WireTapper: a passive wireless OSINT console that leans on external databases

A web console that reads other people's databases

WireTapper describes itself as a wireless OSINT tool built on passive signal intelligence: it discovers, maps and analyses radio-based devices without active intrusion. The wording matters. A passive tool listens to traffic it already has access to and correlates what it sees, rather than transmitting probes or attempting authentication.

The more useful thing to understand before reading any of the feature claims is where the knowledge comes from. Several of the modules are front ends over third-party datasets. Wi-Fi and Bluetooth discovery is described as mapping through WiGLE, cell tower location and beacon analysis come from WiGLE and OpenCellID, and IoT and SCADA reconnaissance for exposed cameras and industrial control systems is described as running through the Shodan and Censys Search API v2. That is not a criticism so much as a framing: WireTapper's own contribution is correlation, presentation and import, while coverage of a given technology depends on a database you may need to pay for.

The repository confirms the shape. The tree is a Python web application: `app.py` for the server, `cli.py` for the command line entry point, `telemetry_importer.py`, `flock_manager.py`, plus `templates/`, `static/` and an `uploads/` directory. The packaging metadata lists Flask, requests, pandas and openpyxl, and registers both a `wiretapper` and a `wiretaper` console script pointing at `cli:main`.

[project.scripts]
wiretapper = "cli:main"

Installing from PyPI, with a naming detail that will confuse you

The pip route is one command, and the README links a dedicated wiki page for it along with separate guides for Linux, macOS, Windows and Android under Termux. Prebuilt binaries for Linux, macOS and Windows are attached to the release page.

pip install wiretapper

That command is correct, and it sits next to a detail that looks like a typo until you check the packaging files. The distribution name in both `pyproject.toml` and `setup.py` is `wiretaper`, one p short of what the README tells you to install, while the console script is registered as `wiretapper`. So `pip install wiretapper` is the command to run, the module metadata calls the package something else, and the executable name matches the README. If you script this, pin the install line from the README rather than deriving a name from the repository.

The two packaging files also disagree about dependencies. `pyproject.toml` lists four of them inline, while `setup.py` reads its requirements from `WireTapper.txt` at build time, filtering comments and blank lines:

with open("WireTapper.txt") as f:
    requirements = [line.strip() for line in f if line.strip() and not line.startswith('#')]

Both declare Python 3.8 or newer. The build backend is setuptools with `py-modules` naming the four scripts directly, and package data pulls in templates, static files and uploads, which is why a local run needs those directories present rather than just the modules.

Configuration follows the platform guide, then comes API credentials, covered next.

Four API keys decide how much of the tool works

The README lists the external services and the environment variable each expects. WiGLE.net for wireless network and Bluetooth mapping takes `WIGLE_API_NAME` and `WIGLE_API_TOKEN`. OpenCellID for cell tower data takes `OPENCELLID_API_KEY`. Shodan for Internet-connected IoT and industrial devices takes `SHODAN_API_KEY`, and Censys for Internet host data takes its own key. The README truncates mid-sentence on the Censys entry.

This is the part to understand before installing anything, because it bounds the tool. A module that geolocates exposed cameras through Shodan cannot work without a Shodan key, and a module that places cell towers cannot work without OpenCellID. The project's own value in those paths is the mapping and correlation layer rather than the discovery.

The environment variable names are also where the `.env` file at the repository root becomes relevant. A project holding four API keys expects them to live in environment configuration rather than in source, and having a `.env` in the tree is a reminder to check your own ignore rules before copying the repository.

The BLE module is the one place the README describes real cryptography rather than a third-party lookup. Bluetooth LE and RPA radar is documented as live passive detection with RSSI path-loss distance estimation and Resolvable Private Address resolution using AES-128-ECB `ah()` functions. That is a specific, checkable claim: resolving an RPA requires knowing the IRK and having seen the advertisement, so the scope is narrower than full Bluetooth device tracking.

The telemetry importer is the piece with the least outside dependency

Alongside the radio modules sits a multi-format telemetry importer, described as drag-and-drop ingestion with smart column-mapping for CSV, KML, GeoJSON, SQLite files with a `.db` extension, and Excel formats. The dedicated `telemetry_importer.py` module and the `uploads/` directory are where that lives, and the presence of pandas and openpyxl among the dependencies explains why Excel and CSV are first-class here rather than bolted on.

In practice this is the part of WireTapper that does not need an API key. Field reports from a colleague, an existing dataset exported from another tool, or a spreadsheet of sightings can be brought in, mapped, and displayed in the same interface as live detections. For an investigation where the interesting data was collected by other means, that importer may be the only feature you need, and it is the one with the least ambiguity about provenance.

The KML and GeoJSON support is worth singling out because those formats carry actual coordinates, which makes the mapping immediate. CSV and Excel inputs rely on the column-mapping step, since the schema is whatever the reporting sheet used.

There is a separate Flock Safety module, named for the company and handled by `flock_manager.py`, covering ALPR camera networks and telemetry datasets with dedicated management, download and mapping. That one is narrower and more specific than the general vehicle and consumer device RF detection described elsewhere in the feature list, which is a reasonable example of a tool growing one data source at a time.

Hardware detection, USB dongles, and the claim list

The module list covers more ground than passive Wi-Fi. Cellular infrastructure analysis uses WiGLE and OpenCellID for beacon and tower location. Vehicles and consumer devices are covered by RF signals from smart vehicles, dashcams, IP cameras, wearables and IoT appliances. Underwater or aerial imagery plays no part here, so this is a radio story rather than a visual reconnaissance one.

There is also a hardware detection path: USB SDR receiver detection that identifies attached software defined radio dongles, specifically RTL-SDR, HackRF One and Airspy, and monitors the frequency range in use. That is the closest the tool comes to active capability, and even here the README describes detection rather than transmission. It tells you what radio hardware is attached to the machine and what it is tuned to, which is a diagnostic feature rather than an exploitation one.

The README also carries a note that AI will be integrated into the platform at some point. That is a stated intention, not a documented feature, and nothing in the repository describes what it would do or which parts would change. Worth knowing so you do not plan around it.

The last push to the repository was on 2026-09-11 and it is not archived, so the work is current. The one recorded release, tagged WireTapper on 2026-01-30, carries release notes for Windows only, and those notes restate the passive OSINT overview rather than listing changes.

Licence, language metadata, and what is not in the repository

Two details deserve attention before you build on this. The first is licensing. The repository's licence field reads as unasserted, and the file in the tree is `LICENSE-NONCOMMERCIAL.md`. A file with that name signals a non-commercial restriction, which is a materially different arrangement from the permissive licences most OSINT tooling uses. Read that file and treat the question of whether your use qualifies as a question for your own counsel, not for the README.

The second is the mismatch between metadata and reality. The repository's declared language is HTML, which reflects the template files and the amount of markup in the README rather than the codebase. The packaging metadata, module list and entry points are unambiguously Python, and the version is 1.0.0 in both `pyproject.toml` and `setup.py`, which is the value to pin if you need reproducibility.

There is also no `tests/` directory in the tree, and no test configuration alongside the other Python project files. For a tool that parses radio data, third-party API responses and user-uploaded files in five formats, that absence is the most visible gap in what the repository offers. There is a `SECURITY.md` and a `CONTRIBUTING.md` and a pull request template, so the project does have its community scaffolding in place.

Finally, the documentation is almost entirely off-repository. Installation for each platform is a wiki page, the project has a website and a Medium post, and the README's own configuration section says to follow the platform-specific guide rather than describing the settings. Anyone evaluating this needs the wiki open alongside the repository.

Editorial conclusion

WireTapper is a reasonable front end for a security analyst who wants one map and one import pipeline instead of querying WiGLE, OpenCellID, Shodan and Censys separately, and the telemetry importer is the part with the clearest independent value. It is the wrong choice if you need documented coverage of any one wireless technology, since the README describes the modules rather than their detection methods, and the wrong choice for commercial use, because the licence file in the repository is named for non-commercial terms. Check first that the API keys you need are ones you are entitled to hold, since four of the modules are inert without them, then read the wiki installation page for your platform, because the README only links to it.

Frequently asked questions

Official sources

1. h9zdev/WireTapper on GitHub
2. Issues
3. README
4. Releases