================================================================================
  NetProxy of Death
  Death's Head Software
  System-wide Proxy Manager for Kali Linux (XFCE)
================================================================================


DEPENDENCIES
------------

  Python Packages:
    pip install PyQt6

  System Packages:
    sudo apt install tor                  (required for Tor mode)
    sudo apt install redsocks             (required for Transparent Proxy mode)
    sudo apt install network-manager      (almost certainly already installed)

  Build / Packaging:
    pip install pyinstaller
    pyinstaller --onefile --windowed --name "NPOD" netproxy_of_death.py


RUNNING
-------

  From source:
    sudo python3 netproxy_of_death.py

  From binary:
    chmod +x ./NPOD
    sudo ./NPOD

  Note: Root privileges are required. Run with sudo or as root.


FEATURES
--------

  System Tray Icon
    Lives in the XFCE system tray. Right-click to access all options.
    Icon colours indicate current proxy state:
      White       No proxy active
      Red         SOCKS proxy active
      Purple      Tor routing active
      Orange      Transparent proxy active

  SOCKS4 / SOCKS5 Proxy
    Routes traffic through a SOCKS4 or SOCKS5 proxy of your choice.
    Configure host, port, and version via Configure SOCKS... in the menu.
    Default: 127.0.0.1:1080

    Sets the following system-wide:
      - /etc/environment              (persists across reboots)
      - /etc/profile.d/netproxy.sh    (new terminal sessions)
      - Systemd user session env vars (live session, no relogin needed)
      - Firefox user.js               (all detected profiles)
      - Chrome/Chromium policy JSON   (managed policy, cannot be overridden)
      - NetworkManager connections    (cleared to prevent conflicts)
      - XFCE xfconf proxy channel

  Tor Routing
    Routes traffic through the Tor network via 127.0.0.1:9150.
    Manages the tor systemd service automatically (starts on enable,
    stops on disable).
    Requires: tor package (NOT Tor Browser — the tor daemon)
      sudo apt install tor

    Note: Tor Browser bundles its own proxy on port 9150 but does not
    install the system tor daemon. Install the tor package separately.

  Transparent Proxy
    Intercepts ALL outbound TCP at the kernel level using iptables + redsocks.
    Catches tools that ignore environment variables entirely (nmap -sT,
    curl, wget, Metasploit, Nikto, sqlmap, most Python tools, etc.)
    Requires: redsocks package
      sudo apt install redsocks

    In this mode browser-level proxy settings are cleared to prevent a
    double-proxy loop. iptables handles all traffic directly.

    Note: Raw socket tools (nmap -sS, masscan) bypass the NAT table and
    cannot be caught by iptables transparent proxying. Use nmap -sT for
    TCP connect scans, or proxychains for raw socket tools.

  Browser Integration
    Firefox:
      Writes proxy settings directly to user.js in all detected profiles
      under ~/.mozilla/firefox/. Firefox must be fully quit and relaunched
      after toggling for changes to take effect.

    Chrome / Chromium:
      Writes managed policy JSON to:
        /etc/chromium/policies/managed/netproxy_of_death.json
        /etc/opt/chrome/policies/managed/netproxy_of_death.json
      Managed policies cannot be overridden by Chrome at startup.
      Chrome must be fully quit and relaunched after toggling.
      A "Managed by your organisation" banner will appear — this is normal.

  Disable All Proxies
    Single click to remove all proxy settings from every layer:
    environment files, live session, browser profiles, NM connections,
    iptables rules, and redsocks daemon.

  Diagnostics
    Opens a window showing the full state of every proxy layer:
      - User/UID detection
      - /etc/environment proxy lines
      - /etc/profile.d/netproxy.sh contents
      - systemctl --user show-environment (live session vars)
      - NetworkManager connection proxy.method
      - iptables chain and rules
      - redsocks PID and config status
      - Firefox and Chrome profile detection
      - Root process environment proxy vars

  Install / Remove Autostart
    Installs or removes system autostart so NPOD launches automatically
    at login without a password prompt.

    Install writes:
      /etc/sudoers.d/netproxy_of_death    (NOPASSWD rule for the binary)
      /etc/xdg/autostart/netproxy_of_death.desktop

    The sudoers rule is scoped to the exact binary path and validated
    with visudo -c before saving. Moving or renaming the binary requires
    reinstalling autostart.


CONFIGURATION
-------------

  SOCKS settings are saved to:
    ~/.config/netproxy_of_death/config.json

  Fields:
    mode            disabled | socks4 | socks5 | tor | transparent
    socks_host      IP address of SOCKS proxy (default: 127.0.0.1)
    socks_port      Port of SOCKS proxy (default: 1080)
    socks_version   4 or 5 (default: 5)


NOTES
-----

  - Browsers must be fully closed and relaunched after toggling proxy
    modes. Running browsers will not pick up changes until restarted.

  - The tor package must be installed separately from Tor Browser.
    Tor Browser does not install the system tor daemon.

  - Transparent mode exempts 127.0.0.0/8 and the SOCKS proxy host/port
    from iptables redirection to prevent routing loops.

  - All proxy changes applied to /etc/environment and /etc/profile.d/
    persist across reboots. Disable All Proxies removes them cleanly.

  - On systems without a systemd user bus socket the live session
    injection step is skipped gracefully. Proxy settings still land
    in /etc/environment and /etc/profile.d/ for the next login.
    
  Apps that are not covered by proxies:
  SOCKS / Tor mode (env vars + browser profiles)

Apps that don't read *_proxy environment variables (most GUI apps launched before the proxy was enabled)
Apps with hardcoded network settings that ignore system proxy
Apps using UDP — SOCKS only handles TCP
ICMP traffic (ping, traceroute)
Raw socket tools (nmap -sS, masscan, hping3)
Apps running as a different user that don't inherit the session environment
System daemons and services started before the proxy was enabled
Java apps — JVM ignores env vars, needs -Djava.net.useSystemProxies=true
Apps using their own proxy configuration (Burp Suite, etc.)

Transparent mode (iptables + redsocks) catches most of the above, but still misses:

UDP traffic — iptables REDIRECT only works on TCP
ICMP (ping, traceroute, nmap -sP)
Raw socket tools using SOCK_RAW (nmap -sS, masscan) — bypass the NAT table entirely
IPv6 traffic — our iptables rules are IPv4 only (ip6tables would need separate rules)
Kernel-level traffic from other daemons in the root namespace

Nothing catches:

UDP-based tools (DNS lookups outside of redsocks, SNMP scanners, etc.)
IPv6 unless you add ip6tables rules
ICMP-based tools
nmap -sS / masscan in any mode


================================================================================
  Death's Head Software
================================================================================
