WhatsTrapp is a tool for analyzing and dumping WhatsApp accounts.

WhatsTrapp uses a Man In the Middle (MITM) attack to establish a session with the WhatsApp's target: once the session has been established, actions for retrieving and collecting the data are executed in the browser context by using the very same WhatsApp Web's APIs (thank to a bit of reverse engineering).

Finally, the collected data are indexed in Elasticsearch in order to allow you to search for a specific text and sort the messages by time.

• Docker
• Docker Compose

Clone the repository:

$ git clone [email protected]:Wicker25/whatstrapp.git
$ cd whatstrapp/

Launch the WhatsTrapp server with:

$ docker-compose up

Then open your browser at http://127.0.0.1:8025/ and wait until the QR code has been loaded.

Launch the target's WhatsApp and, from the main menu, select "WhatsApp Web".

Finally, take a picture of the QR code and enjoy it!

Open Kibana's Discover page at http://127.0.0.1:5601/app/kibana#/discover.

You can start a new Search or open one of the default ones from the menu on the right.

The WhatsTrapp's architecture consists of a Puppeteer, Puppets, and Clients:

• The Puppeteer launches the browser instance by using Google Puppeteer and injects a Puppet into it;
• The Puppet is a JavaScript that performs actions in the WhatsApp Web page;
• The Client is the user interface used by the attacker for performing the hack.

All of the components communicate with each other via WebSocket.

If you are trying to use WhatsTrapp on a GNU/Linux operating system you might need to increase the kernel parameter max_map_count by running:

# sysctl -w vm.max_map_count=262144

See the Elasticsearch Reference for more details.

• Giacomo Trudu - @Wicker25

This project is licensed under the GNU General Public License - see the LICENSE.md file for details.