github.com/PierreGode/Ragnar @main

Ragnar

Ragnar is a fork of the awesome Bjorn project — a Tamagotchi-like autonomous network scanning, vulnerability assessment, and offensive security tool. It runs on a Raspberry Pi with a 2.13-inch e-Paper HAT, as a headless server on Debian-based systems (AMD64/ARM/ARM64) with Ethernet-first connectivity, or on the WiFi Pineapple Pager with full-color LCD display. On servers with 8GB+ RAM, Ragnar unlocks advanced capabilities including enhanced vulnerability scanning and parallel scanning.

[!IMPORTANT] For educational and authorized testing purposes only.

Quick Install

wget https://raw.githubusercontent.com/PierreGode/Ragnar/main/install_ragnar.sh
sudo chmod +x install_ragnar.sh && sudo ./install_ragnar.sh
# On Raspberry Pi: choose between e-Paper HAT, server/headless, or Pineapple Pager deployment.
# On other hardware: choose between server install or Pineapple Pager deployment.
# It may take a while as many packages and modules will be installed. Reboot when it finishes.

For detailed information see the Install Guide. To get the box onto a network — including moving it somewhere new — see Ragnar AP Mode. See Release Notes for what's new. Keeping a box current — from the web UI or the terminal, and what to do when an update complains — is covered in Updating Ragnar.

🌐 Web Interface

Access Ragnar's dashboard at http://<ragnar-ip>:8000

• Real-time network discovery and vulnerability scanning
• Multi-source threat intelligence dashboard
• File management with image gallery
• System monitoring and configuration
• Hardware profile auto-detection (Pi Zero 2W, Pi 4, Pi 5)

WiFi Configuration Portal — When Ragnar can't connect to a known network, it creates a WiFi hotspot: 1. Connect to WiFi network Ragnar (password: ragnarconnect) 2. Navigate to http://192.168.4.1:8000 3. Configure your WiFi credentials via the mobile-friendly interface 4. Ragnar will automatically retry known WiFi after some time if the AP is unused 5. Once configured, Ragnar exits AP mode and connects to your network

The portal supports network scanning with signal strength, manual entry for hidden SSIDs, known network management, and one-tap reconnection.

web will be down during wardrive without ap or wifi connection.

🌟 Features

• Ragnar Mesh — a Viking army, not a box — Links Ragnar units over Tailscale so every one of them is reachable by a stable private address regardless of NAT, CGNAT or the firewall in front of it. There is no controller: every unit publishes its own report and reads its peers', so there is no master to configure and no collector whose failure blinds the rest. Units are individuals — each is born with a Viking name derived from its own machine identity (Bjorn Ironside, Freydis Ravenwing), keeps that name across reinstalls, and carries an operator-assigned unit number, so incidents are discussed by name instead of by IP. The Mesh tab shows what the Tailscale console cannot: per-unit CPU/memory/disk, uptime, undervoltage (the classic remote-Pi killer), worst current alert severity, open incidents, and a degraded state for the case that matters most — the unit answers WireGuard but Ragnar itself is down, which is the difference between restarting a service and flying someone to site. Alerts are pulled from every peer into each unit's own incident engine, scoped so site-local addresses never fuse on coincidence while a public IP or MAC seen at two sites correctly becomes one cross-site campaign. Peer-to-peer API calls are authenticated by WireGuard identity, not a shared secret — no token to mint, ship, rotate or leak — and are GET-only, tag-gated and fail-closed. Deploy unattended by dropping a pre-authorized key on the boot partition (the technician plugs in power and ethernet, nothing else), during install, or later from the web UI; subnet-route advertisement turns a unit into a way into the whole far-side LAN, and Tailscale SSH plus Raspberry Pi Connect give two independent ways back in when the web UI is wedged. For bringing several units up the same way, the Fleet Config card (Config tab) exports one unit's settings to a JSON file and imports them on the rest — the same switches turned on everywhere, with secrets and per-unit state stripped and display/hardware keys applied only when you opt in. Units also move files to each other — a mesh-wide Mesh Share folder and direct unit-to-unit transfers into a quarantined inbox — and can let someone outside the mesh send files in (only that), by tag or by a scoped share token over Tailscale node-share/Funnel. Full details in the Ragnar Mesh Guide and the Mesh Share & File Transfer Guide.

• RuSense — Camera-Free Surveillance — Turns ordinary 2.4 GHz WiFi into a no-camera sensor: ESP32 nodes read Channel State Information (CSI) to report presence, motion, people-count, and — with a trained model — coarse pose and resting vital signs (breathing / heart rate). Works in the dark and through walls, with security & health modes, a calibration wizard, browser flashing, and a multi-node offline mesh. See RuSense

• Home Assistant integration — A HACS custom integration (shipped in-repo under custom_components/ragnar/) that surfaces a unit's RuSense presence / people-count / vitals, Watchtower security alerts + incidents, Wi-Fi / Ethernet connectivity, and Ragnar Mesh fleet health as native Home Assistant entities — occupancy, safety, connectivity and problem binary_sensors, sensors for heart/breathing rate, connected SSID, reachable mesh nodes and alert/incident/vulnerability counts, and an event entity that fires per new security alert — so Ragnar can drive HA automations (presence-triggered lighting, phone push on an evil-twin alert, a nudge when a mesh node drops) and dashboards. It is a read-only local-polling client against Ragnar's existing web API; auth reuses Ragnar's session-cookie login (or none, on an open unit). A config-flow UI handles setup. See Home Assistant integration

• Authority Verification Across the Stack — A built-in engine for verifying authority at every layer — is the claimed root bridge / default gateway / DNS resolver / DHCP server / routing neighbour / name responder / SMB server genuine, or an impostor? — plus a network engineer's toolbox, in the web UI across three tabs. Diagnostics: ping, traceroute, MTR, WHOIS, internet speed test, DNS Doctor, ARP-poisoning / MITM detection, MAC Watch, Path-MTU / black-hole probe, captive-portal check, iperf3 throughput, Live Flow Telemetry, PTP-timing detection, and IPv6 RA Guard (audits + one-click hardens the host's IPv6 first-hop settings — ICMPv6-redirect and rogue-RA-preference exposure) — plus an opt-in Network Integrity Monitor that reruns the DNS-poison / ARP-spoof / rogue-DHCP / RA-Guard checks on a schedule and, with extended monitoring, round-robins the entire passive-scanner suite (STP/DTP/CDP/VTP/FHRP/OSPF/EIGRP/IS-IS/BGP/SMB/Relay/LDAP/IGMP/IPv6/NDP/ICMP/NTP/SNMP/Cert/TLS) through the background poller, Pushover-alerting on any regression — capture-based scanners default to a link-up wired port (pinnable per config), so a sensor plugged into a switch but managed over WiFi watches the cable, not wlan0. A Watchtower pane then unifies the deep standalone watcher daemons (arp_guard · ndpwatch · wifiwatch · certwatch · snmpwatch · isiswatch · igmpwatch) — tailing each one's JSON-lines log into a single normalized, deduped feed with one Pushover path. Switch & L2/L3: LLDP/CDP/EDP/FDP/SONMP switch discovery with PoE, ARP host scan, DHCP Guardian (with an inline DHCP-snooping mode), L2 link health, plus a detection-only passive security-scanner suite spanning L2→L7 — IGMP · IPv6 First-Hop · NDP (IPv6 neighbor-cache poisoning) · NTP · ICMP · SNMP · STP/BPDU · DTP · CDP (Cisco Discovery flood/spoof/leak) · VTP (VTP-bomb / VLAN-DB wipe) · SMB (SMBv1 + LLMNR/NBT-NS/mDNS poisoning + Kerberos downgrade/roasting) · Relay/Coercion (NTLM relay + PetitPotam/PrinterBug/DFSCoerce) · LDAP (Active Directory — cleartext binds, StartTLS strip, enumeration, filter injection, CLDAP reflection) · FHRP (HSRP/VRRP/CARP + GLBP AVG and AVF forwarder-plane hijack) · EIGRP · IS-IS · OSPF · BGP Watch and a receive-only BGP collector + path-asymmetry correlator — a TLS Watch passive TLS/QUIC handshake observer (JA4/JA4_r + JA3/JA3S fingerprints, SNI/ALPN, SNI↔cert mismatch, QUIC v1/v2 Initial recovery), the active Cert Watch certificate/hygiene checker (plus a passive, standalone certwatch that triages observed X.509 certs off a tap/SPAN — expiry, name-mismatch, weak-sig/key — and inventories TLS 1.3 flows whose cert is encrypted), a PCAP analyzer, and Locate Port. Every scanner learns a baseline, ships a CLI, and self-tests (Scapy / local-handshake end-to-end). Interfaces: link speed/duplex/auto-neg, DHCP-vs-static + VLAN, DNS/gateway identity, per-interface public-IP / ISP-ASN lookup, and a VPN-egress check. Missing CLI tools install with one click. Co-authored by Solarflere. Full details in the Authority Verification Guide.

• WiFi Spectrum Analyzer — A passive, tri-band (2.4/5/6 GHz) Wi-Fi RF troubleshooter in the web UI (Network → WiFi Analyzer), a software take on the Ekahau Sidekick. Strictly passive — it only listens for beacons (iw scan -u passive) and never transmits a probe to any AP. Labels every generation up to Wi-Fi 7 (802.11be) — EHT/Multi-Link IEs are recognised from their raw extension IDs (with 320 MHz width from the EHT Operation element), since iw itself can't decode them in scan results yet. A big center spectrum graph with two views — Bar (bar per AP, width = channel width, height = RSSI) and Cone/Dome (the classic filled bell-curve per AP) — shows every BSS with RSSI, channel + width, SSID, security and AP-advertised channel utilisation. The graph is interactive: hover a signal to identify it (SSID/BSSID/vendor/RSSI/security tooltip) with a live channel·frequency·level cursor readout, click it to inspect. ⛶ Full screen opens a survey console that gives the whole viewport to a large hit-testable spectrum, the sortable AP list, and an inspector showing every field the survey holds for the selected AP — radio detail (frequency/centre freq, generation, PHY mode, spatial streams, max PHY rate, Tx power, country, DFS), load & timing (channel utilisation, stations, beacon interval, DTIM, last beacon), full security (PMF, 802.1X, WPS, 802.11k/v/r, findings), RSSI history and the modelled coverage rings — plus interference, since-last-scan changes, live BT/Zigbee device lists, clickable band chips and keyboard shortcuts (↑↓ walk the list, s scan, b/d view, a/2/5/6 band, Esc exit). Flags co-/adjacent-channel interference with 1/6/11 recommendations, shades DFS/radar channels (read live from the radio), estimates an AP's coverage radius (log-distance path-loss rings), and builds a walk-around coverage heatmap (floorplan + IDW interpolation on a true-to-scale square plan with metre rulers, adjustable floor size and zoom/pan — from a 10 m² room to a 300+ m² office). A 📶 Bluetooth overlay puts nearby Bluetooth Classic + BLE activity on the same 2.4 GHz axis — the BLE advertising channels (37/38/39 at 2402/2426/2480 MHz) drawn as markers in the Wi-Fi 1/6/11 gaps, a band-wide "hopping activity" strip, and a device table (RSSI, BLE/Classic, vendor, class-of-device) with an estimated per-channel BT interference level. Receive-only discovery over BlueZ (works on the onboard radio or the Alfa's built-in BT 5.2); it's a device-activity estimate, not a measured RF sweep. A 🐝 Zigbee overlay puts nearby Zigbee / Thread / 802.15.4 activity on the same 2.4 GHz axis via an on-demand sniff from a HuginnESP companion (ESP32-C5) — channel markers (Z11–Z26 at 2405–2480 MHz), a device table (address, proto, PAN ID, vendor, RSSI, clickable to highlight), and per-Wi-Fi-channel pressure; no wardriving needed, and the toggle greys out until a Huginn is on USB. For measured RF, a 📈 Waterfall view adds a true-RF spectrum + scrolling waterfall from a HackRF SDR (hackrf_sweep) — a live spectrum line with max-hold over a time×frequency×power heatmap, Wi-Fi/BT markers overlaid, catching non-Wi-Fi interferers (microwaves, cameras, jammers) nothing else sees; receive-only, and the button stays **greyed out until Ragnar actually d