WEBVTT 00:00:00.940 --> 00:00:03.870 Hi, and welcome to this course, Discovery with Kismet, 00:00:03.880 --> 00:00:07.050 which is a part of the Red Team Tools series on Pluralsight. 00:00:07.060 --> 00:00:09.630 My name is Guillaume Ross, and I'm a security researcher, 00:00:09.630 --> 00:00:11.860 as well as the head of security at a fintech. 00:00:12.240 --> 00:00:14.430 Kismet is what we'll be talking about today, 00:00:14.440 --> 00:00:17.550 which a lot of people call Kismet wireless because of its domain name. 00:00:18.740 --> 00:00:21.850 Kismet was created by @dragorn, or Mike Kershaw. 00:00:21.860 --> 00:00:24.280 It's a wireless network and device detector, 00:00:24.290 --> 00:00:28.110 meaning it will see access points and the things that connect to them, 00:00:28.110 --> 00:00:32.770 and you can use that to sniff, discover networks while performing wardriving, 00:00:32.780 --> 00:00:36.470 but also to do things like wireless intrusion detection on your network. 00:00:36.740 --> 00:00:40.510 Kismet is really a device detection tool and a wireless 00:00:40.510 --> 00:00:42.670 network tool that lets you gather anything. 00:00:42.670 --> 00:00:47.290 You'll know device names, what clients are connecting where on what channel, 00:00:47.290 --> 00:00:50.330 what data is being transmitted, what encryption is in use, 00:00:50.340 --> 00:00:51.420 and much more. 00:00:51.430 --> 00:00:54.770 You can download it from its website at kismetwireless.net, 00:00:54.740 --> 00:00:58.410 and I highly encourage you to download the official packages and not 00:00:58.410 --> 00:01:00.260 use the ones that come with your distribution. 00:01:00.340 --> 00:01:04.580 Because even though it is one of the first wireless security tools to be made, 00:01:04.580 --> 00:01:07.060 it is still very actively maintained. 00:01:07.540 --> 00:01:11.890 It came out back when 2.4 GHz wireless networks were the norm 00:01:11.890 --> 00:01:13.660 and were just starting to become popular, 00:01:13.660 --> 00:01:18.900 and pretty much everyone had cleartext or maybe WEP encryption. 00:01:18.910 --> 00:01:20.040 And to this day, 00:01:20.040 --> 00:01:23.770 it supports a variety of wireless cards and different interfaces, 00:01:23.940 --> 00:01:27.870 including software‑defined radios, so it can do more than just Wi‑Fi. 00:01:28.140 --> 00:01:32.470 If we look at the kill chain, Kismet definitely belongs on the recon section. 00:01:32.740 --> 00:01:36.170 It's a tool that's going to let you gather a lot of information, 00:01:36.180 --> 00:01:38.760 but it won't let you exploit any devices. 00:01:39.440 --> 00:01:42.000 You'll use it to discover devices that might be exploitable, 00:01:42.000 --> 00:01:45.060 to discover networks that might not be configured properly, 00:01:45.070 --> 00:01:49.130 or even together network packets started being exchanged on those networks. 00:01:49.140 --> 00:01:50.640 If we look at MITRE ATT&CK, 00:01:50.650 --> 00:01:55.060 Kismet is essentially a discovery and a collection tool. 00:01:55.070 --> 00:01:56.810 It will let you discover networks, 00:01:56.810 --> 00:01:58.770 and it will let you collect information about that, 00:01:58.770 --> 00:02:02.230 it can let you perform things like network information discovery, 00:02:02.240 --> 00:02:03.150 network sniffing, 00:02:03.160 --> 00:02:06.630 which is really close to eavesdropping on insecure network communications. 00:02:06.630 --> 00:02:08.820 Even though that's part of ATT&CK Mobile, 00:02:08.830 --> 00:02:11.360 we're essentially doing the same thing on the wireless network. 00:02:11.370 --> 00:02:14.790 That being said, there is some overlap between the different tactics. 00:02:14.790 --> 00:02:17.770 For example, while you're collecting data from a network, 00:02:18.040 --> 00:02:20.890 you might get the data you were actually trying to exfiltrate. 00:02:20.890 --> 00:02:23.330 And because Kismet is able to log it to your laptop, 00:02:23.330 --> 00:02:24.860 that could count as exfiltration. 00:02:24.870 --> 00:02:26.670 What if that data contained credentials? 00:02:26.670 --> 00:02:28.760 Well, maybe that's a little bit of credential access. 00:02:28.940 --> 00:02:32.260 Kismet is typically used with a laptop because it's easier to take with you. 00:02:32.740 --> 00:02:35.620 You'll need a wireless network interface that has an antenna. 00:02:35.630 --> 00:02:36.890 That can be the built‑in one, 00:02:36.890 --> 00:02:39.820 but sometimes it's easier to use a USB device with an external 00:02:39.820 --> 00:02:41.410 antenna if you want to receive everything. 00:02:41.420 --> 00:02:42.410 And, of course, 00:02:42.480 --> 00:02:45.410 the nearby wireless networks are sending data over the 00:02:45.410 --> 00:02:47.370 airwaves on multiple different channels. 00:02:47.380 --> 00:02:48.790 If there was only one channel, 00:02:48.800 --> 00:02:51.850 wireless networks would always suffer from a lot of interference, 00:02:52.040 --> 00:02:53.960 so you'll need to configure channel hopping. 00:02:54.140 --> 00:02:54.720 That way, 00:02:54.720 --> 00:02:57.220 your network card will only be on a certain channel 00:02:57.220 --> 00:02:58.590 for a specific amount of time, 00:02:58.600 --> 00:03:00.590 and it will cycle through all the channels so you 00:03:00.590 --> 00:03:02.210 can detect all of the networks. 00:03:02.340 --> 00:03:05.460 And once you identify one where you want to gather more information, 00:03:05.470 --> 00:03:06.860 you can stop the channel hopping. 00:03:07.740 --> 00:03:13.460 The prerequisites for this demo are going to be a VM or a system to run Kismet. 00:03:13.470 --> 00:03:16.370 While Kismet supports Mac, Linux, and Windows, 00:03:16.380 --> 00:03:19.550 we highly recommend using Kali Linux for the demo, 00:03:19.560 --> 00:03:21.590 and you can use it in a virtual machine. 00:03:21.600 --> 00:03:24.200 The Windows support for Kismet is not full support. 00:03:24.210 --> 00:03:26.150 It's essentially the client part of Kismet. 00:03:26.150 --> 00:03:29.660 So if you really need to gather the data from the wireless airwaves, 00:03:29.740 --> 00:03:31.730 you'll need a Mac or a Linux system. 00:03:31.740 --> 00:03:34.420 You also need a Wi‑Fi adapter that's compatible with Kismet. 00:03:34.430 --> 00:03:36.010 If you're running Kismet on Mac, 00:03:36.020 --> 00:03:39.140 most of the built‑in wireless adapters in the Mac are supported, 00:03:39.150 --> 00:03:41.830 but it's usually simpler to use a USB device that 00:03:41.830 --> 00:03:43.410 you'll link to the virtual machine. 00:03:43.420 --> 00:03:43.950 That way, 00:03:43.950 --> 00:03:48.010 your actual laptop's operating system can still use Wi‑Fi while you're 00:03:48.010 --> 00:03:52.230 scanning for other Wi‑Fi networks. You can find links to the devices 00:03:52.230 --> 00:03:55.650 supported by Kismet in the files of this module. 00:03:56.040 --> 00:03:56.720 And, of course, 00:03:56.720 --> 00:03:59.900 you'll need to be around some Wi‑Fi networks, but if you're looking at this, 00:03:59.910 --> 00:04:02.850 it's safe to assume that you probably have some around you right now.