Caellum Buys
All work

AirCommand

A Wi-Fi auditing tool that puts standard security tools behind one interface and only acts on networks you’re authorised to test.

Status
In progressDesign stage
Built for
Personal project
When
2026, in progress
Team
Solo
My role
Design and build
Built with
Python, CustomTkinter, SQLite, Linux, Wraps aircrack-ng, hashcat, nmap
Links
  1. DiscoveryPassive. Sees any network, touches none.
  2. AllowlistThe only thing that can create a Target.
  3. Gated actionsCapture, enumerate, crack. They accept a Target or nothing, one job per radio.
  4. Audit logWritten and committed before anything is reported.
How an action gets permission, drawn from AirCommand’s architecture notes. No Target, no action.

The problem

Mature tools like aircrack-ng, hashcat and nmap each run on their own, with their own commands, output and state. AirCommand puts them behind one desktop interface and adds what they leave to the operator: workflow, tracking and authorisation.

How it works

  • Passive discovery can see any network. Any active operation needs a Target, and only the allowlist can create one.
  • The gate is structural. Gated methods only accept types the allowlist mints, so there is no code path around it.
  • An event-driven core runs jobs and publishes progress to the GUI, which stays a thin layer over a GUI-agnostic Python package.
  • One radio, one job at a time. A reservation state machine refuses a second job instead of corrupting the adapter’s state.

Design decisions

  • Cut from scope on purpose: WEP cracking, WPS attacks and evil-twin creation. Rogue access point detection stays in.
  • One password prompt at launch. Nothing privileged persists once the app closes.
  • Every active operation is audit-logged, and only reported once the log write has committed.
  • The core is testable with no GUI, no root and no hardware.

My part

  • My own project. I wrote the scope, the architecture and the decision records, and I’m building it.

Not done yet

  • The architecture and decision records are written. Most core methods are still stubs.
  • Linux only.
  • Open questions are logged in the design notes, such as WPA3 handshake support in the first version.