Elvis Wiki - User contributions [en]

Threat Modelling

2020-02-17T21:48:18Z

Akrischan:

== Summary ==
Thread modelling is a process used to systematically identify potential threats to products, applications or any other system. It helps to figure out the possible vulnerabilities of a system that are most desired by attackers. There is hardly any product which who threat modeling can´t be used. It helps with the security of software, applications, networks, IoT, business processes and many more.

The reasons to use threat modeling are mainly to build secure design and to document threats and mitigations. It helps to identify threats and compliance requirements and to evaluate their risks to the system as well as is helps to efficient invest given resources. An important part is to document the threats and mitigations found.

The methodology mostly always includes a description, design or model of the potential problem, a list of assumptions that can be checked or challenged and of potential threats, a list of actions to be taken against this threats and a way of validating the output and the action taken.

== When to perform ==

It is never to late to perform Threat Modelling actions but the earlier the better. It is to consider that, if the systems architecture isn´t changing, there are no new processes or dataflows and no changes to the data structure than it is unlikely that there will be new threats that are to be considered. But if some of them change, it is useful to examine what could go wrong in the current change. If something has already happened, it is important to have a look again at the system and check the threat models to find out what was going wrong and what was left out.

== The four questions ==

'''What are we building?'''
This includes the scope of the Threat Model and requires an understanding of the subject to be tested. For that purpose, it can help to have a look at or make yourself a architecture diagram, dataflow transitions or data classifications.

'''What can go wrong?'''
Manly the research activity to find the main threats that appear to the system or the application. It helps to use a structure to think it through or to brainstorm about the possibilities.

'''What are we going to do about it?'''
Turn the findings to action using the most fitted method.

'''Did we a good enough job?'''
Check the quality, feasibility, progress and the planning of the process you developed. If not satisfied, start everything again with a better concept.

== Methodologies ==

=== STRIDE ===

STRIDE is the threat modeling methodology from Microsoft that aligns with their Trustworthy Computing directive of January 2002. It mainly helps Microsoft Windows software developers assure the security during the design phase.
The goal is that the application meets the CIA (Confidentiality, Integrity and Availability) security properties and as well Authorization, Authentication and Non-Repudiation. The six threat categories are:

*'''Spoofing identity:''' assuming or taking on the identity of another person to accomplish a certain goal.
''Example: Using another person’s username and password to login.''

*'''Tampering with data:''' The malicious modification of data.
''Example: The unauthorized changes to persistent data and alteration of data in a dataflow.''

*'''Repudiation:''' Users who deny performing an action without other parties having any way to prove otherwise.
''Example: An illegal action of a user in a system without the possibility to trace the operation.''

*'''Information disclosure:''' The exposure of information to unauthorized individuals.
''Example: If a user can read files, he should not have access to or if an attacker can read transit between computers where he is not supposed to.''

*'''Denial of service:''' A DoS attack denies service to a valid user.
''Example: Making a Webserver unavailable by creating a lot of fake requests.''

*'''Elevation of privilege:''' An unprivileged user gains enough privileged access to destroy the entire system.
''Example: An Attacker has effectively penetrated system defense to the point where he becomes part of the trusted system.''

=== OCTAVE ===

OCTAVE stand for “Operationally Critical Threat, Asset and Vulnerability Evaluation and is developed at the Carnegie Mellon University´s Software Engineering Institute (SEI) and is heavy weighted on assessing organizational risks that result from data asset breaches. It was one of the first specifically for cybersecurity developed threat modeling methods.
Since it is mostly used in companies, it is normally performed in small teams composed of people from the business unit as well as from the IT department to address the security needs. It is driven by the operational risks more than by the theology risks and allows an organization to direct and manage information security risk assessments, communicate key security information as well as focus on protecting key information and to find the best practice and decisions based on the unique risk of their department and thus provides a highly customizable security option.

There are eight processes that are broken in three (or four with phase 0) phases:

'''Phase 0:''' Exploratory phase that determine criteria used.

'''Phase 1:''' Develop initial security strategies

'''Phase 2:''' Technological view to identify infrastructure vulnerabilities

'''Phase 3:''' Risk analysis to develop security strategy and plans

=== Trike ===

The Trike Threat Modeling is an open source process that provides a risk-based approach and risk modeling processes. It is based on a requirement model which ensures that the assigned levels of risk are acceptable to the stakeholders. This means that the modeling process is focused on satisfying the security auditing process from a cyber management perspective.
There are two attack types in the Trike model, an elevation of privilege attack or a denial of service attack and the actions taken are divided into one of four groups called CRUD: ''Create, Read, Update, Delete''. The threats are rated in a rating chart that shows the risk of either attack type to a five-point scale for each CRUD action.
Trike starts with the creation of a requirements model and continues with the creation of a DFD, a Data Flow Diagram. From this point on the risk values are assigned to the threats and an attack graph is created. The Trike model requires a view of the entire system, therefore it can be hard to scale it for larger systems.

== OWASP Tools ==

The Open Web Application Security Project is a NGO whose aim is to improve the security of software. Their main focus are applications within the World Wide Web, to enable organizations to conceive, develop, acquire, operate, and maintain applications that can be trusted. The programm includes:

* Community-led open source software projects
* Over 275 local chapters worldwide
* Tens of thousands of members
* Industry-leading educational and training conferences

OWASP Projects split in two main categories: Development- and Documentationprojects. The documentation project currently consists of:

* '''OWASP ASVS:''' threat modeling standard to verify applications
* '''The Guide:''' Guidelines for implementing secure webapplications
* '''Top Ten Most DotNet:''' Toolkit to improve .net security
* '''Enigform:''' Testplatform for OpenPGP-related webprojects
* '''ESAPI:''' Free and public methods to secure webapplications
* '''AntiSamy:''' Tool to validate user input in webapplications
* '''XSSer:''' Automatic system to detect Cross-Site-Scripting vulnerabilities
* '''Webgoat:''' Dummy webapplication (e.g. how not to do it)
* '''WebScarab:''' Transparent Webproxy
* '''Mantra Security Workframe:''' Pentesting Toolkit based on Mozilla Firefox
* '''OWASP Threat Dragon:''' Tool to create threat model diagrams

=== Top 10 Web Application Security Risks ===

The OWASP Top 10 is a standard awareness document for developers and web application security.

* ''' Injection ''': SQL, OS or LDAP injection occur when untrusted data is sent to an interpreter. It is possible ot trick the interpreter into executing malicious code.
''How to prevent: Usage of safe API's, Whitelists or escaping spezial characters
* ''' Broken authentication ''': Authentication and session management is often poorly implemented, leading to compromised passwords, keys or session tokens.
''How to prevent: Multifactor authentication, no default credentials, weak-password checks, usage of service-side and secure session managers
* ''' Sensitive Data Exposure ''': Many Applications and APIs do not protect sensitive data, leading to credit card fraud, identify theft or other crimes.
''How to prevent: Identify and protect data processing of sensitive data, encryption with secure cipher suites or hash functions, disable caching for sensitive data
* ''' XML Enternal Entities ''': Poorly configured XML processors evalute external entity references.
''How to prevent: Use complex data formats such as JSON, Upgrade old XML processors, use whitelisting or disable XML external entity and DTD processing
* ''' Broken Access Control ''': Poor restrictions on what authenticated users are allowed to do within an application.
''How to prevent: Log access control failures and create admin alerts, rate limit APIs, Deny everything by default, implement access controll mechanisms once and use it throughout the application
* ''' Security Misconfiguration ''': Most commonly issue. Result of default or incomplete configurations like web- or ftp services.
''How to prevent: Minimal plattform - only use what you really need on public systems, review and audit application configurations, use diffrent credentials
* ''' Cross-Site Scripting''': Occur whenever an application includes untrusted data without proper validation, leading to defaced websites, redirection to malicious sites or complete hijacking of user sessions.
''How to prevent: Use frameworks which escape XSS like React JS, Escaping untrusted HTTP requests, applying context-sensitive encoding
* ''' Insecure Deserialization ''': Leads to remote code execution, replay and injection attacks or user privilege escalation
''How to prevent: Implementing integrity checks, Isolating and running code in low privilege environments, log and monitor deserialization failures and exceptions
* ''' Using Components with Known Vulnerabilities ''': Libraries, frameworks or other software modules may undermine application defenses and enable various attacks and impacts.
''How to prevent: Usage of minimal plattforms, remove unused dependencies, features and components. Only obtain components from official sources over secure links - also check their hashes. Patch regularly.
* ''' Insufficient Logging & Monitoring ''': Allows attackers to silently operate within hijacked networks or applications.
''How to prevent: Log and inform admins about access control failures, use centralized log management solutions, establish an incident response and recovery plan

=== OWASP Threat Dragon ===

[[File:Owaspthreatdragon1.PNG|thumbnail|upright]]

Threat Dragon is a free and open-source threat modeling application which is available on multiple plattforms including linux and windows. The application can also be used as a web platform. Threat Dragon is capable of:

* designing data flow diagrams
* automatic determining and ranking threats
* suggests mitigations
* entry of mitigations and counter measures

To install it on windows proceed as follows:

* Download and install node.js latest lts version: https://nodejs.org/en/download/
* Download and install git for windows: https://gitforwindows.org/

Open a powershell (with administrator privileges) and run:

cd C:\
git clone https://github.com/mike-goodwin/owasp-threat-dragon-desktop
cd .\owasp-threat-dragon-desktop\
npm install

To start the application run:

npm run start

To get familiar with the threat modeling process with Threat Dragon you can open a Demo Model and start to edit it:

[[File:Owaspthreatdragon2.PNG]]

== References ==

* https://owasp.org
* https://github.com/mike-goodwin/owasp-threat-dragon-desktop
* https://threatmodeler.com/threat-modeling-methodologies-overview-for-your-business/
* https://docs.microsoft.com/en-us/previous-versions/commerce-server/ee823878(v=cs.20)?redirectedfrom=MSDN
* https://technology.ku.edu/octave-method-security-assessment
* Introducing OCTAVE Allegro:Improving the Information Security Risk Assessment Process"; Richard A. Caralli

[[Category:Documentation]]

Threat Modelling

2020-02-17T20:52:25Z

Akrischan:

== Summary ==
Thread modelling is a process used to systematically identify potential threats to products, applications or any other system. It helps to figure out the possible vulnerabilities of a system that are most desired by attackers. There is hardly any product which who threat modeling can´t be used. It helps with the security of software, applications, networks, IoT, business processes and many more.

The reasons to use threat modeling are mainly to build secure design and to document threats and mitigations. It helps to identify threats and compliance requirements and to evaluate their risks to the system as well as is helps to efficient invest given resources. An important part is to document the threats and mitigations found.

The methodology mostly always includes a description, design or model of the potential problem, a list of assumptions that can be checked or challenged and of potential threats, a list of actions to be taken against this threats and a way of validating the output and the action taken.

== When to perform ==

It is never to late to perform Threat Modelling actions but the earlier the better. It is to consider that, if the systems architecture isn´t changing, there are no new processes or dataflows and no changes to the data structure than it is unlikely that there will be new threats that are to be considered. But if some of them change, it is useful to examine what could go wrong in the current change. If something has already happened, it is important to have a look again at the system and check the threat models to find out what was going wrong and what was left out.

== The four questions ==

'''What are we building?'''
This includes the scope of the Threat Model and requires an understanding of the subject to be tested. For that purpose, it can help to have a look at or make yourself a architecture diagram, dataflow transitions or data classifications.

'''What can go wrong?'''
Manly the research activity to find the main threats that appear to the system or the application. It helps to use a structure to think it through or to brainstorm about the possibilities.

'''What are we going to do about it?'''
Turn the findings to action using the most fitted method.

'''Did we a good enough job?'''
Check the quality, feasibility, progress and the planning of the process you developed. If not satisfied, start everything again with a better concept.

== Methodologies ==

=== STRIDE ===

STRIDE is the threat modeling methodology from Microsoft that aligns with their Trustworthy Computing directive of January 2002. It mainly helps Microsoft Windows software developers assure the security during the design phase.
The goal is that the application meets the CIA (Confidentiality, Integrity and Availability) security properties and as well Authorization, Authentication and Non-Repudiation. The six threat categories are:

*'''Spoofing identity:''' assuming or taking on the identity of another person to accomplish a certain goal.
''Example: Using another person’s username and password to login.''

*'''Tampering with data:''' The malicious modification of data.
''Example: The unauthorized changes to persistent data and alteration of data in a dataflow.''

*'''Repudiation:''' Users who deny performing an action without other parties having any way to prove otherwise.
''Example: An illegal action of a user in a system without the possibility to trace the operation.''

*'''Information disclosure:''' The exposure of information to unauthorized individuals.
''Example: If a user can read files, he should not have access to or if an attacker can read transit between computers where he is not supposed to.''

*'''Denial of service:''' A DoS attack denies service to a valid user.
''Example: Making a Webserver unavailable by creating a lot of fake requests.''

*'''Elevation of privilege:''' An unprivileged user gains enough privileged access to destroy the entire system.
''Example: An Attacker has effectively penetrated system defense to the point where he becomes part of the trusted system.''

=== OCTAVE ===

OCTAVE stand for “Operationally Critical Threat, Asset and Vulnerability Evaluation and is developed at the Carnegie Mellon University´s Software Engineering Institute (SEI) and is heavy weighted on assessing organizational risks that result from data asset breaches. It was one of the first specifically for cybersecurity developed threat modeling methods.
Since it is mostly used in companies, it is normally performed in small teams composed of people from the business unit as well as from the IT department to address the security needs. It is driven by the operational risks more than by the theology risks and allows an organization to direct and manage information security risk assessments, communicate key security information as well as focus on protecting key information and to find the best practice and decisions based on the unique risk of their department and thus provides a highly customizable security option.

There are eight processes that are broken in three (or four with phase 0) phases:

'''Phase 0:''' Exploratory phase that determine criteria used.

'''Phase 1:''' Develop initial security strategies

'''Phase 2:''' Technological view to identify infrastructure vulnerabilities

'''Phase 3:''' Risk analysis to develop security strategy and plans

=== Trike ===

The Trike Threat Modeling is an open source process that provides a risk-based approach and risk modeling processes. It is based on a requirement model which ensures that the assigned levels of risk are acceptable to the stakeholders. This means that the modeling process is focused on satisfying the security auditing process from a cyber management perspective.
There are two attack types in the Trike model, an elevation of privilege attack or a denial of service attack and the actions taken are divided into one of four groups called CRUD: ''Create, Read, Update, Delete''. The threats are rated in a rating chart that shows the risk of either attack type to a five-point scale for each CRUD action.
Trike starts with the creation of a requirements model and continues with the creation of a DFD, a Data Flow Diagram. From this point on the risk values are assigned to the threats and an attack graph is created. The Trike model requires a view of the entire system, therefore it can be hard to scale it for larger systems.

== OWASP Tools ==

The Open Web Application Security Project is a NGO whose aim is to improve the security of software. Their main focus are Applications within the World Wide Web, to enable organizations to conceive, develop, acquire, operate, and maintain applications that can be trusted. The programm includes:

* Community-led open source software projects
* Over 275 local chapters worldwide
* Tens of thousands of members
* Industry-leading educational and training conferences

OWASP Projects split in two main categories: Development- and Documentationprojects. The documentation project currently consists of:

* '''OWASP ASVS:''' threat modeling standard to verify applications
* '''The Guide:''' Guidelines for implementing secure webapplications
* '''Top Ten Most DotNet:''' Toolkit to improve .net security
* '''Enigform:''' Testplatform for OpenPGP-related webprojects
* '''ESAPI:''' Free and public methods to secure webapplications
* '''AntiSamy:''' Tool to validate user input in webapplications
* '''XSSer:''' Automatic system to detect Cross-Site-Scripting vulnerabilities
* '''Webgoat:''' Dummy webapplication (e.g. how not to do it)
* '''WebScarab:''' Transparent Webproxy
* '''Mantra Security Workframe:''' Pentesting Toolkit based on Mozilla Firefox
* '''OWASP Threat Dragon:''' Tool to create threat model diagrams

=== Top 10 Web Application Security Risks ===

=== OWASP Threat Dragon ===

[[File:Owaspthreatdragon1.PNG|thumbnail|upright]]

Threat Dragon is a free and open-source threat modeling application which is available on multiple plattforms including linux and windows. The application can also be used as a web application. Threat Dragon is capable of:

* designing data flow diagrams
* automatic determining and ranking threats
* suggests mitigations
* entry of mitigations and counter measures

To install it on windows proceed as follows:

* Download and install node.js latest lts version: https://nodejs.org/en/download/
* Download and install git for windows: https://gitforwindows.org/

Open a powershell (with administrator privileges) and run:

cd C:\
git clone https://github.com/mike-goodwin/owasp-threat-dragon-desktop
cd .\owasp-threat-dragon-desktop\
npm install

To start the application run:

npm run start

To get familiar with the threat modeling process with Threat Dragon you can open a Demo Model and start to edit it:

[[File:Owaspthreatdragon2.PNG]]

== References ==

* https://owasp.org
* https://github.com/mike-goodwin/owasp-threat-dragon-desktop
* https://threatmodeler.com/threat-modeling-methodologies-overview-for-your-business/
* https://docs.microsoft.com/en-us/previous-versions/commerce-server/ee823878(v=cs.20)?redirectedfrom=MSDN
* https://technology.ku.edu/octave-method-security-assessment
* Introducing OCTAVE Allegro:Improving the Information Security Risk Assessment Process"; Richard A. Caralli

[[Category:Documentation]]

File:Owaspthreatdragon2.PNG

2020-02-17T20:52:16Z

Akrischan:

File:Owaspthreatdragon1.PNG

2020-02-17T20:44:50Z

Akrischan:

Threat Modelling

2020-02-17T20:36:52Z

Akrischan:

== Summary ==
Thread modelling is a process used to systematically identify potential threats to products, applications or any other system. It helps to figure out the possible vulnerabilities of a system that are most desired by attackers. There is hardly any product which who threat modeling can´t be used. It helps with the security of software, applications, networks, IoT, business processes and many more.

The reasons to use threat modeling are mainly to build secure design and to document threats and mitigations. It helps to identify threats and compliance requirements and to evaluate their risks to the system as well as is helps to efficient invest given resources. An important part is to document the threats and mitigations found.

The methodology mostly always includes a description, design or model of the potential problem, a list of assumptions that can be checked or challenged and of potential threats, a list of actions to be taken against this threats and a way of validating the output and the action taken.

== When to perform ==

It is never to late to perform Threat Modelling actions but the earlier the better. It is to consider that, if the systems architecture isn´t changing, there are no new processes or dataflows and no changes to the data structure than it is unlikely that there will be new threats that are to be considered. But if some of them change, it is useful to examine what could go wrong in the current change. If something has already happened, it is important to have a look again at the system and check the threat models to find out what was going wrong and what was left out.

== The four questions ==

'''What are we building?'''
This includes the scope of the Threat Model and requires an understanding of the subject to be tested. For that purpose, it can help to have a look at or make yourself a architecture diagram, dataflow transitions or data classifications.

'''What can go wrong?'''
Manly the research activity to find the main threats that appear to the system or the application. It helps to use a structure to think it through or to brainstorm about the possibilities.

'''What are we going to do about it?'''
Turn the findings to action using the most fitted method.

'''Did we a good enough job?'''
Check the quality, feasibility, progress and the planning of the process you developed. If not satisfied, start everything again with a better concept.

== Methodologies ==

=== STRIDE ===

STRIDE is the threat modeling methodology from Microsoft that aligns with their Trustworthy Computing directive of January 2002. It mainly helps Microsoft Windows software developers assure the security during the design phase.
The goal is that the application meets the CIA (Confidentiality, Integrity and Availability) security properties and as well Authorization, Authentication and Non-Repudiation. The six threat categories are:

*'''Spoofing identity:''' assuming or taking on the identity of another person to accomplish a certain goal.
''Example: Using another person’s username and password to login.''

*'''Tampering with data:''' The malicious modification of data.
''Example: The unauthorized changes to persistent data and alteration of data in a dataflow.''

*'''Repudiation:''' Users who deny performing an action without other parties having any way to prove otherwise.
''Example: An illegal action of a user in a system without the possibility to trace the operation.''

*'''Information disclosure:''' The exposure of information to unauthorized individuals.
''Example: If a user can read files, he should not have access to or if an attacker can read transit between computers where he is not supposed to.''

*'''Denial of service:''' A DoS attack denies service to a valid user.
''Example: Making a Webserver unavailable by creating a lot of fake requests.''

*'''Elevation of privilege:''' An unprivileged user gains enough privileged access to destroy the entire system.
''Example: An Attacker has effectively penetrated system defense to the point where he becomes part of the trusted system.''

=== OCTAVE ===

OCTAVE stand for “Operationally Critical Threat, Asset and Vulnerability Evaluation and is developed at the Carnegie Mellon University´s Software Engineering Institute (SEI) and is heavy weighted on assessing organizational risks that result from data asset breaches. It was one of the first specifically for cybersecurity developed threat modeling methods.
Since it is mostly used in companies, it is normally performed in small teams composed of people from the business unit as well as from the IT department to address the security needs. It is driven by the operational risks more than by the theology risks and allows an organization to direct and manage information security risk assessments, communicate key security information as well as focus on protecting key information and to find the best practice and decisions based on the unique risk of their department and thus provides a highly customizable security option.

There are eight processes that are broken in three (or four with phase 0) phases:

'''Phase 0:''' Exploratory phase that determine criteria used.

'''Phase 1:''' Develop initial security strategies

'''Phase 2:''' Technological view to identify infrastructure vulnerabilities

'''Phase 3:''' Risk analysis to develop security strategy and plans

=== Trike ===

The Trike Threat Modeling is an open source process that provides a risk-based approach and risk modeling processes. It is based on a requirement model which ensures that the assigned levels of risk are acceptable to the stakeholders. This means that the modeling process is focused on satisfying the security auditing process from a cyber management perspective.
There are two attack types in the Trike model, an elevation of privilege attack or a denial of service attack and the actions taken are divided into one of four groups called CRUD: ''Create, Read, Update, Delete''. The threats are rated in a rating chart that shows the risk of either attack type to a five-point scale for each CRUD action.
Trike starts with the creation of a requirements model and continues with the creation of a DFD, a Data Flow Diagram. From this point on the risk values are assigned to the threats and an attack graph is created. The Trike model requires a view of the entire system, therefore it can be hard to scale it for larger systems.

== OWASP Tools ==

The Open Web Application Security Project is a NGO whose aim is to improve the security of software. Their main focus are Applications within the World Wide Web, to enable organizations to conceive, develop, acquire, operate, and maintain applications that can be trusted. The programm includes:

* Community-led open source software projects
* Over 275 local chapters worldwide
* Tens of thousands of members
* Industry-leading educational and training conferences

OWASP Projects split in two main categories: Development- and Documentationprojects. The documentation project currently consists of:

* '''OWASP ASVS:''' threat modeling standard to verify applications
* '''The Guide:''' Guidelines for implementing secure webapplications
* '''Top Ten Most DotNet:''' Toolkit to improve .net security
* '''Enigform:''' Testplatform for OpenPGP-related webprojects
* '''ESAPI:''' Free and public methods to secure webapplications
* '''AntiSamy:''' Tool to validate user input in webapplications
* '''XSSer:''' Automatic system to detect Cross-Site-Scripting vulnerabilities
* '''Webgoat:''' Dummy webapplication (e.g. how not to do it)
* '''WebScarab:''' Transparent Webproxy
* '''Mantra Security Workframe:''' Pentesting Toolkit based on Mozilla Firefox
* '''OWASP Threat Dragon:''' Tool to create threat model diagrams

=== Top 10 Web Application Security Risks ===

=== OWASP Threat Dragon ===

Threat Dragon is a free and open-source threat modeling application which is available on multiple plattforms including linux and windows. The application can also be used as a web application. Threat Dragon is capable of:

* designing data flow diagrams
* automatic determining and ranking threats
* suggests mitigations
* entry of mitigations and counter measures

To install it on windows proceed as follows:

* Download and install node.js latest lts version: https://nodejs.org/en/download/
* Download and install git: https://gitforwindows.org/

Open a powershell (with administrator privileges) and run:

cd C:\
git clone https://github.com/mike-goodwin/owasp-threat-dragon-desktop
cd .\owasp-threat-dragon-desktop\
npm install

To start the application run:

npm run start

== References ==

* https://owasp.org
* https://github.com/mike-goodwin/owasp-threat-dragon-desktop
* https://threatmodeler.com/threat-modeling-methodologies-overview-for-your-business/
* https://docs.microsoft.com/en-us/previous-versions/commerce-server/ee823878(v=cs.20)?redirectedfrom=MSDN
* https://technology.ku.edu/octave-method-security-assessment
* Introducing OCTAVE Allegro:Improving the Information Security Risk Assessment Process"; Richard A. Caralli

[[Category:Documentation]]

Threat Modelling

2020-02-17T20:36:07Z

Akrischan:

== Summary ==
Thread modelling is a process used to systematically identify potential threats to products, applications or any other system. It helps to figure out the possible vulnerabilities of a system that are most desired by attackers. There is hardly any product which who threat modeling can´t be used. It helps with the security of software, applications, networks, IoT, business processes and many more.

The reasons to use threat modeling are mainly to build secure design and to document threats and mitigations. It helps to identify threats and compliance requirements and to evaluate their risks to the system as well as is helps to efficient invest given resources. An important part is to document the threats and mitigations found.

The methodology mostly always includes a description, design or model of the potential problem, a list of assumptions that can be checked or challenged and of potential threats, a list of actions to be taken against this threats and a way of validating the output and the action taken.

== When to perform ==

It is never to late to perform Threat Modelling actions but the earlier the better. It is to consider that, if the systems architecture isn´t changing, there are no new processes or dataflows and no changes to the data structure than it is unlikely that there will be new threats that are to be considered. But if some of them change, it is useful to examine what could go wrong in the current change. If something has already happened, it is important to have a look again at the system and check the threat models to find out what was going wrong and what was left out.

== The four questions ==

'''What are we building?'''
This includes the scope of the Threat Model and requires an understanding of the subject to be tested. For that purpose, it can help to have a look at or make yourself a architecture diagram, dataflow transitions or data classifications.

'''What can go wrong?'''
Manly the research activity to find the main threats that appear to the system or the application. It helps to use a structure to think it through or to brainstorm about the possibilities.

'''What are we going to do about it?'''
Turn the findings to action using the most fitted method.

'''Did we a good enough job?'''
Check the quality, feasibility, progress and the planning of the process you developed. If not satisfied, start everything again with a better concept.

== Methodologies ==

=== STRIDE ===

STRIDE is the threat modeling methodology from Microsoft that aligns with their Trustworthy Computing directive of January 2002. It mainly helps Microsoft Windows software developers assure the security during the design phase.
The goal is that the application meets the CIA (Confidentiality, Integrity and Availability) security properties and as well Authorization, Authentication and Non-Repudiation. The six threat categories are:

*'''Spoofing identity:''' assuming or taking on the identity of another person to accomplish a certain goal.
''Example: Using another person’s username and password to login.''

*'''Tampering with data:''' The malicious modification of data.
''Example: The unauthorized changes to persistent data and alteration of data in a dataflow.''

*'''Repudiation:''' Users who deny performing an action without other parties having any way to prove otherwise.
''Example: An illegal action of a user in a system without the possibility to trace the operation.''

*'''Information disclosure:''' The exposure of information to unauthorized individuals.
''Example: If a user can read files, he should not have access to or if an attacker can read transit between computers where he is not supposed to.''

*'''Denial of service:''' A DoS attack denies service to a valid user.
''Example: Making a Webserver unavailable by creating a lot of fake requests.''

*'''Elevation of privilege:''' An unprivileged user gains enough privileged access to destroy the entire system.
''Example: An Attacker has effectively penetrated system defense to the point where he becomes part of the trusted system.''

=== OCTAVE ===

OCTAVE stand for “Operationally Critical Threat, Asset and Vulnerability Evaluation and is developed at the Carnegie Mellon University´s Software Engineering Institute (SEI) and is heavy weighted on assessing organizational risks that result from data asset breaches. It was one of the first specifically for cybersecurity developed threat modeling methods.
Since it is mostly used in companies, it is normally performed in small teams composed of people from the business unit as well as from the IT department to address the security needs. It is driven by the operational risks more than by the theology risks and allows an organization to direct and manage information security risk assessments, communicate key security information as well as focus on protecting key information and to find the best practice and decisions based on the unique risk of their department and thus provides a highly customizable security option.

There are eight processes that are broken in three (or four with phase 0) phases:

'''Phase 0:''' Exploratory phase that determine criteria used.

'''Phase 1:''' Develop initial security strategies

'''Phase 2:''' Technological view to identify infrastructure vulnerabilities

'''Phase 3:''' Risk analysis to develop security strategy and plans

=== Trike ===

The Trike Threat Modeling is an open source process that provides a risk-based approach and risk modeling processes. It is based on a requirement model which ensures that the assigned levels of risk are acceptable to the stakeholders. This means that the modeling process is focused on satisfying the security auditing process from a cyber management perspective.
There are two attack types in the Trike model, an elevation of privilege attack or a denial of service attack and the actions taken are divided into one of four groups called CRUD: ''Create, Read, Update, Delete''. The threats are rated in a rating chart that shows the risk of either attack type to a five-point scale for each CRUD action.
Trike starts with the creation of a requirements model and continues with the creation of a DFD, a Data Flow Diagram. From this point on the risk values are assigned to the threats and an attack graph is created. The Trike model requires a view of the entire system, therefore it can be hard to scale it for larger systems.

== OWASP Tools ==

The Open Web Application Security Project is a NGO whose aim is to improve the security of software. Their main focus are Applications within the World Wide Web, to enable organizations to conceive, develop, acquire, operate, and maintain applications that can be trusted. The programm includes:

* Community-led open source software projects
* Over 275 local chapters worldwide
* Tens of thousands of members
* Industry-leading educational and training conferences

OWASP Projects split in two main categories: Development- and Documentationprojects. The documentation project currently consists of:

* '''OWASP ASVS:''' threat modeling standard to verify applications
* '''The Guide:''' Guidelines for implementing secure webapplications
* '''Top Ten Most DotNet:''' Toolkit to improve .net security
* '''Enigform:''' Testplatform for OpenPGP-related webprojects
* '''ESAPI:''' Free and public methods to secure webapplications
* '''AntiSamy:''' Tool to validate user input in webapplications
* '''XSSer:''' Automatic system to detect Cross-Site-Scripting vulnerabilities
* '''Webgoat:''' Dummy webapplication (e.g. how not to do it)
* '''WebScarab:''' Transparent Webproxy
* '''Mantra Security Workframe:''' Pentesting Toolkit based on Mozilla Firefox
* '''OWASP Threat Dragon:''' Tool to create threat model diagrams

=== Top 10 Web Application Security Risks ===

=== OWASP Threat Dragon ===

Threat Dragon is a free and open-source threat modeling application which is available on multiple plattforms including linux and windows. The application can also be used as a web application. Threat Dragon is capable of:

* designing data flow diagrams
* automatic determining and ranking threats
* suggests mitigations
* entry of mitigations and counter measures

To install it on windows proceed as follows:

* Download node.js latest lts version: https://nodejs.org/en/download/
* Install git: https://gitforwindows.org/

Open a powershell (with administrator privileges) and run:

cd C:\
git clone https://github.com/mike-goodwin/owasp-threat-dragon-desktop
cd .\owasp-threat-dragon-desktop\
npm install

To start the application run:

npm run start

== References ==

* https://owasp.org
* https://github.com/mike-goodwin/owasp-threat-dragon-desktop
* https://threatmodeler.com/threat-modeling-methodologies-overview-for-your-business/
* https://docs.microsoft.com/en-us/previous-versions/commerce-server/ee823878(v=cs.20)?redirectedfrom=MSDN
* https://technology.ku.edu/octave-method-security-assessment
* Introducing OCTAVE Allegro:Improving the Information Security Risk Assessment Process"; Richard A. Caralli

[[Category:Documentation]]

Threat Modelling

2020-02-17T20:31:45Z

Akrischan:

== Summary ==
Thread modelling is a process used to systematically identify potential threats to products, applications or any other system. It helps to figure out the possible vulnerabilities of a system that are most desired by attackers. There is hardly any product which who threat modeling can´t be used. It helps with the security of software, applications, networks, IoT, business processes and many more.

The reasons to use threat modeling are mainly to build secure design and to document threats and mitigations. It helps to identify threats and compliance requirements and to evaluate their risks to the system as well as is helps to efficient invest given resources. An important part is to document the threats and mitigations found.

The methodology mostly always includes a description, design or model of the potential problem, a list of assumptions that can be checked or challenged and of potential threats, a list of actions to be taken against this threats and a way of validating the output and the action taken.

== When to perform ==

It is never to late to perform Threat Modelling actions but the earlier the better. It is to consider that, if the systems architecture isn´t changing, there are no new processes or dataflows and no changes to the data structure than it is unlikely that there will be new threats that are to be considered. But if some of them change, it is useful to examine what could go wrong in the current change. If something has already happened, it is important to have a look again at the system and check the threat models to find out what was going wrong and what was left out.

== The four questions ==

'''What are we building?'''
This includes the scope of the Threat Model and requires an understanding of the subject to be tested. For that purpose, it can help to have a look at or make yourself a architecture diagram, dataflow transitions or data classifications.

'''What can go wrong?'''
Manly the research activity to find the main threats that appear to the system or the application. It helps to use a structure to think it through or to brainstorm about the possibilities.

'''What are we going to do about it?'''
Turn the findings to action using the most fitted method.

'''Did we a good enough job?'''
Check the quality, feasibility, progress and the planning of the process you developed. If not satisfied, start everything again with a better concept.

== Methodologies ==

=== STRIDE ===

STRIDE is the threat modeling methodology from Microsoft that aligns with their Trustworthy Computing directive of January 2002. It mainly helps Microsoft Windows software developers assure the security during the design phase.
The goal is that the application meets the CIA (Confidentiality, Integrity and Availability) security properties and as well Authorization, Authentication and Non-Repudiation. The six threat categories are:

*'''Spoofing identity:''' assuming or taking on the identity of another person to accomplish a certain goal.
''Example: Using another person’s username and password to login.''

*'''Tampering with data:''' The malicious modification of data.
''Example: The unauthorized changes to persistent data and alteration of data in a dataflow.''

*'''Repudiation:''' Users who deny performing an action without other parties having any way to prove otherwise.
''Example: An illegal action of a user in a system without the possibility to trace the operation.''

*'''Information disclosure:''' The exposure of information to unauthorized individuals.
''Example: If a user can read files, he should not have access to or if an attacker can read transit between computers where he is not supposed to.''

*'''Denial of service:''' A DoS attack denies service to a valid user.
''Example: Making a Webserver unavailable by creating a lot of fake requests.''

*'''Elevation of privilege:''' An unprivileged user gains enough privileged access to destroy the entire system.
''Example: An Attacker has effectively penetrated system defense to the point where he becomes part of the trusted system.''

=== OCTAVE ===

OCTAVE stand for “Operationally Critical Threat, Asset and Vulnerability Evaluation and is developed at the Carnegie Mellon University´s Software Engineering Institute (SEI) and is heavy weighted on assessing organizational risks that result from data asset breaches. It was one of the first specifically for cybersecurity developed threat modeling methods.
Since it is mostly used in companies, it is normally performed in small teams composed of people from the business unit as well as from the IT department to address the security needs. It is driven by the operational risks more than by the theology risks and allows an organization to direct and manage information security risk assessments, communicate key security information as well as focus on protecting key information and to find the best practice and decisions based on the unique risk of their department and thus provides a highly customizable security option.

There are eight processes that are broken in three (or four with phase 0) phases:

'''Phase 0:''' Exploratory phase that determine criteria used.

'''Phase 1:''' Develop initial security strategies

'''Phase 2:''' Technological view to identify infrastructure vulnerabilities

'''Phase 3:''' Risk analysis to develop security strategy and plans

=== Trike ===

The Trike Threat Modeling is an open source process that provides a risk-based approach and risk modeling processes. It is based on a requirement model which ensures that the assigned levels of risk are acceptable to the stakeholders. This means that the modeling process is focused on satisfying the security auditing process from a cyber management perspective.
There are two attack types in the Trike model, an elevation of privilege attack or a denial of service attack and the actions taken are divided into one of four groups called CRUD: ''Create, Read, Update, Delete''. The threats are rated in a rating chart that shows the risk of either attack type to a five-point scale for each CRUD action.
Trike starts with the creation of a requirements model and continues with the creation of a DFD, a Data Flow Diagram. From this point on the risk values are assigned to the threats and an attack graph is created. The Trike model requires a view of the entire system, therefore it can be hard to scale it for larger systems.

== OWASP Tools ==

The Open Web Application Security Project is a NGO whose aim is to improve the security of software. Their main focus are Applications within the World Wide Web, to enable organizations to conceive, develop, acquire, operate, and maintain applications that can be trusted. The programm includes:

* Community-led open source software projects
* Over 275 local chapters worldwide
* Tens of thousands of members
* Industry-leading educational and training conferences

OWASP Projects split in two main categories: Development- and Documentationprojects. The documentation project currently consists of:

* '''OWASP ASVS:''' threat modeling standard to verify applications
* '''The Guide:''' Guidelines for implementing secure webapplications
* '''Top Ten Most DotNet:''' Toolkit to improve .net security
* '''Enigform:''' Testplatform for OpenPGP-related webprojects
* '''ESAPI:''' Free and public methods to secure webapplications
* '''AntiSamy:''' Tool to validate user input in webapplications
* '''XSSer:''' Automatic system to detect Cross-Site-Scripting vulnerabilities
* '''Webgoat:''' Dummy webapplication (e.g. how not to do it)
* '''WebScarab:''' Transparent Webproxy
* '''Mantra Security Workframe:''' Pentesting Toolkit based on Mozilla Firefox
* '''OWASP Threat Dragon:''' Tool to create threat model diagrams

=== Top 10 Web Application Security Risks ===

=== OWASP Threat Dragon ===

Threat Dragon is a free and open-source threat modeling application which is available on multiple plattforms including linux and windows. The application can also be used as a web application. Threat Dragon is capable of:

* designing data flow diagrams
* automatic determining and ranking threats
* suggests mitigations
* entry of mitigations and counter measures

To install it on windows proceed as follows:

* Download node.js latest lts version: https://nodejs.org/en/download/
* Install git: https://gitforwindows.org/

Open a powershell (with administrator privileges) and run:

git clone https://github.com/mike-goodwin/owasp-threat-dragon-desktop
npm install

To start the application run:

npm run start

== References ==

* https://owasp.org
* https://github.com/mike-goodwin/owasp-threat-dragon-desktop
* https://threatmodeler.com/threat-modeling-methodologies-overview-for-your-business/
* https://docs.microsoft.com/en-us/previous-versions/commerce-server/ee823878(v=cs.20)?redirectedfrom=MSDN
* https://technology.ku.edu/octave-method-security-assessment
* Introducing OCTAVE Allegro:Improving the Information Security Risk Assessment Process"; Richard A. Caralli

[[Category:Documentation]]

Threat Modelling

2020-02-17T20:29:29Z

Akrischan:

== Summary ==
Thread modelling is a process used to systematically identify potential threats to products, applications or any other system. It helps to figure out the possible vulnerabilities of a system that are most desired by attackers. There is hardly any product which who threat modeling can´t be used. It helps with the security of software, applications, networks, IoT, business processes and many more.

The reasons to use threat modeling are mainly to build secure design and to document threats and mitigations. It helps to identify threats and compliance requirements and to evaluate their risks to the system as well as is helps to efficient invest given resources. An important part is to document the threats and mitigations found.

The methodology mostly always includes a description, design or model of the potential problem, a list of assumptions that can be checked or challenged and of potential threats, a list of actions to be taken against this threats and a way of validating the output and the action taken.

== When to perform ==

It is never to late to perform Threat Modelling actions but the earlier the better. It is to consider that, if the systems architecture isn´t changing, there are no new processes or dataflows and no changes to the data structure than it is unlikely that there will be new threats that are to be considered. But if some of them change, it is useful to examine what could go wrong in the current change. If something has already happened, it is important to have a look again at the system and check the threat models to find out what was going wrong and what was left out.

== The four questions ==

'''What are we building?'''
This includes the scope of the Threat Model and requires an understanding of the subject to be tested. For that purpose, it can help to have a look at or make yourself a architecture diagram, dataflow transitions or data classifications.

'''What can go wrong?'''
Manly the research activity to find the main threats that appear to the system or the application. It helps to use a structure to think it through or to brainstorm about the possibilities.

'''What are we going to do about it?'''
Turn the findings to action using the most fitted method.

'''Did we a good enough job?'''
Check the quality, feasibility, progress and the planning of the process you developed. If not satisfied, start everything again with a better concept.

== Methodologies ==

=== STRIDE ===

STRIDE is the threat modeling methodology from Microsoft that aligns with their Trustworthy Computing directive of January 2002. It mainly helps Microsoft Windows software developers assure the security during the design phase.
The goal is that the application meets the CIA (Confidentiality, Integrity and Availability) security properties and as well Authorization, Authentication and Non-Repudiation. The six threat categories are:

*'''Spoofing identity:''' assuming or taking on the identity of another person to accomplish a certain goal.
''Example: Using another person’s username and password to login.''

*'''Tampering with data:''' The malicious modification of data.
''Example: The unauthorized changes to persistent data and alteration of data in a dataflow.''

*'''Repudiation:''' Users who deny performing an action without other parties having any way to prove otherwise.
''Example: An illegal action of a user in a system without the possibility to trace the operation.''

*'''Information disclosure:''' The exposure of information to unauthorized individuals.
''Example: If a user can read files, he should not have access to or if an attacker can read transit between computers where he is not supposed to.''

*'''Denial of service:''' A DoS attack denies service to a valid user.
''Example: Making a Webserver unavailable by creating a lot of fake requests.''

*'''Elevation of privilege:''' An unprivileged user gains enough privileged access to destroy the entire system.
''Example: An Attacker has effectively penetrated system defense to the point where he becomes part of the trusted system.''

=== OCTAVE ===

OCTAVE stand for “Operationally Critical Threat, Asset and Vulnerability Evaluation and is developed at the Carnegie Mellon University´s Software Engineering Institute (SEI) and is heavy weighted on assessing organizational risks that result from data asset breaches. It was one of the first specifically for cybersecurity developed threat modeling methods.
Since it is mostly used in companies, it is normally performed in small teams composed of people from the business unit as well as from the IT department to address the security needs. It is driven by the operational risks more than by the theology risks and allows an organization to direct and manage information security risk assessments, communicate key security information as well as focus on protecting key information and to find the best practice and decisions based on the unique risk of their department and thus provides a highly customizable security option.

There are eight processes that are broken in three (or four with phase 0) phases:

'''Phase 0:''' Exploratory phase that determine criteria used.

'''Phase 1:''' Develop initial security strategies

'''Phase 2:''' Technological view to identify infrastructure vulnerabilities

'''Phase 3:''' Risk analysis to develop security strategy and plans

=== Trike ===

The Trike Threat Modeling is an open source process that provides a risk-based approach and risk modeling processes. It is based on a requirement model which ensures that the assigned levels of risk are acceptable to the stakeholders. This means that the modeling process is focused on satisfying the security auditing process from a cyber management perspective.
There are two attack types in the Trike model, an elevation of privilege attack or a denial of service attack and the actions taken are divided into one of four groups called CRUD: ''Create, Read, Update, Delete''. The threats are rated in a rating chart that shows the risk of either attack type to a five-point scale for each CRUD action.
Trike starts with the creation of a requirements model and continues with the creation of a DFD, a Data Flow Diagram. From this point on the risk values are assigned to the threats and an attack graph is created. The Trike model requires a view of the entire system, therefore it can be hard to scale it for larger systems.

== OWASP Tools ==

The Open Web Application Security Project is a NGO whose aim is to improve the security of software. Their main focus are Applications within the World Wide Web, to enable organizations to conceive, develop, acquire, operate, and maintain applications that can be trusted. The programm includes:

* Community-led open source software projects
* Over 275 local chapters worldwide
* Tens of thousands of members
* Industry-leading educational and training conferences

OWASP Projects split in two main categories: Development- and Documentationprojects. The documentation project currently consists of:

* '''OWASP ASVS:''' threat modeling standard to verify applications
* '''The Guide:''' Guidelines for implementing secure webapplications
* '''Top Ten Most DotNet:''' Toolkit to improve .net security
* '''Enigform:''' Testplatform for OpenPGP-related webprojects
* '''ESAPI:''' Free and public methods to secure webapplications
* '''AntiSamy:''' Tool to validate user input in webapplications
* '''XSSer:''' Automatic system to detect Cross-Site-Scripting vulnerabilities
* '''Webgoat:''' Dummy webapplication (e.g. how not to do it)
* '''WebScarab:''' Transparent Webproxy
* '''Mantra Security Workframe:''' Pentesting Toolkit based on Mozilla Firefox
* '''OWASP Threat Dragon:''' Tool to create threat model diagrams

=== Top 10 Web Application Security Risks ===

=== OWASP Threat Dragon ===

Threat Dragon is a free and open-source threat modeling application which is available on multiple plattforms including linux and windows. The application can also be used as a web application. Threat Dragon is capable of:

* designing data flow diagrams
* automatic determining and ranking threats
* suggests mitigations
* entry of mitigations and counter measures

To install it on windows proceed as follows:

* Download node.js latest lts version: https://nodejs.org/en/download/
* Install git: https://gitforwindows.org/

== References ==

* https://owasp.org
* https://github.com/mike-goodwin/owasp-threat-dragon-desktop
* https://threatmodeler.com/threat-modeling-methodologies-overview-for-your-business/
* https://docs.microsoft.com/en-us/previous-versions/commerce-server/ee823878(v=cs.20)?redirectedfrom=MSDN
* https://technology.ku.edu/octave-method-security-assessment
* Introducing OCTAVE Allegro:Improving the Information Security Risk Assessment Process"; Richard A. Caralli

[[Category:Documentation]]

Threat Modelling

2020-02-17T20:16:36Z

Akrischan:

Threat Modelling

2020-02-17T20:16:13Z

Akrischan:

Threat Modelling

2020-02-17T20:13:50Z

Akrischan:

Threat Modelling

2020-02-17T20:11:49Z

Akrischan:

Threat Modelling

2020-02-17T20:10:00Z

Akrischan:

Threat Modelling

2020-02-17T19:51:45Z

Akrischan:

Threat Modelling

2020-02-17T19:46:06Z

Akrischan:

Bluetooth Pentesting Tools (HW/SW)

2020-02-17T19:23:56Z

Akrischan:

== Summary ==

This article describes various tools for bluetooth penetration testing and aims to provide an overview to choose the right tool for a use case.

== Requirements ==

* Operating system: Kali Linux amd64 2019.2
* Packages: Individual shown for each tool

In order to use hardware pentesting devices a dedicated installation of kali linux is recommended but it is also possible to use hypervisors which are capable of passing USB devices from the host- to the guestsystem e.g. VMWare Workstation or the free hypervisor VirtualBox.

== Information gathering ==

The offical linux bluetooth protocol stack BlueZ is already installed on kali linux but can be installed on other linux maschines with:

apt install -y bluez bluez-utils
systemctl start bluetooth.service
systemctl status bluetooth.service

[[File:Bluetoothservice.PNG]]

=== hcitool ===

To start with penetration testing we need to gather information about our environment, for this purpose scan for available bluetooth devices with the included packages 'hcitool' or 'bluetoothctl'.

First check if your bluetooth device is available:

hciconfig

[[File:Hciconfig.PNG]]

Scan for BR/EDR Bluetooth devices with hcitool:

hcitool scan

[[File:Scanbr.PNG]]

In order to scan for BLE devices use:

hcitool lescan

=== bluetoothctl ===

Alternatively you can use bluetoothctl which is also included in the bluez-utils package:

[[File:Btctl.PNG]]

=== bettercap ===

In order to complete these steps, you must have followed [[Install_Bettercap_on_Kali_Linux]] before.

Bettercap is a powerful tool for Wifi, Bluetooth LE or ethernet hijacking and provides tools for MITM attacks. Bettercap can also be used to gather informations about bluetooth devices like shown below:

Start bettercap with:

bettercap

Scanning for BLE devices:

ble.recon on

Show a formatted output of found BLE devices:

ble.show

[[File:Bettercapblescan.PNG]]

=== bluelog ===

Another great tool for bluetooth device discovery is 'bluelog'. It is extremly lightweight and can be automated for background usage without user intervention. Bluelog is already preinstalled on kali linux but can be installed with:

apt install -y bluelog

To start scanning for bluetooth devices use:

bluelog -nmtc

(n=log device names;m=log manufacturer;t=log timestamps of discovery;c=log device class)

[[File:Bluelog.PNG]]

== Capturing bluetooth traffic ==

=== btmon ===

With the preinstalled package 'btmon' it is possible to capture traffic between the HCI and the controller:

btmon --write ~/Documents/bttraffic.snoop

These files can be viewed and analysed with 'Wireshark' which is also preinstalled on kali linux.

=== Wireshark ===

Alternatively you can capture bluetooth traffic directly with Wireshark. Start Wireshark with...

wireshark -w ~/Documents/bttraffic.snoop

...and select your bluetooth interface e.g. bluetooth0 or bluetooth1.

[[File:Wiresharkhciscan.PNG]]

== Bluetooth Pentesting Software ==

In the following chapter we will present some software pentesting tools which are used for ethical bluetooth device hacking.

=== BlueMaho ===

BlueMaho is a tool suite for bluetooth device pentesting and provides various exploits. It is written in python and uses wxPython. The feature set includes: scanning, tracking, alerts on new devices or targeted devices, sending files or changing BT values like the BD_ADDR.

Although it is still listed in the kali linux tool list, it has to be manually installed:

apt install autoconf build-essential build-dep git python-wxtools
git clone https://github.com/zenware/bluemaho
cd bluemaho/config
./build.sh

In order to run the GUI use:

./bluemaho.py

[[File:Bluemaho.PNG]]

=== GATT Tool ===

A great BLE penetration testing example with the powerful GATT Tool can be found here:

[[Bluetooth_GATT_Tool_Basics_with_the_MiPow_Playbulb_Candle]]

=== Bluepot ===

Bluepot is a Bluetooth Honeypot written in Java, it is designed to accept and store any malware sent to it and interact with common Bluetooth attacks. The system also allows monitoring of attacks via a graphical user interface that provides graphs, lists, a dashboard and further detailed analysis from log files.

In order to install bluepot use following commands:

wget https://github.com/andrewmichaelsmith/bluepot/raw/master/bin/bluepot-0.1.tar.gz
tar xfz bluepot-0.1.tar.gz
java -jar bluepot/BluePot-0.1.jar

[[File:Bluepot.PNG]]

=== spooftooph ===

Spooftooph is designed to automate spoofing or cloning Bluetooth device information. The software is able to clone and log bluetooth devices, generate or change new random bluetooth profiles and specify device information for bluetooth interfaces.

E.g.: Spoof your own device address for the interface hci0:

[[File:Btspoofbdaddr.PNG]]

== Bluetooth Pentesting Hardware ==

For hardware pentesting devices like the Ubertooth one please see following documentations:

* [[Bluetooth_Sniffing_with_Ubertooth:_A_Step-by-step_guide]]
* [[Bluetooth_Hacking_Ubertooth]]

== References ==

* https://tools.kali.org
* https://www.offensive-security.com/
* https://www.kali.org
* https://github.com/andrewmichaelsmith/bluepot
* https://github.com/zenware/bluemaho

[[Category:Documentation]]

Bluetooth Pentesting Tools (HW/SW)

2020-02-17T19:21:56Z

Akrischan:

== Summary ==

This article describes various tools for bluetooth penetration testing and aims to provide an overview to choose the right tool for a use case.

== Requirements ==

* Operating system: Kali Linux amd64 2019.2
* Packages: Individual shown for each tool

In order to use hardware pentesting devices a dedicated installation of kali linux is recommended but it is also possible to use hypervisors which are capable of passing USB devices from the host- to the guestsystem e.g. VMWare Workstation or the free hypervisor VirtualBox.

== Information gathering ==

The offical linux bluetooth protocol stack BlueZ is already installed on kali linux but can be installed on other linux maschines with:

apt install -y bluez bluez-utils
systemctl start bluetooth.service
systemctl status bluetooth.service

[[File:Bluetoothservice.PNG]]

=== hcitool ===

To start with penetration testing we need to gather information about our environment, for this purpose scan for available bluetooth devices with the included packages 'hcitool' or 'bluetoothctl'.

First check if your bluetooth device is available:

hciconfig

[[File:Hciconfig.PNG]]

Scan for BR/EDR Bluetooth devices with hcitool:

hcitool scan

[[File:Scanbr.PNG]]

In order to scan for BLE devices use:

hcitool lescan

=== bluetoothctl ===

Alternatively you can use bluetoothctl which is also included in the bluez-utils package:

[[File:Btctl.PNG]]

=== bettercap ===

In order to complete these steps, you must have followed [[Install_Bettercap_on_Kali_Linux]] before.

Bettercap is a powerful tool for Wifi, Bluetooth LE or ethernet hijacking and provides tools for MITM attacks. Bettercap can also be used to gather informations about bluetooth devices like shown below:

Start bettercap with:

bettercap

Scanning for BLE devices:

ble.recon on

Show a formatted output of found BLE devices:

ble.show

[[File:Bettercapblescan.PNG]]

=== bluelog ===

Another great tool for bluetooth device discovery is 'bluelog'. It is extremly lightweight and can be automated for background usage without user intervention. Bluelog is already preinstalled on kali linux but can be installed with:

apt install -y bluelog

To start scanning for bluetooth devices use:

bluelog -nmtc

(n=log device names;m=log manufacturer;t=log timestamps of discovery;c=log device class)

[[File:Bluelog.PNG]]

== Capturing bluetooth traffic ==

=== btmon ===

With the preinstalled package 'btmon' it is possible to capture traffic between the HCI and the controller:

btmon --write ~/Documents/bttraffic.snoop

These files can be viewed and analysed with 'Wireshark' which is also preinstalled on kali linux.

=== Wireshark ===

Alternatively you can capture bluetooth traffic directly with Wireshark. Start Wireshark with...

wireshark -w ~/Documents/bttraffic.snoop

...and select your bluetooth interface e.g. bluetooth0 or bluetooth1.

[[File:Wiresharkhciscan.PNG]]

== Bluetooth Pentesting Software ==

In the following chapter we will present some software pentesting tools which are used for ethical bluetooth device hacking.

=== BlueMaho ===

BlueMaho is a tool suite for bluetooth device pentesting and provides various exploits. It is written in python and uses wxPython. The feature set includes: scanning, tracking, alerts on new devices or targeted devices, sending files or changing BT values like the BD_ADDR.

Although it is still listed in the kali linux tool list, it has to be manually installed:

apt install autoconf build-essential build-dep git python-wxtools
git clone https://github.com/zenware/bluemaho
cd bluemaho/config
./build.sh

In order to run the GUI use:

./bluemaho.py

[[File:Bluemaho.PNG]]

=== GATT Tool ===

A great BLE penetration testing example with the powerful GATT Tool can be found here:

[[Bluetooth_GATT_Tool_Basics_with_the_MiPow_Playbulb_Candle]]

=== Bluepot ===

Bluepot is a Bluetooth Honeypot written in Java, it is designed to accept and store any malware sent to it and interact with common Bluetooth attacks. The system also allows monitoring of attacks via a graphical user interface that provides graphs, lists, a dashboard and further detailed analysis from log files.

In order to install bluepot use following commands:

wget https://github.com/andrewmichaelsmith/bluepot/raw/master/bin/bluepot-0.1.tar.gz
tar xfz bluepot-0.1.tar.gz
java -jar bluepot/BluePot-0.1.jar

[[File:Bluepot.PNG]]

=== spooftooph ===

Spooftooph is designed to automate spoofing or cloning Bluetooth device information. The software is able to clone and log bluetooth devices, generate or change new random bluetooth profiles and specify device information for bluetooth interfaces.

[[File:Btspoofbdaddr.PNG]]

== Bluetooth Pentesting Hardware ==

For hardware pentesting devices like the Ubertooth one please see following documentations:

* [[Bluetooth_Sniffing_with_Ubertooth:_A_Step-by-step_guide]]
* [[Bluetooth_Hacking_Ubertooth]]

== References ==

* https://tools.kali.org
* https://www.offensive-security.com/
* https://www.kali.org
* https://github.com/andrewmichaelsmith/bluepot
* https://github.com/zenware/bluemaho

[[Category:Documentation]]

File:Btspoofbdaddr.PNG

2020-02-17T19:21:50Z

Akrischan:

Bluetooth Pentesting Tools (HW/SW)

2020-02-17T19:13:29Z

Akrischan:

== Summary ==

This article describes various tools for bluetooth penetration testing and aims to provide an overview to choose the right tool for a use case.

== Requirements ==

* Operating system: Kali Linux amd64 2019.2
* Packages: Individual shown for each tool

In order to use hardware pentesting devices a dedicated installation of kali linux is recommended but it is also possible to use hypervisors which are capable of passing USB devices from the host- to the guestsystem e.g. VMWare Workstation or the free hypervisor VirtualBox.

== Information gathering ==

The offical linux bluetooth protocol stack BlueZ is already installed on kali linux but can be installed on other linux maschines with:

apt install -y bluez bluez-utils
systemctl start bluetooth.service
systemctl status bluetooth.service

[[File:Bluetoothservice.PNG]]

=== hcitool ===

To start with penetration testing we need to gather information about our environment, for this purpose scan for available bluetooth devices with the included packages 'hcitool' or 'bluetoothctl'.

First check if your bluetooth device is available:

hciconfig

[[File:Hciconfig.PNG]]

Scan for BR/EDR Bluetooth devices with hcitool:

hcitool scan

[[File:Scanbr.PNG]]

In order to scan for BLE devices use:

hcitool lescan

=== bluetoothctl ===

Alternatively you can use bluetoothctl which is also included in the bluez-utils package:

[[File:Btctl.PNG]]

=== bettercap ===

In order to complete these steps, you must have followed [[Install_Bettercap_on_Kali_Linux]] before.

Bettercap is a powerful tool for Wifi, Bluetooth LE or ethernet hijacking and provides tools for MITM attacks. Bettercap can also be used to gather informations about bluetooth devices like shown below:

Start bettercap with:

bettercap

Scanning for BLE devices:

ble.recon on

Show a formatted output of found BLE devices:

ble.show

[[File:Bettercapblescan.PNG]]

=== bluelog ===

Another great tool for bluetooth device discovery is 'bluelog'. It is extremly lightweight and can be automated for background usage without user intervention. Bluelog is already preinstalled on kali linux but can be installed with:

apt install -y bluelog

To start scanning for bluetooth devices use:

bluelog -nmtc

(n=log device names;m=log manufacturer;t=log timestamps of discovery;c=log device class)

[[File:Bluelog.PNG]]

== Capturing bluetooth traffic ==

=== btmon ===

With the preinstalled package 'btmon' it is possible to capture traffic between the HCI and the controller:

btmon --write ~/Documents/bttraffic.snoop

These files can be viewed and analysed with 'Wireshark' which is also preinstalled on kali linux.

=== Wireshark ===

Alternatively you can capture bluetooth traffic directly with Wireshark. Start Wireshark with...

wireshark -w ~/Documents/bttraffic.snoop

...and select your bluetooth interface e.g. bluetooth0 or bluetooth1.

[[File:Wiresharkhciscan.PNG]]

== Bluetooth Pentesting Software ==

In the following chapter we will present some software pentesting tools which are used for ethical bluetooth device hacking.

=== BlueMaho ===

BlueMaho is a tool suite for bluetooth device pentesting and provides various exploits. It is written in python and uses wxPython. The feature set includes: scanning, tracking, alerts on new devices or targeted devices, sending files or changing BT values like the BD_ADDR.

Although it is still listed in the kali linux tool list, it has to be manually installed:

apt install autoconf build-essential build-dep git python-wxtools
git clone https://github.com/zenware/bluemaho
cd bluemaho/config
./build.sh

In order to run the GUI use:

./bluemaho.py

[[File:Bluemaho.PNG]]

=== GATT Tool ===

A great BLE penetration testing example with the powerful GATT Tool can be found here:

[[Bluetooth_GATT_Tool_Basics_with_the_MiPow_Playbulb_Candle]]

=== Bluepot ===

Bluepot is a Bluetooth Honeypot written in Java, it is designed to accept and store any malware sent to it and interact with common Bluetooth attacks. The system also allows monitoring of attacks via a graphical user interface that provides graphs, lists, a dashboard and further detailed analysis from log files.

In order to install bluepot use following commands:

wget https://github.com/andrewmichaelsmith/bluepot/raw/master/bin/bluepot-0.1.tar.gz
tar xfz bluepot-0.1.tar.gz
java -jar bluepot/BluePot-0.1.jar

[[File:Bluepot.PNG]]

=== spooftooph ===

Spooftooph is designed to automate spoofing or cloning Bluetooth device information. The software is able to clone and log bluetooth devices, generate new random bluetooth profiles,

== Bluetooth Pentesting Hardware ==

For hardware pentesting devices like the Ubertooth one please see following documentations:

* [[Bluetooth_Sniffing_with_Ubertooth:_A_Step-by-step_guide]]
* [[Bluetooth_Hacking_Ubertooth]]

== References ==

* https://tools.kali.org
* https://www.offensive-security.com/
* https://www.kali.org
* https://github.com/andrewmichaelsmith/bluepot
* https://github.com/zenware/bluemaho

[[Category:Documentation]]

Bluetooth Pentesting Tools (HW/SW)

2020-02-17T19:09:09Z

Akrischan:

== Summary ==

This article describes various tools for bluetooth penetration testing and aims to provide an overview to choose the right tool for a use case.

== Requirements ==

* Operating system: Kali Linux amd64 2019.2
* Packages: Individual shown for each tool

In order to use hardware pentesting devices a dedicated installation of kali linux is recommended but it is also possible to use hypervisors which are capable of passing USB devices from the host- to the guestsystem e.g. VMWare Workstation or the free hypervisor VirtualBox.

== Information gathering ==

The offical linux bluetooth protocol stack BlueZ is already installed on kali linux but can be installed on other linux maschines with:

apt install -y bluez bluez-utils
systemctl start bluetooth.service
systemctl status bluetooth.service

[[File:Bluetoothservice.PNG]]

=== hcitool ===

To start with penetration testing we need to gather information about our environment, for this purpose scan for available bluetooth devices with the included packages 'hcitool' or 'bluetoothctl'.

First check if your bluetooth device is available:

hciconfig

[[File:Hciconfig.PNG]]

Scan for BR/EDR Bluetooth devices with hcitool:

hcitool scan

[[File:Scanbr.PNG]]

In order to scan for BLE devices use:

hcitool lescan

=== bluetoothctl ===

Alternatively you can use bluetoothctl which is also included in the bluez-utils package:

[[File:Btctl.PNG]]

=== bettercap ===

In order to complete these steps, you must have followed [[Install_Bettercap_on_Kali_Linux]] before.

Bettercap is a powerful tool for Wifi, Bluetooth LE or ethernet hijacking and provides tools for MITM attacks. Bettercap can also be used to gather informations about bluetooth devices like shown below:

Start bettercap with:

bettercap

Scanning for BLE devices:

ble.recon on

Show a formatted output of found BLE devices:

ble.show

[[File:Bettercapblescan.PNG]]

=== bluelog ===

Another great tool for bluetooth device discovery is 'bluelog'. It is extremly lightweight and can be automated for background usage without user intervention. Bluelog is already preinstalled on kali linux but can be installed with:

apt install -y bluelog

To start scanning for bluetooth devices use:

bluelog -nmtc

(n=log device names;m=log manufacturer;t=log timestamps of discovery;c=log device class)

[[File:Bluelog.PNG]]

== Capturing bluetooth traffic ==

=== btmon ===

With the preinstalled package 'btmon' it is possible to capture traffic between the HCI and the controller:

btmon --write ~/Documents/bttraffic.snoop

These files can be viewed and analysed with 'Wireshark' which is also preinstalled on kali linux.

=== Wireshark ===

Alternatively you can capture bluetooth traffic directly with Wireshark. Start Wireshark with...

wireshark -w ~/Documents/bttraffic.snoop

...and select your bluetooth interface e.g. bluetooth0 or bluetooth1.

[[File:Wiresharkhciscan.PNG]]

== Bluetooth Pentesting Software ==

In the following chapter we will present some software pentesting tools which are used for ethical bluetooth device hacking.

=== BlueMaho ===

BlueMaho is a tool suite for bluetooth device pentesting and provides various exploits. It is written in python and uses wxPython. The feature set includes: scanning, tracking, alerts on new devices or targeted devices, sending files, changing BT values like the BD_ADDR.

Although it is still listed in the kali linux tool list, it has to be manually installed:

apt install autoconf build-essential build-dep git python-wxtools
git clone https://github.com/zenware/bluemaho
cd bluemaho/config
./build.sh

In order to run the GUI use:

./bluemaho.py

[[File:Bluemaho.PNG]]

=== GATT Tool ===

A great BLE penetration testing example with the powerful GATT Tool can be found here:

[[Bluetooth_GATT_Tool_Basics_with_the_MiPow_Playbulb_Candle]]

=== Bluepot ===

Bluepot is a Bluetooth Honeypot written in Java, it is designed to accept and store any malware sent to it and interact with common Bluetooth attacks. The system also allows monitoring of attacks via a graphical user interface that provides graphs, lists, a dashboard and further detailed analysis from log files.

In order to install bluepot use following commands:

wget https://github.com/andrewmichaelsmith/bluepot/raw/master/bin/bluepot-0.1.tar.gz
tar xfz bluepot-0.1.tar.gz
java -jar bluepot/BluePot-0.1.jar

[[File:Bluepot.PNG]]

== Bluetooth Pentesting Hardware ==

For hardware pentesting devices like the Ubertooth one please see following documentations:

* [[Bluetooth_Sniffing_with_Ubertooth:_A_Step-by-step_guide]]
* [[Bluetooth_Hacking_Ubertooth]]

== References ==

* https://wikipedia.org
* https://google.com

[[Category:Documentation]]

File:Bluepot.PNG

2020-02-17T19:08:47Z

Akrischan:

Bluetooth Pentesting Tools (HW/SW)

2020-02-17T19:00:01Z

Akrischan:

== Summary ==

This article describes various tools for bluetooth penetration testing and aims to provide an overview to choose the right tool for a use case.

== Requirements ==

* Operating system: Kali Linux amd64 2019.2
* Packages: Individual shown for each tool

In order to use hardware pentesting devices a dedicated installation of kali linux is recommended but it is also possible to use hypervisors which are capable of passing USB devices from the host- to the guestsystem e.g. VMWare Workstation or the free hypervisor VirtualBox.

== Information gathering ==

The offical linux bluetooth protocol stack BlueZ is already installed on kali linux but can be installed on other linux maschines with:

apt install -y bluez bluez-utils
systemctl start bluetooth.service
systemctl status bluetooth.service

[[File:Bluetoothservice.PNG]]

=== hcitool ===

To start with penetration testing we need to gather information about our environment, for this purpose scan for available bluetooth devices with the included packages 'hcitool' or 'bluetoothctl'.

First check if your bluetooth device is available:

hciconfig

[[File:Hciconfig.PNG]]

Scan for BR/EDR Bluetooth devices with hcitool:

hcitool scan

[[File:Scanbr.PNG]]

In order to scan for BLE devices use:

hcitool lescan

=== bluetoothctl ===

Alternatively you can use bluetoothctl which is also included in the bluez-utils package:

[[File:Btctl.PNG]]

=== bettercap ===

In order to complete these steps, you must have followed [[Install_Bettercap_on_Kali_Linux]] before.

Bettercap is a powerful tool for Wifi, Bluetooth LE or ethernet hijacking and provides tools for MITM attacks. Bettercap can also be used to gather informations about bluetooth devices like shown below:

Start bettercap with:

bettercap

Scanning for BLE devices:

ble.recon on

Show a formatted output of found BLE devices:

ble.show

[[File:Bettercapblescan.PNG]]

=== bluelog ===

Another great tool for bluetooth device discovery is 'bluelog'. It is extremly lightweight and can be automated for background usage without user intervention. Bluelog is already preinstalled on kali linux but can be installed with:

apt install -y bluelog

To start scanning for bluetooth devices use:

bluelog -nmtc

(n=log device names;m=log manufacturer;t=log timestamps of discovery;c=log device class)

[[File:Bluelog.PNG]]

== Capturing bluetooth traffic ==

=== btmon ===

With the preinstalled package 'btmon' it is possible to capture traffic between the HCI and the controller:

btmon --write ~/Documents/bttraffic.snoop

These files can be viewed and analysed with 'Wireshark' which is also preinstalled on kali linux.

=== Wireshark ===

Alternatively you can capture bluetooth traffic directly with Wireshark. Start Wireshark with...

wireshark -w ~/Documents/bttraffic.snoop

...and select your bluetooth interface e.g. bluetooth0 or bluetooth1.

[[File:Wiresharkhciscan.PNG]]

== Bluetooth Pentesting Software ==

In the following chapter we will present some software pentesting tools which are used for ethical bluetooth device hacking.

=== BlueMaho ===

BlueMaho is a tool suite for bluetooth device pentesting and provides various exploits. It is written in python and uses wxPython. The feature set includes: scanning, tracking, alerts on new devices or targeted devices, sending files, changing BT values like the BD_ADDR.

Although it is still listed in the kali linux tool list, it has to be manually installed:

apt install autoconf build-essential build-dep git python-wxtools
git clone https://github.com/zenware/bluemaho
cd bluemaho/config
./build.sh

In order to run the GUI use:

./bluemaho.py

[[File:Bluemaho.PNG]]

=== GATT Tool ===

A great BLE penetration testing example with the powerful GATT Tool can be found here:

[[Bluetooth_GATT_Tool_Basics_with_the_MiPow_Playbulb_Candle]]

=== Bluepot ===

Bluepot is a Bluetooth Honeypot written in Java, it is designed to accept and store any malware sent to it and interact with common Bluetooth attacks. The system also allows monitoring of attacks via a graphical user interface that provides graphs, lists, a dashboard and further detailed analysis from log files.

== Bluetooth Pentesting Hardware ==

For hardware pentesting devices like the Ubertooth one please see following documentations:

* [[Bluetooth_Sniffing_with_Ubertooth:_A_Step-by-step_guide]]
* [[Bluetooth_Hacking_Ubertooth]]

== References ==

* https://wikipedia.org
* https://google.com

[[Category:Documentation]]

Bluetooth Pentesting Tools (HW/SW)

2020-02-17T18:54:16Z

Akrischan:

== Summary ==

This article describes various tools for bluetooth penetration testing and aims to provide an overview to choose the right tool for a use case.

== Requirements ==

* Operating system: Kali Linux amd64 2019.2
* Packages: Individual shown for each tool

In order to use hardware pentesting devices a dedicated installation of kali linux is recommended but it is also possible to use hypervisors which are capable of passing USB devices from the host- to the guestsystem e.g. VMWare Workstation or the free hypervisor VirtualBox.

== Information gathering ==

The offical linux bluetooth protocol stack BlueZ is already installed on kali linux but can be installed on other linux maschines with:

apt install -y bluez bluez-utils
systemctl start bluetooth.service
systemctl status bluetooth.service

[[File:Bluetoothservice.PNG]]

=== hcitool ===

To start with penetration testing we need to gather information about our environment, for this purpose scan for available bluetooth devices with the included packages 'hcitool' or 'bluetoothctl'.

First check if your bluetooth device is available:

hciconfig

[[File:Hciconfig.PNG]]

Scan for BR/EDR Bluetooth devices with hcitool:

hcitool scan

[[File:Scanbr.PNG]]

In order to scan for BLE devices use:

hcitool lescan

=== bluetoothctl ===

Alternatively you can use bluetoothctl which is also included in the bluez-utils package:

[[File:Btctl.PNG]]

=== bettercap ===

In order to complete these steps, you must have followed [[Install_Bettercap_on_Kali_Linux]] before.

Bettercap is a powerful tool for Wifi, Bluetooth LE or ethernet hijacking and provides tools for MITM attacks. Bettercap can also be used to gather informations about bluetooth devices like shown below:

Start bettercap with:

bettercap

Scanning for BLE devices:

ble.recon on

Show a formatted output of found BLE devices:

ble.show

[[File:Bettercapblescan.PNG]]

=== bluelog ===

Another great tool for bluetooth device discovery is 'bluelog'. It is extremly lightweight and can be automated for background usage without user intervention. Bluelog is already preinstalled on kali linux but can be installed with:

apt install -y bluelog

To start scanning for bluetooth devices use:

bluelog -nmtc

(n=log device names;m=log manufacturer;t=log timestamps of discovery;c=log device class)

[[File:Bluelog.PNG]]

== Capturing bluetooth traffic ==

=== btmon ===

With the preinstalled package 'btmon' it is possible to capture traffic between the HCI and the controller:

btmon --write ~/Documents/bttraffic.snoop

These files can be viewed and analysed with 'Wireshark' which is also preinstalled on kali linux.

=== Wireshark ===

Alternatively you can capture bluetooth traffic directly with Wireshark. Start Wireshark with...

wireshark -w ~/Documents/bttraffic.snoop

...and select your bluetooth interface e.g. bluetooth0 or bluetooth1.

[[File:Wiresharkhciscan.PNG]]

== Bluetooth Pentesting Software ==

In the following chapter we will present some software pentesting tools which are used for ethical bluetooth device hacking.

=== BlueMaho ===

BlueMaho is a tool suite for bluetooth device pentesting and provides various exploits. Although it is still listed in the kali linux tool list, it has to be manually installed:

apt install autoconf build-essential build-dep git python-wxtools
git clone https://github.com/zenware/bluemaho
cd bluemaho/config
./build.sh

In order to run the GUI use:

./bluemaho.py

[[File:Bluemaho.PNG]]

=== GATT Tool ===

A great BLE penetration testing example with the powerful GATT Tool can be found here:

[[Bluetooth_GATT_Tool_Basics_with_the_MiPow_Playbulb_Candle]]

== Bluetooth Pentesting Hardware ==

For hardware pentesting devices like the Ubertooth one please see following documentations:

* [[Bluetooth_Sniffing_with_Ubertooth:_A_Step-by-step_guide]]
* [[Bluetooth_Hacking_Ubertooth]]

== References ==

* https://wikipedia.org
* https://google.com

[[Category:Documentation]]

File:Bluemaho.PNG

2020-02-17T18:53:03Z

Akrischan:

Bluetooth Pentesting Tools (HW/SW)

2020-02-17T18:40:44Z

Akrischan:

== Summary ==

This article describes various tools for bluetooth penetration testing and aims to provide an overview to choose the right tool for a use case.

== Requirements ==

* Operating system: Kali Linux amd64 2019.2
* Packages: Individual shown for each tool

In order to use hardware pentesting devices a dedicated installation of kali linux is recommended but it is also possible to use hypervisors which are capable of passing USB devices from the host- to the guestsystem e.g. VMWare Workstation or the free hypervisor VirtualBox.

== Information gathering ==

The offical linux bluetooth protocol stack BlueZ is already installed on kali linux but can be installed on other linux maschines with:

apt install -y bluez bluez-utils
systemctl start bluetooth.service
systemctl status bluetooth.service

[[File:Bluetoothservice.PNG]]

=== hcitool ===

To start with penetration testing we need to gather information about our environment, for this purpose scan for available bluetooth devices with the included packages 'hcitool' or 'bluetoothctl'.

First check if your bluetooth device is available:

hciconfig

[[File:Hciconfig.PNG]]

Scan for BR/EDR Bluetooth devices with hcitool:

hcitool scan

[[File:Scanbr.PNG]]

In order to scan for BLE devices use:

hcitool lescan

=== bluetoothctl ===

Alternatively you can use bluetoothctl which is also included in the bluez-utils package:

[[File:Btctl.PNG]]

=== bettercap ===

In order to complete these steps, you must have followed [[Install_Bettercap_on_Kali_Linux]] before.

Bettercap is a powerful tool for Wifi, Bluetooth LE or ethernet hijacking and provides tools for MITM attacks. Bettercap can also be used to gather informations about bluetooth devices like shown below:

Start bettercap with:

bettercap

Scanning for BLE devices:

ble.recon on

Show a formatted output of found BLE devices:

ble.show

[[File:Bettercapblescan.PNG]]

=== bluelog ===

Another great tool for bluetooth device discovery is 'bluelog'. It is extremly lightweight and can be automated for background usage without user intervention. Bluelog is already preinstalled on kali linux but can be installed with:

apt install -y bluelog

To start scanning for bluetooth devices use:

bluelog -nmtc

(n=log device names;m=log manufacturer;t=log timestamps of discovery;c=log device class)

[[File:Bluelog.PNG]]

== Capturing bluetooth traffic ==

=== btmon ===

With the preinstalled package 'btmon' it is possible to capture traffic between the HCI and the controller:

btmon --write ~/Documents/bttraffic.snoop

These files can be viewed and analysed with 'Wireshark' which is also preinstalled on kali linux.

=== Wireshark ===

Alternatively you can capture bluetooth traffic directly with Wireshark. Start Wireshark with...

wireshark -w ~/Documents/bttraffic.snoop

...and select your bluetooth interface e.g. bluetooth0 or bluetooth1.

[[File:Wiresharkhciscan.PNG]]

== Bluetooth Pentesting Software ==

In the following chapter we will present some software pentesting tools which are used for ethical bluetooth device hacking.

=== BlueMaho ===

BlueMaho is a tool suite for bluetooth device pentesting and provides various exploits. Although it is still listed in the kali linux tool list, it has to be manually installed:

apt install autoconf build-essential build-dep git python-wxtools
git clone https://github.com/zenware/bluemaho
cd bluemaho/config
./build.sh

In order to run the GUI use:

./bluemaho.py

== Bluetooth Pentesting Hardware ==

For hardware pentesting devices like the Ubertooth one please see following documentations:

* [[Bluetooth_Sniffing_with_Ubertooth:_A_Step-by-step_guide]]
* [[Bluetooth_Hacking_Ubertooth]]

Another BLE penetration testing example with the powerful GATT Tool can be found here:

* [[Bluetooth_GATT_Tool_Basics_with_the_MiPow_Playbulb_Candle]]

== References ==

* https://wikipedia.org
* https://google.com

[[Category:Documentation]]

Bluetooth Pentesting Tools (HW/SW)

2020-02-17T18:39:55Z

Akrischan:

== Summary ==

This article describes various tools for bluetooth penetration testing and aims to provide an overview to choose the right tool for a use case.

== Requirements ==

* Operating system: Kali Linux amd64 2019.2
* Packages: Individual shown for each tool

In order to use hardware pentesting devices a dedicated installation of kali linux is recommended but it is also possible to use hypervisors which are capable of passing USB devices from the host- to the guestsystem e.g. VMWare Workstation or the free hypervisor VirtualBox.

== Information gathering ==

The offical linux bluetooth protocol stack BlueZ is already installed on kali linux but can be installed on other linux maschines with:

apt install -y bluez bluez-utils
systemctl start bluetooth.service
systemctl status bluetooth.service

[[File:Bluetoothservice.PNG]]

=== hcitool ===

To start with penetration testing we need to gather information about our environment, for this purpose scan for available bluetooth devices with the included packages 'hcitool' or 'bluetoothctl'.

First check if your bluetooth device is available:

hciconfig

[[File:Hciconfig.PNG]]

Scan for BR/EDR Bluetooth devices with hcitool:

hcitool scan

[[File:Scanbr.PNG]]

In order to scan for BLE devices use:

hcitool lescan

=== bluetoothctl ===

Alternatively you can use bluetoothctl which is also included in the bluez-utils package:

[[File:Btctl.PNG]]

=== bettercap ===

In order to complete these steps, you must have followed [[Install_Bettercap_on_Kali_Linux]] before.

Bettercap is a powerful tool for Wifi, Bluetooth LE or ethernet hijacking and provides tools for MITM attacks. Bettercap can also be used to gather informations about bluetooth devices like shown below:

Start bettercap with:

bettercap

Scanning for BLE devices:

ble.recon on

Show a formatted output of found BLE devices:

ble.show

[[File:Bettercapblescan.PNG]]

=== bluelog ===

Another great tool for bluetooth device discovery is 'bluelog'. It is extremly lightweight and can be automated for background usage without user intervention. Bluelog is already preinstalled on kali linux but can be installed with:

apt install -y bluelog

To start scanning for bluetooth devices use:

bluelog -nmtc

(n=log device names;m=log manufacturer;t=log timestamps of discovery;c=log device class)

[[File:Bluelog.PNG]]

== Capturing bluetooth traffic ==

=== btmon ===

With the preinstalled package 'btmon' it is possible to capture traffic between the HCI and the controller:

btmon --write ~/Documents/bttraffic.snoop

These files can be viewed and analysed with 'Wireshark' which is also preinstalled on kali linux.

=== Wireshark ===

Alternatively you can capture bluetooth traffic directly with Wireshark. Start Wireshark with...

wireshark -w ~/Documents/bttraffic.snoop

...and select your bluetooth interface e.g. bluetooth0 or bluetooth1.

[[File:Wiresharkhciscan.PNG]]

== Bluetooth Pentesting Software ==

In the following chapter we will present some software pentesting tools which are used for ethical bluetooth device hacking.

=== BlueMaho ===

BlueMaho is a tool suite for bluetooth device pentesting and provides various exploits. Although it is still listed in the kali linux tool list, it has to be manually installed:

apt install autoconf build-essential build-dep git python-wxtools
git clone https://github.com/zenware/bluemaho
cd /bluemaho/config
./build.sh

In order to run the GUI use:

./bluemaho.py

== Bluetooth Pentesting Hardware ==

For hardware pentesting devices like the Ubertooth one please see following documentations:

* [[Bluetooth_Sniffing_with_Ubertooth:_A_Step-by-step_guide]]
* [[Bluetooth_Hacking_Ubertooth]]

Another BLE penetration testing example with the powerful GATT Tool can be found here:

* [[Bluetooth_GATT_Tool_Basics_with_the_MiPow_Playbulb_Candle]]

== References ==

* https://wikipedia.org
* https://google.com

[[Category:Documentation]]

Bluetooth Pentesting Tools (HW/SW)

2020-02-17T18:24:39Z

Akrischan:

File:Bluelog.PNG

2020-02-17T18:24:32Z

Akrischan:

Bluetooth Pentesting Tools (HW/SW)

2020-02-17T18:10:50Z

Akrischan:

File:Bettercapblescan.PNG

2020-02-17T18:10:39Z

Akrischan:

Bluetooth Pentesting Tools (HW/SW)

2020-02-17T18:01:09Z

Akrischan:

Bluetooth Pentesting Tools (HW/SW)

2020-02-17T17:54:48Z

Akrischan:

Bluetooth Pentesting Tools (HW/SW)

2020-02-17T17:52:57Z

Akrischan:

Bluetooth Pentesting Tools (HW/SW)

2020-02-17T17:35:19Z

Akrischan:

Bluetooth Pentesting Tools (HW/SW)

2020-02-17T17:33:54Z

Akrischan:

Bluetooth Pentesting Tools (HW/SW)

2020-02-17T17:23:50Z

Akrischan:

File:Wiresharkhciscan.PNG

2020-02-17T17:09:35Z

Akrischan:

Bluetooth Pentesting Tools (HW/SW)

2020-02-17T17:04:21Z

Akrischan:

Bluetooth Pentesting Tools (HW/SW)

2020-02-17T16:44:52Z

Akrischan:

Bluetooth Pentesting Tools (HW/SW)

2020-02-17T16:41:34Z

Akrischan:

File:Btctl.PNG

2020-02-17T16:41:25Z

Akrischan:

File:Scanbr.PNG

2020-02-17T16:38:47Z

Akrischan: Akrischan uploaded a new version of File:Scanbr.PNG

File:Scanbr.PNG

2020-02-17T16:38:06Z

Akrischan:

File:Bluetoothservice.PNG

2020-02-17T16:36:09Z

Akrischan:

File:Hciconfig.PNG

2020-02-17T16:33:33Z

Akrischan:

Bluetooth Pentesting Tools (HW/SW)

2020-02-17T15:56:49Z

Akrischan:

Bluetooth Pentesting Tools (HW/SW)

2020-02-17T15:27:31Z

Akrischan: Created page with "== Summary == This article describes various tools for bluetooth penetration testing, besides some software tools == Requirements == * Operating system: Kali Linux amd64..."

== Summary ==

This article describes various tools for bluetooth penetration testing, besides some software tools

== Requirements ==

* Operating system: Kali Linux amd64 2019.2
* Packages: Individual shown for each tool

In order to use hardware pentesting devices a dedicated installation of kali linux is recommended but it is also possible to use hypervisors which are capable of passing USB devices from the host- to the guestsystem e.g. VMWare Workstation or the free hypervisor VirtualBox.

== Preinstalled tools ==

=== Step 1 ===

Enter these commands in the shell

echo foo
echo bar

=== Step 2 ===

Make sure to read

* War and Peace
* Lord of the Rings
* The Baroque Cycle

== Used Hardware ==

[[Device to be used with this documentation]]
[[Maybe another device to be used with this documentation]]

== Courses ==

* [[A course where this documentation was used]] (2017, 2018)
* [[Another one]] (2018)

== References ==

* https://wikipedia.org
* https://google.com

[[Category:Basics]]

Metasploit with Armitage

2020-01-31T19:37:06Z

Akrischan:

== Summary ==

This documentation describes how to use Armitage GUI with the Metasploit Framework.

Armitage is a Java-based graphical user interface and serves as a free frontend for the Metasploit Framework. The software was first developed by Raphael Mudge in 2013. It is used for the visualization of vulnerable systems, provides suitable exploits and tools for post-exploitation. Access on a single Metasploit RPC instance is possible through multiple Armitage clients. Therefore, teamwork is possible sharing same data, i.e. workspaces and sessions with common event logs. Armitage is a Team Red cooperation, a group of moral hackers (White Hats), whose declared goal is to detect security vulnerabilities before they can be discovered and exploited by destructive hackers (Black Hats). In addition to such projects, the American company offers security audits as well as customized training.

== Requirements ==

* Operating system: Kali Linux amd64 2019.2
* Packages: Metasploit Framework

In order to complete these steps, you should have followed [[Metasploit Framework MSF]] before.

== Attack Process ==

[[File:Ablauf.PNG|thumbnail|upright]]

Armitage is able to perform network scans via NMAP but the import of data from external tools is also supported. Hosts are displayed within a GUI workspace. Afterwards the hosts can be compared with the exploit database provided by Metasploit. If no matching exploits can be found, a so-called Hail Mary Attack is possible. In this case, all available exploits from the database are executed without necessary knowledge of the target system. However, this method leaves traces in the network or on hosts. After a successful attack the available post exploitation tools can be used. Once the necessary rights to the system have been obtained or already existed (root exploit), keyloggers can be installed or existing password hash files can be read from the file system. The execution of remote shells is also possible, e.g.: the installation of further malware. Especially interesting is the possibility to use pivot systems, these are systems that have already been compromised within a network and are used for further attacks in the local network. For this purpose Armitage offers support for the SOCKS proxy modules provided by the Metasploit Framework.

== First Start ==

After successful login to our kali linux desktop, the Armitage GUI can be started as follows.

Select 08 - Exploitation Tools - armitage:

[[File:Armitage01.PNG]]

Afterwards start with the 'Connect' Button:

[[File:Armitage02.png]]

If the metasploit RPC service was not started already, start it with 'Yes':

[[File:Armitage03.PNG]]

== Example Attack with Armitage ==

Afterwards we will show an example attack with the Armitage GUI.

=== Network Discovery with NMAP ===

Start with an NMAP 'Intense Scan' within your local network. This will scan for services on well known ports and provides service and os detection:

[[File:Armitage04.PNG]]

Afterwards detected hosts will be shown in your workspace:

[[File:Armitage05.PNG]]

You can check services with a right click on the host:

[[File:Workspace03.PNG]]

=== Attack ProFTPD Service ===

For our demonstration we will use the Exploit CVE-2015-3306, a well known vulnerability in the mod_copy module of ProFTPD.

With a right click on the host, the Exploit 'proftpd_mod_copy' can be selected and executed:

[[File:Workspace04.PNG]]

After a successful attack the host picture will look as follows:

[[File:Workspace05.PNG]]

Now we can use the active session for a remote shell:

[[File:Workspace06.PNG]]

== References ==

* http://www.fastandeasyhacking.com/manual
* https://www.redteamsecure.com/
* https://www.offensive-security.com/metasploit-unleashed/
* http://www.proftpd.org/docs/

[[Category:Documentation]]

File:Workspace06.PNG

2020-01-31T19:18:51Z

Akrischan:

File:Workspace05.PNG

2020-01-31T19:16:21Z

Akrischan: Akrischan uploaded a new version of File:Workspace05.PNG