If you’ve read my posts on T-Pot honeypots or the tiny titans of RF hacking, you know I’m a big fan of shrinking serious security tooling down to pocket size. So when I kept finding myself lugging a laptop around just to answer simple questions — who’s on this network? Is that an AirTag following me? Did that AP always have WEP security? — I decided the answer should live on my phone.
That became NetGuard, my open-source Android app: a self-contained network security toolkit built in pure Kotlin and Jetpack Compose. No root. No Termux. No cloud. It’s on GitHub now: DaemonSec ToolKit / NetGuard.
What It Does
NetGuard organizes everything into six tabs, and every scan writes structured findings to an on-device Room database you can export as MD, JSON, or PDF — all generated locally, no server involved.
| Tab | What you get | Root needed |
|---|---|---|
| Network Recon | ARP host discovery, TCP sweep of your /24, mDNS/SSDP listening, OUI vendor lookup | No |
| WiFi Scan | Every visible AP logged (SSID/BSSID/channel/RSSI), congestion advisor, evil-twin + downgrade detection | No |
| Traffic Observation | VpnService TUN observer — real UDP forwarding, DNS log, TLS SNI extraction (no decryption) | No |
| BLE Discovery | Tracker classification (AirTag/Tile/SmartTag/Chipolo) incl. Find My beacons, movement heuristics | No |
| Fox Hunt | Lock onto a MAC and chase it — live RSSI, warmer/colder guidance, hunt trail | No |
| Web Recon | crt.sh subdomain enum, DNS-over-HTTPS, CSP/HSTS/CORS header audits, directory busting | No |
The traffic observer deserves special mention: it builds a proper TUN interface with actual UDP forwarding, so DNS, QUIC, and HTTP/3 pass straight through while you watch domains via TLS SNI — metadata, not payloads. You learn what’s phoning home without decrypting anything.
And Fox Hunt is exactly what it sounds like. Copy a tracker’s MAC from the BLE tab, hit Hunt, and the phone becomes a signal-strength bloodhound with a warmer/colder indicator and a walk-back-to-best-signal breadcrumb trail. Ask me how many AirTags I’ve found in parking lots this year.
Building Without Root
The constraint that shaped the whole app: nothing here requires root or Termux. Everything runs through official Android APIs —
VpnServicefor the traffic observer- Standard BLE scanning APIs for discovery and hunts
- Room database for structured, exportable findings
Build it from the CLI (no Android Studio needed) or just open it and hit Run — it’s a standard Gradle/Compose project.
⚠️ Ethics Are Baked In
⚠️ Warning: Scanning networks you don’t have permission to touch is illegal essentially everywhere. NetGuard is for networks you own and bug-bounty targets within a program’s written scope.
The app enforces part of this itself. Web recon and OSINT targets require an explicit scope declaration before you can start, .gov and .mil are hard-refused, requests are throttled, and every exported report embeds the authorization you typed. Your HIBP and GitHub tokens (optional OSINT extras) stay in app-private storage and never appear in exports.
This is the same philosophy behind my Hermes setup: powerful tooling with guardrails, not toys.
Lessons Learned
- Constraint breeds creativity — refusing root forced solutions I wouldn’t have found otherwise (TUN forwarding for SNI extraction being the big one).
- Structured data beats walls of logs — grouping findings in Room DB before rendering made the UI almost trivial.
- Battery is the real enemy — Fox Hunt’s platform-filtered BLE filtering turned a battery incinerator into something usable for hours.
Final Thoughts
NetGuard is at v0.9.6 and actively developed. If you’re a bug bounty hunter wanting recon in your pocket, a traveler wondering whether that BLE beacon is following you, or just someone who likes knowing what your phone’s neighbors are doing — give it a spin.
Repo: https://github.com/r00t-n0v4/DaemonSec-ToolKit-NetGuard-
Issues, PRs, and feature requests are all welcome. Play safe, verify your scope, and happy hunting. 🦊