Function download_file_api

webapp_modern.py:16158–16216

Download a file

()

            bssid_match = _re.match(r'^([0-9A-Fa-f]{2}\\:[0-9A-Fa-f]{2}\\:[0-9A-Fa-f]{2}\\:[0-9A-Fa-f]{2}\\:[0-9A-Fa-f]{2}\\:[0-9A-Fa-f]{2})', raw)
            if not bssid_match:
                continue
            bssid = bssid_match.group(1).replace('\\:', ':').upper()
            remainder = raw[bssid_match.end():]
            if remainder.startswith(':'):
                remainder = remainder[1:]
            rparts = remainder.split(':')
            if len(rparts) < 4:
                continue
            ssid = rparts[0] if rparts[0] else '(Hidden)'
            signal = rparts[1] if len(rparts) > 1 else '0'
            security = rparts[2] if len(rparts) > 2 else ''
            freq = rparts[3] if len(rparts) > 3 else ''

            # 1. Evil twin detection — same SSID as ours, different BSSID
            if own_ssid and ssid == own_ssid and bssid != own_bssid and own_bssid:
                key = f'evil_twin_{bssid}'
                if key not in seen:
                    seen.add(key)
                    findings.append({
                        'type': 'Evil Twin',
                        'severity': 'critical',
                        'ssid': ssid,
                        'bssid': bssid,
                        'signal': signal,
                        'description': f'AP impersonating your network "{ssid}" with different BSSID {bssid}'
                    })

            # 2. Rogue SSID patterns
            for pattern, name, severity, desc in _ROGUE_SSID_PATTERNS:
                if pattern.search(ssid):
                    key = f'rogue_{name}_{bssid}'
                    if key not in seen:
                        seen.add(key)
                        findings.append({
                            'type': name,
                            'severity': severity,
                            'ssid': ssid,
                            'bssid': bssid,
                            'signal': signal,
                            'description': desc
                        })
                    break

            # 3. Suspicious OUI (ESP32/Pi broadcasting as AP)
            oui = bssid[:8]
            if oui in _SUSPICIOUS_AP_OUIS:
                vendor = _SUSPICIOUS_AP_OUIS[oui]
                key = f'sus_oui_{bssid}'
                if key not in seen:
                    seen.add(key)
                    findings.append({
                        'type': f'Suspicious {vendor} AP',
                        'severity': 'low',
                        'ssid': ssid,
                        'bssid': bssid,
                        'signal': signal,
                        'description': f'{vendor} device broadcasting as access point — may be rogue'
                    })