User guide · ZRAK

What ZRAK is

ZRAK (written Z.R.A.K. in the app, for Zone Recon & Analysis Kit) is a network security toolkit for Android. It scans for Wi-Fi networks, Bluetooth devices and the devices on the network your phone is connected to, watches for signs of trouble, keeps a history of what it saw with the place where it saw it, and turns that history into scores, maps and reports.

The app has two sides. RECON is for looking yourself: scanning, opening one network or device, running a tool. SOC (short for security operations centre) is for leaving the app running so that it keeps watch. A switch in the top bar changes between them.

This guide says how the app is laid out and what its tools show. The full reference, with a page for every tool, is in the app itself: the question mark in the top bar opens Help, and most tools have a help button of their own.

Use it where you are allowed to

ZRAK is for examining and defending a network that is yours, or one you have permission to test, and for learning. Listing the Wi-Fi networks and Bluetooth devices in range only listens to what they announce. Several tools go further and send probes to other devices. They are for authorised assessments only, and a tool that touches other people's privacy is marked in the app as for use in authorised contexts only.

So before you point a tool at a device, ask whose it is. On your own network, in a classroom lab, or with the owner's permission you are on safe ground. Elsewhere you may be breaking the law.

What you need

Android 12 or newer.
No root. ZRAK is built to run on an ordinary phone, without developer mode and without special Wi-Fi hardware. A rooted phone lets it see more; see What Android does not show.
A phone that lets it scan. ZRAK works best on a Google Pixel (Pixel 6 or newer), where scanning behaves as Android documents it. Phones of other makers may slow scanning down or stop the app in the background. Switching off battery optimisation for ZRAK helps there.
Permissions. Android hands Wi-Fi and Bluetooth scan results to an app only with the location permission and with location switched on; without it a network's name shows as unknown. The app also asks for the Bluetooth permissions and for notifications. The privacy policy says what each permission is for.

First start

A short introduction of five steps opens the first time: what the app is, how it works, how it treats your data, which permissions it needs, and a choice between two ways of showing things.

Basic mode is a simpler view. It shows about 33 essential tools, gives signal strength as a word (Excellent, Good, Fair, Weak), and leaves out hardware addresses, channels, threat scores and similar detail.
Advanced mode shows every tool and every detail: signal in dBm, the hardware addresses of networks and devices, channels, scores with their confidence, and the trust state of each device.

You can change the mode at any time in the settings.

The tabs of RECON

RECON has seven tabs along the bottom.

Overview: the switch that starts and stops monitoring, the current risk level, the quality of the network, whether DNS and the internet connection answer, the details of your Wi-Fi connection, counts of what was found, and the most recent serious events. Baselines, trends, reports and the upkeep of the database are here too.
WiFi: three views. Devices lists the devices on the network you are connected to, live or from history. Networks lists the Wi-Fi networks in range with a chart of channel use. History holds every network seen so far, with sorting and filters such as open, secured or strong.
Bluetooth: the Bluetooth devices in range, live, and the history of those seen before, with filters for Low Energy, Classic, paired and strong.
Map: every Wi-Fi network and Bluetooth device that was seen with a position, on a map, coloured by signal strength. Filters narrow it to an area, a vendor or a type of device.
Events: the list of what the detection engines noticed. Session shows everything since the app was opened; History shows the saved events of medium severity and above.
Analyzer: an analysis of the whole stored history, started with one button.
Tools: the toolkit, with one view for guided workflows, one for Wi-Fi and network tools and one for Bluetooth tools.

Tapping a network or a device opens a sheet with its details. A device can be given a name, notes and labels of your own there. The sheet also starts the tools that work on one target, such as following its signal to where it comes from.

Monitoring and events

"Start Monitoring" on the Overview switches the detection engines on, and a permanent notification shows that scanning is active. Monitoring can go on while the app is not on the screen.

While it runs, ZRAK watches for:

a router that is not the one it was: the hardware address of the gateway is remembered when first seen, and a change raises a critical event;
forged DNS answers: what your network's DNS server says is compared with the answers of public resolvers;
a second DHCP server handing out addresses on the network;
an imitated access point: a network with a known name but different security or an implausible signal;
probes of the phone itself: the app listens on a few ports that nothing should connect to;
Bluetooth trackers: devices that stay close while you move.

Each of these can be switched off on its own in the settings.

An event has one of five severities: INFO, LOW, MEDIUM, HIGH or CRITICAL. Opening an event shows why it matters, the common harmless causes, and suggested actions. Read the harmless causes: a router that was replaced or a network with several access points can look like an attack. Events from a source you know can be muted, and a kind of event can be snoozed. High and critical events also raise a notification, if you leave that switched on.

Monitoring profiles set how often the app scans. Three are built in: Home (every 60 seconds), Office (every 30) and Public WiFi (every 15). You can add your own and have a profile switch on by itself when the phone joins a certain network.

Baselines are saved lists of the devices on a network. Save one when all is in order and compare later: the app shows which devices are new, which are missing, and which changed their hardware address.

The tools and what each group shows

The Tools tab holds more than 200 tools. Wi-Fi and network tools are sorted into eight groups, A to H, and Bluetooth tools into three. A search field finds a tool by name. A tool opens over the whole screen, keeps the screen awake while it runs, and works on what the app is scanning at that moment.

Group	What its tools show
A: Threat and intrusion detection	Signs that somebody is interfering with the network: access points that imitate others, tampered DNS answers, an unexpected DHCP server or proxy setting, intercepted encrypted connections, a login page that misbehaves, clocks that disagree.
B: Enumeration and mapping	What is on the network: its devices, the services they announce, the ports and service greetings they answer with, the route your traffic takes, and the speed and delay of the connection.
C: Privacy and counter-surveillance	What can be learned about you: whether a VPN leaks, what the phone's own connections reveal, whether the phone hides its hardware address, and signs of being tracked.
D: Radio and signal analysis	The radio side: signal strength over time and place, coverage maps, crowded channels and a proposal for a better one, and the direction and rough distance of a transmitter.
E: Assessment and reporting	The findings put together: audits, risk scores, a comparison of services with a built-in list of known vulnerabilities, a mapping of events to the MITRE ATT&CK catalogue, evidence capture and reports.
F: IoT and specialised	Smart home and similar devices and the protocols they speak, and the search for hidden devices in a room, also with the camera: lens reflections and infrared lights.
G: Advanced reconnaissance and forensics	Longer investigations: devices that follow you, time servers that disagree, and material for forensic work.
H: Protocol and active defence	IPv6, TLS and Wi-Fi sign-in examined in depth, and decoys: harmless services that raise an alarm when something touches them.
Bluetooth: Detection	Signs of misuse of Bluetooth near you: module names typical of card skimmers, devices that copy another's identity, suspicious pairing behaviour.
Bluetooth: Recon	What a Bluetooth device says about itself: its maker, its beacon data, the services it offers, its signal over time.
Bluetooth: Counter-surveillance	Devices that stay near you over time, devices that come close, and devices that keep changing their address.

The tools that send something, rather than only listen, send it to the device or address you chose. The paragraph Use it where you are allowed to is about them.

Guided workflows

A workflow chains several tools into a procedure for one task and explains at each step why the step matters. There are 36 of them, at four levels: Beginner (quick checks of 10 to 20 minutes), Intermediate, Advanced and Expert. They cover finding threats, privacy, network audits, physical security, responding to an incident, and security tests that the help marks as authorised engagements.

Examples are a check of a hotel's or another new network before you use it, the question "am I being tracked?", a DNS security audit, an audit of the smart home devices on a network, and a sweep of a room for hidden devices.

Start a workflow from its card. "Launch" opens the tool of the current step; closing the tool marks the step as done. "Skip" moves on without it. Progress is kept, so a workflow can be resumed another day.

Workflows are a good way to learn: they give the tools an order and a reason.

SOC mode

SOC changes the tabs to Environment, Command, Inventory, Live Map and Operations. It is meant for a phone that stays in one place for hours or days, at home, in an office or at an event.

Environment says where you are, what surrounds you and whether there is reason for concern.
Command shows live figures of what the app is doing.
Inventory compares the radio surroundings with a saved baseline and shows what has drifted.
Live Map draws the network as a graph of connected devices.
Operations gathers related events into incidents with a severity and the evidence for it.

A tap on RECON in the top bar brings the usual tabs back.

History, analysis and reports

Everything ZRAK finds goes into a history on the device, with time and, where known, position. The history is kept until you delete it.

Analyzer. "Analyze Database" goes through the whole history. It gives every Wi-Fi network and Bluetooth device a score from 0 to 100 with the reasons, summarises how the networks around you are secured, lists oddities such as one network name with two kinds of encryption, rates the channels, and marks areas where risky finds cluster.
Trends. Events, threats and newly found devices per day.
Reports. The Overview exports the data as JSON, as CSV, as an incident report in Markdown, as PDF, and in the CEF and Syslog formats used by security monitoring systems. The Analyzer exports its analysis as Markdown, JSON or CSV. A report is handed to Android's share sheet, and you choose where it goes.
Backup and restore. "Backup" saves the whole database as one file where you choose; "Restore" reads it back. The app is not part of Android's own backup, so this is the way to move a history to another phone.
Purge All deletes the whole history for good.

A report contains hardware addresses and positions. Think about who receives it.

What Android does not show

ZRAK uses the scanning and network functions Android offers to every app. That sets limits, and it is better to know them than to trust a result too much.

No capture of other devices' traffic. An Android app cannot listen to the radio traffic between other devices. Detectors for attacks that happen there conclude from side effects, for example a network that vanishes and returns. Such a finding is a hint, not a proof.
Hardware addresses without root. Since Android 10 an app can hardly read the hardware addresses of the devices on a network. Without root they are mostly missing, and with them the vendor of a device; the detection of a changed router address and of address floods becomes unreliable. Windows computers, file servers and printers can still be asked for their address.
Scan limits. Android allows an app four Wi-Fi scans in two minutes. ZRAK asks about every 30 seconds and reads the latest results every few seconds in between, so a new network may appear a little late.
Listening ports. Without root the app can listen for probes only on ports above 1024.
Location must be on. Otherwise Android gives no network names.

Without root these work as intended: finding devices on the network, Wi-Fi and Bluetooth scanning, the detection of imitated access points and forged DNS answers, port and service checks, TLS certificate checks, service discovery, the check for a login page, the route trace and the Analyzer.

Your data

ZRAK has no account, no advertising and no analytics, and it sends nothing to Enlyzr. Some tools and the map do contact services on the internet. Which ones, what the app stores and how to delete it is in the privacy policy.

ZRAK: user guide