Elvis Wiki - User contributions [en]

MITRE ATT&CK

2024-01-04T12:57:26Z

ALanners: /* Lateral Movement */

Developed by MITRE, ATT&CK is a globally accessible knowledge base focused on adversary behaviour - also called cyber threat intelligence . Cyber adversaries are known for their intelligence, adaptability, and persistence, learning from each attack, whether successful or unsuccessful. Their capabilities range from stealing personal information an data to disrupting infrastructure and/or damaging business operations.
The MITRE ATT&CK knowledge-base is freely available to everyone. The knowledge base documents the common tactics, techniques and procedures used by cyber threat actors. The framework can be used as a resource for the development of specific threat models and methodologies, as well as the development of specific countermeasures. <ref name=”RE1”>"MITRE ATT&CK" - available under: https://www.mitre.org/focus-areas/cybersecurity/mitre-attack - Retrieved 2024-01-01.</ref>

==MITRE ATT&CK Groups==
The groups are "activity clusters" that are often observed in the cyber security bubble under a specific name. It should be noted that groups in the cybersecurity sector are often loosely connected and may be known by several names. In addition, it can happen that the same clusters are tracked by different actors under different names. In the context of the MITRE Groups documentation, the MITRE team endeavours to document the overlaps under the Associated Groups/Aliases section. Groups are in turn linked to techniques that are assigned to the respective tactics. As a result, there is a separate ATT&CK matrix for many groups. <ref name=”RE8”>"Groups" - available under: https://attack.mitre.org/groups/ - Retrieved 2024-01-01.</ref>

==MITRE ATT&CK Software==
According to MITRE, software is defined as "operating system utilities, open-source software, or other tools used to conduct behaviour modeled in ATT&CK".
Analogous to offender groups, there are also artefacts in the area of software that are known by different names but are the same software. Each entry in the software documentation contains a technical artefact, which in turn can be assigned to a group. The information is based on open source.

MITRE distinguishes between tools and malware:
A tool is software that can be used by Defender, Pentester as well as redteamer or threat actors. This includes software that is not found in the corporate context as well as software that is used in the corporate context.
In contrast to tools, malware is designed to carry out malicious actions on the targetsystem.<ref name=”RE9”>"Software" - available under: https://attack.mitre.org/software/ - Retrieved 2024-01-01.</ref>

==MITRE ATT&CK Techniques==
Techniques in the context of the MITRE ATT&CK knowledge base describe how an attacker achieves a tactical objective, i.e. which actions he performs to achieve it. As a striking example, the threat actor can, for example, dump credentials in order to gain access to the victim's credentials. As of January 2023, a total of 201 techniques are documented with a total of 424 sub-techniques. <ref name=”RE2”>"Enterprise Techniques" - available under: https://attack.mitre.org/techniques/enterprise/ - Retrieved 2024-01-01.</ref>

==MITRE ATT&CK Tactics==
Tactics documented the why of an ATT&CK technique or sub-technique, it is therefore the actual target of the attacker. The targets reflect the respective process steps of the MITRE ATT&CK matrix - i.e. from reconnaissance to impact. For example, an attacker can use credential access or privilege escalation as a tactic. <ref name=”RE3”>"Enterprise tactics" - available under: https://attack.mitre.org/tactics/enterprise/ - Retrieved 2024-01-01.</ref>

==MITRE ATT&CK Matrix==

The MITRE ATT&CK matrix is part of the knowledge base and provides actor-specific techniques and procedures for each phase of the attack. The process begins with reconnaissance and ends with impact. Different techniques and tactics are assigned to each process step, which can be clicked on and which then lead to documentation. <ref name=”RE4”>"ATT&CK Matrix" - available under: https://attack.mitre.org/# - Retrieved 2024-01-01.</ref>

[[File:MITRE_ATT%26CK_Matrix.png|frameless|center|caption]]

In addition to the Enterprise Matrix, there is a matrix for Mobile and one for ICS

===Reconnaissance===
Reconnaissance involves adversaries actively or passively collecting information to support their targeting efforts an reach their target, which consist in an successfull attack. This gathered informations may include details about the victim organization, its infrastructure, used software or hardware or personnel. Threat actors can utilize this information across different phases of the mentioned process (MITRE ATT&CK Matrix), using it for tasks like planning and executing Initial Access, determining post-compromise objectives, or guiding subsequent Reconnaissance efforts. <ref name=”RE5”>"Reconnaissance" - available under: https://attack.mitre.org/tactics/TA0043/ - Retrieved 2024-01-01.</ref>

===Ressource Development===
Resource development encompasses methods by which adversaries generate, acquire, or steal resources to support their targeting activities. These resources may include infrastructure, accounts or capabilities. The threat actors can use these resources at different stages of their lifecycle - for example by using purchased or stolen domains for command and control infrastructure, using email accounts for phishing during initial access or acquiring code signing certificates to facilitate defence evasion. <ref name=”RE6”>"Resource Development" - available under: https://attack.mitre.org/tactics/TA0042/ - Retrieved 2024-01-01.</ref>

===Initial Access===
Initial access consists of methods that the attackers use to gain a foothold in the victim's infrastructure. These include spearphishing, content injection or exploiting a vulnerability. A distinction can be made between measures that grant continuous access or temporary access, as passwords change continuously, for example.
<ref name=”RE7”>"Initial Access" - available under: https://attack.mitre.org/tactics/TA0001/ - Retrieved 2024-01-01.</ref>

===Execution===
Execution consists of executing the attacker's malicious code on the target system. Techniques from this phase are often combined with techniques from other phases in order to achieve several goals at once. Examples of techniques include the use of a command and script interpreter such as Powershell to execute malicious scripts or user execution of a malicious file. <ref name=”RE10”>"Execution" - available under: https://attack.mitre.org/tactics/TA0002/ - Retrieved 2024-01-01.</ref>

===Persistence===
Once threat actors have gained access to the system, they want to maintain access. This is ensured in the course of persistence. The attackers ensure that access is maintained by restarting the system, changing access data and making other changes. An example of this technique is the addition of code during boot or logon autostart execution.<ref name=”RE11”>"Persistence" - available under: https://attack.mitre.org/tactics/TA0003/ - Retrieved 2024-01-01.</ref>

===Privilege Escalation===
The aim is to ensure higher privileges - higher level permissions on systems and networks - based on the existing access. Higher privileges are often needed to achieve the actual goals. System weaknesses, misconfigurations and vulnerabilities are often exploited to achieve higher privileges.
According to MITRE, the target stages are, for example <ref name=”RE14”>" Privilege Escalation " - available under: https://attack.mitre.org/tactics/TA0004/ - Retrieved 2024-01-01.</ref>:
* SYSTEM/root level
* local administrator
* user account with admin-like access
* user accounts with access to specific system or perform specific function

===Defense Evasion===
To avoid the compromise being noticed, use attack techniques of defence evasion. For example, security software can be switched off or uninstalled, or payloads and data can be encrypted and obfuscated. In addition, legitimate processes can be misused to carry out the attackers' activities and thus conceal them.
<ref name=”RE15”>" Privilege Escalation " - available under: https://attack.mitre.org/tactics/TA0005/ - Retrieved 2024-01-01.</ref>.

===Credential Access===
The aim of the attacker is to steal credentials in order to be able to move laterally in the network, for example. Techniques such as keylogging or credential dumping using Mimikatz are used for this purpose. If the attackers obtain legitimate credentials, it is also much more difficult to track down the attackers in their own systems and networks. <ref name=”RE20”>"Credential Access" - available under: https://attack.mitre.org/tactics/TA0006/ - Retrieved 2024-01-01.</ref>.

===Discovery===
In order to obtain further information about the system landscape and the network, the perpetrators observe the digital environment so that they can then plan further steps. They always look at what the attackers can currently control and what they can gain from this or how they can use it to achieve their goals.<ref name=”RE16”>"Discovery" - available under: https://attack.mitre.org/tactics/TA0007/ - Retrieved 2024-01-01.</ref>.

===Lateral Movement===
Lateral movement consists of techniques to compromise other systems in the victim network and make their way through the system landscape to the target. This involves repeatedly gaining access to the various systems that have been discovered. This can be done using own tools for lateral movement or using stolen credentials, which allows the use of native OS tools and is therefore less conspicuous. Examples of techniques include internal spearphishing and remote services such as RDP.<ref name=”RE17”>"Lateral Movement" - available under: https://attack.mitre.org/tactics/TA0008/ - Retrieved 2024-01-01.</ref>.

===Collection===
In the course of the collection, information is gathered as potentially useful sources. The second step after collection often consists of exfiltration, i.e. stealing data. Classic files such as audio, video, email, browsers etc. are often of interest here. Screenshots or keyboard input can also be exfiltrated. <ref name=”RE18”>"Collection" - available under: https://attack.mitre.org/tactics/TA0009/ - Retrieved 2024-01-01.</ref>.

===Command and Controll===
Command and control is used to ensure that the compromised system can be communicated with in the victim network and can therefore be controlled. An attempt is made to package the C2 traffic in such a way that it imitates normal traffic. For example, different application layer protocols such as FTP, MAIL or DNS can be used for obfuscation. <ref name=”RE19”>"Command and Controll" - available under: https://attack.mitre.org/tactics/TA00011/ - Retrieved 2024-01-01.</ref>.

===Exfiltration===
Techniques in the exfiltration phase are used to steal data from the victim's infrastructure. Once the data has been collected, it is compressed and encrypted to prevent detection. Subsequently, the transfer between victim and threat actor often takes place via C&C. Exfiltration techniques are i.e. data transfer size limits to avoid detection and, as mentioned, exfiltration over C2 channels. <ref name=”RE13”>"Exfiltration" - available under: https://attack.mitre.org/tactics/TA0010/ - Retrieved 2024-01-01.</ref>

===Impact===
Basically, the attackers have at least goal. This target is reached during the impact phase and systems or data are manipulated, disrupted or destroyed. Techniques are used that enable the threat actor to impair the availability or integrity of the business or processes. It should be noted that the symptoms are not always noticed immediately and the objectives can also be achieved without the victim realising it directly. A striking example would be the deletion of an account access or data destruction. <ref name=”RE12”>"Impact" - available under: https://attack.mitre.org/tactics/TA0040/ - Retrieved 2024-01-01.</ref>

== References ==

[[Category:Documentation]]

MITRE ATT&CK

2024-01-04T12:52:01Z

ALanners: /* Collection */

Developed by MITRE, ATT&CK is a globally accessible knowledge base focused on adversary behaviour - also called cyber threat intelligence . Cyber adversaries are known for their intelligence, adaptability, and persistence, learning from each attack, whether successful or unsuccessful. Their capabilities range from stealing personal information an data to disrupting infrastructure and/or damaging business operations.
The MITRE ATT&CK knowledge-base is freely available to everyone. The knowledge base documents the common tactics, techniques and procedures used by cyber threat actors. The framework can be used as a resource for the development of specific threat models and methodologies, as well as the development of specific countermeasures. <ref name=”RE1”>"MITRE ATT&CK" - available under: https://www.mitre.org/focus-areas/cybersecurity/mitre-attack - Retrieved 2024-01-01.</ref>

==MITRE ATT&CK Groups==
The groups are "activity clusters" that are often observed in the cyber security bubble under a specific name. It should be noted that groups in the cybersecurity sector are often loosely connected and may be known by several names. In addition, it can happen that the same clusters are tracked by different actors under different names. In the context of the MITRE Groups documentation, the MITRE team endeavours to document the overlaps under the Associated Groups/Aliases section. Groups are in turn linked to techniques that are assigned to the respective tactics. As a result, there is a separate ATT&CK matrix for many groups. <ref name=”RE8”>"Groups" - available under: https://attack.mitre.org/groups/ - Retrieved 2024-01-01.</ref>

==MITRE ATT&CK Software==
According to MITRE, software is defined as "operating system utilities, open-source software, or other tools used to conduct behaviour modeled in ATT&CK".
Analogous to offender groups, there are also artefacts in the area of software that are known by different names but are the same software. Each entry in the software documentation contains a technical artefact, which in turn can be assigned to a group. The information is based on open source.

MITRE distinguishes between tools and malware:
A tool is software that can be used by Defender, Pentester as well as redteamer or threat actors. This includes software that is not found in the corporate context as well as software that is used in the corporate context.
In contrast to tools, malware is designed to carry out malicious actions on the targetsystem.<ref name=”RE9”>"Software" - available under: https://attack.mitre.org/software/ - Retrieved 2024-01-01.</ref>

==MITRE ATT&CK Techniques==
Techniques in the context of the MITRE ATT&CK knowledge base describe how an attacker achieves a tactical objective, i.e. which actions he performs to achieve it. As a striking example, the threat actor can, for example, dump credentials in order to gain access to the victim's credentials. As of January 2023, a total of 201 techniques are documented with a total of 424 sub-techniques. <ref name=”RE2”>"Enterprise Techniques" - available under: https://attack.mitre.org/techniques/enterprise/ - Retrieved 2024-01-01.</ref>

==MITRE ATT&CK Tactics==
Tactics documented the why of an ATT&CK technique or sub-technique, it is therefore the actual target of the attacker. The targets reflect the respective process steps of the MITRE ATT&CK matrix - i.e. from reconnaissance to impact. For example, an attacker can use credential access or privilege escalation as a tactic. <ref name=”RE3”>"Enterprise tactics" - available under: https://attack.mitre.org/tactics/enterprise/ - Retrieved 2024-01-01.</ref>

==MITRE ATT&CK Matrix==

The MITRE ATT&CK matrix is part of the knowledge base and provides actor-specific techniques and procedures for each phase of the attack. The process begins with reconnaissance and ends with impact. Different techniques and tactics are assigned to each process step, which can be clicked on and which then lead to documentation. <ref name=”RE4”>"ATT&CK Matrix" - available under: https://attack.mitre.org/# - Retrieved 2024-01-01.</ref>

[[File:MITRE_ATT%26CK_Matrix.png|frameless|center|caption]]

In addition to the Enterprise Matrix, there is a matrix for Mobile and one for ICS

===Reconnaissance===
Reconnaissance involves adversaries actively or passively collecting information to support their targeting efforts an reach their target, which consist in an successfull attack. This gathered informations may include details about the victim organization, its infrastructure, used software or hardware or personnel. Threat actors can utilize this information across different phases of the mentioned process (MITRE ATT&CK Matrix), using it for tasks like planning and executing Initial Access, determining post-compromise objectives, or guiding subsequent Reconnaissance efforts. <ref name=”RE5”>"Reconnaissance" - available under: https://attack.mitre.org/tactics/TA0043/ - Retrieved 2024-01-01.</ref>

===Ressource Development===
Resource development encompasses methods by which adversaries generate, acquire, or steal resources to support their targeting activities. These resources may include infrastructure, accounts or capabilities. The threat actors can use these resources at different stages of their lifecycle - for example by using purchased or stolen domains for command and control infrastructure, using email accounts for phishing during initial access or acquiring code signing certificates to facilitate defence evasion. <ref name=”RE6”>"Resource Development" - available under: https://attack.mitre.org/tactics/TA0042/ - Retrieved 2024-01-01.</ref>

===Initial Access===
Initial access consists of methods that the attackers use to gain a foothold in the victim's infrastructure. These include spearphishing, content injection or exploiting a vulnerability. A distinction can be made between measures that grant continuous access or temporary access, as passwords change continuously, for example.
<ref name=”RE7”>"Initial Access" - available under: https://attack.mitre.org/tactics/TA0001/ - Retrieved 2024-01-01.</ref>

===Execution===
Execution consists of executing the attacker's malicious code on the target system. Techniques from this phase are often combined with techniques from other phases in order to achieve several goals at once. Examples of techniques include the use of a command and script interpreter such as Powershell to execute malicious scripts or user execution of a malicious file. <ref name=”RE10”>"Execution" - available under: https://attack.mitre.org/tactics/TA0002/ - Retrieved 2024-01-01.</ref>

===Persistence===
Once threat actors have gained access to the system, they want to maintain access. This is ensured in the course of persistence. The attackers ensure that access is maintained by restarting the system, changing access data and making other changes. An example of this technique is the addition of code during boot or logon autostart execution.<ref name=”RE11”>"Persistence" - available under: https://attack.mitre.org/tactics/TA0003/ - Retrieved 2024-01-01.</ref>

===Privilege Escalation===
The aim is to ensure higher privileges - higher level permissions on systems and networks - based on the existing access. Higher privileges are often needed to achieve the actual goals. System weaknesses, misconfigurations and vulnerabilities are often exploited to achieve higher privileges.
According to MITRE, the target stages are, for example <ref name=”RE14”>" Privilege Escalation " - available under: https://attack.mitre.org/tactics/TA0004/ - Retrieved 2024-01-01.</ref>:
* SYSTEM/root level
* local administrator
* user account with admin-like access
* user accounts with access to specific system or perform specific function

===Defense Evasion===
To avoid the compromise being noticed, use attack techniques of defence evasion. For example, security software can be switched off or uninstalled, or payloads and data can be encrypted and obfuscated. In addition, legitimate processes can be misused to carry out the attackers' activities and thus conceal them.
<ref name=”RE15”>" Privilege Escalation " - available under: https://attack.mitre.org/tactics/TA0005/ - Retrieved 2024-01-01.</ref>.

===Credential Access===
The aim of the attacker is to steal credentials in order to be able to move laterally in the network, for example. Techniques such as keylogging or credential dumping using Mimikatz are used for this purpose. If the attackers obtain legitimate credentials, it is also much more difficult to track down the attackers in their own systems and networks. <ref name=”RE20”>"Credential Access" - available under: https://attack.mitre.org/tactics/TA0006/ - Retrieved 2024-01-01.</ref>.

===Discovery===
In order to obtain further information about the system landscape and the network, the perpetrators observe the digital environment so that they can then plan further steps. They always look at what the attackers can currently control and what they can gain from this or how they can use it to achieve their goals.<ref name=”RE16”>"Discovery" - available under: https://attack.mitre.org/tactics/TA0007/ - Retrieved 2024-01-01.</ref>.

===Lateral Movement===

<ref name=”RE17”>"Lateral Movement" - available under: https://attack.mitre.org/tactics/TA0008/ - Retrieved 2024-01-01.</ref>.

===Collection===
In the course of the collection, information is gathered as potentially useful sources. The second step after collection often consists of exfiltration, i.e. stealing data. Classic files such as audio, video, email, browsers etc. are often of interest here. Screenshots or keyboard input can also be exfiltrated. <ref name=”RE18”>"Collection" - available under: https://attack.mitre.org/tactics/TA0009/ - Retrieved 2024-01-01.</ref>.

===Command and Controll===
Command and control is used to ensure that the compromised system can be communicated with in the victim network and can therefore be controlled. An attempt is made to package the C2 traffic in such a way that it imitates normal traffic. For example, different application layer protocols such as FTP, MAIL or DNS can be used for obfuscation. <ref name=”RE19”>"Command and Controll" - available under: https://attack.mitre.org/tactics/TA00011/ - Retrieved 2024-01-01.</ref>.

===Exfiltration===
Techniques in the exfiltration phase are used to steal data from the victim's infrastructure. Once the data has been collected, it is compressed and encrypted to prevent detection. Subsequently, the transfer between victim and threat actor often takes place via C&C. Exfiltration techniques are i.e. data transfer size limits to avoid detection and, as mentioned, exfiltration over C2 channels. <ref name=”RE13”>"Exfiltration" - available under: https://attack.mitre.org/tactics/TA0010/ - Retrieved 2024-01-01.</ref>

===Impact===
Basically, the attackers have at least goal. This target is reached during the impact phase and systems or data are manipulated, disrupted or destroyed. Techniques are used that enable the threat actor to impair the availability or integrity of the business or processes. It should be noted that the symptoms are not always noticed immediately and the objectives can also be achieved without the victim realising it directly. A striking example would be the deletion of an account access or data destruction. <ref name=”RE12”>"Impact" - available under: https://attack.mitre.org/tactics/TA0040/ - Retrieved 2024-01-01.</ref>

== References ==

[[Category:Documentation]]

MITRE ATT&CK

2024-01-04T12:48:24Z

ALanners: /* Command and Controll */

Developed by MITRE, ATT&CK is a globally accessible knowledge base focused on adversary behaviour - also called cyber threat intelligence . Cyber adversaries are known for their intelligence, adaptability, and persistence, learning from each attack, whether successful or unsuccessful. Their capabilities range from stealing personal information an data to disrupting infrastructure and/or damaging business operations.
The MITRE ATT&CK knowledge-base is freely available to everyone. The knowledge base documents the common tactics, techniques and procedures used by cyber threat actors. The framework can be used as a resource for the development of specific threat models and methodologies, as well as the development of specific countermeasures. <ref name=”RE1”>"MITRE ATT&CK" - available under: https://www.mitre.org/focus-areas/cybersecurity/mitre-attack - Retrieved 2024-01-01.</ref>

==MITRE ATT&CK Groups==
The groups are "activity clusters" that are often observed in the cyber security bubble under a specific name. It should be noted that groups in the cybersecurity sector are often loosely connected and may be known by several names. In addition, it can happen that the same clusters are tracked by different actors under different names. In the context of the MITRE Groups documentation, the MITRE team endeavours to document the overlaps under the Associated Groups/Aliases section. Groups are in turn linked to techniques that are assigned to the respective tactics. As a result, there is a separate ATT&CK matrix for many groups. <ref name=”RE8”>"Groups" - available under: https://attack.mitre.org/groups/ - Retrieved 2024-01-01.</ref>

==MITRE ATT&CK Software==
According to MITRE, software is defined as "operating system utilities, open-source software, or other tools used to conduct behaviour modeled in ATT&CK".
Analogous to offender groups, there are also artefacts in the area of software that are known by different names but are the same software. Each entry in the software documentation contains a technical artefact, which in turn can be assigned to a group. The information is based on open source.

MITRE distinguishes between tools and malware:
A tool is software that can be used by Defender, Pentester as well as redteamer or threat actors. This includes software that is not found in the corporate context as well as software that is used in the corporate context.
In contrast to tools, malware is designed to carry out malicious actions on the targetsystem.<ref name=”RE9”>"Software" - available under: https://attack.mitre.org/software/ - Retrieved 2024-01-01.</ref>

==MITRE ATT&CK Techniques==
Techniques in the context of the MITRE ATT&CK knowledge base describe how an attacker achieves a tactical objective, i.e. which actions he performs to achieve it. As a striking example, the threat actor can, for example, dump credentials in order to gain access to the victim's credentials. As of January 2023, a total of 201 techniques are documented with a total of 424 sub-techniques. <ref name=”RE2”>"Enterprise Techniques" - available under: https://attack.mitre.org/techniques/enterprise/ - Retrieved 2024-01-01.</ref>

==MITRE ATT&CK Tactics==
Tactics documented the why of an ATT&CK technique or sub-technique, it is therefore the actual target of the attacker. The targets reflect the respective process steps of the MITRE ATT&CK matrix - i.e. from reconnaissance to impact. For example, an attacker can use credential access or privilege escalation as a tactic. <ref name=”RE3”>"Enterprise tactics" - available under: https://attack.mitre.org/tactics/enterprise/ - Retrieved 2024-01-01.</ref>

==MITRE ATT&CK Matrix==

The MITRE ATT&CK matrix is part of the knowledge base and provides actor-specific techniques and procedures for each phase of the attack. The process begins with reconnaissance and ends with impact. Different techniques and tactics are assigned to each process step, which can be clicked on and which then lead to documentation. <ref name=”RE4”>"ATT&CK Matrix" - available under: https://attack.mitre.org/# - Retrieved 2024-01-01.</ref>

[[File:MITRE_ATT%26CK_Matrix.png|frameless|center|caption]]

In addition to the Enterprise Matrix, there is a matrix for Mobile and one for ICS

===Reconnaissance===
Reconnaissance involves adversaries actively or passively collecting information to support their targeting efforts an reach their target, which consist in an successfull attack. This gathered informations may include details about the victim organization, its infrastructure, used software or hardware or personnel. Threat actors can utilize this information across different phases of the mentioned process (MITRE ATT&CK Matrix), using it for tasks like planning and executing Initial Access, determining post-compromise objectives, or guiding subsequent Reconnaissance efforts. <ref name=”RE5”>"Reconnaissance" - available under: https://attack.mitre.org/tactics/TA0043/ - Retrieved 2024-01-01.</ref>

===Ressource Development===
Resource development encompasses methods by which adversaries generate, acquire, or steal resources to support their targeting activities. These resources may include infrastructure, accounts or capabilities. The threat actors can use these resources at different stages of their lifecycle - for example by using purchased or stolen domains for command and control infrastructure, using email accounts for phishing during initial access or acquiring code signing certificates to facilitate defence evasion. <ref name=”RE6”>"Resource Development" - available under: https://attack.mitre.org/tactics/TA0042/ - Retrieved 2024-01-01.</ref>

===Initial Access===
Initial access consists of methods that the attackers use to gain a foothold in the victim's infrastructure. These include spearphishing, content injection or exploiting a vulnerability. A distinction can be made between measures that grant continuous access or temporary access, as passwords change continuously, for example.
<ref name=”RE7”>"Initial Access" - available under: https://attack.mitre.org/tactics/TA0001/ - Retrieved 2024-01-01.</ref>

===Execution===
Execution consists of executing the attacker's malicious code on the target system. Techniques from this phase are often combined with techniques from other phases in order to achieve several goals at once. Examples of techniques include the use of a command and script interpreter such as Powershell to execute malicious scripts or user execution of a malicious file. <ref name=”RE10”>"Execution" - available under: https://attack.mitre.org/tactics/TA0002/ - Retrieved 2024-01-01.</ref>

===Persistence===
Once threat actors have gained access to the system, they want to maintain access. This is ensured in the course of persistence. The attackers ensure that access is maintained by restarting the system, changing access data and making other changes. An example of this technique is the addition of code during boot or logon autostart execution.<ref name=”RE11”>"Persistence" - available under: https://attack.mitre.org/tactics/TA0003/ - Retrieved 2024-01-01.</ref>

===Privilege Escalation===
The aim is to ensure higher privileges - higher level permissions on systems and networks - based on the existing access. Higher privileges are often needed to achieve the actual goals. System weaknesses, misconfigurations and vulnerabilities are often exploited to achieve higher privileges.
According to MITRE, the target stages are, for example <ref name=”RE14”>" Privilege Escalation " - available under: https://attack.mitre.org/tactics/TA0004/ - Retrieved 2024-01-01.</ref>:
* SYSTEM/root level
* local administrator
* user account with admin-like access
* user accounts with access to specific system or perform specific function

===Defense Evasion===
To avoid the compromise being noticed, use attack techniques of defence evasion. For example, security software can be switched off or uninstalled, or payloads and data can be encrypted and obfuscated. In addition, legitimate processes can be misused to carry out the attackers' activities and thus conceal them.
<ref name=”RE15”>" Privilege Escalation " - available under: https://attack.mitre.org/tactics/TA0005/ - Retrieved 2024-01-01.</ref>.

===Credential Access===
The aim of the attacker is to steal credentials in order to be able to move laterally in the network, for example. Techniques such as keylogging or credential dumping using Mimikatz are used for this purpose. If the attackers obtain legitimate credentials, it is also much more difficult to track down the attackers in their own systems and networks. <ref name=”RE20”>"Credential Access" - available under: https://attack.mitre.org/tactics/TA0006/ - Retrieved 2024-01-01.</ref>.

===Discovery===
In order to obtain further information about the system landscape and the network, the perpetrators observe the digital environment so that they can then plan further steps. They always look at what the attackers can currently control and what they can gain from this or how they can use it to achieve their goals.<ref name=”RE16”>"Discovery" - available under: https://attack.mitre.org/tactics/TA0007/ - Retrieved 2024-01-01.</ref>.

===Lateral Movement===

<ref name=”RE17”>"Lateral Movement" - available under: https://attack.mitre.org/tactics/TA0008/ - Retrieved 2024-01-01.</ref>.

===Collection===

<ref name=”RE18”>"Collection" - available under: https://attack.mitre.org/tactics/TA0009/ - Retrieved 2024-01-01.</ref>.

===Command and Controll===
Command and control is used to ensure that the compromised system can be communicated with in the victim network and can therefore be controlled. An attempt is made to package the C2 traffic in such a way that it imitates normal traffic. For example, different application layer protocols such as FTP, MAIL or DNS can be used for obfuscation. <ref name=”RE19”>"Command and Controll" - available under: https://attack.mitre.org/tactics/TA00011/ - Retrieved 2024-01-01.</ref>.

===Exfiltration===
Techniques in the exfiltration phase are used to steal data from the victim's infrastructure. Once the data has been collected, it is compressed and encrypted to prevent detection. Subsequently, the transfer between victim and threat actor often takes place via C&C. Exfiltration techniques are i.e. data transfer size limits to avoid detection and, as mentioned, exfiltration over C2 channels. <ref name=”RE13”>"Exfiltration" - available under: https://attack.mitre.org/tactics/TA0010/ - Retrieved 2024-01-01.</ref>

===Impact===
Basically, the attackers have at least goal. This target is reached during the impact phase and systems or data are manipulated, disrupted or destroyed. Techniques are used that enable the threat actor to impair the availability or integrity of the business or processes. It should be noted that the symptoms are not always noticed immediately and the objectives can also be achieved without the victim realising it directly. A striking example would be the deletion of an account access or data destruction. <ref name=”RE12”>"Impact" - available under: https://attack.mitre.org/tactics/TA0040/ - Retrieved 2024-01-01.</ref>

== References ==

[[Category:Documentation]]

MITRE ATT&CK

2024-01-04T12:45:31Z

ALanners:

Developed by MITRE, ATT&CK is a globally accessible knowledge base focused on adversary behaviour - also called cyber threat intelligence . Cyber adversaries are known for their intelligence, adaptability, and persistence, learning from each attack, whether successful or unsuccessful. Their capabilities range from stealing personal information an data to disrupting infrastructure and/or damaging business operations.
The MITRE ATT&CK knowledge-base is freely available to everyone. The knowledge base documents the common tactics, techniques and procedures used by cyber threat actors. The framework can be used as a resource for the development of specific threat models and methodologies, as well as the development of specific countermeasures. <ref name=”RE1”>"MITRE ATT&CK" - available under: https://www.mitre.org/focus-areas/cybersecurity/mitre-attack - Retrieved 2024-01-01.</ref>

==MITRE ATT&CK Groups==
The groups are "activity clusters" that are often observed in the cyber security bubble under a specific name. It should be noted that groups in the cybersecurity sector are often loosely connected and may be known by several names. In addition, it can happen that the same clusters are tracked by different actors under different names. In the context of the MITRE Groups documentation, the MITRE team endeavours to document the overlaps under the Associated Groups/Aliases section. Groups are in turn linked to techniques that are assigned to the respective tactics. As a result, there is a separate ATT&CK matrix for many groups. <ref name=”RE8”>"Groups" - available under: https://attack.mitre.org/groups/ - Retrieved 2024-01-01.</ref>

==MITRE ATT&CK Software==
According to MITRE, software is defined as "operating system utilities, open-source software, or other tools used to conduct behaviour modeled in ATT&CK".
Analogous to offender groups, there are also artefacts in the area of software that are known by different names but are the same software. Each entry in the software documentation contains a technical artefact, which in turn can be assigned to a group. The information is based on open source.

MITRE distinguishes between tools and malware:
A tool is software that can be used by Defender, Pentester as well as redteamer or threat actors. This includes software that is not found in the corporate context as well as software that is used in the corporate context.
In contrast to tools, malware is designed to carry out malicious actions on the targetsystem.<ref name=”RE9”>"Software" - available under: https://attack.mitre.org/software/ - Retrieved 2024-01-01.</ref>

==MITRE ATT&CK Techniques==
Techniques in the context of the MITRE ATT&CK knowledge base describe how an attacker achieves a tactical objective, i.e. which actions he performs to achieve it. As a striking example, the threat actor can, for example, dump credentials in order to gain access to the victim's credentials. As of January 2023, a total of 201 techniques are documented with a total of 424 sub-techniques. <ref name=”RE2”>"Enterprise Techniques" - available under: https://attack.mitre.org/techniques/enterprise/ - Retrieved 2024-01-01.</ref>

==MITRE ATT&CK Tactics==
Tactics documented the why of an ATT&CK technique or sub-technique, it is therefore the actual target of the attacker. The targets reflect the respective process steps of the MITRE ATT&CK matrix - i.e. from reconnaissance to impact. For example, an attacker can use credential access or privilege escalation as a tactic. <ref name=”RE3”>"Enterprise tactics" - available under: https://attack.mitre.org/tactics/enterprise/ - Retrieved 2024-01-01.</ref>

==MITRE ATT&CK Matrix==

The MITRE ATT&CK matrix is part of the knowledge base and provides actor-specific techniques and procedures for each phase of the attack. The process begins with reconnaissance and ends with impact. Different techniques and tactics are assigned to each process step, which can be clicked on and which then lead to documentation. <ref name=”RE4”>"ATT&CK Matrix" - available under: https://attack.mitre.org/# - Retrieved 2024-01-01.</ref>

[[File:MITRE_ATT%26CK_Matrix.png|frameless|center|caption]]

In addition to the Enterprise Matrix, there is a matrix for Mobile and one for ICS

===Reconnaissance===
Reconnaissance involves adversaries actively or passively collecting information to support their targeting efforts an reach their target, which consist in an successfull attack. This gathered informations may include details about the victim organization, its infrastructure, used software or hardware or personnel. Threat actors can utilize this information across different phases of the mentioned process (MITRE ATT&CK Matrix), using it for tasks like planning and executing Initial Access, determining post-compromise objectives, or guiding subsequent Reconnaissance efforts. <ref name=”RE5”>"Reconnaissance" - available under: https://attack.mitre.org/tactics/TA0043/ - Retrieved 2024-01-01.</ref>

===Ressource Development===
Resource development encompasses methods by which adversaries generate, acquire, or steal resources to support their targeting activities. These resources may include infrastructure, accounts or capabilities. The threat actors can use these resources at different stages of their lifecycle - for example by using purchased or stolen domains for command and control infrastructure, using email accounts for phishing during initial access or acquiring code signing certificates to facilitate defence evasion. <ref name=”RE6”>"Resource Development" - available under: https://attack.mitre.org/tactics/TA0042/ - Retrieved 2024-01-01.</ref>

===Initial Access===
Initial access consists of methods that the attackers use to gain a foothold in the victim's infrastructure. These include spearphishing, content injection or exploiting a vulnerability. A distinction can be made between measures that grant continuous access or temporary access, as passwords change continuously, for example.
<ref name=”RE7”>"Initial Access" - available under: https://attack.mitre.org/tactics/TA0001/ - Retrieved 2024-01-01.</ref>

===Execution===
Execution consists of executing the attacker's malicious code on the target system. Techniques from this phase are often combined with techniques from other phases in order to achieve several goals at once. Examples of techniques include the use of a command and script interpreter such as Powershell to execute malicious scripts or user execution of a malicious file. <ref name=”RE10”>"Execution" - available under: https://attack.mitre.org/tactics/TA0002/ - Retrieved 2024-01-01.</ref>

===Persistence===
Once threat actors have gained access to the system, they want to maintain access. This is ensured in the course of persistence. The attackers ensure that access is maintained by restarting the system, changing access data and making other changes. An example of this technique is the addition of code during boot or logon autostart execution.<ref name=”RE11”>"Persistence" - available under: https://attack.mitre.org/tactics/TA0003/ - Retrieved 2024-01-01.</ref>

===Privilege Escalation===
The aim is to ensure higher privileges - higher level permissions on systems and networks - based on the existing access. Higher privileges are often needed to achieve the actual goals. System weaknesses, misconfigurations and vulnerabilities are often exploited to achieve higher privileges.
According to MITRE, the target stages are, for example <ref name=”RE14”>" Privilege Escalation " - available under: https://attack.mitre.org/tactics/TA0004/ - Retrieved 2024-01-01.</ref>:
* SYSTEM/root level
* local administrator
* user account with admin-like access
* user accounts with access to specific system or perform specific function

===Defense Evasion===
To avoid the compromise being noticed, use attack techniques of defence evasion. For example, security software can be switched off or uninstalled, or payloads and data can be encrypted and obfuscated. In addition, legitimate processes can be misused to carry out the attackers' activities and thus conceal them.
<ref name=”RE15”>" Privilege Escalation " - available under: https://attack.mitre.org/tactics/TA0005/ - Retrieved 2024-01-01.</ref>.

===Credential Access===
The aim of the attacker is to steal credentials in order to be able to move laterally in the network, for example. Techniques such as keylogging or credential dumping using Mimikatz are used for this purpose. If the attackers obtain legitimate credentials, it is also much more difficult to track down the attackers in their own systems and networks. <ref name=”RE20”>"Credential Access" - available under: https://attack.mitre.org/tactics/TA0006/ - Retrieved 2024-01-01.</ref>.

===Discovery===
In order to obtain further information about the system landscape and the network, the perpetrators observe the digital environment so that they can then plan further steps. They always look at what the attackers can currently control and what they can gain from this or how they can use it to achieve their goals.<ref name=”RE16”>"Discovery" - available under: https://attack.mitre.org/tactics/TA0007/ - Retrieved 2024-01-01.</ref>.

===Lateral Movement===

<ref name=”RE17”>"Lateral Movement" - available under: https://attack.mitre.org/tactics/TA0008/ - Retrieved 2024-01-01.</ref>.

===Collection===

<ref name=”RE18”>"Collection" - available under: https://attack.mitre.org/tactics/TA0009/ - Retrieved 2024-01-01.</ref>.

===Command and Controll===

<ref name=”RE19”>"Command and Controll" - available under: https://attack.mitre.org/tactics/TA00011/ - Retrieved 2024-01-01.</ref>.

===Exfiltration===
Techniques in the exfiltration phase are used to steal data from the victim's infrastructure. Once the data has been collected, it is compressed and encrypted to prevent detection. Subsequently, the transfer between victim and threat actor often takes place via C&C. Exfiltration techniques are i.e. data transfer size limits to avoid detection and, as mentioned, exfiltration over C2 channels. <ref name=”RE13”>"Exfiltration" - available under: https://attack.mitre.org/tactics/TA0010/ - Retrieved 2024-01-01.</ref>

===Impact===
Basically, the attackers have at least goal. This target is reached during the impact phase and systems or data are manipulated, disrupted or destroyed. Techniques are used that enable the threat actor to impair the availability or integrity of the business or processes. It should be noted that the symptoms are not always noticed immediately and the objectives can also be achieved without the victim realising it directly. A striking example would be the deletion of an account access or data destruction. <ref name=”RE12”>"Impact" - available under: https://attack.mitre.org/tactics/TA0040/ - Retrieved 2024-01-01.</ref>

== References ==

[[Category:Documentation]]

MITRE ATT&CK

2024-01-04T12:44:55Z

ALanners:

Developed by MITRE, ATT&CK is a globally accessible knowledge base focused on adversary behaviour - also called cyber threat intelligence . Cyber adversaries are known for their intelligence, adaptability, and persistence, learning from each attack, whether successful or unsuccessful. Their capabilities range from stealing personal information an data to disrupting infrastructure and/or damaging business operations.
The MITRE ATT&CK knowledge-base is freely available to everyone. The knowledge base documents the common tactics, techniques and procedures used by cyber threat actors. The framework can be used as a resource for the development of specific threat models and methodologies, as well as the development of specific countermeasures. <ref name=”RE1”>"MITRE ATT&CK" - available under: https://www.mitre.org/focus-areas/cybersecurity/mitre-attack - Retrieved 2024-01-01.</ref>

==MITRE ATT&CK Groups==
The groups are "activity clusters" that are often observed in the cyber security bubble under a specific name. It should be noted that groups in the cybersecurity sector are often loosely connected and may be known by several names. In addition, it can happen that the same clusters are tracked by different actors under different names. In the context of the MITRE Groups documentation, the MITRE team endeavours to document the overlaps under the Associated Groups/Aliases section. Groups are in turn linked to techniques that are assigned to the respective tactics. As a result, there is a separate ATT&CK matrix for many groups. <ref name=”RE8”>"Groups" - available under: https://attack.mitre.org/groups/ - Retrieved 2024-01-01.</ref>

==MITRE ATT&CK Software==
According to MITRE, software is defined as "operating system utilities, open-source software, or other tools used to conduct behaviour modeled in ATT&CK".
Analogous to offender groups, there are also artefacts in the area of software that are known by different names but are the same software. Each entry in the software documentation contains a technical artefact, which in turn can be assigned to a group. The information is based on open source.

MITRE distinguishes between tools and malware:
A tool is software that can be used by Defender, Pentester as well as redteamer or threat actors. This includes software that is not found in the corporate context as well as software that is used in the corporate context.
In contrast to tools, malware is designed to carry out malicious actions on the targetsystem.<ref name=”RE9”>"Software" - available under: https://attack.mitre.org/software/ - Retrieved 2024-01-01.</ref>

==MITRE ATT&CK Techniques==
Techniques in the context of the MITRE ATT&CK knowledge base describe how an attacker achieves a tactical objective, i.e. which actions he performs to achieve it. As a striking example, the threat actor can, for example, dump credentials in order to gain access to the victim's credentials. As of January 2023, a total of 201 techniques are documented with a total of 424 sub-techniques. <ref name=”RE2”>"Enterprise Techniques" - available under: https://attack.mitre.org/techniques/enterprise/ - Retrieved 2024-01-01.</ref>

==MITRE ATT&CK Tactics==
Tactics documented the why of an ATT&CK technique or sub-technique, it is therefore the actual target of the attacker. The targets reflect the respective process steps of the MITRE ATT&CK matrix - i.e. from reconnaissance to impact. For example, an attacker can use credential access or privilege escalation as a tactic. <ref name=”RE3”>"Enterprise tactics" - available under: https://attack.mitre.org/tactics/enterprise/ - Retrieved 2024-01-01.</ref>

==MITRE ATT&CK Matrix==

The MITRE ATT&CK matrix is part of the knowledge base and provides actor-specific techniques and procedures for each phase of the attack. The process begins with reconnaissance and ends with impact. Different techniques and tactics are assigned to each process step, which can be clicked on and which then lead to documentation. <ref name=”RE4”>"ATT&CK Matrix" - available under: https://attack.mitre.org/# - Retrieved 2024-01-01.</ref>

[[File:MITRE_ATT%26CK_Matrix.png|frameless|center|caption]]

In addition to the Enterprise Matrix, there is a matrix for Mobile and one for ICS

===Reconnaissance===
Reconnaissance involves adversaries actively or passively collecting information to support their targeting efforts an reach their target, which consist in an successfull attack. This gathered informations may include details about the victim organization, its infrastructure, used software or hardware or personnel. Threat actors can utilize this information across different phases of the mentioned process (MITRE ATT&CK Matrix), using it for tasks like planning and executing Initial Access, determining post-compromise objectives, or guiding subsequent Reconnaissance efforts. <ref name=”RE5”>"Reconnaissance" - available under: https://attack.mitre.org/tactics/TA0043/ - Retrieved 2024-01-01.</ref>

===Ressource Development===
Resource development encompasses methods by which adversaries generate, acquire, or steal resources to support their targeting activities. These resources may include infrastructure, accounts or capabilities. The threat actors can use these resources at different stages of their lifecycle - for example by using purchased or stolen domains for command and control infrastructure, using email accounts for phishing during initial access or acquiring code signing certificates to facilitate defence evasion. <ref name=”RE6”>"Resource Development" - available under: https://attack.mitre.org/tactics/TA0042/ - Retrieved 2024-01-01.</ref>

===Initial Access===
Initial access consists of methods that the attackers use to gain a foothold in the victim's infrastructure. These include spearphishing, content injection or exploiting a vulnerability. A distinction can be made between measures that grant continuous access or temporary access, as passwords change continuously, for example.
<ref name=”RE7”>"Initial Access" - available under: https://attack.mitre.org/tactics/TA0001/ - Retrieved 2024-01-01.</ref>

===Execution===
Execution consists of executing the attacker's malicious code on the target system. Techniques from this phase are often combined with techniques from other phases in order to achieve several goals at once. Examples of techniques include the use of a command and script interpreter such as Powershell to execute malicious scripts or user execution of a malicious file. <ref name=”RE10”>"Execution" - available under: https://attack.mitre.org/tactics/TA0002/ - Retrieved 2024-01-01.</ref>

===Persistence===
Once threat actors have gained access to the system, they want to maintain access. This is ensured in the course of persistence. The attackers ensure that access is maintained by restarting the system, changing access data and making other changes. An example of this technique is the addition of code during boot or logon autostart execution.<ref name=”RE11”>"Persistence" - available under: https://attack.mitre.org/tactics/TA0003/ - Retrieved 2024-01-01.</ref>

===Privilege Escalation===
The aim is to ensure higher privileges - higher level permissions on systems and networks - based on the existing access. Higher privileges are often needed to achieve the actual goals. System weaknesses, misconfigurations and vulnerabilities are often exploited to achieve higher privileges.
According to MITRE, the target stages are, for example <ref name=”RE14”>" Privilege Escalation " - available under: https://attack.mitre.org/tactics/TA0004/ - Retrieved 2024-01-01.</ref>:
* SYSTEM/root level
* local administrator
* user account with admin-like access
* user accounts with access to specific system or perform specific function

===Defense Evasion===
To avoid the compromise being noticed, use attack techniques of defence evasion. For example, security software can be switched off or uninstalled, or payloads and data can be encrypted and obfuscated. In addition, legitimate processes can be misused to carry out the attackers' activities and thus conceal them.
<ref name=”RE15”>" Privilege Escalation " - available under: https://attack.mitre.org/tactics/TA0005/ - Retrieved 2024-01-01.</ref>.

===Credential Access===
The aim of the attacker is to steal credentials in order to be able to move laterally in the network, for example. Techniques such as keylogging or credential dumping using Mimikatz are used for this purpose. If the attackers obtain legitimate credentials, it is also much more difficult to track down the attackers in their own systems and networks. <ref name=”RE16”>"Credential Access" - available under: https://attack.mitre.org/tactics/TA0006/ - Retrieved 2024-01-01.</ref>.

===Discovery===
In order to obtain further information about the system landscape and the network, the perpetrators observe the digital environment so that they can then plan further steps. They always look at what the attackers can currently control and what they can gain from this or how they can use it to achieve their goals.<ref name=”RE16”>"Discovery" - available under: https://attack.mitre.org/tactics/TA0007/ - Retrieved 2024-01-01.</ref>.

===Lateral Movement===

<ref name=”RE17”>"Lateral Movement" - available under: https://attack.mitre.org/tactics/TA0008/ - Retrieved 2024-01-01.</ref>.

===Collection===

<ref name=”RE18”>"Collection" - available under: https://attack.mitre.org/tactics/TA0009/ - Retrieved 2024-01-01.</ref>.

===Command and Controll===

<ref name=”RE19”>"Command and Controll" - available under: https://attack.mitre.org/tactics/TA00011/ - Retrieved 2024-01-01.</ref>.

===Exfiltration===
Techniques in the exfiltration phase are used to steal data from the victim's infrastructure. Once the data has been collected, it is compressed and encrypted to prevent detection. Subsequently, the transfer between victim and threat actor often takes place via C&C. Exfiltration techniques are i.e. data transfer size limits to avoid detection and, as mentioned, exfiltration over C2 channels. <ref name=”RE13”>"Exfiltration" - available under: https://attack.mitre.org/tactics/TA0010/ - Retrieved 2024-01-01.</ref>

===Impact===
Basically, the attackers have at least goal. This target is reached during the impact phase and systems or data are manipulated, disrupted or destroyed. Techniques are used that enable the threat actor to impair the availability or integrity of the business or processes. It should be noted that the symptoms are not always noticed immediately and the objectives can also be achieved without the victim realising it directly. A striking example would be the deletion of an account access or data destruction. <ref name=”RE12”>"Impact" - available under: https://attack.mitre.org/tactics/TA0040/ - Retrieved 2024-01-01.</ref>

== References ==

[[Category:Documentation]]

MITRE ATT&CK

2024-01-04T12:44:30Z

ALanners:

Developed by MITRE, ATT&CK is a globally accessible knowledge base focused on adversary behaviour - also called cyber threat intelligence . Cyber adversaries are known for their intelligence, adaptability, and persistence, learning from each attack, whether successful or unsuccessful. Their capabilities range from stealing personal information an data to disrupting infrastructure and/or damaging business operations.
The MITRE ATT&CK knowledge-base is freely available to everyone. The knowledge base documents the common tactics, techniques and procedures used by cyber threat actors. The framework can be used as a resource for the development of specific threat models and methodologies, as well as the development of specific countermeasures. <ref name=”RE1”>"MITRE ATT&CK" - available under: https://www.mitre.org/focus-areas/cybersecurity/mitre-attack - Retrieved 2024-01-01.</ref>

==MITRE ATT&CK Groups==
The groups are "activity clusters" that are often observed in the cyber security bubble under a specific name. It should be noted that groups in the cybersecurity sector are often loosely connected and may be known by several names. In addition, it can happen that the same clusters are tracked by different actors under different names. In the context of the MITRE Groups documentation, the MITRE team endeavours to document the overlaps under the Associated Groups/Aliases section. Groups are in turn linked to techniques that are assigned to the respective tactics. As a result, there is a separate ATT&CK matrix for many groups. <ref name=”RE8”>"Groups" - available under: https://attack.mitre.org/groups/ - Retrieved 2024-01-01.</ref>

==MITRE ATT&CK Software==
According to MITRE, software is defined as "operating system utilities, open-source software, or other tools used to conduct behaviour modeled in ATT&CK".
Analogous to offender groups, there are also artefacts in the area of software that are known by different names but are the same software. Each entry in the software documentation contains a technical artefact, which in turn can be assigned to a group. The information is based on open source.

MITRE distinguishes between tools and malware:
A tool is software that can be used by Defender, Pentester as well as redteamer or threat actors. This includes software that is not found in the corporate context as well as software that is used in the corporate context.
In contrast to tools, malware is designed to carry out malicious actions on the targetsystem.<ref name=”RE9”>"Software" - available under: https://attack.mitre.org/software/ - Retrieved 2024-01-01.</ref>

==MITRE ATT&CK Techniques==
Techniques in the context of the MITRE ATT&CK knowledge base describe how an attacker achieves a tactical objective, i.e. which actions he performs to achieve it. As a striking example, the threat actor can, for example, dump credentials in order to gain access to the victim's credentials. As of January 2023, a total of 201 techniques are documented with a total of 424 sub-techniques. <ref name=”RE2”>"Enterprise Techniques" - available under: https://attack.mitre.org/techniques/enterprise/ - Retrieved 2024-01-01.</ref>

==MITRE ATT&CK Tactics==
Tactics documented the why of an ATT&CK technique or sub-technique, it is therefore the actual target of the attacker. The targets reflect the respective process steps of the MITRE ATT&CK matrix - i.e. from reconnaissance to impact. For example, an attacker can use credential access or privilege escalation as a tactic. <ref name=”RE3”>"Enterprise tactics" - available under: https://attack.mitre.org/tactics/enterprise/ - Retrieved 2024-01-01.</ref>

==MITRE ATT&CK Matrix==

The MITRE ATT&CK matrix is part of the knowledge base and provides actor-specific techniques and procedures for each phase of the attack. The process begins with reconnaissance and ends with impact. Different techniques and tactics are assigned to each process step, which can be clicked on and which then lead to documentation. <ref name=”RE4”>"ATT&CK Matrix" - available under: https://attack.mitre.org/# - Retrieved 2024-01-01.</ref>

[[File:MITRE_ATT%26CK_Matrix.png|frameless|center|caption]]

In addition to the Enterprise Matrix, there is a matrix for Mobile and one for ICS

===Reconnaissance===
Reconnaissance involves adversaries actively or passively collecting information to support their targeting efforts an reach their target, which consist in an successfull attack. This gathered informations may include details about the victim organization, its infrastructure, used software or hardware or personnel. Threat actors can utilize this information across different phases of the mentioned process (MITRE ATT&CK Matrix), using it for tasks like planning and executing Initial Access, determining post-compromise objectives, or guiding subsequent Reconnaissance efforts. <ref name=”RE5”>"Reconnaissance" - available under: https://attack.mitre.org/tactics/TA0043/ - Retrieved 2024-01-01.</ref>

===Ressource Development===
Resource development encompasses methods by which adversaries generate, acquire, or steal resources to support their targeting activities. These resources may include infrastructure, accounts or capabilities. The threat actors can use these resources at different stages of their lifecycle - for example by using purchased or stolen domains for command and control infrastructure, using email accounts for phishing during initial access or acquiring code signing certificates to facilitate defence evasion. <ref name=”RE6”>"Resource Development" - available under: https://attack.mitre.org/tactics/TA0042/ - Retrieved 2024-01-01.</ref>

===Initial Access===
Initial access consists of methods that the attackers use to gain a foothold in the victim's infrastructure. These include spearphishing, content injection or exploiting a vulnerability. A distinction can be made between measures that grant continuous access or temporary access, as passwords change continuously, for example.
<ref name=”RE7”>"Initial Access" - available under: https://attack.mitre.org/tactics/TA0001/ - Retrieved 2024-01-01.</ref>

===Execution===
Execution consists of executing the attacker's malicious code on the target system. Techniques from this phase are often combined with techniques from other phases in order to achieve several goals at once. Examples of techniques include the use of a command and script interpreter such as Powershell to execute malicious scripts or user execution of a malicious file. <ref name=”RE10”>"Execution" - available under: https://attack.mitre.org/tactics/TA0002/ - Retrieved 2024-01-01.</ref>

===Persistence===
Once threat actors have gained access to the system, they want to maintain access. This is ensured in the course of persistence. The attackers ensure that access is maintained by restarting the system, changing access data and making other changes. An example of this technique is the addition of code during boot or logon autostart execution.<ref name=”RE11”>"Persistence" - available under: https://attack.mitre.org/tactics/TA0003/ - Retrieved 2024-01-01.</ref>

===Privilege Escalation===
The aim is to ensure higher privileges - higher level permissions on systems and networks - based on the existing access. Higher privileges are often needed to achieve the actual goals. System weaknesses, misconfigurations and vulnerabilities are often exploited to achieve higher privileges.
According to MITRE, the target stages are, for example <ref name=”RE14”>" Privilege Escalation " - available under: https://attack.mitre.org/tactics/TA0004/ - Retrieved 2024-01-01.</ref>:
* SYSTEM/root level
* local administrator
* user account with admin-like access
* user accounts with access to specific system or perform specific function

===Defense Evasion===
To avoid the compromise being noticed, use attack techniques of defence evasion. For example, security software can be switched off or uninstalled, or payloads and data can be encrypted and obfuscated. In addition, legitimate processes can be misused to carry out the attackers' activities and thus conceal them.
<ref name=”RE15”>" Privilege Escalation " - available under: https://attack.mitre.org/tactics/TA0005/ - Retrieved 2024-01-01.</ref>.

===Credential Access===
The aim of the attacker is to steal credentials in order to be able to move laterally in the network, for example. Techniques such as keylogging or credential dumping using Mimikatz are used for this purpose. If the attackers obtain legitimate credentials, it is also much more difficult to track down the attackers in their own systems and networks. <ref name=”RE16”>"Credential Access" - available under: https://attack.mitre.org/tactics/TA0006/ - Retrieved 2024-01-01.</ref>.

===Discovery===
In order to obtain further information about the system landscape and the network, the perpetrators observe the digital environment so that they can then plan further steps. They always look at what the attackers can currently control and what they can gain from this or how they can use it to achieve their goals.<ref name=”RE16”>"Discovery" - available under: https://attack.mitre.org/tactics/TA0007/ - Retrieved 2024-01-01.</ref>.

===Lateral Movement===

<ref name=”RE16”>"Lateral Movement" - available under: https://attack.mitre.org/tactics/TA0008/ - Retrieved 2024-01-01.</ref>.

===Collection===

<ref name=”RE16”>"Collection" - available under: https://attack.mitre.org/tactics/TA0009/ - Retrieved 2024-01-01.</ref>.

===Command and Controll===

<ref name=”RE16”>"Command and Controll" - available under: https://attack.mitre.org/tactics/TA00011/ - Retrieved 2024-01-01.</ref>.

===Exfiltration===
Techniques in the exfiltration phase are used to steal data from the victim's infrastructure. Once the data has been collected, it is compressed and encrypted to prevent detection. Subsequently, the transfer between victim and threat actor often takes place via C&C. Exfiltration techniques are i.e. data transfer size limits to avoid detection and, as mentioned, exfiltration over C2 channels. <ref name=”RE13”>"Exfiltration" - available under: https://attack.mitre.org/tactics/TA0010/ - Retrieved 2024-01-01.</ref>

===Impact===
Basically, the attackers have at least goal. This target is reached during the impact phase and systems or data are manipulated, disrupted or destroyed. Techniques are used that enable the threat actor to impair the availability or integrity of the business or processes. It should be noted that the symptoms are not always noticed immediately and the objectives can also be achieved without the victim realising it directly. A striking example would be the deletion of an account access or data destruction. <ref name=”RE12”>"Impact" - available under: https://attack.mitre.org/tactics/TA0040/ - Retrieved 2024-01-01.</ref>

== References ==

[[Category:Documentation]]

MITRE ATT&CK

2024-01-04T12:43:32Z

ALanners: /* Discovery */

Developed by MITRE, ATT&CK is a globally accessible knowledge base focused on adversary behaviour - also called cyber threat intelligence . Cyber adversaries are known for their intelligence, adaptability, and persistence, learning from each attack, whether successful or unsuccessful. Their capabilities range from stealing personal information an data to disrupting infrastructure and/or damaging business operations.
The MITRE ATT&CK knowledge-base is freely available to everyone. The knowledge base documents the common tactics, techniques and procedures used by cyber threat actors. The framework can be used as a resource for the development of specific threat models and methodologies, as well as the development of specific countermeasures. <ref name=”RE1”>"MITRE ATT&CK" - available under: https://www.mitre.org/focus-areas/cybersecurity/mitre-attack - Retrieved 2024-01-01.</ref>

==MITRE ATT&CK Groups==
The groups are "activity clusters" that are often observed in the cyber security bubble under a specific name. It should be noted that groups in the cybersecurity sector are often loosely connected and may be known by several names. In addition, it can happen that the same clusters are tracked by different actors under different names. In the context of the MITRE Groups documentation, the MITRE team endeavours to document the overlaps under the Associated Groups/Aliases section. Groups are in turn linked to techniques that are assigned to the respective tactics. As a result, there is a separate ATT&CK matrix for many groups. <ref name=”RE8”>"Groups" - available under: https://attack.mitre.org/groups/ - Retrieved 2024-01-01.</ref>

==MITRE ATT&CK Software==
According to MITRE, software is defined as "operating system utilities, open-source software, or other tools used to conduct behaviour modeled in ATT&CK".
Analogous to offender groups, there are also artefacts in the area of software that are known by different names but are the same software. Each entry in the software documentation contains a technical artefact, which in turn can be assigned to a group. The information is based on open source.

MITRE distinguishes between tools and malware:
A tool is software that can be used by Defender, Pentester as well as redteamer or threat actors. This includes software that is not found in the corporate context as well as software that is used in the corporate context.
In contrast to tools, malware is designed to carry out malicious actions on the targetsystem.<ref name=”RE9”>"Software" - available under: https://attack.mitre.org/software/ - Retrieved 2024-01-01.</ref>

==MITRE ATT&CK Techniques==
Techniques in the context of the MITRE ATT&CK knowledge base describe how an attacker achieves a tactical objective, i.e. which actions he performs to achieve it. As a striking example, the threat actor can, for example, dump credentials in order to gain access to the victim's credentials. As of January 2023, a total of 201 techniques are documented with a total of 424 sub-techniques. <ref name=”RE2”>"Enterprise Techniques" - available under: https://attack.mitre.org/techniques/enterprise/ - Retrieved 2024-01-01.</ref>

==MITRE ATT&CK Tactics==
Tactics documented the why of an ATT&CK technique or sub-technique, it is therefore the actual target of the attacker. The targets reflect the respective process steps of the MITRE ATT&CK matrix - i.e. from reconnaissance to impact. For example, an attacker can use credential access or privilege escalation as a tactic. <ref name=”RE3”>"Enterprise tactics" - available under: https://attack.mitre.org/tactics/enterprise/ - Retrieved 2024-01-01.</ref>

==MITRE ATT&CK Matrix==

The MITRE ATT&CK matrix is part of the knowledge base and provides actor-specific techniques and procedures for each phase of the attack. The process begins with reconnaissance and ends with impact. Different techniques and tactics are assigned to each process step, which can be clicked on and which then lead to documentation. <ref name=”RE4”>"ATT&CK Matrix" - available under: https://attack.mitre.org/# - Retrieved 2024-01-01.</ref>

[[File:MITRE_ATT%26CK_Matrix.png|frameless|center|caption]]

In addition to the Enterprise Matrix, there is a matrix for Mobile and one for ICS

===Reconnaissance===
Reconnaissance involves adversaries actively or passively collecting information to support their targeting efforts an reach their target, which consist in an successfull attack. This gathered informations may include details about the victim organization, its infrastructure, used software or hardware or personnel. Threat actors can utilize this information across different phases of the mentioned process (MITRE ATT&CK Matrix), using it for tasks like planning and executing Initial Access, determining post-compromise objectives, or guiding subsequent Reconnaissance efforts. <ref name=”RE5”>"Reconnaissance" - available under: https://attack.mitre.org/tactics/TA0043/ - Retrieved 2024-01-01.</ref>

===Ressource Development===
Resource development encompasses methods by which adversaries generate, acquire, or steal resources to support their targeting activities. These resources may include infrastructure, accounts or capabilities. The threat actors can use these resources at different stages of their lifecycle - for example by using purchased or stolen domains for command and control infrastructure, using email accounts for phishing during initial access or acquiring code signing certificates to facilitate defence evasion. <ref name=”RE6”>"Resource Development" - available under: https://attack.mitre.org/tactics/TA0042/ - Retrieved 2024-01-01.</ref>

===Initial Access===
Initial access consists of methods that the attackers use to gain a foothold in the victim's infrastructure. These include spearphishing, content injection or exploiting a vulnerability. A distinction can be made between measures that grant continuous access or temporary access, as passwords change continuously, for example.
<ref name=”RE7”>"Initial Access" - available under: https://attack.mitre.org/tactics/TA0001/ - Retrieved 2024-01-01.</ref>

===Execution===
Execution consists of executing the attacker's malicious code on the target system. Techniques from this phase are often combined with techniques from other phases in order to achieve several goals at once. Examples of techniques include the use of a command and script interpreter such as Powershell to execute malicious scripts or user execution of a malicious file. <ref name=”RE10”>"Execution" - available under: https://attack.mitre.org/tactics/TA0002/ - Retrieved 2024-01-01.</ref>

===Persistence===
Once threat actors have gained access to the system, they want to maintain access. This is ensured in the course of persistence. The attackers ensure that access is maintained by restarting the system, changing access data and making other changes. An example of this technique is the addition of code during boot or logon autostart execution.<ref name=”RE11”>"Persistence" - available under: https://attack.mitre.org/tactics/TA0003/ - Retrieved 2024-01-01.</ref>

===Privilege Escalation===
The aim is to ensure higher privileges - higher level permissions on systems and networks - based on the existing access. Higher privileges are often needed to achieve the actual goals. System weaknesses, misconfigurations and vulnerabilities are often exploited to achieve higher privileges.
According to MITRE, the target stages are, for example <ref name=”RE14”>" Privilege Escalation " - available under: https://attack.mitre.org/tactics/TA0004/ - Retrieved 2024-01-01.</ref>:
* SYSTEM/root level
* local administrator
* user account with admin-like access
* user accounts with access to specific system or perform specific function

===Defense Evasion===
To avoid the compromise being noticed, use attack techniques of defence evasion. For example, security software can be switched off or uninstalled, or payloads and data can be encrypted and obfuscated. In addition, legitimate processes can be misused to carry out the attackers' activities and thus conceal them.
<ref name=”RE15”>" Privilege Escalation " - available under: https://attack.mitre.org/tactics/TA0005/ - Retrieved 2024-01-01.</ref>.

===Credential Access===
The aim of the attacker is to steal credentials in order to be able to move laterally in the network, for example. Techniques such as keylogging or credential dumping using Mimikatz are used for this purpose. If the attackers obtain legitimate credentials, it is also much more difficult to track down the attackers in their own systems and networks. <ref name=”RE16”>"Credential Access" - available under: https://attack.mitre.org/tactics/TA0006/ - Retrieved 2024-01-01.</ref>.

===Discovery===
In order to obtain further information about the system landscape and the network, the perpetrators observe the digital environment so that they can then plan further steps. They always look at what the attackers can currently control and what they can gain from this or how they can use it to achieve their goals.<ref name=”RE16”>"Discovery" - available under: https://attack.mitre.org/tactics/TA0007/ - Retrieved 2024-01-01.</ref>.

===Lateral Movement===

===Collection===

===Command and Controll===

===Exfiltration===
Techniques in the exfiltration phase are used to steal data from the victim's infrastructure. Once the data has been collected, it is compressed and encrypted to prevent detection. Subsequently, the transfer between victim and threat actor often takes place via C&C. Exfiltration techniques are i.e. data transfer size limits to avoid detection and, as mentioned, exfiltration over C2 channels. <ref name=”RE13”>"Exfiltration" - available under: https://attack.mitre.org/tactics/TA0010/ - Retrieved 2024-01-01.</ref>

===Impact===
Basically, the attackers have at least goal. This target is reached during the impact phase and systems or data are manipulated, disrupted or destroyed. Techniques are used that enable the threat actor to impair the availability or integrity of the business or processes. It should be noted that the symptoms are not always noticed immediately and the objectives can also be achieved without the victim realising it directly. A striking example would be the deletion of an account access or data destruction. <ref name=”RE12”>"Impact" - available under: https://attack.mitre.org/tactics/TA0040/ - Retrieved 2024-01-01.</ref>

== References ==

[[Category:Documentation]]

MITRE ATT&CK

2024-01-04T12:34:15Z

ALanners:

Developed by MITRE, ATT&CK is a globally accessible knowledge base focused on adversary behaviour - also called cyber threat intelligence . Cyber adversaries are known for their intelligence, adaptability, and persistence, learning from each attack, whether successful or unsuccessful. Their capabilities range from stealing personal information an data to disrupting infrastructure and/or damaging business operations.
The MITRE ATT&CK knowledge-base is freely available to everyone. The knowledge base documents the common tactics, techniques and procedures used by cyber threat actors. The framework can be used as a resource for the development of specific threat models and methodologies, as well as the development of specific countermeasures. <ref name=”RE1”>"MITRE ATT&CK" - available under: https://www.mitre.org/focus-areas/cybersecurity/mitre-attack - Retrieved 2024-01-01.</ref>

==MITRE ATT&CK Groups==
The groups are "activity clusters" that are often observed in the cyber security bubble under a specific name. It should be noted that groups in the cybersecurity sector are often loosely connected and may be known by several names. In addition, it can happen that the same clusters are tracked by different actors under different names. In the context of the MITRE Groups documentation, the MITRE team endeavours to document the overlaps under the Associated Groups/Aliases section. Groups are in turn linked to techniques that are assigned to the respective tactics. As a result, there is a separate ATT&CK matrix for many groups. <ref name=”RE8”>"Groups" - available under: https://attack.mitre.org/groups/ - Retrieved 2024-01-01.</ref>

==MITRE ATT&CK Software==
According to MITRE, software is defined as "operating system utilities, open-source software, or other tools used to conduct behaviour modeled in ATT&CK".
Analogous to offender groups, there are also artefacts in the area of software that are known by different names but are the same software. Each entry in the software documentation contains a technical artefact, which in turn can be assigned to a group. The information is based on open source.

MITRE distinguishes between tools and malware:
A tool is software that can be used by Defender, Pentester as well as redteamer or threat actors. This includes software that is not found in the corporate context as well as software that is used in the corporate context.
In contrast to tools, malware is designed to carry out malicious actions on the targetsystem.<ref name=”RE9”>"Software" - available under: https://attack.mitre.org/software/ - Retrieved 2024-01-01.</ref>

==MITRE ATT&CK Techniques==
Techniques in the context of the MITRE ATT&CK knowledge base describe how an attacker achieves a tactical objective, i.e. which actions he performs to achieve it. As a striking example, the threat actor can, for example, dump credentials in order to gain access to the victim's credentials. As of January 2023, a total of 201 techniques are documented with a total of 424 sub-techniques. <ref name=”RE2”>"Enterprise Techniques" - available under: https://attack.mitre.org/techniques/enterprise/ - Retrieved 2024-01-01.</ref>

==MITRE ATT&CK Tactics==
Tactics documented the why of an ATT&CK technique or sub-technique, it is therefore the actual target of the attacker. The targets reflect the respective process steps of the MITRE ATT&CK matrix - i.e. from reconnaissance to impact. For example, an attacker can use credential access or privilege escalation as a tactic. <ref name=”RE3”>"Enterprise tactics" - available under: https://attack.mitre.org/tactics/enterprise/ - Retrieved 2024-01-01.</ref>

==MITRE ATT&CK Matrix==

The MITRE ATT&CK matrix is part of the knowledge base and provides actor-specific techniques and procedures for each phase of the attack. The process begins with reconnaissance and ends with impact. Different techniques and tactics are assigned to each process step, which can be clicked on and which then lead to documentation. <ref name=”RE4”>"ATT&CK Matrix" - available under: https://attack.mitre.org/# - Retrieved 2024-01-01.</ref>

[[File:MITRE_ATT%26CK_Matrix.png|frameless|center|caption]]

In addition to the Enterprise Matrix, there is a matrix for Mobile and one for ICS

===Reconnaissance===
Reconnaissance involves adversaries actively or passively collecting information to support their targeting efforts an reach their target, which consist in an successfull attack. This gathered informations may include details about the victim organization, its infrastructure, used software or hardware or personnel. Threat actors can utilize this information across different phases of the mentioned process (MITRE ATT&CK Matrix), using it for tasks like planning and executing Initial Access, determining post-compromise objectives, or guiding subsequent Reconnaissance efforts. <ref name=”RE5”>"Reconnaissance" - available under: https://attack.mitre.org/tactics/TA0043/ - Retrieved 2024-01-01.</ref>

===Ressource Development===
Resource development encompasses methods by which adversaries generate, acquire, or steal resources to support their targeting activities. These resources may include infrastructure, accounts or capabilities. The threat actors can use these resources at different stages of their lifecycle - for example by using purchased or stolen domains for command and control infrastructure, using email accounts for phishing during initial access or acquiring code signing certificates to facilitate defence evasion. <ref name=”RE6”>"Resource Development" - available under: https://attack.mitre.org/tactics/TA0042/ - Retrieved 2024-01-01.</ref>

===Initial Access===
Initial access consists of methods that the attackers use to gain a foothold in the victim's infrastructure. These include spearphishing, content injection or exploiting a vulnerability. A distinction can be made between measures that grant continuous access or temporary access, as passwords change continuously, for example.
<ref name=”RE7”>"Initial Access" - available under: https://attack.mitre.org/tactics/TA0001/ - Retrieved 2024-01-01.</ref>

===Execution===
Execution consists of executing the attacker's malicious code on the target system. Techniques from this phase are often combined with techniques from other phases in order to achieve several goals at once. Examples of techniques include the use of a command and script interpreter such as Powershell to execute malicious scripts or user execution of a malicious file. <ref name=”RE10”>"Execution" - available under: https://attack.mitre.org/tactics/TA0002/ - Retrieved 2024-01-01.</ref>

===Persistence===
Once threat actors have gained access to the system, they want to maintain access. This is ensured in the course of persistence. The attackers ensure that access is maintained by restarting the system, changing access data and making other changes. An example of this technique is the addition of code during boot or logon autostart execution.<ref name=”RE11”>"Persistence" - available under: https://attack.mitre.org/tactics/TA0003/ - Retrieved 2024-01-01.</ref>

===Privilege Escalation===
The aim is to ensure higher privileges - higher level permissions on systems and networks - based on the existing access. Higher privileges are often needed to achieve the actual goals. System weaknesses, misconfigurations and vulnerabilities are often exploited to achieve higher privileges.
According to MITRE, the target stages are, for example <ref name=”RE14”>" Privilege Escalation " - available under: https://attack.mitre.org/tactics/TA0004/ - Retrieved 2024-01-01.</ref>:
* SYSTEM/root level
* local administrator
* user account with admin-like access
* user accounts with access to specific system or perform specific function

===Defense Evasion===
To avoid the compromise being noticed, use attack techniques of defence evasion. For example, security software can be switched off or uninstalled, or payloads and data can be encrypted and obfuscated. In addition, legitimate processes can be misused to carry out the attackers' activities and thus conceal them.
<ref name=”RE15”>" Privilege Escalation " - available under: https://attack.mitre.org/tactics/TA0005/ - Retrieved 2024-01-01.</ref>.

===Credential Access===
The aim of the attacker is to steal credentials in order to be able to move laterally in the network, for example. Techniques such as keylogging or credential dumping using Mimikatz are used for this purpose. If the attackers obtain legitimate credentials, it is also much more difficult to track down the attackers in their own systems and networks. <ref name=”RE16”>"Credential Access" - available under: https://attack.mitre.org/tactics/TA0006/ - Retrieved 2024-01-01.</ref>.

===Discovery===
<ref name=”RE16”>"Discovery" - available under: https://attack.mitre.org/tactics/TA0007/ - Retrieved 2024-01-01.</ref>.

===Lateral Movement===

===Collection===

===Command and Controll===

===Exfiltration===
Techniques in the exfiltration phase are used to steal data from the victim's infrastructure. Once the data has been collected, it is compressed and encrypted to prevent detection. Subsequently, the transfer between victim and threat actor often takes place via C&C. Exfiltration techniques are i.e. data transfer size limits to avoid detection and, as mentioned, exfiltration over C2 channels. <ref name=”RE13”>"Exfiltration" - available under: https://attack.mitre.org/tactics/TA0010/ - Retrieved 2024-01-01.</ref>

===Impact===
Basically, the attackers have at least goal. This target is reached during the impact phase and systems or data are manipulated, disrupted or destroyed. Techniques are used that enable the threat actor to impair the availability or integrity of the business or processes. It should be noted that the symptoms are not always noticed immediately and the objectives can also be achieved without the victim realising it directly. A striking example would be the deletion of an account access or data destruction. <ref name=”RE12”>"Impact" - available under: https://attack.mitre.org/tactics/TA0040/ - Retrieved 2024-01-01.</ref>

== References ==

[[Category:Documentation]]

MITRE ATT&CK

2024-01-04T12:27:15Z

ALanners:

Developed by MITRE, ATT&CK is a globally accessible knowledge base focused on adversary behaviour - also called cyber threat intelligence . Cyber adversaries are known for their intelligence, adaptability, and persistence, learning from each attack, whether successful or unsuccessful. Their capabilities range from stealing personal information an data to disrupting infrastructure and/or damaging business operations.
The MITRE ATT&CK knowledge-base is freely available to everyone. The knowledge base documents the common tactics, techniques and procedures used by cyber threat actors. The framework can be used as a resource for the development of specific threat models and methodologies, as well as the development of specific countermeasures. <ref name=”RE1”>"MITRE ATT&CK" - available under: https://www.mitre.org/focus-areas/cybersecurity/mitre-attack - Retrieved 2024-01-01.</ref>

==MITRE ATT&CK Groups==
The groups are "activity clusters" that are often observed in the cyber security bubble under a specific name. It should be noted that groups in the cybersecurity sector are often loosely connected and may be known by several names. In addition, it can happen that the same clusters are tracked by different actors under different names. In the context of the MITRE Groups documentation, the MITRE team endeavours to document the overlaps under the Associated Groups/Aliases section. Groups are in turn linked to techniques that are assigned to the respective tactics. As a result, there is a separate ATT&CK matrix for many groups. <ref name=”RE8”>"Groups" - available under: https://attack.mitre.org/groups/ - Retrieved 2024-01-01.</ref>

==MITRE ATT&CK Software==
According to MITRE, software is defined as "operating system utilities, open-source software, or other tools used to conduct behaviour modeled in ATT&CK".
Analogous to offender groups, there are also artefacts in the area of software that are known by different names but are the same software. Each entry in the software documentation contains a technical artefact, which in turn can be assigned to a group. The information is based on open source.

MITRE distinguishes between tools and malware:
A tool is software that can be used by Defender, Pentester as well as redteamer or threat actors. This includes software that is not found in the corporate context as well as software that is used in the corporate context.
In contrast to tools, malware is designed to carry out malicious actions on the targetsystem.<ref name=”RE9”>"Software" - available under: https://attack.mitre.org/software/ - Retrieved 2024-01-01.</ref>

==MITRE ATT&CK Techniques==
Techniques in the context of the MITRE ATT&CK knowledge base describe how an attacker achieves a tactical objective, i.e. which actions he performs to achieve it. As a striking example, the threat actor can, for example, dump credentials in order to gain access to the victim's credentials. As of January 2023, a total of 201 techniques are documented with a total of 424 sub-techniques. <ref name=”RE2”>"Enterprise Techniques" - available under: https://attack.mitre.org/techniques/enterprise/ - Retrieved 2024-01-01.</ref>

==MITRE ATT&CK Tactics==
Tactics documented the why of an ATT&CK technique or sub-technique, it is therefore the actual target of the attacker. The targets reflect the respective process steps of the MITRE ATT&CK matrix - i.e. from reconnaissance to impact. For example, an attacker can use credential access or privilege escalation as a tactic. <ref name=”RE3”>"Enterprise tactics" - available under: https://attack.mitre.org/tactics/enterprise/ - Retrieved 2024-01-01.</ref>

==MITRE ATT&CK Matrix==

The MITRE ATT&CK matrix is part of the knowledge base and provides actor-specific techniques and procedures for each phase of the attack. The process begins with reconnaissance and ends with impact. Different techniques and tactics are assigned to each process step, which can be clicked on and which then lead to documentation. <ref name=”RE4”>"ATT&CK Matrix" - available under: https://attack.mitre.org/# - Retrieved 2024-01-01.</ref>

[[File:MITRE_ATT%26CK_Matrix.png|frameless|center|caption]]

In addition to the Enterprise Matrix, there is a matrix for Mobile and one for ICS

===Reconnaissance===
Reconnaissance involves adversaries actively or passively collecting information to support their targeting efforts an reach their target, which consist in an successfull attack. This gathered informations may include details about the victim organization, its infrastructure, used software or hardware or personnel. Threat actors can utilize this information across different phases of the mentioned process (MITRE ATT&CK Matrix), using it for tasks like planning and executing Initial Access, determining post-compromise objectives, or guiding subsequent Reconnaissance efforts. <ref name=”RE5”>"Reconnaissance" - available under: https://attack.mitre.org/tactics/TA0043/ - Retrieved 2024-01-01.</ref>

===Ressource Development===
Resource development encompasses methods by which adversaries generate, acquire, or steal resources to support their targeting activities. These resources may include infrastructure, accounts or capabilities. The threat actors can use these resources at different stages of their lifecycle - for example by using purchased or stolen domains for command and control infrastructure, using email accounts for phishing during initial access or acquiring code signing certificates to facilitate defence evasion. <ref name=”RE6”>"Resource Development" - available under: https://attack.mitre.org/tactics/TA0042/ - Retrieved 2024-01-01.</ref>

===Initial Access===
Initial access consists of methods that the attackers use to gain a foothold in the victim's infrastructure. These include spearphishing, content injection or exploiting a vulnerability. A distinction can be made between measures that grant continuous access or temporary access, as passwords change continuously, for example.
<ref name=”RE7”>"Initial Access" - available under: https://attack.mitre.org/tactics/TA0001/ - Retrieved 2024-01-01.</ref>

===Execution===
Execution consists of executing the attacker's malicious code on the target system. Techniques from this phase are often combined with techniques from other phases in order to achieve several goals at once. Examples of techniques include the use of a command and script interpreter such as Powershell to execute malicious scripts or user execution of a malicious file. <ref name=”RE10”>"Execution" - available under: https://attack.mitre.org/tactics/TA0002/ - Retrieved 2024-01-01.</ref>

===Persistence===
Once threat actors have gained access to the system, they want to maintain access. This is ensured in the course of persistence. The attackers ensure that access is maintained by restarting the system, changing access data and making other changes. An example of this technique is the addition of code during boot or logon autostart execution.<ref name=”RE11”>"Persistence" - available under: https://attack.mitre.org/tactics/TA0003/ - Retrieved 2024-01-01.</ref>

===Privilege Escalation===
The aim is to ensure higher privileges - higher level permissions on systems and networks - based on the existing access. Higher privileges are often needed to achieve the actual goals. System weaknesses, misconfigurations and vulnerabilities are often exploited to achieve higher privileges.
According to MITRE, the target stages are, for example <ref name=”RE14”>" Privilege Escalation " - available under: https://attack.mitre.org/tactics/TA0004/ - Retrieved 2024-01-01.</ref>:
* SYSTEM/root level
* local administrator
* user account with admin-like access
* user accounts with access to specific system or perform specific function

===Defense Evasion===
To avoid the compromise being noticed, use attack techniques of defence evasion. For example, security software can be switched off or uninstalled, or payloads and data can be encrypted and obfuscated. In addition, legitimate processes can be misused to carry out the attackers' activities and thus conceal them.
<ref name=”RE15”>" Privilege Escalation " - available under: https://attack.mitre.org/tactics/TA0005/ - Retrieved 2024-01-01.</ref>.

===Credential Access===

===Discovery===

===Lateral Movement===

===Collection===

===Command and Controll===

===Exfiltration===
Techniques in the exfiltration phase are used to steal data from the victim's infrastructure. Once the data has been collected, it is compressed and encrypted to prevent detection. Subsequently, the transfer between victim and threat actor often takes place via C&C. Exfiltration techniques are i.e. data transfer size limits to avoid detection and, as mentioned, exfiltration over C2 channels. <ref name=”RE13”>"Exfiltration" - available under: https://attack.mitre.org/tactics/TA0010/ - Retrieved 2024-01-01.</ref>

===Impact===
Basically, the attackers have at least goal. This target is reached during the impact phase and systems or data are manipulated, disrupted or destroyed. Techniques are used that enable the threat actor to impair the availability or integrity of the business or processes. It should be noted that the symptoms are not always noticed immediately and the objectives can also be achieved without the victim realising it directly. A striking example would be the deletion of an account access or data destruction. <ref name=”RE12”>"Impact" - available under: https://attack.mitre.org/tactics/TA0040/ - Retrieved 2024-01-01.</ref>

== References ==

[[Category:Documentation]]

MITRE ATT&CK

2024-01-04T12:23:03Z

ALanners:

Developed by MITRE, ATT&CK is a globally accessible knowledge base focused on adversary behaviour - also called cyber threat intelligence . Cyber adversaries are known for their intelligence, adaptability, and persistence, learning from each attack, whether successful or unsuccessful. Their capabilities range from stealing personal information an data to disrupting infrastructure and/or damaging business operations.
The MITRE ATT&CK knowledge-base is freely available to everyone. The knowledge base documents the common tactics, techniques and procedures used by cyber threat actors. The framework can be used as a resource for the development of specific threat models and methodologies, as well as the development of specific countermeasures. <ref name=”RE1”>"MITRE ATT&CK" - available under: https://www.mitre.org/focus-areas/cybersecurity/mitre-attack - Retrieved 2024-01-01.</ref>

==MITRE ATT&CK Groups==
The groups are "activity clusters" that are often observed in the cyber security bubble under a specific name. It should be noted that groups in the cybersecurity sector are often loosely connected and may be known by several names. In addition, it can happen that the same clusters are tracked by different actors under different names. In the context of the MITRE Groups documentation, the MITRE team endeavours to document the overlaps under the Associated Groups/Aliases section. Groups are in turn linked to techniques that are assigned to the respective tactics. As a result, there is a separate ATT&CK matrix for many groups. <ref name=”RE8”>"Groups" - available under: https://attack.mitre.org/groups/ - Retrieved 2024-01-01.</ref>

==MITRE ATT&CK Software==
According to MITRE, software is defined as "operating system utilities, open-source software, or other tools used to conduct behaviour modeled in ATT&CK".
Analogous to offender groups, there are also artefacts in the area of software that are known by different names but are the same software. Each entry in the software documentation contains a technical artefact, which in turn can be assigned to a group. The information is based on open source.

MITRE distinguishes between tools and malware:
A tool is software that can be used by Defender, Pentester as well as redteamer or threat actors. This includes software that is not found in the corporate context as well as software that is used in the corporate context.
In contrast to tools, malware is designed to carry out malicious actions on the targetsystem.<ref name=”RE9”>"Software" - available under: https://attack.mitre.org/software/ - Retrieved 2024-01-01.</ref>

==MITRE ATT&CK Techniques==
Techniques in the context of the MITRE ATT&CK knowledge base describe how an attacker achieves a tactical objective, i.e. which actions he performs to achieve it. As a striking example, the threat actor can, for example, dump credentials in order to gain access to the victim's credentials. As of January 2023, a total of 201 techniques are documented with a total of 424 sub-techniques. <ref name=”RE2”>"Enterprise Techniques" - available under: https://attack.mitre.org/techniques/enterprise/ - Retrieved 2024-01-01.</ref>

==MITRE ATT&CK Tactics==
Tactics documented the why of an ATT&CK technique or sub-technique, it is therefore the actual target of the attacker. The targets reflect the respective process steps of the MITRE ATT&CK matrix - i.e. from reconnaissance to impact. For example, an attacker can use credential access or privilege escalation as a tactic. <ref name=”RE3”>"Enterprise tactics" - available under: https://attack.mitre.org/tactics/enterprise/ - Retrieved 2024-01-01.</ref>

==MITRE ATT&CK Matrix==

The MITRE ATT&CK matrix is part of the knowledge base and provides actor-specific techniques and procedures for each phase of the attack. The process begins with reconnaissance and ends with impact. Different techniques and tactics are assigned to each process step, which can be clicked on and which then lead to documentation. <ref name=”RE4”>"ATT&CK Matrix" - available under: https://attack.mitre.org/# - Retrieved 2024-01-01.</ref>

[[File:MITRE_ATT%26CK_Matrix.png|frameless|center|caption]]

In addition to the Enterprise Matrix, there is a matrix for Mobile and one for ICS

===Reconnaissance===
Reconnaissance involves adversaries actively or passively collecting information to support their targeting efforts an reach their target, which consist in an successfull attack. This gathered informations may include details about the victim organization, its infrastructure, used software or hardware or personnel. Threat actors can utilize this information across different phases of the mentioned process (MITRE ATT&CK Matrix), using it for tasks like planning and executing Initial Access, determining post-compromise objectives, or guiding subsequent Reconnaissance efforts. <ref name=”RE5”>"Reconnaissance" - available under: https://attack.mitre.org/tactics/TA0043/ - Retrieved 2024-01-01.</ref>

===Ressource Development===
Resource development encompasses methods by which adversaries generate, acquire, or steal resources to support their targeting activities. These resources may include infrastructure, accounts or capabilities. The threat actors can use these resources at different stages of their lifecycle - for example by using purchased or stolen domains for command and control infrastructure, using email accounts for phishing during initial access or acquiring code signing certificates to facilitate defence evasion. <ref name=”RE6”>"Resource Development" - available under: https://attack.mitre.org/tactics/TA0042/ - Retrieved 2024-01-01.</ref>

===Initial Access===
Initial access consists of methods that the attackers use to gain a foothold in the victim's infrastructure. These include spearphishing, content injection or exploiting a vulnerability. A distinction can be made between measures that grant continuous access or temporary access, as passwords change continuously, for example.
<ref name=”RE7”>"Initial Access" - available under: https://attack.mitre.org/tactics/TA0001/ - Retrieved 2024-01-01.</ref>

===Execution===
Execution consists of executing the attacker's malicious code on the target system. Techniques from this phase are often combined with techniques from other phases in order to achieve several goals at once. Examples of techniques include the use of a command and script interpreter such as Powershell to execute malicious scripts or user execution of a malicious file. <ref name=”RE10”>"Execution" - available under: https://attack.mitre.org/tactics/TA0002/ - Retrieved 2024-01-01.</ref>

===Persistence===
Once threat actors have gained access to the system, they want to maintain access. This is ensured in the course of persistence. The attackers ensure that access is maintained by restarting the system, changing access data and making other changes. An example of this technique is the addition of code during boot or logon autostart execution.<ref name=”RE11”>"Persistence" - available under: https://attack.mitre.org/tactics/TA0003/ - Retrieved 2024-01-01.</ref>

===Privilege Escalation===
The aim is to ensure higher privileges - higher level permissions on systems and networks - based on the existing access. Higher privileges are often needed to achieve the actual goals. System weaknesses, misconfigurations and vulnerabilities are often exploited to achieve higher privileges.
According to MITRE, the target stages are, for example <ref name=”RE14”>" Privilege Escalation " - available under: https://attack.mitre.org/tactics/TA0004/ - Retrieved 2024-01-01.</ref>:
* SYSTEM/root level
* local administrator
* user account with admin-like access
* user accounts with access to specific system or perform specific function

===Defense Evasion===

===Credential Access===

===Discovery===

===Lateral Movement===

===Collection===

===Command and Controll===

===Exfiltration===
Techniques in the exfiltration phase are used to steal data from the victim's infrastructure. Once the data has been collected, it is compressed and encrypted to prevent detection. Subsequently, the transfer between victim and threat actor often takes place via C&C. Exfiltration techniques are i.e. data transfer size limits to avoid detection and, as mentioned, exfiltration over C2 channels. <ref name=”RE13”>"Exfiltration" - available under: https://attack.mitre.org/tactics/TA0010/ - Retrieved 2024-01-01.</ref>

===Impact===
Basically, the attackers have at least goal. This target is reached during the impact phase and systems or data are manipulated, disrupted or destroyed. Techniques are used that enable the threat actor to impair the availability or integrity of the business or processes. It should be noted that the symptoms are not always noticed immediately and the objectives can also be achieved without the victim realising it directly. A striking example would be the deletion of an account access or data destruction. <ref name=”RE12”>"Impact" - available under: https://attack.mitre.org/tactics/TA0040/ - Retrieved 2024-01-01.</ref>

== References ==

[[Category:Documentation]]

Evil Twin Attack via Kali on Raspberry Pi

2024-01-04T12:02:27Z

ALanners: /* Reconnaissance */

An Evil Twin is a rogue access point designed to imitate a legitimate access point in order to carry out malicious actions such as phising. Regular laptops and Wi-Fi adapters can be used to set up an Evil Twin, or Raspberry Pis, as these are quite small and can be easily packed into a bagpack when powered by a battery bank. This setup can then be left in one place for several days, for example, during which time the AP can phish information.

The main scenarios in the context of rogue access points or Evil Twins are:
* Machine-in-the-Middle/Content Injection tion
* Malicious webpages through e.g. DNS spoofing
* Deauthentication attacks
* Technique for social engineering for more in-depth scenarios

== Kali Linux on Raspberry Pi ==

For example, Kali Linux can be installed on a Raspberry Pi 4 Model B with 8 GB RAM. The Raspberry Pi 4 Model B is equipped with a Broadcom BCM2711, Quad core Cortex-A72 (ARM v8) 64-bit SoC @ 1.8GHz. This information is relevant because Kali Linux provides an image specifically for ARM processors on their website.
This image can be downloaded at [https://www.kali.org/get-kali/#kali-arm Kali Linux on ARM] The Raspberry Pi 4 is equipped with a 64-bit processor and supports the execution of 64-bit images. This results in two options: Either the Kali Linux RaspberryPi 2, 3, 4 32-bit or 64-bit image can be selected, whereby more documentation is available for the 32-bit variant. In addition, the 32-bit image ran with fewer problems than the 64-bit image during practical tests.
To get the image onto the Raspberry Pi, it must be transferred to a micro SD card. Balena Etcher or similar software can be used for this purpose.
Once the image has been successfully transferred to the SD card, it can be inserted into the corresponding slot on the Raspberry Pi 4. This can then be started and Kali Linux will boot from the SD card. The username and password are kali/kali.

A more detailed guide to installing Kali Linux on a Raspberry Pi can be found in the following article: [https://wiki.elvis.science/index.php?title=Install_Kali_Linux_on_Raspberry_Pi_3_%26_4 Install Kali Linux on Raspberry Pi 3 & 4]

=== Hands-on report ===
Kali Linux on a Raspberry Pi was tested extensively in the course of setting up an Evil Twin. Overall, the installation of the latest version of Kali Linux (as of December 2023) on a Raspberry Pi is not recommended for testing and lab purposes. The use for spawning an Evil Twin can also be achieved with other Linux systems, which is why it should be determined whether Kali Linux is absolutely necessary.
The following bugs were observed:
* After installing dependencies that were necessary to start Wifiphisher and Wifipumpkin 3, there were more boot problems
* Overall, booting was often prone to errors. Depending on the connected screen, it took several attempts.
* There were often non-reproducible bugs when starting programmes. For example, Wifiphisher did not work from time to time, no networks could be displayed and the like. The bugs occurred randomly and could not be reproduced.
* There were also bugs in the GUI area. For example, the bar for maximising, minimising and closing windows suddenly disappeared and it was no longer possible to move windows. To fix this, the corresponding driver had to be restarted.

*When starting a rogue access point with aireplay and without an external Wireless Adapter, an error message may appear. This can be rectified by increasing the MTU. This is not easily possible on the internal interface on the Raspberry Pi and is blocked as the kernel does not support an MTU higher than 1500. There are then 2 options: Option (1): revise kernel settings and recompile or option (2): use external network antenna. Due to the risk and the necessary knowledge, option (2) is preferable. This means that an external Wi-Fi adapter is required as a wireless network interface. In addition, actions can be carried out on both 2.4 GHz and 5 GHz when using an appropriate network adapter. Without an external antenna, you can only work on 2.4 GHz. The external network adapter choosen for the lab was an Alfa AWUS036ACH Wide Range AC1200 Wireless Adapter. In the Linux environment, care should also be taken to ensure that the network adapters work with the respective distribution and kernel and that a corresponding driver is available. According to the manufacturer, the Alfa AWUS036ACH Wide Range AC1200 Wireless Adapter can be used with Kali Linux without any problems.

== Evil Twin ==

=== Evil Twin using native Kali Linux Tools ===
The following tools are all pre-installed on Kali Linux. All of the tools listed can be used to carry out an Evil Twin attack:
* Airmon-ng: Display interfaces and stop potentially disruptive processes.
* Airodump-ng: Can be used to carry out reconnaissance. All surrounding networks and associated devices can be detected.
* Airbase-ng: Can be used to create a Wi-Fi access point. created.
* Aireplay-ng: Can be used to carry out deauth- attacks
* Accompanying activities: dns-masq can be used to set up a DNS server. Furthermore activation of a corresponding route on the interfaces as well as enabling IP forwarding and setting up firewall rules.

=== Hardware requirements ===
At least the following hardware is required to set up an Evil Twin:
* Raspberry Pi 4 Model B - 8GB incl. accessories such as power cable and MicroSD
* Two external wireless adapter, whereby the following can be recommended: 2 x Alfa AWUS036ACH Wide Range AC1200 Wireless Adapter

=== Reconnaissance ===

To find out which networks exist in the environment and which devices are associated with which network, the airodump-ng tool can be used for reconnaissance. The information such as BSSID, SSID or channel is important for the next steps.

The following command can be used for starting the reconnaissance using airodump-ng:
sudo airodump-ng <interface> -b abg

The attributes a,b,g describe the bands on which airodump should sniff should sniff. 'b' and 'g' use 2.4GHz and 'a' uses 5GHz

=== Spawning Rogue Access Point ===

With the pre-installed tools airmon-ng, airodump-ng, airbase-ng and aireplay-ng in Kali Linux, it is possible to initiate both a rogue access point and an Evil Twin attack. The only significant drawback is that these tools do not offer a captive portal option.

An access point can be spawned as follows:
sudo airbase-ng -e <wifiname> -c <channel> <interface>

To increase the range of the access point, the transmission power can be increased:
sudo iwconfig interface txpower <NmW/NdBm>

In addition to the tools in the corresponding Deauth chapter, a Deauth attack can also be carried out using aireplay-ng:
sudo aireplay-ng --deauth 50 -a <BSSID>

=== Deauthentication attack ===
Deauthentication attacks are a subtle yet serious threat. The targeted de-authentication attacks, which aim to remove connected devices from a Wi-Fi network, have the potential to have a significant impact on the availability and integrity of connections.

The channel of the AP or the devices that are connected to the AP can be taken from the reconnaissance. For setting the channel on the Wi-Fi adapter:
sudo iwlist <interface> channel
sudo iwconfig <interface> power off
sudo iwconfig <interface> channel {channel, ex. "23"}
sudo iwconfig <interface> power on

To check whether the channel has been set
sudo iwlist {interface} channel

For carrying out a deauth attack on 2.4 GHz:
aireplay-ng -0 0 -a <MAC address of the TargetAP> -c
<MAC address client> <interfacename>
-0 for Deauthentication
0 Number of deauths to be sent, 0 means,
that they are sent continuously

For carrying out a deauth attack on 5 GHz:
sudo mdk4 <interface> d -E <WLAN SSID>

=== Alternative all-in-one frameworks ===
All-in-one frameworks that combine the activities described above in one software are, for example, [https://wiki.elvis.science/index.php?title=Wifiphisher wifiphisher] and [https://wiki.elvis.science/index.php?title=Wifipumpkin3 wifipumpkin3]

== Potential measures to protect against Evil Twins ==
Organisational measures are closely linked to personal measures. As an organisational measure, it can be established, for example, that different passwords must be used for different services and applications. This can prevent the same password being used for VPN access as for Wi-Fi access. In the corporate context, the operation of a structured and continuously improving information security management system can also be categorised as an organisational measure.

In the client-side area, care can be taken to ensure that the devices are configured so that only that only TLS-encrypted connections (e.g. HTTPS) are permitted. are allowed. This at least prevents the rogue access point from accessing data in plain text or manipulate it unnoticed.

The use of a VPN can also be recommended as a technical measure against MitM attacks. This is usually accompanied by increased information security through encryption of the traffic, which prevents transmitted data from being read or manipulated. In the context of a Wi-Fi MitM attack, a VPN hides the client's communication, encrypts the network traffic and hides metadata such as IP addresses or domain names.

Personal measures focus on the end user. Awareness-raising measures in particular can be derived in this context. It is important to sensitise users to the existing risks, make them aware and motivate them to support and implement the technical and organisational security measures. An easy-to-understand personal measure can be, for example, to pay attention to Wi-Fi names and other irregularities and to report these to the relevant reporting centres in the event of anomalies. This allows a quick response in the case of an emergency.

== References ==

[[Category:Documentation]]

Evil Twin Attack via Kali on Raspberry Pi

2024-01-04T11:59:46Z

ALanners: /* Spawning Rogue Access Point */

An Evil Twin is a rogue access point designed to imitate a legitimate access point in order to carry out malicious actions such as phising. Regular laptops and Wi-Fi adapters can be used to set up an Evil Twin, or Raspberry Pis, as these are quite small and can be easily packed into a bagpack when powered by a battery bank. This setup can then be left in one place for several days, for example, during which time the AP can phish information.

The main scenarios in the context of rogue access points or Evil Twins are:
* Machine-in-the-Middle/Content Injection tion
* Malicious webpages through e.g. DNS spoofing
* Deauthentication attacks
* Technique for social engineering for more in-depth scenarios

== Kali Linux on Raspberry Pi ==

For example, Kali Linux can be installed on a Raspberry Pi 4 Model B with 8 GB RAM. The Raspberry Pi 4 Model B is equipped with a Broadcom BCM2711, Quad core Cortex-A72 (ARM v8) 64-bit SoC @ 1.8GHz. This information is relevant because Kali Linux provides an image specifically for ARM processors on their website.
This image can be downloaded at [https://www.kali.org/get-kali/#kali-arm Kali Linux on ARM] The Raspberry Pi 4 is equipped with a 64-bit processor and supports the execution of 64-bit images. This results in two options: Either the Kali Linux RaspberryPi 2, 3, 4 32-bit or 64-bit image can be selected, whereby more documentation is available for the 32-bit variant. In addition, the 32-bit image ran with fewer problems than the 64-bit image during practical tests.
To get the image onto the Raspberry Pi, it must be transferred to a micro SD card. Balena Etcher or similar software can be used for this purpose.
Once the image has been successfully transferred to the SD card, it can be inserted into the corresponding slot on the Raspberry Pi 4. This can then be started and Kali Linux will boot from the SD card. The username and password are kali/kali.

A more detailed guide to installing Kali Linux on a Raspberry Pi can be found in the following article: [https://wiki.elvis.science/index.php?title=Install_Kali_Linux_on_Raspberry_Pi_3_%26_4 Install Kali Linux on Raspberry Pi 3 & 4]

=== Hands-on report ===
Kali Linux on a Raspberry Pi was tested extensively in the course of setting up an Evil Twin. Overall, the installation of the latest version of Kali Linux (as of December 2023) on a Raspberry Pi is not recommended for testing and lab purposes. The use for spawning an Evil Twin can also be achieved with other Linux systems, which is why it should be determined whether Kali Linux is absolutely necessary.
The following bugs were observed:
* After installing dependencies that were necessary to start Wifiphisher and Wifipumpkin 3, there were more boot problems
* Overall, booting was often prone to errors. Depending on the connected screen, it took several attempts.
* There were often non-reproducible bugs when starting programmes. For example, Wifiphisher did not work from time to time, no networks could be displayed and the like. The bugs occurred randomly and could not be reproduced.
* There were also bugs in the GUI area. For example, the bar for maximising, minimising and closing windows suddenly disappeared and it was no longer possible to move windows. To fix this, the corresponding driver had to be restarted.

*When starting a rogue access point with aireplay and without an external Wireless Adapter, an error message may appear. This can be rectified by increasing the MTU. This is not easily possible on the internal interface on the Raspberry Pi and is blocked as the kernel does not support an MTU higher than 1500. There are then 2 options: Option (1): revise kernel settings and recompile or option (2): use external network antenna. Due to the risk and the necessary knowledge, option (2) is preferable. This means that an external Wi-Fi adapter is required as a wireless network interface. In addition, actions can be carried out on both 2.4 GHz and 5 GHz when using an appropriate network adapter. Without an external antenna, you can only work on 2.4 GHz. The external network adapter choosen for the lab was an Alfa AWUS036ACH Wide Range AC1200 Wireless Adapter. In the Linux environment, care should also be taken to ensure that the network adapters work with the respective distribution and kernel and that a corresponding driver is available. According to the manufacturer, the Alfa AWUS036ACH Wide Range AC1200 Wireless Adapter can be used with Kali Linux without any problems.

== Evil Twin ==

=== Evil Twin using native Kali Linux Tools ===
The following tools are all pre-installed on Kali Linux. All of the tools listed can be used to carry out an Evil Twin attack:
* Airmon-ng: Display interfaces and stop potentially disruptive processes.
* Airodump-ng: Can be used to carry out reconnaissance. All surrounding networks and associated devices can be detected.
* Airbase-ng: Can be used to create a Wi-Fi access point. created.
* Aireplay-ng: Can be used to carry out deauth- attacks
* Accompanying activities: dns-masq can be used to set up a DNS server. Furthermore activation of a corresponding route on the interfaces as well as enabling IP forwarding and setting up firewall rules.

=== Hardware requirements ===
At least the following hardware is required to set up an Evil Twin:
* Raspberry Pi 4 Model B - 8GB incl. accessories such as power cable and MicroSD
* Two external wireless adapter, whereby the following can be recommended: 2 x Alfa AWUS036ACH Wide Range AC1200 Wireless Adapter

=== Reconnaissance ===

=== Spawning Rogue Access Point ===

With the pre-installed tools airmon-ng, airodump-ng, airbase-ng and aireplay-ng in Kali Linux, it is possible to initiate both a rogue access point and an Evil Twin attack. The only significant drawback is that these tools do not offer a captive portal option.

An access point can be spawned as follows:
sudo airbase-ng -e <wifiname> -c <channel> <interface>

To increase the range of the access point, the transmission power can be increased:
sudo iwconfig interface txpower <NmW/NdBm>

In addition to the tools in the corresponding Deauth chapter, a Deauth attack can also be carried out using aireplay-ng:
sudo aireplay-ng --deauth 50 -a <BSSID>

=== Deauthentication attack ===
Deauthentication attacks are a subtle yet serious threat. The targeted de-authentication attacks, which aim to remove connected devices from a Wi-Fi network, have the potential to have a significant impact on the availability and integrity of connections.

The channel of the AP or the devices that are connected to the AP can be taken from the reconnaissance. For setting the channel on the Wi-Fi adapter:
sudo iwlist <interface> channel
sudo iwconfig <interface> power off
sudo iwconfig <interface> channel {channel, ex. "23"}
sudo iwconfig <interface> power on

To check whether the channel has been set
sudo iwlist {interface} channel

For carrying out a deauth attack on 2.4 GHz:
aireplay-ng -0 0 -a <MAC address of the TargetAP> -c
<MAC address client> <interfacename>
-0 for Deauthentication
0 Number of deauths to be sent, 0 means,
that they are sent continuously

For carrying out a deauth attack on 5 GHz:
sudo mdk4 <interface> d -E <WLAN SSID>

=== Alternative all-in-one frameworks ===
All-in-one frameworks that combine the activities described above in one software are, for example, [https://wiki.elvis.science/index.php?title=Wifiphisher wifiphisher] and [https://wiki.elvis.science/index.php?title=Wifipumpkin3 wifipumpkin3]

== Potential measures to protect against Evil Twins ==
Organisational measures are closely linked to personal measures. As an organisational measure, it can be established, for example, that different passwords must be used for different services and applications. This can prevent the same password being used for VPN access as for Wi-Fi access. In the corporate context, the operation of a structured and continuously improving information security management system can also be categorised as an organisational measure.

In the client-side area, care can be taken to ensure that the devices are configured so that only that only TLS-encrypted connections (e.g. HTTPS) are permitted. are allowed. This at least prevents the rogue access point from accessing data in plain text or manipulate it unnoticed.

The use of a VPN can also be recommended as a technical measure against MitM attacks. This is usually accompanied by increased information security through encryption of the traffic, which prevents transmitted data from being read or manipulated. In the context of a Wi-Fi MitM attack, a VPN hides the client's communication, encrypts the network traffic and hides metadata such as IP addresses or domain names.

Personal measures focus on the end user. Awareness-raising measures in particular can be derived in this context. It is important to sensitise users to the existing risks, make them aware and motivate them to support and implement the technical and organisational security measures. An easy-to-understand personal measure can be, for example, to pay attention to Wi-Fi names and other irregularities and to report these to the relevant reporting centres in the event of anomalies. This allows a quick response in the case of an emergency.

== References ==

[[Category:Documentation]]

Evil Twin Attack via Kali on Raspberry Pi

2024-01-04T11:15:22Z

ALanners: /* Hardware requirements */

An Evil Twin is a rogue access point designed to imitate a legitimate access point in order to carry out malicious actions such as phising. Regular laptops and Wi-Fi adapters can be used to set up an Evil Twin, or Raspberry Pis, as these are quite small and can be easily packed into a bagpack when powered by a battery bank. This setup can then be left in one place for several days, for example, during which time the AP can phish information.

The main scenarios in the context of rogue access points or Evil Twins are:
* Machine-in-the-Middle/Content Injection tion
* Malicious webpages through e.g. DNS spoofing
* Deauthentication attacks
* Technique for social engineering for more in-depth scenarios

== Kali Linux on Raspberry Pi ==

For example, Kali Linux can be installed on a Raspberry Pi 4 Model B with 8 GB RAM. The Raspberry Pi 4 Model B is equipped with a Broadcom BCM2711, Quad core Cortex-A72 (ARM v8) 64-bit SoC @ 1.8GHz. This information is relevant because Kali Linux provides an image specifically for ARM processors on their website.
This image can be downloaded at [https://www.kali.org/get-kali/#kali-arm Kali Linux on ARM] The Raspberry Pi 4 is equipped with a 64-bit processor and supports the execution of 64-bit images. This results in two options: Either the Kali Linux RaspberryPi 2, 3, 4 32-bit or 64-bit image can be selected, whereby more documentation is available for the 32-bit variant. In addition, the 32-bit image ran with fewer problems than the 64-bit image during practical tests.
To get the image onto the Raspberry Pi, it must be transferred to a micro SD card. Balena Etcher or similar software can be used for this purpose.
Once the image has been successfully transferred to the SD card, it can be inserted into the corresponding slot on the Raspberry Pi 4. This can then be started and Kali Linux will boot from the SD card. The username and password are kali/kali.

A more detailed guide to installing Kali Linux on a Raspberry Pi can be found in the following article: [https://wiki.elvis.science/index.php?title=Install_Kali_Linux_on_Raspberry_Pi_3_%26_4 Install Kali Linux on Raspberry Pi 3 & 4]

=== Hands-on report ===
Kali Linux on a Raspberry Pi was tested extensively in the course of setting up an Evil Twin. Overall, the installation of the latest version of Kali Linux (as of December 2023) on a Raspberry Pi is not recommended for testing and lab purposes. The use for spawning an Evil Twin can also be achieved with other Linux systems, which is why it should be determined whether Kali Linux is absolutely necessary.
The following bugs were observed:
* After installing dependencies that were necessary to start Wifiphisher and Wifipumpkin 3, there were more boot problems
* Overall, booting was often prone to errors. Depending on the connected screen, it took several attempts.
* There were often non-reproducible bugs when starting programmes. For example, Wifiphisher did not work from time to time, no networks could be displayed and the like. The bugs occurred randomly and could not be reproduced.
* There were also bugs in the GUI area. For example, the bar for maximising, minimising and closing windows suddenly disappeared and it was no longer possible to move windows. To fix this, the corresponding driver had to be restarted.

*When starting a rogue access point with aireplay and without an external Wireless Adapter, an error message may appear. This can be rectified by increasing the MTU. This is not easily possible on the internal interface on the Raspberry Pi and is blocked as the kernel does not support an MTU higher than 1500. There are then 2 options: Option (1): revise kernel settings and recompile or option (2): use external network antenna. Due to the risk and the necessary knowledge, option (2) is preferable. This means that an external Wi-Fi adapter is required as a wireless network interface. In addition, actions can be carried out on both 2.4 GHz and 5 GHz when using an appropriate network adapter. Without an external antenna, you can only work on 2.4 GHz. The external network adapter choosen for the lab was an Alfa AWUS036ACH Wide Range AC1200 Wireless Adapter. In the Linux environment, care should also be taken to ensure that the network adapters work with the respective distribution and kernel and that a corresponding driver is available. According to the manufacturer, the Alfa AWUS036ACH Wide Range AC1200 Wireless Adapter can be used with Kali Linux without any problems.

== Evil Twin ==

=== Evil Twin using native Kali Linux Tools ===
The following tools are all pre-installed on Kali Linux. All of the tools listed can be used to carry out an Evil Twin attack:
* Airmon-ng: Display interfaces and stop potentially disruptive processes.
* Airodump-ng: Can be used to carry out reconnaissance. All surrounding networks and associated devices can be detected.
* Airbase-ng: Can be used to create a Wi-Fi access point. created.
* Aireplay-ng: Can be used to carry out deauth- attacks
* Accompanying activities: dns-masq can be used to set up a DNS server. Furthermore activation of a corresponding route on the interfaces as well as enabling IP forwarding and setting up firewall rules.

=== Hardware requirements ===
At least the following hardware is required to set up an Evil Twin:
* Raspberry Pi 4 Model B - 8GB incl. accessories such as power cable and MicroSD
* Two external wireless adapter, whereby the following can be recommended: 2 x Alfa AWUS036ACH Wide Range AC1200 Wireless Adapter

=== Reconnaissance ===

=== Spawning Rogue Access Point ===

=== Deauthentication attack ===
Deauthentication attacks are a subtle yet serious threat. The targeted de-authentication attacks, which aim to remove connected devices from a Wi-Fi network, have the potential to have a significant impact on the availability and integrity of connections.

The channel of the AP or the devices that are connected to the AP can be taken from the reconnaissance. For setting the channel on the Wi-Fi adapter:
sudo iwlist <interface> channel
sudo iwconfig <interface> power off
sudo iwconfig <interface> channel {channel, ex. "23"}
sudo iwconfig <interface> power on

To check whether the channel has been set
sudo iwlist {interface} channel

For carrying out a deauth attack on 2.4 GHz:
aireplay-ng -0 0 -a <MAC address of the TargetAP> -c
<MAC address client> <interfacename>
-0 for Deauthentication
0 Number of deauths to be sent, 0 means,
that they are sent continuously

For carrying out a deauth attack on 5 GHz:
sudo mdk4 <interface> d -E <WLAN SSID>

=== Alternative all-in-one frameworks ===
All-in-one frameworks that combine the activities described above in one software are, for example, [https://wiki.elvis.science/index.php?title=Wifiphisher wifiphisher] and [https://wiki.elvis.science/index.php?title=Wifipumpkin3 wifipumpkin3]

== Potential measures to protect against Evil Twins ==
Organisational measures are closely linked to personal measures. As an organisational measure, it can be established, for example, that different passwords must be used for different services and applications. This can prevent the same password being used for VPN access as for Wi-Fi access. In the corporate context, the operation of a structured and continuously improving information security management system can also be categorised as an organisational measure.

In the client-side area, care can be taken to ensure that the devices are configured so that only that only TLS-encrypted connections (e.g. HTTPS) are permitted. are allowed. This at least prevents the rogue access point from accessing data in plain text or manipulate it unnoticed.

The use of a VPN can also be recommended as a technical measure against MitM attacks. This is usually accompanied by increased information security through encryption of the traffic, which prevents transmitted data from being read or manipulated. In the context of a Wi-Fi MitM attack, a VPN hides the client's communication, encrypts the network traffic and hides metadata such as IP addresses or domain names.

Personal measures focus on the end user. Awareness-raising measures in particular can be derived in this context. It is important to sensitise users to the existing risks, make them aware and motivate them to support and implement the technical and organisational security measures. An easy-to-understand personal measure can be, for example, to pay attention to Wi-Fi names and other irregularities and to report these to the relevant reporting centres in the event of anomalies. This allows a quick response in the case of an emergency.

== References ==

[[Category:Documentation]]

Evil Twin Attack via Kali on Raspberry Pi

2024-01-04T11:12:44Z

ALanners: /* Hands-on report */

An Evil Twin is a rogue access point designed to imitate a legitimate access point in order to carry out malicious actions such as phising. Regular laptops and Wi-Fi adapters can be used to set up an Evil Twin, or Raspberry Pis, as these are quite small and can be easily packed into a bagpack when powered by a battery bank. This setup can then be left in one place for several days, for example, during which time the AP can phish information.

The main scenarios in the context of rogue access points or Evil Twins are:
* Machine-in-the-Middle/Content Injection tion
* Malicious webpages through e.g. DNS spoofing
* Deauthentication attacks
* Technique for social engineering for more in-depth scenarios

== Kali Linux on Raspberry Pi ==

For example, Kali Linux can be installed on a Raspberry Pi 4 Model B with 8 GB RAM. The Raspberry Pi 4 Model B is equipped with a Broadcom BCM2711, Quad core Cortex-A72 (ARM v8) 64-bit SoC @ 1.8GHz. This information is relevant because Kali Linux provides an image specifically for ARM processors on their website.
This image can be downloaded at [https://www.kali.org/get-kali/#kali-arm Kali Linux on ARM] The Raspberry Pi 4 is equipped with a 64-bit processor and supports the execution of 64-bit images. This results in two options: Either the Kali Linux RaspberryPi 2, 3, 4 32-bit or 64-bit image can be selected, whereby more documentation is available for the 32-bit variant. In addition, the 32-bit image ran with fewer problems than the 64-bit image during practical tests.
To get the image onto the Raspberry Pi, it must be transferred to a micro SD card. Balena Etcher or similar software can be used for this purpose.
Once the image has been successfully transferred to the SD card, it can be inserted into the corresponding slot on the Raspberry Pi 4. This can then be started and Kali Linux will boot from the SD card. The username and password are kali/kali.

A more detailed guide to installing Kali Linux on a Raspberry Pi can be found in the following article: [https://wiki.elvis.science/index.php?title=Install_Kali_Linux_on_Raspberry_Pi_3_%26_4 Install Kali Linux on Raspberry Pi 3 & 4]

=== Hands-on report ===
Kali Linux on a Raspberry Pi was tested extensively in the course of setting up an Evil Twin. Overall, the installation of the latest version of Kali Linux (as of December 2023) on a Raspberry Pi is not recommended for testing and lab purposes. The use for spawning an Evil Twin can also be achieved with other Linux systems, which is why it should be determined whether Kali Linux is absolutely necessary.
The following bugs were observed:
* After installing dependencies that were necessary to start Wifiphisher and Wifipumpkin 3, there were more boot problems
* Overall, booting was often prone to errors. Depending on the connected screen, it took several attempts.
* There were often non-reproducible bugs when starting programmes. For example, Wifiphisher did not work from time to time, no networks could be displayed and the like. The bugs occurred randomly and could not be reproduced.
* There were also bugs in the GUI area. For example, the bar for maximising, minimising and closing windows suddenly disappeared and it was no longer possible to move windows. To fix this, the corresponding driver had to be restarted.

*When starting a rogue access point with aireplay and without an external Wireless Adapter, an error message may appear. This can be rectified by increasing the MTU. This is not easily possible on the internal interface on the Raspberry Pi and is blocked as the kernel does not support an MTU higher than 1500. There are then 2 options: Option (1): revise kernel settings and recompile or option (2): use external network antenna. Due to the risk and the necessary knowledge, option (2) is preferable. This means that an external Wi-Fi adapter is required as a wireless network interface. In addition, actions can be carried out on both 2.4 GHz and 5 GHz when using an appropriate network adapter. Without an external antenna, you can only work on 2.4 GHz. The external network adapter choosen for the lab was an Alfa AWUS036ACH Wide Range AC1200 Wireless Adapter. In the Linux environment, care should also be taken to ensure that the network adapters work with the respective distribution and kernel and that a corresponding driver is available. According to the manufacturer, the Alfa AWUS036ACH Wide Range AC1200 Wireless Adapter can be used with Kali Linux without any problems.

== Evil Twin ==

=== Evil Twin using native Kali Linux Tools ===
The following tools are all pre-installed on Kali Linux. All of the tools listed can be used to carry out an Evil Twin attack:
* Airmon-ng: Display interfaces and stop potentially disruptive processes.
* Airodump-ng: Can be used to carry out reconnaissance. All surrounding networks and associated devices can be detected.
* Airbase-ng: Can be used to create a Wi-Fi access point. created.
* Aireplay-ng: Can be used to carry out deauth- attacks
* Accompanying activities: dns-masq can be used to set up a DNS server. Furthermore activation of a corresponding route on the interfaces as well as enabling IP forwarding and setting up firewall rules.

=== Hardware requirements ===
At least the following hardware is required to set up an Evil Twin:
* Raspberry Pi 4 Model B - 8GB incl. accessories such as power cable and MicroSD
* 2 x Alfa AWUS036ACH Wide Range AC1200 Wireless Adapter

=== Reconnaissance ===

=== Spawning Rogue Access Point ===

=== Deauthentication attack ===
Deauthentication attacks are a subtle yet serious threat. The targeted de-authentication attacks, which aim to remove connected devices from a Wi-Fi network, have the potential to have a significant impact on the availability and integrity of connections.

The channel of the AP or the devices that are connected to the AP can be taken from the reconnaissance. For setting the channel on the Wi-Fi adapter:
sudo iwlist <interface> channel
sudo iwconfig <interface> power off
sudo iwconfig <interface> channel {channel, ex. "23"}
sudo iwconfig <interface> power on

To check whether the channel has been set
sudo iwlist {interface} channel

For carrying out a deauth attack on 2.4 GHz:
aireplay-ng -0 0 -a <MAC address of the TargetAP> -c
<MAC address client> <interfacename>
-0 for Deauthentication
0 Number of deauths to be sent, 0 means,
that they are sent continuously

For carrying out a deauth attack on 5 GHz:
sudo mdk4 <interface> d -E <WLAN SSID>

=== Alternative all-in-one frameworks ===
All-in-one frameworks that combine the activities described above in one software are, for example, [https://wiki.elvis.science/index.php?title=Wifiphisher wifiphisher] and [https://wiki.elvis.science/index.php?title=Wifipumpkin3 wifipumpkin3]

== Potential measures to protect against Evil Twins ==
Organisational measures are closely linked to personal measures. As an organisational measure, it can be established, for example, that different passwords must be used for different services and applications. This can prevent the same password being used for VPN access as for Wi-Fi access. In the corporate context, the operation of a structured and continuously improving information security management system can also be categorised as an organisational measure.

In the client-side area, care can be taken to ensure that the devices are configured so that only that only TLS-encrypted connections (e.g. HTTPS) are permitted. are allowed. This at least prevents the rogue access point from accessing data in plain text or manipulate it unnoticed.

The use of a VPN can also be recommended as a technical measure against MitM attacks. This is usually accompanied by increased information security through encryption of the traffic, which prevents transmitted data from being read or manipulated. In the context of a Wi-Fi MitM attack, a VPN hides the client's communication, encrypts the network traffic and hides metadata such as IP addresses or domain names.

Personal measures focus on the end user. Awareness-raising measures in particular can be derived in this context. It is important to sensitise users to the existing risks, make them aware and motivate them to support and implement the technical and organisational security measures. An easy-to-understand personal measure can be, for example, to pay attention to Wi-Fi names and other irregularities and to report these to the relevant reporting centres in the event of anomalies. This allows a quick response in the case of an emergency.

== References ==

[[Category:Documentation]]

Evil Twin Attack via Kali on Raspberry Pi

2024-01-04T11:12:35Z

ALanners: /* Hands-on report */

An Evil Twin is a rogue access point designed to imitate a legitimate access point in order to carry out malicious actions such as phising. Regular laptops and Wi-Fi adapters can be used to set up an Evil Twin, or Raspberry Pis, as these are quite small and can be easily packed into a bagpack when powered by a battery bank. This setup can then be left in one place for several days, for example, during which time the AP can phish information.

The main scenarios in the context of rogue access points or Evil Twins are:
* Machine-in-the-Middle/Content Injection tion
* Malicious webpages through e.g. DNS spoofing
* Deauthentication attacks
* Technique for social engineering for more in-depth scenarios

== Kali Linux on Raspberry Pi ==

For example, Kali Linux can be installed on a Raspberry Pi 4 Model B with 8 GB RAM. The Raspberry Pi 4 Model B is equipped with a Broadcom BCM2711, Quad core Cortex-A72 (ARM v8) 64-bit SoC @ 1.8GHz. This information is relevant because Kali Linux provides an image specifically for ARM processors on their website.
This image can be downloaded at [https://www.kali.org/get-kali/#kali-arm Kali Linux on ARM] The Raspberry Pi 4 is equipped with a 64-bit processor and supports the execution of 64-bit images. This results in two options: Either the Kali Linux RaspberryPi 2, 3, 4 32-bit or 64-bit image can be selected, whereby more documentation is available for the 32-bit variant. In addition, the 32-bit image ran with fewer problems than the 64-bit image during practical tests.
To get the image onto the Raspberry Pi, it must be transferred to a micro SD card. Balena Etcher or similar software can be used for this purpose.
Once the image has been successfully transferred to the SD card, it can be inserted into the corresponding slot on the Raspberry Pi 4. This can then be started and Kali Linux will boot from the SD card. The username and password are kali/kali.

A more detailed guide to installing Kali Linux on a Raspberry Pi can be found in the following article: [https://wiki.elvis.science/index.php?title=Install_Kali_Linux_on_Raspberry_Pi_3_%26_4 Install Kali Linux on Raspberry Pi 3 & 4]

=== Hands-on report ===
Kali Linux on a Raspberry Pi was tested extensively in the course of setting up an Evil Twin. Overall, the installation of the latest version of Kali Linux (as of December 2023) on a Raspberry Pi is not recommended for testing and lab purposes. The use for spawning an Evil Twin can also be achieved with other Linux systems, which is why it should be determined whether Kali Linux is absolutely necessary.
The following bugs were observed:
* After installing dependencies that were necessary to start Wifiphisher and Wifipumpkin 3, there were more boot problems
* Overall, booting was often prone to errors. Depending on the connected screen, it took several attempts.
* There were often non-reproducible bugs when starting programmes. For example, Wifiphisher did not work from time to time, no networks could be displayed and the like. The bugs occurred randomly and could not be reproduced.
* There were also bugs in the GUI area. For example, the bar for maximising, minimising and closing windows suddenly disappeared and it was no longer possible to move windows. To fix this, the corresponding driver had to be restarted.

*When starting a rogue access point with aireplay and without an external Wireless Adapter, an error message may appear. This can be rectified by increasing the MTU. This is not easily possible on the internal interface on the Raspberry Pi and is blocked as the kernel does not support an MTU higher than 1500. There are then 2 options: Option (1): revise kernel settings and recompile or option (2): use external network antenna. Due to the risk and the necessary knowledge, option (2) is preferable. This means that an external Wi-Fi adapter is required as a wireless network interface. In addition, actions can be carried out on both 2.4 GHz and 5 GHz when using an appropriate network adapter. Without an external antenna, you can only work on 2.4 GHz. The external network adapter choosen for the lab was an Alfa AWUS036ACH Wide Range AC1200 Wireless Adapter. In the Linux environment, care should also be taken to ensure that the network adapters work with the respective distribution and kernel and that a corresponding driver is available. According to the manufacturer, the Alfa AWUS036ACH Wide Range AC1200 Wireless Adapter can be used with Kali Linux without any problems.

== Evil Twin ==

=== Evil Twin using native Kali Linux Tools ===
The following tools are all pre-installed on Kali Linux. All of the tools listed can be used to carry out an Evil Twin attack:
* Airmon-ng: Display interfaces and stop potentially disruptive processes.
* Airodump-ng: Can be used to carry out reconnaissance. All surrounding networks and associated devices can be detected.
* Airbase-ng: Can be used to create a Wi-Fi access point. created.
* Aireplay-ng: Can be used to carry out deauth- attacks
* Accompanying activities: dns-masq can be used to set up a DNS server. Furthermore activation of a corresponding route on the interfaces as well as enabling IP forwarding and setting up firewall rules.

=== Hardware requirements ===
At least the following hardware is required to set up an Evil Twin:
* Raspberry Pi 4 Model B - 8GB incl. accessories such as power cable and MicroSD
* 2 x Alfa AWUS036ACH Wide Range AC1200 Wireless Adapter

=== Reconnaissance ===

=== Spawning Rogue Access Point ===

=== Deauthentication attack ===
Deauthentication attacks are a subtle yet serious threat. The targeted de-authentication attacks, which aim to remove connected devices from a Wi-Fi network, have the potential to have a significant impact on the availability and integrity of connections.

The channel of the AP or the devices that are connected to the AP can be taken from the reconnaissance. For setting the channel on the Wi-Fi adapter:
sudo iwlist <interface> channel
sudo iwconfig <interface> power off
sudo iwconfig <interface> channel {channel, ex. "23"}
sudo iwconfig <interface> power on

To check whether the channel has been set
sudo iwlist {interface} channel

For carrying out a deauth attack on 2.4 GHz:
aireplay-ng -0 0 -a <MAC address of the TargetAP> -c
<MAC address client> <interfacename>
-0 for Deauthentication
0 Number of deauths to be sent, 0 means,
that they are sent continuously

For carrying out a deauth attack on 5 GHz:
sudo mdk4 <interface> d -E <WLAN SSID>

=== Alternative all-in-one frameworks ===
All-in-one frameworks that combine the activities described above in one software are, for example, [https://wiki.elvis.science/index.php?title=Wifiphisher wifiphisher] and [https://wiki.elvis.science/index.php?title=Wifipumpkin3 wifipumpkin3]

== Potential measures to protect against Evil Twins ==
Organisational measures are closely linked to personal measures. As an organisational measure, it can be established, for example, that different passwords must be used for different services and applications. This can prevent the same password being used for VPN access as for Wi-Fi access. In the corporate context, the operation of a structured and continuously improving information security management system can also be categorised as an organisational measure.

In the client-side area, care can be taken to ensure that the devices are configured so that only that only TLS-encrypted connections (e.g. HTTPS) are permitted. are allowed. This at least prevents the rogue access point from accessing data in plain text or manipulate it unnoticed.

The use of a VPN can also be recommended as a technical measure against MitM attacks. This is usually accompanied by increased information security through encryption of the traffic, which prevents transmitted data from being read or manipulated. In the context of a Wi-Fi MitM attack, a VPN hides the client's communication, encrypts the network traffic and hides metadata such as IP addresses or domain names.

Personal measures focus on the end user. Awareness-raising measures in particular can be derived in this context. It is important to sensitise users to the existing risks, make them aware and motivate them to support and implement the technical and organisational security measures. An easy-to-understand personal measure can be, for example, to pay attention to Wi-Fi names and other irregularities and to report these to the relevant reporting centres in the event of anomalies. This allows a quick response in the case of an emergency.

== References ==

[[Category:Documentation]]

Evil Twin Attack via Kali on Raspberry Pi

2024-01-04T11:12:22Z

ALanners: /* Hands-on report */

An Evil Twin is a rogue access point designed to imitate a legitimate access point in order to carry out malicious actions such as phising. Regular laptops and Wi-Fi adapters can be used to set up an Evil Twin, or Raspberry Pis, as these are quite small and can be easily packed into a bagpack when powered by a battery bank. This setup can then be left in one place for several days, for example, during which time the AP can phish information.

The main scenarios in the context of rogue access points or Evil Twins are:
* Machine-in-the-Middle/Content Injection tion
* Malicious webpages through e.g. DNS spoofing
* Deauthentication attacks
* Technique for social engineering for more in-depth scenarios

== Kali Linux on Raspberry Pi ==

For example, Kali Linux can be installed on a Raspberry Pi 4 Model B with 8 GB RAM. The Raspberry Pi 4 Model B is equipped with a Broadcom BCM2711, Quad core Cortex-A72 (ARM v8) 64-bit SoC @ 1.8GHz. This information is relevant because Kali Linux provides an image specifically for ARM processors on their website.
This image can be downloaded at [https://www.kali.org/get-kali/#kali-arm Kali Linux on ARM] The Raspberry Pi 4 is equipped with a 64-bit processor and supports the execution of 64-bit images. This results in two options: Either the Kali Linux RaspberryPi 2, 3, 4 32-bit or 64-bit image can be selected, whereby more documentation is available for the 32-bit variant. In addition, the 32-bit image ran with fewer problems than the 64-bit image during practical tests.
To get the image onto the Raspberry Pi, it must be transferred to a micro SD card. Balena Etcher or similar software can be used for this purpose.
Once the image has been successfully transferred to the SD card, it can be inserted into the corresponding slot on the Raspberry Pi 4. This can then be started and Kali Linux will boot from the SD card. The username and password are kali/kali.

A more detailed guide to installing Kali Linux on a Raspberry Pi can be found in the following article: [https://wiki.elvis.science/index.php?title=Install_Kali_Linux_on_Raspberry_Pi_3_%26_4 Install Kali Linux on Raspberry Pi 3 & 4]

=== Hands-on report ===
Kali Linux on a Raspberry Pi was tested extensively in the course of setting up an Evil Twin. Overall, the installation of the latest version of Kali Linux (as of December 2023) on a Raspberry Pi is not recommended for testing and lab purposes. The use for spawning an Evil Twin can also be achieved with other Linux systems, which is why it should be determined whether Kali Linux is absolutely necessary.
The following bugs were observed:
* After installing dependencies that were necessary to start Wifiphisher and Wifipumpkin 3, there were more boot problems
* Overall, booting was often prone to errors. Depending on the connected screen, it took several attempts.
* There were often non-reproducible bugs when starting programmes. For example, Wifiphisher did not work from time to time, no networks could be displayed and the like. The bugs occurred randomly and could not be reproduced.
* There were also bugs in the GUI area. For example, the bar for maximising, minimising and closing windows suddenly disappeared and it was no longer possible to move windows. To fix this, the corresponding driver had to be restarted.

*When starting a rogue access point with aireplay and without an external Wireless Adapter, an error message may appear. This can be rectified by increasing the MTU. This is not easily possible on the internal interface on the Raspberry Pi and is blocked as the kernel does not support an MTU higher than 1500. There are then 2 options: Option (1): revise kernel settings and recompile or option (2): use external network antenna. Due to the risk and the necessary knowledge, option (2) is preferable. This means that an external Wi-Fi adapter is required as a wireless network interface. In addition, actions can be carried out on both 2.4 GHz and 5 GHz when using an appropriate network adapter. Without an external antenna, you can only work on 2.4 GHz.
The external network adapter choosen for the lab was an Alfa AWUS036ACH Wide Range AC1200 Wireless Adapter. In the Linux environment, care should also be taken to ensure that the network adapters work with the respective distribution and kernel and that a corresponding driver is available. According to the manufacturer, the Alfa AWUS036ACH Wide Range AC1200 Wireless Adapter can be used with Kali Linux without any problems.

== Evil Twin ==

=== Evil Twin using native Kali Linux Tools ===
The following tools are all pre-installed on Kali Linux. All of the tools listed can be used to carry out an Evil Twin attack:
* Airmon-ng: Display interfaces and stop potentially disruptive processes.
* Airodump-ng: Can be used to carry out reconnaissance. All surrounding networks and associated devices can be detected.
* Airbase-ng: Can be used to create a Wi-Fi access point. created.
* Aireplay-ng: Can be used to carry out deauth- attacks
* Accompanying activities: dns-masq can be used to set up a DNS server. Furthermore activation of a corresponding route on the interfaces as well as enabling IP forwarding and setting up firewall rules.

=== Hardware requirements ===
At least the following hardware is required to set up an Evil Twin:
* Raspberry Pi 4 Model B - 8GB incl. accessories such as power cable and MicroSD
* 2 x Alfa AWUS036ACH Wide Range AC1200 Wireless Adapter

=== Reconnaissance ===

=== Spawning Rogue Access Point ===

=== Deauthentication attack ===
Deauthentication attacks are a subtle yet serious threat. The targeted de-authentication attacks, which aim to remove connected devices from a Wi-Fi network, have the potential to have a significant impact on the availability and integrity of connections.

The channel of the AP or the devices that are connected to the AP can be taken from the reconnaissance. For setting the channel on the Wi-Fi adapter:
sudo iwlist <interface> channel
sudo iwconfig <interface> power off
sudo iwconfig <interface> channel {channel, ex. "23"}
sudo iwconfig <interface> power on

To check whether the channel has been set
sudo iwlist {interface} channel

For carrying out a deauth attack on 2.4 GHz:
aireplay-ng -0 0 -a <MAC address of the TargetAP> -c
<MAC address client> <interfacename>
-0 for Deauthentication
0 Number of deauths to be sent, 0 means,
that they are sent continuously

For carrying out a deauth attack on 5 GHz:
sudo mdk4 <interface> d -E <WLAN SSID>

=== Alternative all-in-one frameworks ===
All-in-one frameworks that combine the activities described above in one software are, for example, [https://wiki.elvis.science/index.php?title=Wifiphisher wifiphisher] and [https://wiki.elvis.science/index.php?title=Wifipumpkin3 wifipumpkin3]

== Potential measures to protect against Evil Twins ==
Organisational measures are closely linked to personal measures. As an organisational measure, it can be established, for example, that different passwords must be used for different services and applications. This can prevent the same password being used for VPN access as for Wi-Fi access. In the corporate context, the operation of a structured and continuously improving information security management system can also be categorised as an organisational measure.

In the client-side area, care can be taken to ensure that the devices are configured so that only that only TLS-encrypted connections (e.g. HTTPS) are permitted. are allowed. This at least prevents the rogue access point from accessing data in plain text or manipulate it unnoticed.

The use of a VPN can also be recommended as a technical measure against MitM attacks. This is usually accompanied by increased information security through encryption of the traffic, which prevents transmitted data from being read or manipulated. In the context of a Wi-Fi MitM attack, a VPN hides the client's communication, encrypts the network traffic and hides metadata such as IP addresses or domain names.

Personal measures focus on the end user. Awareness-raising measures in particular can be derived in this context. It is important to sensitise users to the existing risks, make them aware and motivate them to support and implement the technical and organisational security measures. An easy-to-understand personal measure can be, for example, to pay attention to Wi-Fi names and other irregularities and to report these to the relevant reporting centres in the event of anomalies. This allows a quick response in the case of an emergency.

== References ==

[[Category:Documentation]]

Evil Twin Attack via Kali on Raspberry Pi

2024-01-04T11:09:12Z

ALanners: /* Rogue Access Point */

An Evil Twin is a rogue access point designed to imitate a legitimate access point in order to carry out malicious actions such as phising. Regular laptops and Wi-Fi adapters can be used to set up an Evil Twin, or Raspberry Pis, as these are quite small and can be easily packed into a bagpack when powered by a battery bank. This setup can then be left in one place for several days, for example, during which time the AP can phish information.

The main scenarios in the context of rogue access points or Evil Twins are:
* Machine-in-the-Middle/Content Injection tion
* Malicious webpages through e.g. DNS spoofing
* Deauthentication attacks
* Technique for social engineering for more in-depth scenarios

== Kali Linux on Raspberry Pi ==

For example, Kali Linux can be installed on a Raspberry Pi 4 Model B with 8 GB RAM. The Raspberry Pi 4 Model B is equipped with a Broadcom BCM2711, Quad core Cortex-A72 (ARM v8) 64-bit SoC @ 1.8GHz. This information is relevant because Kali Linux provides an image specifically for ARM processors on their website.
This image can be downloaded at [https://www.kali.org/get-kali/#kali-arm Kali Linux on ARM] The Raspberry Pi 4 is equipped with a 64-bit processor and supports the execution of 64-bit images. This results in two options: Either the Kali Linux RaspberryPi 2, 3, 4 32-bit or 64-bit image can be selected, whereby more documentation is available for the 32-bit variant. In addition, the 32-bit image ran with fewer problems than the 64-bit image during practical tests.
To get the image onto the Raspberry Pi, it must be transferred to a micro SD card. Balena Etcher or similar software can be used for this purpose.
Once the image has been successfully transferred to the SD card, it can be inserted into the corresponding slot on the Raspberry Pi 4. This can then be started and Kali Linux will boot from the SD card. The username and password are kali/kali.

A more detailed guide to installing Kali Linux on a Raspberry Pi can be found in the following article: [https://wiki.elvis.science/index.php?title=Install_Kali_Linux_on_Raspberry_Pi_3_%26_4 Install Kali Linux on Raspberry Pi 3 & 4]

=== Hands-on report ===
Kali Linux on a Raspberry Pi was tested extensively in the course of setting up an Evil Twin. Overall, the installation of the latest version of Kali Linux (as of December 2023) on a Raspberry Pi is not recommended for testing and lab purposes. The use for spawning an Evil Twin can also be achieved with other Linux systems, which is why it should be determined whether Kali Linux is absolutely necessary.
The following bugs were observed:
* After installing dependencies that were necessary to start Wifiphisher and Wifipumpkin 3, there were more boot problems
* Overall, booting was often prone to errors. Depending on the connected screen, it took several attempts.
* There were often non-reproducible bugs when starting programmes. For example, Wifiphisher did not work from time to time, no networks could be displayed and the like. The bugs occurred randomly and could not be reproduced.
* There were also bugs in the GUI area. For example, the bar for maximising, minimising and closing windows suddenly disappeared and it was no longer possible to move windows. To fix this, the corresponding driver had to be restarted.

== Evil Twin ==

=== Evil Twin using native Kali Linux Tools ===
The following tools are all pre-installed on Kali Linux. All of the tools listed can be used to carry out an Evil Twin attack:
* Airmon-ng: Display interfaces and stop potentially disruptive processes.
* Airodump-ng: Can be used to carry out reconnaissance. All surrounding networks and associated devices can be detected.
* Airbase-ng: Can be used to create a Wi-Fi access point. created.
* Aireplay-ng: Can be used to carry out deauth- attacks
* Accompanying activities: dns-masq can be used to set up a DNS server. Furthermore activation of a corresponding route on the interfaces as well as enabling IP forwarding and setting up firewall rules.

=== Hardware requirements ===
At least the following hardware is required to set up an Evil Twin:
* Raspberry Pi 4 Model B - 8GB incl. accessories such as power cable and MicroSD
* 2 x Alfa AWUS036ACH Wide Range AC1200 Wireless Adapter

=== Reconnaissance ===

=== Spawning Rogue Access Point ===

=== Deauthentication attack ===
Deauthentication attacks are a subtle yet serious threat. The targeted de-authentication attacks, which aim to remove connected devices from a Wi-Fi network, have the potential to have a significant impact on the availability and integrity of connections.

The channel of the AP or the devices that are connected to the AP can be taken from the reconnaissance. For setting the channel on the Wi-Fi adapter:
sudo iwlist <interface> channel
sudo iwconfig <interface> power off
sudo iwconfig <interface> channel {channel, ex. "23"}
sudo iwconfig <interface> power on

To check whether the channel has been set
sudo iwlist {interface} channel

For carrying out a deauth attack on 2.4 GHz:
aireplay-ng -0 0 -a <MAC address of the TargetAP> -c
<MAC address client> <interfacename>
-0 for Deauthentication
0 Number of deauths to be sent, 0 means,
that they are sent continuously

For carrying out a deauth attack on 5 GHz:
sudo mdk4 <interface> d -E <WLAN SSID>

=== Alternative all-in-one frameworks ===
All-in-one frameworks that combine the activities described above in one software are, for example, [https://wiki.elvis.science/index.php?title=Wifiphisher wifiphisher] and [https://wiki.elvis.science/index.php?title=Wifipumpkin3 wifipumpkin3]

== Potential measures to protect against Evil Twins ==
Organisational measures are closely linked to personal measures. As an organisational measure, it can be established, for example, that different passwords must be used for different services and applications. This can prevent the same password being used for VPN access as for Wi-Fi access. In the corporate context, the operation of a structured and continuously improving information security management system can also be categorised as an organisational measure.

In the client-side area, care can be taken to ensure that the devices are configured so that only that only TLS-encrypted connections (e.g. HTTPS) are permitted. are allowed. This at least prevents the rogue access point from accessing data in plain text or manipulate it unnoticed.

The use of a VPN can also be recommended as a technical measure against MitM attacks. This is usually accompanied by increased information security through encryption of the traffic, which prevents transmitted data from being read or manipulated. In the context of a Wi-Fi MitM attack, a VPN hides the client's communication, encrypts the network traffic and hides metadata such as IP addresses or domain names.

Personal measures focus on the end user. Awareness-raising measures in particular can be derived in this context. It is important to sensitise users to the existing risks, make them aware and motivate them to support and implement the technical and organisational security measures. An easy-to-understand personal measure can be, for example, to pay attention to Wi-Fi names and other irregularities and to report these to the relevant reporting centres in the event of anomalies. This allows a quick response in the case of an emergency.

== References ==

[[Category:Documentation]]

Evil Twin Attack via Kali on Raspberry Pi

2024-01-04T11:08:58Z

ALanners: /* Deauthentication attack */

An Evil Twin is a rogue access point designed to imitate a legitimate access point in order to carry out malicious actions such as phising. Regular laptops and Wi-Fi adapters can be used to set up an Evil Twin, or Raspberry Pis, as these are quite small and can be easily packed into a bagpack when powered by a battery bank. This setup can then be left in one place for several days, for example, during which time the AP can phish information.

The main scenarios in the context of rogue access points or Evil Twins are:
* Machine-in-the-Middle/Content Injection tion
* Malicious webpages through e.g. DNS spoofing
* Deauthentication attacks
* Technique for social engineering for more in-depth scenarios

== Kali Linux on Raspberry Pi ==

For example, Kali Linux can be installed on a Raspberry Pi 4 Model B with 8 GB RAM. The Raspberry Pi 4 Model B is equipped with a Broadcom BCM2711, Quad core Cortex-A72 (ARM v8) 64-bit SoC @ 1.8GHz. This information is relevant because Kali Linux provides an image specifically for ARM processors on their website.
This image can be downloaded at [https://www.kali.org/get-kali/#kali-arm Kali Linux on ARM] The Raspberry Pi 4 is equipped with a 64-bit processor and supports the execution of 64-bit images. This results in two options: Either the Kali Linux RaspberryPi 2, 3, 4 32-bit or 64-bit image can be selected, whereby more documentation is available for the 32-bit variant. In addition, the 32-bit image ran with fewer problems than the 64-bit image during practical tests.
To get the image onto the Raspberry Pi, it must be transferred to a micro SD card. Balena Etcher or similar software can be used for this purpose.
Once the image has been successfully transferred to the SD card, it can be inserted into the corresponding slot on the Raspberry Pi 4. This can then be started and Kali Linux will boot from the SD card. The username and password are kali/kali.

A more detailed guide to installing Kali Linux on a Raspberry Pi can be found in the following article: [https://wiki.elvis.science/index.php?title=Install_Kali_Linux_on_Raspberry_Pi_3_%26_4 Install Kali Linux on Raspberry Pi 3 & 4]

=== Hands-on report ===
Kali Linux on a Raspberry Pi was tested extensively in the course of setting up an Evil Twin. Overall, the installation of the latest version of Kali Linux (as of December 2023) on a Raspberry Pi is not recommended for testing and lab purposes. The use for spawning an Evil Twin can also be achieved with other Linux systems, which is why it should be determined whether Kali Linux is absolutely necessary.
The following bugs were observed:
* After installing dependencies that were necessary to start Wifiphisher and Wifipumpkin 3, there were more boot problems
* Overall, booting was often prone to errors. Depending on the connected screen, it took several attempts.
* There were often non-reproducible bugs when starting programmes. For example, Wifiphisher did not work from time to time, no networks could be displayed and the like. The bugs occurred randomly and could not be reproduced.
* There were also bugs in the GUI area. For example, the bar for maximising, minimising and closing windows suddenly disappeared and it was no longer possible to move windows. To fix this, the corresponding driver had to be restarted.

== Evil Twin ==

=== Evil Twin using native Kali Linux Tools ===
The following tools are all pre-installed on Kali Linux. All of the tools listed can be used to carry out an Evil Twin attack:
* Airmon-ng: Display interfaces and stop potentially disruptive processes.
* Airodump-ng: Can be used to carry out reconnaissance. All surrounding networks and associated devices can be detected.
* Airbase-ng: Can be used to create a Wi-Fi access point. created.
* Aireplay-ng: Can be used to carry out deauth- attacks
* Accompanying activities: dns-masq can be used to set up a DNS server. Furthermore activation of a corresponding route on the interfaces as well as enabling IP forwarding and setting up firewall rules.

=== Hardware requirements ===
At least the following hardware is required to set up an Evil Twin:
* Raspberry Pi 4 Model B - 8GB incl. accessories such as power cable and MicroSD
* 2 x Alfa AWUS036ACH Wide Range AC1200 Wireless Adapter

=== Reconnaissance ===

=== Rogue Access Point ===

=== Deauthentication attack ===
Deauthentication attacks are a subtle yet serious threat. The targeted de-authentication attacks, which aim to remove connected devices from a Wi-Fi network, have the potential to have a significant impact on the availability and integrity of connections.

The channel of the AP or the devices that are connected to the AP can be taken from the reconnaissance. For setting the channel on the Wi-Fi adapter:
sudo iwlist <interface> channel
sudo iwconfig <interface> power off
sudo iwconfig <interface> channel {channel, ex. "23"}
sudo iwconfig <interface> power on

To check whether the channel has been set
sudo iwlist {interface} channel

For carrying out a deauth attack on 2.4 GHz:
aireplay-ng -0 0 -a <MAC address of the TargetAP> -c
<MAC address client> <interfacename>
-0 for Deauthentication
0 Number of deauths to be sent, 0 means,
that they are sent continuously

For carrying out a deauth attack on 5 GHz:
sudo mdk4 <interface> d -E <WLAN SSID>

=== Alternative all-in-one frameworks ===
All-in-one frameworks that combine the activities described above in one software are, for example, [https://wiki.elvis.science/index.php?title=Wifiphisher wifiphisher] and [https://wiki.elvis.science/index.php?title=Wifipumpkin3 wifipumpkin3]

== Potential measures to protect against Evil Twins ==
Organisational measures are closely linked to personal measures. As an organisational measure, it can be established, for example, that different passwords must be used for different services and applications. This can prevent the same password being used for VPN access as for Wi-Fi access. In the corporate context, the operation of a structured and continuously improving information security management system can also be categorised as an organisational measure.

In the client-side area, care can be taken to ensure that the devices are configured so that only that only TLS-encrypted connections (e.g. HTTPS) are permitted. are allowed. This at least prevents the rogue access point from accessing data in plain text or manipulate it unnoticed.

The use of a VPN can also be recommended as a technical measure against MitM attacks. This is usually accompanied by increased information security through encryption of the traffic, which prevents transmitted data from being read or manipulated. In the context of a Wi-Fi MitM attack, a VPN hides the client's communication, encrypts the network traffic and hides metadata such as IP addresses or domain names.

Personal measures focus on the end user. Awareness-raising measures in particular can be derived in this context. It is important to sensitise users to the existing risks, make them aware and motivate them to support and implement the technical and organisational security measures. An easy-to-understand personal measure can be, for example, to pay attention to Wi-Fi names and other irregularities and to report these to the relevant reporting centres in the event of anomalies. This allows a quick response in the case of an emergency.

== References ==

[[Category:Documentation]]

Evil Twin Attack via Kali on Raspberry Pi

2024-01-04T11:08:36Z

ALanners: /* Deauthentication attack */

An Evil Twin is a rogue access point designed to imitate a legitimate access point in order to carry out malicious actions such as phising. Regular laptops and Wi-Fi adapters can be used to set up an Evil Twin, or Raspberry Pis, as these are quite small and can be easily packed into a bagpack when powered by a battery bank. This setup can then be left in one place for several days, for example, during which time the AP can phish information.

The main scenarios in the context of rogue access points or Evil Twins are:
* Machine-in-the-Middle/Content Injection tion
* Malicious webpages through e.g. DNS spoofing
* Deauthentication attacks
* Technique for social engineering for more in-depth scenarios

== Kali Linux on Raspberry Pi ==

For example, Kali Linux can be installed on a Raspberry Pi 4 Model B with 8 GB RAM. The Raspberry Pi 4 Model B is equipped with a Broadcom BCM2711, Quad core Cortex-A72 (ARM v8) 64-bit SoC @ 1.8GHz. This information is relevant because Kali Linux provides an image specifically for ARM processors on their website.
This image can be downloaded at [https://www.kali.org/get-kali/#kali-arm Kali Linux on ARM] The Raspberry Pi 4 is equipped with a 64-bit processor and supports the execution of 64-bit images. This results in two options: Either the Kali Linux RaspberryPi 2, 3, 4 32-bit or 64-bit image can be selected, whereby more documentation is available for the 32-bit variant. In addition, the 32-bit image ran with fewer problems than the 64-bit image during practical tests.
To get the image onto the Raspberry Pi, it must be transferred to a micro SD card. Balena Etcher or similar software can be used for this purpose.
Once the image has been successfully transferred to the SD card, it can be inserted into the corresponding slot on the Raspberry Pi 4. This can then be started and Kali Linux will boot from the SD card. The username and password are kali/kali.

A more detailed guide to installing Kali Linux on a Raspberry Pi can be found in the following article: [https://wiki.elvis.science/index.php?title=Install_Kali_Linux_on_Raspberry_Pi_3_%26_4 Install Kali Linux on Raspberry Pi 3 & 4]

=== Hands-on report ===
Kali Linux on a Raspberry Pi was tested extensively in the course of setting up an Evil Twin. Overall, the installation of the latest version of Kali Linux (as of December 2023) on a Raspberry Pi is not recommended for testing and lab purposes. The use for spawning an Evil Twin can also be achieved with other Linux systems, which is why it should be determined whether Kali Linux is absolutely necessary.
The following bugs were observed:
* After installing dependencies that were necessary to start Wifiphisher and Wifipumpkin 3, there were more boot problems
* Overall, booting was often prone to errors. Depending on the connected screen, it took several attempts.
* There were often non-reproducible bugs when starting programmes. For example, Wifiphisher did not work from time to time, no networks could be displayed and the like. The bugs occurred randomly and could not be reproduced.
* There were also bugs in the GUI area. For example, the bar for maximising, minimising and closing windows suddenly disappeared and it was no longer possible to move windows. To fix this, the corresponding driver had to be restarted.

== Evil Twin ==

=== Evil Twin using native Kali Linux Tools ===
The following tools are all pre-installed on Kali Linux. All of the tools listed can be used to carry out an Evil Twin attack:
* Airmon-ng: Display interfaces and stop potentially disruptive processes.
* Airodump-ng: Can be used to carry out reconnaissance. All surrounding networks and associated devices can be detected.
* Airbase-ng: Can be used to create a Wi-Fi access point. created.
* Aireplay-ng: Can be used to carry out deauth- attacks
* Accompanying activities: dns-masq can be used to set up a DNS server. Furthermore activation of a corresponding route on the interfaces as well as enabling IP forwarding and setting up firewall rules.

=== Hardware requirements ===
At least the following hardware is required to set up an Evil Twin:
* Raspberry Pi 4 Model B - 8GB incl. accessories such as power cable and MicroSD
* 2 x Alfa AWUS036ACH Wide Range AC1200 Wireless Adapter

=== Reconnaissance ===

=== Rogue Access Point ===

=== Deauthentication attack ===
Deauthentication attacks are a subtle yet serious threat. The targeted de-authentication attacks, which aim to remove connected devices from a Wi-Fi network, have the potential to have a significant impact on the availability and integrity of connections.

The channel of the AP or the devices that are connected to the AP can be taken from the reconnaissance. For setting the channel on the Wi-Fi adapter:
sudo iwlist <interface> channel
sudo iwconfig <interface> power off
sudo iwconfig <interface> channel {channel, ex. "23"}
sudo iwconfig <interface> power on

To check whether the channel has been set
sudo iwlist {interface} channel

For carrying out a deauth attack on 2.4 GHz:
aireplay-ng -0 0 -a <MAC Adresse des TargetAP> -c
<MAC Adresse Client> <interfacename>
-0 for Deauthentication
0 Number of deauths to be sent, 0 means,
that they are sent continuously

For carrying out a deauth attack on 5 GHz:
sudo mdk4 <interface> d -E <WLAN SSID>

=== Alternative all-in-one frameworks ===
All-in-one frameworks that combine the activities described above in one software are, for example, [https://wiki.elvis.science/index.php?title=Wifiphisher wifiphisher] and [https://wiki.elvis.science/index.php?title=Wifipumpkin3 wifipumpkin3]

== Potential measures to protect against Evil Twins ==
Organisational measures are closely linked to personal measures. As an organisational measure, it can be established, for example, that different passwords must be used for different services and applications. This can prevent the same password being used for VPN access as for Wi-Fi access. In the corporate context, the operation of a structured and continuously improving information security management system can also be categorised as an organisational measure.

In the client-side area, care can be taken to ensure that the devices are configured so that only that only TLS-encrypted connections (e.g. HTTPS) are permitted. are allowed. This at least prevents the rogue access point from accessing data in plain text or manipulate it unnoticed.

The use of a VPN can also be recommended as a technical measure against MitM attacks. This is usually accompanied by increased information security through encryption of the traffic, which prevents transmitted data from being read or manipulated. In the context of a Wi-Fi MitM attack, a VPN hides the client's communication, encrypts the network traffic and hides metadata such as IP addresses or domain names.

Personal measures focus on the end user. Awareness-raising measures in particular can be derived in this context. It is important to sensitise users to the existing risks, make them aware and motivate them to support and implement the technical and organisational security measures. An easy-to-understand personal measure can be, for example, to pay attention to Wi-Fi names and other irregularities and to report these to the relevant reporting centres in the event of anomalies. This allows a quick response in the case of an emergency.

== References ==

[[Category:Documentation]]

Evil Twin Attack via Kali on Raspberry Pi

2024-01-04T11:07:59Z

ALanners: /* Deauthentication attack */

An Evil Twin is a rogue access point designed to imitate a legitimate access point in order to carry out malicious actions such as phising. Regular laptops and Wi-Fi adapters can be used to set up an Evil Twin, or Raspberry Pis, as these are quite small and can be easily packed into a bagpack when powered by a battery bank. This setup can then be left in one place for several days, for example, during which time the AP can phish information.

The main scenarios in the context of rogue access points or Evil Twins are:
* Machine-in-the-Middle/Content Injection tion
* Malicious webpages through e.g. DNS spoofing
* Deauthentication attacks
* Technique for social engineering for more in-depth scenarios

== Kali Linux on Raspberry Pi ==

For example, Kali Linux can be installed on a Raspberry Pi 4 Model B with 8 GB RAM. The Raspberry Pi 4 Model B is equipped with a Broadcom BCM2711, Quad core Cortex-A72 (ARM v8) 64-bit SoC @ 1.8GHz. This information is relevant because Kali Linux provides an image specifically for ARM processors on their website.
This image can be downloaded at [https://www.kali.org/get-kali/#kali-arm Kali Linux on ARM] The Raspberry Pi 4 is equipped with a 64-bit processor and supports the execution of 64-bit images. This results in two options: Either the Kali Linux RaspberryPi 2, 3, 4 32-bit or 64-bit image can be selected, whereby more documentation is available for the 32-bit variant. In addition, the 32-bit image ran with fewer problems than the 64-bit image during practical tests.
To get the image onto the Raspberry Pi, it must be transferred to a micro SD card. Balena Etcher or similar software can be used for this purpose.
Once the image has been successfully transferred to the SD card, it can be inserted into the corresponding slot on the Raspberry Pi 4. This can then be started and Kali Linux will boot from the SD card. The username and password are kali/kali.

A more detailed guide to installing Kali Linux on a Raspberry Pi can be found in the following article: [https://wiki.elvis.science/index.php?title=Install_Kali_Linux_on_Raspberry_Pi_3_%26_4 Install Kali Linux on Raspberry Pi 3 & 4]

=== Hands-on report ===
Kali Linux on a Raspberry Pi was tested extensively in the course of setting up an Evil Twin. Overall, the installation of the latest version of Kali Linux (as of December 2023) on a Raspberry Pi is not recommended for testing and lab purposes. The use for spawning an Evil Twin can also be achieved with other Linux systems, which is why it should be determined whether Kali Linux is absolutely necessary.
The following bugs were observed:
* After installing dependencies that were necessary to start Wifiphisher and Wifipumpkin 3, there were more boot problems
* Overall, booting was often prone to errors. Depending on the connected screen, it took several attempts.
* There were often non-reproducible bugs when starting programmes. For example, Wifiphisher did not work from time to time, no networks could be displayed and the like. The bugs occurred randomly and could not be reproduced.
* There were also bugs in the GUI area. For example, the bar for maximising, minimising and closing windows suddenly disappeared and it was no longer possible to move windows. To fix this, the corresponding driver had to be restarted.

== Evil Twin ==

=== Evil Twin using native Kali Linux Tools ===
The following tools are all pre-installed on Kali Linux. All of the tools listed can be used to carry out an Evil Twin attack:
* Airmon-ng: Display interfaces and stop potentially disruptive processes.
* Airodump-ng: Can be used to carry out reconnaissance. All surrounding networks and associated devices can be detected.
* Airbase-ng: Can be used to create a Wi-Fi access point. created.
* Aireplay-ng: Can be used to carry out deauth- attacks
* Accompanying activities: dns-masq can be used to set up a DNS server. Furthermore activation of a corresponding route on the interfaces as well as enabling IP forwarding and setting up firewall rules.

=== Hardware requirements ===
At least the following hardware is required to set up an Evil Twin:
* Raspberry Pi 4 Model B - 8GB incl. accessories such as power cable and MicroSD
* 2 x Alfa AWUS036ACH Wide Range AC1200 Wireless Adapter

=== Reconnaissance ===

=== Rogue Access Point ===

=== Deauthentication attack ===
Deauthentication attacks are a subtle yet serious threat. The targeted de-authentication attacks, which aim to remove connected devices from a Wi-Fi network, have the potential to have a significant impact on the availability and integrity of connections.

The channel of the AP or the devices that are connected to the AP can be taken from the reconnaissance. For setting the channel on the Wi-Fi adapter:
sudo iwlist <interface> channel
sudo iwconfig <interface> power off
sudo iwconfig <interface> channel {channel, ex. "23"}
sudo iwconfig <interface> power on

To check whether the channel has been set
sudo iwlist {interface} channel

For carrying out a deauth attack on 2.4 GHz:
aireplay-ng -0 0 -a <MAC Adresse des TargetAP> -c
<MAC Adresse Client> <interfacename>
-0 fuer Deauthentication
0 Anzahl der zu sendenden Deauths, 0 bedeutet,
dass sie kontinuierlich gesendet werden

For carrying out a deauth attack on 5 GHz:
sudo mdk4 <interface> d -E <WLAN SSID>

=== Alternative all-in-one frameworks ===
All-in-one frameworks that combine the activities described above in one software are, for example, [https://wiki.elvis.science/index.php?title=Wifiphisher wifiphisher] and [https://wiki.elvis.science/index.php?title=Wifipumpkin3 wifipumpkin3]

== Potential measures to protect against Evil Twins ==
Organisational measures are closely linked to personal measures. As an organisational measure, it can be established, for example, that different passwords must be used for different services and applications. This can prevent the same password being used for VPN access as for Wi-Fi access. In the corporate context, the operation of a structured and continuously improving information security management system can also be categorised as an organisational measure.

In the client-side area, care can be taken to ensure that the devices are configured so that only that only TLS-encrypted connections (e.g. HTTPS) are permitted. are allowed. This at least prevents the rogue access point from accessing data in plain text or manipulate it unnoticed.

The use of a VPN can also be recommended as a technical measure against MitM attacks. This is usually accompanied by increased information security through encryption of the traffic, which prevents transmitted data from being read or manipulated. In the context of a Wi-Fi MitM attack, a VPN hides the client's communication, encrypts the network traffic and hides metadata such as IP addresses or domain names.

Personal measures focus on the end user. Awareness-raising measures in particular can be derived in this context. It is important to sensitise users to the existing risks, make them aware and motivate them to support and implement the technical and organisational security measures. An easy-to-understand personal measure can be, for example, to pay attention to Wi-Fi names and other irregularities and to report these to the relevant reporting centres in the event of anomalies. This allows a quick response in the case of an emergency.

== References ==

[[Category:Documentation]]

Evil Twin Attack via Kali on Raspberry Pi

2024-01-04T11:06:46Z

ALanners: /* Deauthentication attack */

An Evil Twin is a rogue access point designed to imitate a legitimate access point in order to carry out malicious actions such as phising. Regular laptops and Wi-Fi adapters can be used to set up an Evil Twin, or Raspberry Pis, as these are quite small and can be easily packed into a bagpack when powered by a battery bank. This setup can then be left in one place for several days, for example, during which time the AP can phish information.

The main scenarios in the context of rogue access points or Evil Twins are:
* Machine-in-the-Middle/Content Injection tion
* Malicious webpages through e.g. DNS spoofing
* Deauthentication attacks
* Technique for social engineering for more in-depth scenarios

== Kali Linux on Raspberry Pi ==

For example, Kali Linux can be installed on a Raspberry Pi 4 Model B with 8 GB RAM. The Raspberry Pi 4 Model B is equipped with a Broadcom BCM2711, Quad core Cortex-A72 (ARM v8) 64-bit SoC @ 1.8GHz. This information is relevant because Kali Linux provides an image specifically for ARM processors on their website.
This image can be downloaded at [https://www.kali.org/get-kali/#kali-arm Kali Linux on ARM] The Raspberry Pi 4 is equipped with a 64-bit processor and supports the execution of 64-bit images. This results in two options: Either the Kali Linux RaspberryPi 2, 3, 4 32-bit or 64-bit image can be selected, whereby more documentation is available for the 32-bit variant. In addition, the 32-bit image ran with fewer problems than the 64-bit image during practical tests.
To get the image onto the Raspberry Pi, it must be transferred to a micro SD card. Balena Etcher or similar software can be used for this purpose.
Once the image has been successfully transferred to the SD card, it can be inserted into the corresponding slot on the Raspberry Pi 4. This can then be started and Kali Linux will boot from the SD card. The username and password are kali/kali.

A more detailed guide to installing Kali Linux on a Raspberry Pi can be found in the following article: [https://wiki.elvis.science/index.php?title=Install_Kali_Linux_on_Raspberry_Pi_3_%26_4 Install Kali Linux on Raspberry Pi 3 & 4]

=== Hands-on report ===
Kali Linux on a Raspberry Pi was tested extensively in the course of setting up an Evil Twin. Overall, the installation of the latest version of Kali Linux (as of December 2023) on a Raspberry Pi is not recommended for testing and lab purposes. The use for spawning an Evil Twin can also be achieved with other Linux systems, which is why it should be determined whether Kali Linux is absolutely necessary.
The following bugs were observed:
* After installing dependencies that were necessary to start Wifiphisher and Wifipumpkin 3, there were more boot problems
* Overall, booting was often prone to errors. Depending on the connected screen, it took several attempts.
* There were often non-reproducible bugs when starting programmes. For example, Wifiphisher did not work from time to time, no networks could be displayed and the like. The bugs occurred randomly and could not be reproduced.
* There were also bugs in the GUI area. For example, the bar for maximising, minimising and closing windows suddenly disappeared and it was no longer possible to move windows. To fix this, the corresponding driver had to be restarted.

== Evil Twin ==

=== Evil Twin using native Kali Linux Tools ===
The following tools are all pre-installed on Kali Linux. All of the tools listed can be used to carry out an Evil Twin attack:
* Airmon-ng: Display interfaces and stop potentially disruptive processes.
* Airodump-ng: Can be used to carry out reconnaissance. All surrounding networks and associated devices can be detected.
* Airbase-ng: Can be used to create a Wi-Fi access point. created.
* Aireplay-ng: Can be used to carry out deauth- attacks
* Accompanying activities: dns-masq can be used to set up a DNS server. Furthermore activation of a corresponding route on the interfaces as well as enabling IP forwarding and setting up firewall rules.

=== Hardware requirements ===
At least the following hardware is required to set up an Evil Twin:
* Raspberry Pi 4 Model B - 8GB incl. accessories such as power cable and MicroSD
* 2 x Alfa AWUS036ACH Wide Range AC1200 Wireless Adapter

=== Reconnaissance ===

=== Rogue Access Point ===

=== Deauthentication attack ===
Deauthentication attacks are a subtle yet serious threat. The targeted de-authentication attacks, which aim to remove connected devices from a Wi-Fi network, have the potential to have a significant impact on the availability and integrity of connections.

The channel of the AP or the devices that are connected to the AP can be taken from the reconnaissance. For setting the channel on the Wi-Fi adapter:
sudo iwlist <interface> channel
sudo iwconfig <interface> power off
sudo iwconfig <interface> channel {channel, ex. "23"}
sudo iwconfig <interface> power on

To check whether the channel has been set
sudo iwlist {interface} channel

=== Alternative all-in-one frameworks ===
All-in-one frameworks that combine the activities described above in one software are, for example, [https://wiki.elvis.science/index.php?title=Wifiphisher wifiphisher] and [https://wiki.elvis.science/index.php?title=Wifipumpkin3 wifipumpkin3]

== Potential measures to protect against Evil Twins ==
Organisational measures are closely linked to personal measures. As an organisational measure, it can be established, for example, that different passwords must be used for different services and applications. This can prevent the same password being used for VPN access as for Wi-Fi access. In the corporate context, the operation of a structured and continuously improving information security management system can also be categorised as an organisational measure.

In the client-side area, care can be taken to ensure that the devices are configured so that only that only TLS-encrypted connections (e.g. HTTPS) are permitted. are allowed. This at least prevents the rogue access point from accessing data in plain text or manipulate it unnoticed.

The use of a VPN can also be recommended as a technical measure against MitM attacks. This is usually accompanied by increased information security through encryption of the traffic, which prevents transmitted data from being read or manipulated. In the context of a Wi-Fi MitM attack, a VPN hides the client's communication, encrypts the network traffic and hides metadata such as IP addresses or domain names.

Personal measures focus on the end user. Awareness-raising measures in particular can be derived in this context. It is important to sensitise users to the existing risks, make them aware and motivate them to support and implement the technical and organisational security measures. An easy-to-understand personal measure can be, for example, to pay attention to Wi-Fi names and other irregularities and to report these to the relevant reporting centres in the event of anomalies. This allows a quick response in the case of an emergency.

== References ==

[[Category:Documentation]]

Evil Twin Attack via Kali on Raspberry Pi

2024-01-04T11:03:13Z

ALanners: /* Alternative all-in-one frameworks */

Evil Twin Attack via Kali on Raspberry Pi

2024-01-04T10:58:52Z

ALanners: /* Field report */

Evil Twin Attack via Kali on Raspberry Pi

2024-01-04T10:58:30Z

ALanners:

Evil Twin Attack via Kali on Raspberry Pi

2024-01-04T10:58:18Z

ALanners:

Evil Twin Attack via Kali on Raspberry Pi

2024-01-04T10:58:10Z

ALanners:

Evil Twin Attack via Kali on Raspberry Pi

2024-01-04T10:55:19Z

ALanners: /* Evil Twin using native Kali Linux Tools */

Evil Twin Attack via Kali on Raspberry Pi

2024-01-04T10:53:30Z

ALanners: /* Evil Twin using native Kali Linux Tools */

Evil Twin Attack via Kali on Raspberry Pi

2024-01-04T10:49:09Z

ALanners:

Evil Twin Attack via Kali on Raspberry Pi

2024-01-04T10:48:48Z

ALanners: /* Potential measures to protect against Evil Twins */

Evil Twin Attack via Kali on Raspberry Pi

2024-01-04T10:48:34Z

ALanners: /* Evil Twin using native Kali Linux Tools */

Evil Twin Attack via Kali on Raspberry Pi

2024-01-04T10:43:58Z

ALanners: /* Field report */

Evil Twin Attack via Kali on Raspberry Pi

2024-01-04T10:34:51Z

ALanners: /* Evil Twin */

Evil Twin Attack via Kali on Raspberry Pi

2024-01-04T10:34:32Z

ALanners: /* Evil Twin using native Kali Linux Tools */

Evil Twin Attack via Kali on Raspberry Pi

2024-01-04T10:32:59Z

ALanners:

Evil Twin Attack via Kali on Raspberry Pi

2024-01-04T10:32:09Z

ALanners:

Evil Twin Attack via Kali on Raspberry Pi

2024-01-04T10:29:47Z

ALanners:

Evil Twin Attack via Kali on Raspberry Pi

2024-01-04T10:26:01Z

ALanners:

Wifiphisher

2024-01-03T21:47:51Z

ALanners:

Wifiphisher is a comprehensive framework for setting up rogue access points. The framework can be used during penetration tests to test Wi-Fi security, among other things. At the same time, with Wifiphisher an Evil Twin can be setup and used to test personal measures such as security awareness.

== Wifiphisher ==
Wifiphisher is a framework for spawning malicious access points, especially designed for red team deployments and Wi-Fi security pentesting. The framework allows pentester to perform man-in-the-middle attacks against wireless clients. Wifiphisher can run on devices such as the Raspberry Pi.<ref name=”RE1”>"wifiphisher " - available under: https://github.com/wifiphisher/wifiphisher - Retrieved 2024-01-01.</ref>

The framework utilises modern Wi-Fi techniques and tactics such as "Evil Twin", "KARMA" and "Known Beacons. Wifiphisher is characterised by its modularity, allowing users to develop customized Python modules to extend the tool. Furthermore custom phishing scenarios for specific targeted attacks can be created.<ref name=”RE1”/>

Despite its advanced capabilities, Wifiphisher remains user-friendly. The process can ne launched with a simple command, while advanced users can take advantage of its many features per command line. The interactive text-based console interface guides users through process of an attack, ensuring usability for users with varying levels of knowledge.<ref name=”RE1”/>

== Community based phishing pages ==
Since wifiphisher is community based, there are some extensions. Community-based phishing pages can be highlighted as an example. For example, there are phishing templates that imitate instagram, google or starbucks pages.<ref name=”RE2”>"extra-phishing-pages" - available under: https://github.com/wifiphisher/extra-phishing-pages - Retrieved 2024-01-01.</ref>

== First steps ==
Installation:

Firstly, you have to install the dependencies:

sudo apt-get install hostapd dnsmasq python-pyric python-jinja2

Wifiphisher can be cloned from the corresponding gitrepo:

git clone https://github.com/wifiphisher/wifiphisher.git
cd wifiphisher
sudo python setup.py install

Alternatively, wifiphisher can also be installed as follows:

sudo apt-get -y install wifiphisher

Starting wifiphisher:

sudo wifiphisher

After wifiphisher has been started, a process is run through in which the network to be imitated and the corresponding captive portal can be selected. The deauth process then starts. The big advantage of Wifiphisher over other frameworks such as Wifipumpkin3 is that the captive portal can be accessed via https and the user therefore does not receive a warning when entering the access data.

Help section:
sudo wifiphisher -h

All possible options, apart from the standard process, can be taken from the help section.

== References ==

[[Category:Documentation]]

Wifiphisher

2024-01-03T21:37:01Z

ALanners:

Wifiphisher is a comprehensive framework for setting up rogue access points. The framework can be used during penetration tests to test Wi-Fi security, among other things. At the same time, with Wifiphisher an Evil Twin can be setup and used to test personal measures such as security awareness.

== Wifiphisher ==
Wifiphisher is a framework for spawning malicious access points, especially designed for red team deployments and Wi-Fi security pentesting. The framework allows pentester to perform man-in-the-middle attacks against wireless clients. Wifiphisher can run on devices such as the Raspberry Pi.<ref name=”RE1”>"wifiphisher " - available under: https://github.com/wifiphisher/wifiphisher - Retrieved 2024-01-01.</ref>

The framework utilises modern Wi-Fi techniques and tactics such as "Evil Twin", "KARMA" and "Known Beacons. Wifiphisher is characterised by its modularity, allowing users to develop customized Python modules to extend the tool. Furthermore custom phishing scenarios for specific targeted attacks can be created.<ref name=”RE1”/>

Despite its advanced capabilities, Wifiphisher remains user-friendly. Beginners can launch the tool with a simple command, while advanced users can take advantage of its many features. The interactive, text-based user interface guides testers through the creation of attacks, ensuring accessibility for users with varying levels of knowledge.<ref name=”RE1”/>

== Community based phishing pages ==
Since wifiphisher is community based, there are some extensions. Community-based phishing pages can be highlighted as an example. For example, there are phishing templates that imitate instagram, google or starbucks pages.<ref name=”RE2”>"extra-phishing-pages" - available under: https://github.com/wifiphisher/extra-phishing-pages - Retrieved 2024-01-01.</ref>

== First steps ==
Installation:

Firstly, you have to install the dependencies:

sudo apt-get install hostapd dnsmasq python-pyric python-jinja2

Wifiphisher can be cloned from the corresponding gitrepo:

git clone https://github.com/wifiphisher/wifiphisher.git
cd wifiphisher
sudo python setup.py install

Alternatively, wifiphisher can also be installed as follows:

sudo apt-get -y install wifiphisher

Starting wifiphisher:

sudo wifiphisher

After wifiphisher has been started, a process is run through in which the network to be imitated and the corresponding captive portal can be selected. The deauth process then starts. The big advantage of Wifiphisher over other frameworks such as Wifipumpkin3 is that the captive portal can be accessed via https and the user therefore does not receive a warning when entering the access data.

Help section:
sudo wifiphisher -h

All possible options, apart from the standard process, can be taken from the help section.

== References ==

[[Category:Documentation]]

Wifiphisher

2024-01-03T21:07:54Z

ALanners:

Wifiphisher is a comprehensive framework for setting up rogue access points. The framework can be used during penetration tests to test Wi-Fi security, among other things. At the same time, with Wifiphisher an Evil Twin can be setup and used to test personal measures such as security awareness.

== Wifiphisher ==
Wifiphisher is a robust malicious access point framework designed for red team deployments and Wi-Fi security testing. Wifiphisher allows penetration testers to take a man-in-the-middle position against wireless clients by performing targeted Wi-Fi mapping attacks. Wifiphisher can run on devices such as the Raspberry Pi and utilises modern Wi-Fi association techniques such as "Evil Twin", "KARMA" and "Known Beacons", making it a powerful tool for extended operations.<ref name=”RE1”>"wifiphisher " - available under: https://github.com/wifiphisher/wifiphisher - Retrieved 2024-01-01.</ref>

Flexibility is one of the key features of Wifiphisher, which supports a variety of arguments and provides a collection of phishing templates for different deployment scenarios. Wifiphisher is characterised by its modularity, allowing users to develop both simple and complex Python modules to extend the tool's functionality or create custom phishing scenarios for specific targeted attacks.<ref name=”RE1”/>

Despite its advanced capabilities, Wifiphisher remains user-friendly. Beginners can launch the tool with a simple command, while advanced users can take advantage of its many features. The interactive, text-based user interface guides testers through the creation of attacks, ensuring accessibility for users with varying levels of knowledge.<ref name=”RE1”/>

== Community based phishing pages ==
Since wifiphisher is community based, there are some extensions. Community-based phishing pages can be highlighted as an example. For example, there are phishing templates that imitate instagram, google or starbucks pages.<ref name=”RE2”>"extra-phishing-pages" - available under: https://github.com/wifiphisher/extra-phishing-pages - Retrieved 2024-01-01.</ref>

== First steps ==
Installation:

Firstly, you have to install the dependencies:

sudo apt-get install hostapd dnsmasq python-pyric python-jinja2

Wifiphisher can be cloned from the corresponding gitrepo:

git clone https://github.com/wifiphisher/wifiphisher.git
cd wifiphisher
sudo python setup.py install

Alternatively, wifiphisher can also be installed as follows:

sudo apt-get -y install wifiphisher

Starting wifiphisher:

sudo wifiphisher

After wifiphisher has been started, a process is run through in which the network to be imitated and the corresponding captive portal can be selected. The deauth process then starts. The big advantage of Wifiphisher over other frameworks such as Wifipumpkin3 is that the captive portal can be accessed via https and the user therefore does not receive a warning when entering the access data.

Help section:
sudo wifiphisher -h

All possible options, apart from the standard process, can be taken from the help section.

== References ==

[[Category:Documentation]]

Wifiphisher

2024-01-03T21:07:22Z

ALanners: /* First steps */

Wifiphisher is a comprehensive framework for setting up rogue access points. The framework can be used during penetration tests to test Wi-Fi security, among other things. At the same time, with Wifiphisher an Evil Twin can be setup and used to test personal measures such as security awareness.

== Wifiphisher ==
Wifiphisher is a robust malicious access point framework designed for red team deployments and Wi-Fi security testing. Wifiphisher allows penetration testers to take a man-in-the-middle position against wireless clients by performing targeted Wi-Fi mapping attacks. Wifiphisher can run on devices such as the Raspberry Pi and utilises modern Wi-Fi association techniques such as "Evil Twin", "KARMA" and "Known Beacons", making it a powerful tool for extended operations.<ref name=”RE1”>"wifiphisher " - available under: https://github.com/wifiphisher/wifiphisher - Retrieved 2024-01-01.</ref>

Flexibility is one of the key features of Wifiphisher, which supports a variety of arguments and provides a collection of phishing templates for different deployment scenarios. Wifiphisher is characterised by its modularity, allowing users to develop both simple and complex Python modules to extend the tool's functionality or create custom phishing scenarios for specific targeted attacks.<ref name=”RE1”/>

Despite its advanced capabilities, Wifiphisher remains user-friendly. Beginners can launch the tool with a simple command, while advanced users can take advantage of its many features. The interactive, text-based user interface guides testers through the creation of attacks, ensuring accessibility for users with varying levels of knowledge.<ref name=”RE1”/>

== Community based phishing pages ==
Since wifiphisher is community based, there are some extensions. Community-based phishing pages can be highlighted as an example. For example, there are phishing templates that imitate instagram, google or starbucks pages.<ref name=”RE2”>"extra-phishing-pages" - available under: https://github.com/wifiphisher/wifiphisher - Retrieved 2024-01-01.</ref>

== First steps ==
Installation:

Firstly, you have to install the dependencies:

sudo apt-get install hostapd dnsmasq python-pyric python-jinja2

Wifiphisher can be cloned from the corresponding gitrepo:

git clone https://github.com/wifiphisher/wifiphisher.git
cd wifiphisher
sudo python setup.py install

Alternatively, wifiphisher can also be installed as follows:

sudo apt-get -y install wifiphisher

Starting wifiphisher:

sudo wifiphisher

After wifiphisher has been started, a process is run through in which the network to be imitated and the corresponding captive portal can be selected. The deauth process then starts. The big advantage of Wifiphisher over other frameworks such as Wifipumpkin3 is that the captive portal can be accessed via https and the user therefore does not receive a warning when entering the access data.

Help section:
sudo wifiphisher -h

All possible options, apart from the standard process, can be taken from the help section.

== References ==

[[Category:Documentation]]

Wifiphisher

2024-01-03T21:01:30Z

ALanners:

Wifiphisher

2024-01-03T21:00:57Z

ALanners:

Evil Twin Attack via Kali on Raspberry Pi

2024-01-03T18:19:00Z

ALanners: Created page with "An Evil Twin is a rogue access point designed to imitate a legitimate access point in order to carry out malicious actions such as phising.Regular laptops and Wi-Fi adapters can be used to set up an Evil Twin, or Raspberry Pis, as these are quite small and can be easily packed into a bagpack when powered by a battery bank. This setup can then be left in one place for several days, for example, during which time the AP can phish information."

Wifipumpkin3

2024-01-03T18:14:04Z

ALanners:

Wifipumpkin3 is a framework for setting up rogue access points and the associated evil twins. The framework is written in Python. <ref name=”RE1”>"Wifipumpkin3" - available under: https://github.com/P0cL4bs/wifipumpkin3 - Retrieved 2024-01-01.</ref>

== Features ==
According to the authors, the main features of the framework are as follows <ref name=”RE1”/>:
Rogue access point attack
Man-in-the-middle attack
Module for deauthentication attack
Module for extra-captiveflask templates
Rogue Dns Server
Captive portal attack (captiveflask)
Intercept, inspect, modify and replay web traffic
WiFi networks scanning
DNS monitoring service
Credentials harvesting
Phishkin3 (Support MFA phishing attack via captive portal)
EvilQR3 (Support Phishing QR code attack)
Transparent Proxies

== Installation ==
Wifipumpkin3 is written in Python3, which is why the installation of Python3 (version 3.7 or later) is required. In addition, it requires a Wi-Fi adapter that allows access point (AP) mode.
Windows and Mac OSX are currently (01.01.2024) not supported. <ref name=”RE2”>"Getting Started - Installation" - available under: https://wifipumpkin3.github.io/docs/getting-started - Retrieved 2024-01-01.</ref>

'''Installation: '''

Dependencies should be installed first:
sudo apt install python3.7-dev libssl-dev libffi-dev build-essential python3.7

Then wifipumpkin3 can be cloned from the github repo and uninstalled:
git clone https://github.com/P0cL4bs/wifipumpkin3.git
cd wifipumpkin3
sudo make install

Alternatively, wifipumpkin3 can be installed under Kali Linux (2022.2) as follows:
sudo apt install wifipumpkin3

== Some examples of use ==
The operation of wifipumpkin3 is reminiscent of the operation of Metasploit. The framework can be started as follows:
sudo wp3

'''The following commands are relevant for setting up an Evil Twin:<ref name=”RE3”>"Getting Started - Usage" - available under: https://wifipumpkin3.github.io/docs/getting-started#usage - Retrieved 2024-01-01.</ref>'''

Display all information/parameters about the access point to be spawned:
ap

As in Metasploit, the variables of the AP can be set with set:
set

Display installed proxies:
proxies

A proxy can be activated or set as follows:
set proxy proxy_name

The configured access point can be started with the following command:
start

The AP then starts according to the entered configurations, whereby, depending on the proxy, the traffic or the connected devices and intercepted credentials of the captive portal are then displayed, for example.

== References ==
According to the author, wifipumpkin3 comes with the following pre-installed proxies<ref name=”RE4”>"Getting Started - Proxies" - available under: https://wifipumpkin3.github.io/docs/getting-started#proxies - Retrieved 2024-01-01.</ref>:
pumpkinproxy - Proxy for intercept network traffic on TCP protocol.
captiveflask - Allow block Internet access for users until they open the page login page.
noproxy - Runnning without proxy redirect traffic

The respective options of a proxy can also be defined with true/false. For example, pumpkinproxy offers options for html_injection or javascript injection, which can be defined and activated as required. Similarly, the captive portal can be defined for the captive flask proxy.

[[Category:Documentation]]

Wifipumpkin3

2024-01-03T18:13:44Z

ALanners:

Wifipumpkin3 is a framework for setting up rogue access points and the associated evil twins. The framework is written in Python. <ref name=”RE1”>"Wifipumpkin3" - available under: https://github.com/P0cL4bs/wifipumpkin3 - Retrieved 2024-01-01.</ref>

== Features ==
According to the authors, the main features of the framework are as follows <ref name=”RE1”/>:
Rogue access point attack
Man-in-the-middle attack
Module for deauthentication attack
Module for extra-captiveflask templates
Rogue Dns Server
Captive portal attack (captiveflask)
Intercept, inspect, modify and replay web traffic
WiFi networks scanning
DNS monitoring service
Credentials harvesting
Phishkin3 (Support MFA phishing attack via captive portal)
EvilQR3 (Support Phishing QR code attack)
Transparent Proxies

== Installation ==
Wifipumpkin3 is written in Python3, which is why the installation of Python3 (version 3.7 or later) is required. In addition, it requires a Wi-Fi adapter that allows access point (AP) mode.
Windows and Mac OSX are currently (01.01.2024) not supported. <ref name=”RE2”>"Getting Started - Installation" - available under: https://wifipumpkin3.github.io/docs/getting-started - Retrieved 2024-01-01.</ref>

'''Installation: '''

Dependencies should be installed first:
sudo apt install python3.7-dev libssl-dev libffi-dev build-essential python3.7

Then wifipumpkin3 can be cloned from the github repo and uninstalled:
git clone https://github.com/P0cL4bs/wifipumpkin3.git
cd wifipumpkin3
sudo make install

Alternatively, wifipumpkin3 can be installed under Kali Linux (2022.2) as follows:
sudo apt install wifipumpkin3

== Some examples of use ==
The operation of wifipumpkin3 is reminiscent of the operation of Metasploit. The framework can be started as follows:
sudo wp3

'''The following commands are relevant for setting up an Evil Twin:<ref name=”RE3”>"Getting Started - Usage" - available under: https://wifipumpkin3.github.io/docs/getting-started#usage - Retrieved 2024-01-01.</ref>'''

Display all information/parameters about the access point to be spawned:
ap

As in Metasploit, the variables of the AP can be set with set:
set

Display installed proxies:
proxies

A proxy can be activated or set as follows:
set proxy proxy_name

The configured access point can be started with the following command:
start

The AP then starts according to the entered configurations, whereby, depending on the proxy, the traffic or the connected devices and intercepted credentials of the captive portal are then displayed, for example.

== References ==
According to the author, wifipumpkin3 comes with the following pre-installed proxies<ref name=”RE4”>"Getting Started - Proxies" - available under: https://wifipumpkin3.github.io/docs/getting-started#proxies - Retrieved 2024-01-01.</ref>:
pumpkinproxy - Proxy for intercept network traffic on TCP protocol doc
captiveflask - Allow block Internet access for users until they open the page login page. doc
noproxy - Runnning without proxy redirect traffic

The respective options of a proxy can also be defined with true/false. For example, pumpkinproxy offers options for html_injection or javascript injection, which can be defined and activated as required. Similarly, the captive portal can be defined for the captive flask proxy.

[[Category:Documentation]]

Wifipumpkin3

2024-01-03T18:13:20Z

ALanners:

Wifipumpkin3 is a framework for setting up rogue access points and the associated evil twins. The framework is written in Python. <ref name=”RE1”>"Wifipumpkin3" - available under: https://github.com/P0cL4bs/wifipumpkin3 - Retrieved 2024-01-01.</ref>

== Features ==
According to the authors, the main features of the framework are as follows <ref name=”RE1”/>:
Rogue access point attack
Man-in-the-middle attack
Module for deauthentication attack
Module for extra-captiveflask templates
Rogue Dns Server
Captive portal attack (captiveflask)
Intercept, inspect, modify and replay web traffic
WiFi networks scanning
DNS monitoring service
Credentials harvesting
Phishkin3 (Support MFA phishing attack via captive portal)
EvilQR3 (Support Phishing QR code attack)
Transparent Proxies

== Installation ==
Wifipumpkin3 is written in Python3, which is why the installation of Python3 (version 3.7 or later) is required. In addition, it requires a Wi-Fi adapter that allows access point (AP) mode.
Windows and Mac OSX are currently (01.01.2024) not supported. <ref name=”RE2”>"Getting Started - Installation" - available under: https://wifipumpkin3.github.io/docs/getting-started - Retrieved 2024-01-01.</ref>

'''Installation: '''

Dependencies should be installed first:
sudo apt install python3.7-dev libssl-dev libffi-dev build-essential python3.7

Then wifipumpkin3 can be cloned from the github repo and uninstalled:
git clone https://github.com/P0cL4bs/wifipumpkin3.git
cd wifipumpkin3
sudo make install

Alternatively, wifipumpkin3 can be installed under Kali Linux (2022.2) as follows:
sudo apt install wifipumpkin3

== Some examples of use ==
The operation of wifipumpkin3 is reminiscent of the operation of Metasploit. The framework can be started as follows:
sudo wp3

'''The following commands are relevant for setting up an Evil Twin:<ref name=”RE3”>"Getting Started - Usage" - available under: https://wifipumpkin3.github.io/docs/getting-started#usage - Retrieved 2024-01-01.</ref>'''

Display all information/parameters about the access point to be spawned:
ap

As in Metasploit, the variables of the AP can be set with set:
set

Display installed proxies:
proxies

A proxy can be activated or set as follows:
set proxy proxy_name

The configured access point can be started with the following command:
start

The AP then starts according to the entered configurations, whereby, depending on the proxy, the traffic or the connected devices and intercepted credentials of the captive portal are then displayed, for example.

<ref name=”RE4”>"Getting Started - Proxies" - available under: https://wifipumpkin3.github.io/docs/getting-started#proxies - Retrieved 2024-01-01.</ref>

== References ==
According to the author, wifipumpkin3 comes with the following pre-installed proxies:
pumpkinproxy - Proxy for intercept network traffic on TCP protocol doc
captiveflask - Allow block Internet access for users until they open the page login page. doc
noproxy - Runnning without proxy redirect traffic

The respective options of a proxy can also be defined with true/false. For example, pumpkinproxy offers options for html_injection or javascript injection, which can be defined and activated as required. Similarly, the captive portal can be defined for the captive flask proxy.

[[Category:Documentation]]

Wifipumpkin3

2024-01-03T18:10:15Z

ALanners: /* Some examples of use */

Wifipumpkin3 is a framework for setting up rogue access points and the associated evil twins. The framework is written in Python. <ref name=”RE1”>"Wifipumpkin3" - available under: https://github.com/P0cL4bs/wifipumpkin3 - Retrieved 2024-01-01.</ref>

== Features ==
According to the authors, the main features of the framework are as follows <ref name=”RE1”/>:
Rogue access point attack
Man-in-the-middle attack
Module for deauthentication attack
Module for extra-captiveflask templates
Rogue Dns Server
Captive portal attack (captiveflask)
Intercept, inspect, modify and replay web traffic
WiFi networks scanning
DNS monitoring service
Credentials harvesting
Phishkin3 (Support MFA phishing attack via captive portal)
EvilQR3 (Support Phishing QR code attack)
Transparent Proxies

== Installation ==
Wifipumpkin3 is written in Python3, which is why the installation of Python3 (version 3.7 or later) is required. In addition, it requires a Wi-Fi adapter that allows access point (AP) mode.
Windows and Mac OSX are currently (01.01.2024) not supported. <ref name=”RE2”>"Getting Started - Installation" - available under: https://wifipumpkin3.github.io/docs/getting-started - Retrieved 2024-01-01.</ref>

'''Installation: '''

Dependencies should be installed first:
sudo apt install python3.7-dev libssl-dev libffi-dev build-essential python3.7

Then wifipumpkin3 can be cloned from the github repo and uninstalled:
git clone https://github.com/P0cL4bs/wifipumpkin3.git
cd wifipumpkin3
sudo make install

Alternatively, wifipumpkin3 can be installed under Kali Linux (2022.2) as follows:
sudo apt install wifipumpkin3

== Some examples of use ==
The operation of wifipumpkin3 is reminiscent of the operation of Metasploit. The framework can be started as follows:
sudo wp3

'''The following commands are relevant for setting up an Evil Twin:<ref name=”RE3”>"Getting Started - Usage" - available under: https://wifipumpkin3.github.io/docs/getting-started#usage - Retrieved 2024-01-01.</ref>'''

Display all information/parameters about the access point to be spawned:
ap

As in Metasploit, the variables of the AP can be set with set:
set

Display installed proxies:
proxies

A proxy can be activated or set as follows:
set proxy proxy_name

The configured access point can be started with the following command:
start

The AP then starts according to the entered configurations, whereby, depending on the proxy, the traffic or the connected devices and intercepted credentials of the captive portal are then displayed, for example.

<ref name=”RE4”>"Getting Started - Proxies" - available under: https://wifipumpkin3.github.io/docs/getting-started#proxies - Retrieved 2024-01-01.</ref>

== References ==

[[Category:Documentation]]

Wifipumpkin3

2024-01-03T18:03:29Z

ALanners: /* Installation */