About THUGS(red) Wardrive

A common place for the THUGS(red) community to collect, keep and share what we find while wardriving — instead of leaving it scattered across a dozen SD cards in half a dozen incompatible formats.

Why this exists

Wardriving produces a surprising amount of data and almost no good way to keep it. A Kismet run leaves you with .netxml. A phone running WiGLE gives you CSV. A home-built ESP32 rig writes whatever its sketch happened to print. Each one ends up on a different device, in a different shape, and the interesting part — what did we actually see, and where — stays locked inside a file nobody opens again.

This site is the shared place for that data. Upload the dump your gear produced, whatever format it is in, and it gets normalised into the same dataset as everyone else's: one record per access point, every sighting kept, all of it searchable, sortable and on a map. A drive from last summer sits alongside one from last night, and both are useful.

It is deliberately a community archive rather than a public dragnet. Every upload is reviewed before it appears, contributors can hide their own findings, and moderators can hide anything — see privacy below.

Who is behind it

THUGS(red) is a local Danish hacking community — people who like taking things apart, understanding how they work, and occasionally driving around town with an antenna on the dashboard. We are hobbyists, not a company, and this is a hobby project.

The community lives on Discord, and new faces are welcome:

Join the THUGS(red) Discord

The person behind THUGS(red) and this site is Kawaiipantsu, whose other work is on GitHub.

A note on privacy

Wardriving records the existence and rough position of wireless access points. It does not capture traffic, does not attempt to connect to anything, and does not break encryption — a beacon frame announcing "I am here, and I am called this" is broadcast to everyone in range by design. Still, an access point can be somebody's home, so the site takes a few positions on that:

• Uploads are reviewed. A dump does not appear publicly until a moderator has looked at it.
• You can hide your own contributions. If you would rather a network you found were not listed, hide it — and if a moderator or admin hides something, only someone of equal or higher standing can put it back. That rule is enforced in the database, not just the interface.
• No traffic, no credentials, no clients. The data model has room for access points and where they were seen. That is all it has room for.
• Your account details are encrypted. Email addresses are stored encrypted rather than in the clear, and passwords are hashed with argon2id — they cannot be recovered, only reset.

If a network of yours is listed here and you would rather it were not, ask in the Discord and a moderator will hide it.

How the site is built

Plainly, and on purpose. There is no framework, no build step, and no package manager — a stack that can be understood by reading it, and that will still run in five years without a dependency archaeology expedition.

Backend

PHP 8 on Apache. No framework; a small router, a thin PDO wrapper, and plain PHP templates.

Database

MariaDB, with spatial indexing so map queries stay fast as the archive grows.

Frontend

Hand-written CSS and vanilla JavaScript. Leaflet for the map, self-hosted rather than pulled from a CDN.

Dependencies

One: Leaflet. Its files are pinned by hash and verified on demand.

The interesting parts

• Every format converges. Each supported dump type has its own streaming parser, and all of them funnel through one normalisation step — so a WiGLE row and a Kismet network are held to identical standards. Formats are detected by sniffing the file's contents, not by trusting its extension.
• Records without a real GPS fix are thrown away. Including the 0,0 that a device reports when it never got a satellite lock, which would otherwise drop a pile of fake access points in the Gulf of Guinea.
• Parsing is streamed, never loaded whole. A long drive can hold hundreds of thousands of sightings; memory use stays flat regardless.
• Sorting and filtering live in the URL. Every table view can be copied, bookmarked and shared, and so can a map position — the map writes its centre, zoom and filters into the address bar as you move.
• Permissions are ranked rather than boolean. Members, moderators and admins each have a rank, and a moderator cannot undo an admin's decision. The rule is enforced in three independent places, including a database constraint, because it is the one rule that must not quietly break.
• Rigs can post directly. An ESP32 with a GPS module can send observations to the API as it drives, with a token you can revoke the moment a device goes missing.

Security is treated as part of the build rather than a later pass: a strict content security policy with no inline scripts or styles, CSRF protection on every state-changing action, prepared statements everywhere, uploads stored outside the web root, and HTTP methods restricted per route. There is a test suite covering the authorisation rules and the parsers, and an end-to-end run that walks the whole pipeline from upload to map.

Getting involved

Build a rig, go for a drive, upload what you find. If you want to know how to get started — setting up Kismet, using a Hak5 Pineapple, or building an ESP32 with GPS that talks straight to this site — ask in the Discord; written guides are on the way.

So far the archive holds 6,128 access points from 6,143 observations, contributed by 1 person.