wifideaddrop

📦 WiFi Dead Drop

Anonymous file & message drop over Wi-Fi using a captive portal.
Turn your Evil-Cardputer into a temporary, offline, wireless dead drop.

---

🧠 Concept

A Dead Drop is a classic intelligence and underground technique used to exchange information without direct contact.

The WiFi Dead Drop module recreates this idea digitally: a temporary Wi-Fi access point exposing a captive portal where anyone nearby can upload files, download deposits, or leave notes without authentication or prior setup.

Everything happens locally, offline, and disappears as soon as the device is stopped.

---

🚀 Workflow

[1] Evil-Cardputer starts a Wi-Fi Access Point
           │
           ▼
[2] Captive Portal Triggered (Android / iOS / Windows)
           │
           ▼
[3] Landing Page
    - Upload files
    - Leave text notes
           │
           ▼
[4] Files stored on SD card
    /evil/deaddrop/
           │
           ▼
[5] Other clients can browse and download deposits
           │
           ▼
[6] Live Dashboard on device
    - Clients
    - Uploads / Downloads
    - Files
    - Throughput

---

📡 Features

• 📶 Wi-Fi Access Point with cloned SSID
• 🌐 Captive portal compatible with Android, iOS and Windows
• 📤 Anonymous file uploads (any type)
• 📥 Public file listing and downloads
• 📝 Anonymous text notes (append-only)
• 📊 Real-time on-device dashboard
• 📈 Live throughput graphs (upload / download)
• 💾 SD card storage
• 🧹 Graceful shutdown (waits for active transfers)

---

🖥️ On-Device Dashboard

While the Dead Drop is active, the Cardputer displays a live dashboard:

• Clients: number of connected devices
• Uploads: total completed uploads
• Downloads: total completed downloads
• Files: current number of stored files
• IO Throughput: KB/s upload & download

Small sparklines show activity evolution over time for:

• Connected clients
• Upload bandwidth
• Download bandwidth

---

📁 Storage Layout

All content is stored on the SD card:

/evil/deaddrop/
 ├── file1.bin
 ├── picture.jpg
 ├── document.pdf
 └── notes.txt

• notes.txt contains all submitted text notes (append-only)
• Files are saved with sanitized filenames to prevent path traversal

---

🌍 Captive Portal Behavior

The module answers common OS connectivity checks to force captive portal display:

• Android: /generate_204, /gen_204
• iOS: /hotspot-detect.html
• Windows: /ncsi.txt, /connecttest.txt

Any unknown request is redirected to the landing page.

---

🔐 Security Model

This module is intentionally minimal and anonymous:

• No authentication
• No encryption at application level
• No logging of client identities
• No IP storage

It is designed for:

• Demonstrations
• Training labs
• Field experiments
• Awareness of captive portal abuse patterns

---

❓ FAQ

❔ Is this persistent?

No. The Dead Drop exists only while the module is running. Stopping it shuts down the access point and server.

❔ Is encryption used?

No. Traffic is plain HTTP over Wi-Fi. This is intentional to keep the setup simple and compatible with captive portals.

❔ Can uploads be interrupted?

Yes. The system tracks active transfers and performs a graceful shutdown, allowing in-flight uploads/downloads to complete when exiting.

❔ Is this exploiting anything?

No. This module does not exploit vulnerabilities. It demonstrates how captive portals can be used as anonymous exchange points.

---

WiFi Dead Drop is a practical illustration of how simple wireless infrastructure can be repurposed for anonymous data exchange.