Home

🛡️ WRAITH-PRIME // SOVEREIGN CYBERNETIC HARDENING & ANONYMIZATION KERNEL

Production-Grade Linux Network Anonymization, OS Fingerprint Normalization & Active Deception Engine
Built strictly in Pure Safe Rust with Zero Garbage Collection, Netfilter TransProxy, Netlink FIB & 16-Layer Defense Matrix.

📑 Wiki Navigation & Index

⚡ 1. Architectural Overview & Pipeline
🚀 2. Rapid Installation & Deployment
🎛️ 3. Full Operational Command Matrix
🛡️ 4. The 16 Sovereign Defense Layers Breakdown
🔗 5. Multi-Hop Tunneling & Onion Services
🍯 6. Deceptive Honeypots & Active LAN Sensor
🌐 7. 75-Language i18n Matrix
🧪 8. Operational Red Team & Pentest Scenarios
🔬 9. Leak Testing, Forensics & System Diagnostics

⚡ 1. Architectural Overview

Wraith is an autonomous, fail-closed anonymity gateway engineered for cyber security specialists, offensive operators, and extreme-privacy environments. Unlike legacy wrapper scripts (anonsurf, torghost), Wraith operates via low-level kernel abstractions (AF_NETLINK, AF_PACKET, eBPF, Seccomp, iptables/nftables, cgroups):

graph LR
    classDef red fill:#1e1e2e,stroke:#f38ba8,stroke-width:1.5px,color:#cdd6f4;
    classDef green fill:#1e1e2e,stroke:#a6e3a1,stroke-width:1.5px,color:#cdd6f4;
    classDef cyan fill:#1e1e2e,stroke:#89dceb,stroke-width:1.5px,color:#cdd6f4;

    APP["🎯 Local Applications / Scanners<br/>(Nmap, Sqlmap, Browsers)"]:::red
    
    subgraph INGRESS["Host Hardening Gate"]
        NS["Linux Network Namespace Jail<br/>(10.200.1.0/24)"]:::cyan
        VD["X11 Virtual Display Sandbox<br/>(Xvfb 1920x1080@24bit)"]:::cyan
        DPI["In-Flight AF_PACKET DPI Sanitizer<br/>(50+ Tool Signature Stripper)"]:::cyan
    end

    subgraph KERNEL["Kernel Network Engine"]
        FIB["Netlink Routing & Table 52"]:::green
        TC["TC Netem Traffic Shaper"]:::green
        BPF["eBPF / Seccomp Ring 0 Gate"]:::green
        FLT["Netfilter TransProxy & Anti-Nmap Drop"]:::green
    end

    subgraph EGRESS["Anonymized Egress Mesh"]
        WG["WireGuard Hop 1 Link"]:::cyan
        TOR["Tor Multi-Hop TransProxy (Port 9040)"]:::cyan
        EXT["🌐 Anonymous World Exit"]:::red
    end

    APP --> INGRESS
    INGRESS --> KERNEL
    KERNEL --> EGRESS

🚀 2. Rapid Installation & Deployment

One-Line Automated Setup

git clone https://github.com/ByGh00st/wraith.git
cd wraith
chmod +x build.sh
sudo ./build.sh

Manual Binary Compilation

cargo build --release --workspace
sudo cp target/release/wraith /usr/local/bin/wraith
sudo chmod 755 /usr/local/bin/wraith
sudo mkdir -p /etc/wraith /var/log/wraith /etc/tor

🎛️ 3. Full Operational Command Matrix

sudo wraith [SHORTCUTS | OPTIONS] [COMMAND]

Command / Shortcut	Description
`sudo wraith -s` / `wraith start`	Start Wraith Isolation: Engages Fail-Closed routing & selected security layers.
`sudo wraith -s -F`	Full Security Mode: Engages ALL 16 non-destructive defense layers at once.
`sudo wraith -x`	Stop Wraith: Tears down proxies, flushes firewall, and restores clean Clearnet.
`sudo wraith -r`	Circuit Rotation: Triggers `SIGNAL NEWNYM` to switch Tor identity on-demand.
`sudo wraith -t`	Leak Audit: Comprehensive real-time DNS, IPv6, WebRTC STUN leak verification.
`sudo wraith -i`	Status Telemetry: Displays exit node IP, country, circuits, and active shields.
`sudo wraith -M`	Real-Time DPI Monitor: Live pop-up terminal intercepting packet signatures.
`sudo wraith -c`	Anti-Forensic Purge: Clears RAM drop_caches, temporary state, and session traces.
`sudo wraith --cleanup-full`	Deep Forensic Purge: Wipes RAM, swap partitions, and all system auth logs.
`sudo wraith doctor`	Kernel Diagnostics Auditor: Multi-tier audit for sysctl, Tor, Netlink, Seccomp.
`sudo wraith benchmark`	Crypto Benchmark: ChaCha20-Poly1305, SHA-256, HMAC, and socket throughput tests.
`sudo wraith shred <FILE>`	Military File Shredder: Overwrites file using DoD 5220.22-M 7-pass cryptosequence.
`sudo wraith --select-lang`	75-Language Selector: Native interactive Unicode TUI for instant locale switching.

🛡️ 4. The 16 Sovereign Defense Layers

#	Defense Layer	Implementation Details
1	Fail-Closed Netfilter TransProxy	All TCP (`:9040`) and DNS (`:5353`) redirected to Tor. Inbound default `DROP` against Nmap sweeps.
2	Ring 0 Seccomp-BPF Sandbox	Strict syscall filtering. Blocks `ptrace` and unauthorized process memory dumping.
3	eBPF TC Egress Fastpath	Kernel-level traffic drop on the `clsact` qdisc before packets hit the physical NIC.
4	QNAME Minimized DNS Engine	EDNS0 468-byte padded queries, local DNS caching, telemetry sinkholing.
5	Dynamic TLS JA3/JA4 GREASE	RFC 8701 cipher randomization mimicking Google Chrome 131 on Windows 11.
6	In-Flight AF_PACKET DPI Sanitizer	Real-time payload scrubbing stripping offensive signatures (Nmap, Sqlmap, Ffuf, Nikto).
7	Hardware DMI & Machine-ID Masking	Ephemeral spoofing of `/etc/machine-id` and system serial numbers.
8	TCP/IP L4 Stack Normalization	Forcibly sets IPv4 TTL=128 and timestamps=0 to defeat remote OS fingerprinting (p0f/Nmap).
9	DoD 5220.22-M 7-Pass Shredder	Cryptographic 7-pass zeroizer for auth logs, `.bash_history`, and volatile files.
10	In-Memory RAMFS Crypto Vault	ChaCha20-Poly1305 encrypted runtime state stored in `/dev/shm` with `mlock`.
11	Linux Network Namespace Jail	Isolated virtual routing namespace (`10.200.1.0/24`) isolating host routing tables.
12	cgroup2 Network Socket Jail	Pinpoint socket isolation and process tree traffic enforcement.
13	Isolated Virtual Display Sandbox	Headless X11 server (`Xvfb 1920x1080@24bit`) masking physical monitor EDID/resolution.
14	Kernel TC Netem Traffic Shaper	Normal-distribution packet delay (35ms ± 12ms) defeating statistical traffic flow correlation.
15	Deceptive Localhost Honeypots	Decoy listeners on `:2222, :3306, :5432, :6379, :8080, :27017` with rogue PID detection.
16	Active LAN Deception Sensor	`0.0.0.0` network decoy traps catching and tarpitting lateral network port scanners.

🔗 5. Multi-Hop Tunneling & Onion Services

WireGuard ➔ Tor Multi-Hop Pipeline

Wraith encapsulates outbound Tor traffic inside a kernel-level WireGuard interface (wg0), hiding Tor usage from ISPs:

sudo wraith start --wireguard /etc/wireguard/mullvad.conf

Ephemeral v3 Onion Service Provisioning

Expose internal services as hidden Tor Onion Services on-the-fly:

# Forward local web app (port 8080) to an anonymous .onion address on port 80
sudo wraith start --onion 80:8080

🍯 6. Deceptive Honeypots & Active LAN Sensor

Localhost Trap (--honey-ports): Binds decoy services strictly on 127.0.0.1 to catch malware attempting local database credential theft. Investigates /proc/net/tcp to extract attacker PID, binary path, and process name.
LAN Sensor Mode (--honey-lan): Binds decoy services to 0.0.0.0. External LAN/Wi-Fi scanners attempting Nmap probes get caught in an asynchronous 30-second TCP Tarpit, freezing their scanning threads.

🌐 7. 75-Language i18n Matrix

Wraith natively supports 75 languages with instant switching and zero external dependencies:

# Launch interactive 75-Language Selector TUI
sudo wraith --select-lang

# Execute command in Turkish
sudo wraith --lang tr start -F

# Execute command in Russian
sudo wraith --lang ru test

🧪 8. Operational Red Team & Pentest Scenarios

# 1. Maximum Stealth Engagement
sudo wraith start -F --profile stealth -m

# 2. Multi-Hop ISP Camouflage + Traffic Shaper
sudo wraith start -F -W /etc/wireguard/vpn.conf --shaper

# 3. Dedicated Red Team Operation with Auto-Shred on Exit
sudo wraith start -F -L -d

# 4. LAN Network Defense Sensor Mode
sudo wraith start --honey-lan

🔬 9. Leak Testing, Forensics & Diagnostics

Run deep audit: sudo wraith doctor
Run comprehensive leak suite: sudo wraith test
Run cryptographic benchmarks: sudo wraith benchmark

Navigation Menu