniques - Captures hardware and software details through browser fingerprinting without alerting the user.
- Permissionless API Exploits - Leverages browser APIs that do not require user permission to harvest data silently.
- WebRTC Exploitation Tools - Abuses WebRTC and getUserMedia to access camera and microphone streams silently.
- Permission Bypass Exploits - Exploits browser API quirks to access sensors without triggering native permission prompts.
- Device Information Harvesting - Harvests device-specific details such as operating system, browser version, and hardware specs.
- Surveillance Dashboards - Provides a self-contained web application that orchestrates multi-sensor data capture and exfiltration.
Star history
How this analysis was created: This summary and feature list are AI-generated from collected project material and can contain mistakes. Stars, license and language are imported from GitHub. Inclusion does not mean that we have tested or audited this project. Check the source documentation for any feature you depend on. Learn more on our About page.
