Security Model

Security Model

Wirecat is a general-purpose network utility for lawful administration, debugging, research, and educational use.

Use Wirecat only on systems and networks that you own, administer, or have explicit permission to test. You are responsible for how you use this software. The author and contributors are not responsible for misuse, damage, unauthorized access, policy violations, or illegal activity performed with Wirecat.

Intentional Boundaries

Wirecat intentionally avoids:

• persistence
• stealth
• autonomous operation
• embedded scripting
• C2 framework behavior
• offensive automation

The intended security-professional workflows are transport inspection, secure relays, controlled shell/process bridging, file movement, and repeatable test automation.

Security Defaults

• TLS client verification is enabled by default.
• TLS servers can require verified client certificates.
• TCP listeners and brokers can restrict peers with exact IP or CIDR rules.
• --tls-insecure is explicit and intended for local testing or controlled private environments.
• Listeners bind only to the address supplied by the operator.
• Process and PTY bridging require an explicit --exec path.

Access Control

Use --allow and --deny with TCP listeners and brokers:

wcat listen --allow 192.0.2.0/24 0.0.0.0 4444
wcat broker --deny 198.51.100.10 0.0.0.0 5555

Deny rules are evaluated before allow rules.

Reporting Security Issues

Report security issues privately to the maintainer listed for the project. Include the affected release or commit, platform, compiler, command line, expected behavior, observed behavior, and crash logs or packet captures when relevant.