pentest-threat-modeling

name	pentest-threat-modeling
description	PTES Phase 3 - Threat modeling for AWS security assessments
type	skill

PTES Phase 3: Threat Modeling

🎯 pfSense Detection & Routing

IMPORTANTE: Se durante o threat modeling você identificar pfSense como alvo, ATIVE A SKILL pentest-pfsense para modelagem específica.

pfSense Threat Modeling

Attack Surface Mapping

pfSense Attack Vectors:
├── Web GUI (443/tcp)
│   ├── Authentication bypass
│   ├── Command injection (diag_*.php)
│   ├── XSS (stored/reflected)
│   └── File read/write arbitrary
├── SSH (22/tcp)
│   ├── Brute force
│   └── Terrapin attack (CVE-2023-48795)
├── VPN Services
│   ├── OpenVPN (1194)
│   ├── IPsec (500/4500)
│   └── WireGuard (51820)
├── Packages
│   ├── pfBlockerNG (RCE CVE-2022-40624)
│   ├── Suricata (Path Traversal CVE-2025-12490)
│   └── Snort (File Oracle CVE-2025-34173)
└── HA/CARP
    ├── XMLRPC sync abuse
    └── Config sync injection

High-Value Targets

• /cf/conf/config.xml - Todas as credenciais e configurações
• OpenVPN/IPsec credentials - Acesso VPN
• HA sync credentials - Controle do cluster
• Package configurations - Persistência

Ação Imediata

# Se pfSense identificado → ATIVAR pentest-pfsense skill
# Esta skill continua para threat modeling geral
# Use pentest-pfsense para:
# - Attack tree específico para firewall
# - Feature-based threat modeling (158 features)
# - CVE prioritization (EPSS/CVSS)
# - Privilege escalation paths

---

Objetivo

Analisar dados coletados para identificar vetores de ataque, alvos de alto valor e caminhos de exploração prioritários, alinhado com PTES Section 3.3 (Attack Avenues) e Section 3.2 (Vulnerability Validation).

Referências PTES para Threat Modeling

PTES 3.3 - Attack Avenues

• 3.3.1 Creation of Attack Trees: Mapear caminhos de exploração
• 3.3.2 Identify protection mechanisms:
  • 3.3.2.1 Network protections (packet filters, traffic shaping, DLP)
  • 3.3.2.2 Host based protections (stack/heap, whitelisting, AV)
  • 3.3.2.3 Application level protections

PTES 3.2 - Vulnerability Validation

• 3.2.1 Public Research: Common/default passwords, CVE research
• 3.2.2 Establish target list:
  • 3.2.2.1 Mapping Versions
  • 3.2.2.2 Identifying Patch Levels
  • 3.2.2.3 Looking for Weak Web Applications
  • 3.2.2.4 Identify Weak Ports and Services
  • 3.2.2.5 Identify Lockout threshold

---

Análise de Dados com WorstAssume

1. Executar Security Assessment (PTES 3.1 - Vulnerability Testing)

# Rodar assessment completo (PTES 3.1.2 - Automated Tools)
worst assess

# Assessment com filtro de severidade (PTES 3.1.1 - Active)
worst assess --min-severity HIGH

# Assessment de conta específica
worst assess --account-id 123456789012

# Assessment focado em IAM (PTES 3.2.2.4 - Weak Services)
worst assess --focus iam

2. Categorias de Ameaças a Modelar (PTES 3.3 - Attack Avenues)

WEAK_TRUST - Trust Policies Problemáticas (PTES 3.3.2 - Protection Mechanisms)

• Roles com Principal: "*" (wildcard público)
• Cross-account trust sem ExternalId
• Service principals amplos (ex: sts.amazonaws.com)
• Federated trust sem condições sub/aud
• Root account trust de outras contas

PERMISSIVE_POLICY - Permissões Excessivas (PTES 3.2.2.4 - Weak Services)

• AdministratorAccess attached
• PowerUserAccess attached
• IAMFullAccess attached
• Políticas customizadas com *:*
• Group-based privilege inheritance

RESOURCE_WILDCARD - Recursos sem Restrição

• Write actions em Resource: "*"
• iam:PassRole sem restrição de recurso
• s3:* em todos os buckets
• secretsmanager:GetSecretValue global

USER_CONFIG - Misconfigurações de Usuário (PTES 3.2.2.5 - Lockout Threshold)

• Console access sem MFA
• Access keys > 90 dias
• Access keys > 365 dias (CRITICAL)
• Users com múltiplas access keys ativas

GROUP_CONFIG - Grupos Perigosos

• Grupos com AdministratorAccess
• Grupos com IAM manipulation permissions
• Group membership escalation paths

3. Modelagem de Ameaças por Categoria (PTES 3.3.1 - Attack Trees)

A. Ameaças de Identidade (IAM) - PTES 3.3.2.2 Host Based Protections

ATTACK VECTOR: IAM Policy Manipulation
├── PATH-001: CreatePolicyVersion → Admin em qualquer policy
├── PATH-002: SetDefaultPolicyVersion → Ativar versão permissiva
├── PATH-003: AttachUserPolicy → Attach admin policy em user
├── PATH-004: AttachRolePolicy → Attach admin policy em role
├── PATH-005: AttachGroupPolicy → Attach admin policy em group
├── PATH-006: PutUserPolicy → Inline policy em user
├── PATH-007: PutRolePolicy → Inline policy em role
├── PATH-008: PutGroupPolicy → Inline policy em group
├── PATH-009: AddUserToGroup → Herdar permissões do grupo
├── PATH-010: UpdateAssumeRolePolicy → Modificar trust policy
├── PATH-011: CreateAccessKey → Criar chave persistente
├── PATH-012: CreateLoginProfile → Criar console access
└── PATH-013: UpdateLoginProfile → Overwrite senha console

B. Ameaças de PassRole - PTES 3.3.2.3 Application Level Protections

ATTACK VECTOR: PassRole + Compute Services
├── PATH-015: EC2 RunInstances → Roubar creds via IMDS
├── PATH-016: Lambda CreateFunction → Executar como role
├── PATH-018: Lambda EventSourceMapping → Trigger automático
├── PATH-021: Glue CreateDevEndpoint → SSH + creds
├── PATH-023: CloudFormation CreateStack → Service role abuse
├── PATH-024: DataPipeline CreatePipeline → Shell activity
├── PATH-025: SageMaker CreateNotebook → Notebook com creds
└── PATH-027: CodeStar CreateProject → Project role abuse

C. Ameaças de Resource Abuse - PTES 3.3.2.1 Network Protections

ATTACK VECTOR: Resource-Based Lateral Movement
├── PATH-014: IMDSv1 → Roubar instance role
├── PATH-019: Lambda UpdateFunctionCode → Inject code
├── PATH-020: Lambda UpdateConfiguration → Malicious layer
├── PATH-022: Glue UpdateDevEndpoint → SSH key injection
├── PATH-026: SageMaker CreatePresignedUrl → Hijack session
├── PATH-030: AssumeRole (same-account) → Assumir role
├── PATH-031: AssumeRole (cross-account) → Pivot conta
├── PATH-032: SSM SendCommand → RCE via Run Command
├── PATH-033: EC2 Instance Connect → SSH via public key
├── PATH-035: S3 PutBucketPolicy → Access bucket externo
├── PATH-036: SecretsManager GetSecretValue → Harvest creds
└── PATH-037: ECS Task Metadata → Roubar task role

D. Ameaças de Defensive Blinding - PTES 3.3.2 - Identify Protection Mechanisms

ATTACK VECTOR: Blindar Defesas
└── PATH-042: CloudTrail StopLogging / GuardDuty DeleteDetector

E. Ameaças de Network-Based Attacks - PTES 3.3.2.1 Network Protections

ATTACK VECTOR: Network Scanning e Firewall Bypass (hping3)
├── Network Reconnaissance
│   ├── Host discovery via SYN scan
│   ├── Port scanning com flags customizadas
│   └── Firewall ruleset mapping
├── IDS/IPS Evasion
│   ├── XMAS scan (-FPU flags)
│   ├── NULL scan (sem flags)
│   ├── Fragmented packets (-f)
│   └── Random source IP (--rand-source)
├── Covert Channels
│   ├── ICMP tunneling (-1 -d <size>)
│   └── Beaconing simulation (-i <interval>)
└── Lateral Movement
    ├── Internal network pivoting
    ├── Database port discovery (3306, 5432, 1433)
    └── SMB/NetBIOS enumeration (445, 139)

Network Threat Model com hping3 (PTES 3.3.1 - Attack Trees)

ATTACK TREE: Network Compromise via hping3
Root: Obter acesso à rede interna
├── Branch 1: Host Discovery
│   ├── SYN scan em subnet (-S -p <port> --scan)
│   ├── ICMP discovery (-1)
│   └── UDP scan (-2 -p 53)
├── Branch 2: Firewall Analysis
│   ├── ACK scan para stateless detection (-A)
│   ├── SYN scan para stateful detection (-S)
│   └── TTL analysis para OS fingerprinting (-t)
├── Branch 3: IDS Evasion
│   ├── Fragmentation (-f)
│   ├── XMAS scan (-F -P -U)
│   ├── NULL scan (-O)
│   └── Source spoofing (-a, --rand-source)
└── Branch 4: Lateral Movement
    ├── Internal port scanning
    ├── Database discovery
    └── SMB/NetBIOS enumeration

4. Criação de Attack Trees (PTES 3.3.1 - Creation of Attack Trees)

Attack Tree 1: Privilege Escalation to Admin

Root: Obter AdministratorAccess
├── Branch 1: IAM Policy Modification
│   ├── PATH-001: CreatePolicyVersion
│   ├── PATH-003: AttachUserPolicy
│   └── PATH-009: AddUserToGroup
├── Branch 2: Credential Creation
│   ├── PATH-011: CreateAccessKey
│   └── PATH-012: CreateLoginProfile
└── Branch 3: Role Assumption
    ├── PATH-030: AssumeRole (same-account)
    └── PATH-031: AssumeRole (cross-account)

Attack Tree 2: Cross-Account Compromise

Root: Comprometer Conta Secundária
├── Branch 1: Wildcard Trust Abuse
│   └── PATH-031: AssumeRole com Principal: *
├── Branch 2: Credential Harvesting
│   └── PATH-036: SecretsManager GetSecretValue
└── Branch 3: PassRole Attack
    ├── PATH-016: Lambda CreateFunction
    └── PATH-023: CloudFormation CreateStack

Attack Tree 3: Data Exfiltration

Root: Exfiltrar Dados Sensíveis
├── Branch 1: S3 Access
│   └── PATH-035: S3 PutBucketPolicy
├── Branch 2: Secret Access
│   └── PATH-036: SecretsManager GetSecretValue
└── Branch 3: Database Access
    └── PATH-032: SSM SendCommand → RDS access

5. Análise de Cadeias de Ataque (7 Famílias) - PTES 3.3.1

Family I - IAM Self-Modification

CreatePolicy + AttachUserPolicy → Self Admin Escalation
CreatePolicy + AttachRolePolicy → Role Privilege Escalation

Family II - PassRole + Compute Service

PassRole + Lambda → Steal Execution Role
PassRole + EC2 → IMDS Credential Theft
PassRole + CloudFormation → IAM User Creation
PassRole + ECS → Task Role Theft
PassRole + Glue → Code Execution
PassRole + SageMaker → Container Execution
PassRole + CodeBuild → Shell Execution

Family III - Compute Credential Theft

SSM SendCommand → Instance Profile Theft
EC2 ModifyUserData → Credential Exfil via UserData
Lambda UpdateCode → Execution Role Theft
ECS UpdateService → Task Role Theft

Family IV - Secret Exfiltration → Credential Reuse

SecretsManager GetSecretValue → IAM Key Reuse
SSM GetParameter → Credential Theft
Lambda GetFunction → Env Variable Secrets
S3 GetObject → Credential Files (.aws/credentials, id_rsa)

Family V - Account Takeover

UpdateLoginProfile → Console Takeover
MFA Bypass + UpdateLogin → Takeover sem MFA
CreateAccessKey → Persistent Admin Access
UpdateAssumeRolePolicy + AssumeRole → Role Takeover

Family VI - Group Membership

AddUserToGroup → Join High-Privilege Group
PutGroupPolicy + AddUserToGroup → Self-Escalation via Group

Family VII - Cross-Account Lateral Movement

WildcardTrust → Any Principal Assumes High-Priv Role
CrossAccount Trust → Dangerous Role → Lateral Movement

6. Identificação de Mecanismos de Proteção (PTES 3.3.2)

Network Protections (PTES 3.3.2.1)

• VPC Flow Logs habilitados
• Security Groups restritivos
• NACLs configurados
• VPC Endpoints para serviços AWS
• Transit Gateway com inspeção

Host Based Protections (PTES 3.3.2.2)

• IMDSv2 forçado (bloqueia IMDSv1)
• SSM Session Manager (sem SSH direto)
• GuardDuty habilitado
• CloudTrail em todas as regiões
• Config Rules ativas

Application Level Protections (PTES 3.3.2.3)

• SCPs (Service Control Policies)
• Permission Boundaries
• MFA obrigatório para ações críticas
• ExternalId para cross-account
• Resource-based policies restritivas

7. Priorização de Ameaças por Impacto (PTES 3.2 - Vulnerability Validation)

CRITICAL (Exploração Imediata) - PTES 3.2.2 Establish Target List

• Wildcard trust policies (Principal: "*")
• IAMFullAccess + CreatePolicyVersion
• UpdateLoginProfile em admin users
• PassRole + CloudFormation/CreateStack
• Cross-account wildcard trust

HIGH (Exploração Prioritária)

• AdministratorAccess attached
• Console access sem MFA
• PassRole + Lambda/EC2/ECS
• SSM SendCommand em EC2
• SecretsManager GetSecretValue global

MEDIUM (Exploração Secundária)

• Access keys > 90 dias
• IMDSv1 habilitado
• Group-based escalation
• Resource wildcard permissions

8. Mapeamento de Alvos de Alto Valor (PTES 3.2.2 - Establish Target List)

Crown Jewels (Alvos Críticos) - PTES 3.2.2.1 Mapping Versions

• IAM Admin roles/users
• Root account equivalents
• Secrets Manager com creds produção
• KMS keys mestras
• Cross-account hub roles

Dados Sensíveis - PTES 3.2.2.3 Looking for Weak Applications

• S3 buckets com dados sensíveis
• RDS databases
• DynamoDB tables críticos
• EBS snapshots sensíveis

Controle de Infraestrutura - PTES 3.2.2.4 Identify Weak Ports/Services

• CloudFormation stacks
• Lambda functions críticas
• ECS/EKS clusters produção
• VPC networking core

9. Matriz de Ameaças por Serviço (PTES 3.3 - Attack Avenues)

Serviço	Ameaça Principal	Impacto	Probabilidade	PATH-IDs
IAM	Privilege Escalation	CRITICAL	Alta	001-013
EC2	Instance Profile Theft	HIGH	Alta	014, 015
Lambda	Execution Role Abuse	HIGH	Alta	016, 018-020
S3	Data Exfiltration	HIGH	Média	035
Secrets Manager	Credential Harvest	CRITICAL	Média	036
ECS	Task Role Theft	HIGH	Média	037
CloudFormation	Service Role Abuse	CRITICAL	Baixa	023
SSM	Lateral Movement	HIGH	Média	032
Glue	Code Execution	HIGH	Baixa	021, 022
SageMaker	Container Execution	HIGH	Baixa	025, 026

10. Output da Fase de Threat Modeling (PTES Deliverables)

Documento de Threat Model (PTES 3.3.1 - Attack Trees)

1. IDENTIDADE INICIAL (PTES 2.5 - Footprinting)
   - ARN: arn:aws:iam::123456789012:user/auditor
   - Permissões: [Lista]
   - Restrições: [Lista]

2. VETORES PRIORITÁRIOS (PTES 3.3 - Attack Avenues)
   - Vetor 1: [Descrição + PATH-ID]
   - Vetor 2: [Descrição + PATH-ID]
   - Vetor 3: [Descrição + PATH-ID]

3. ALVOS DE ALTO VALOR (PTES 3.2.2 - Target List)
   - Alvo 1: [ARN + Justificativa]
   - Alvo 2: [ARN + Justificativa]

4. ATTACK TREES (PTES 3.3.1 - Creation of Attack Trees)
   - Tree 1: [Root + Branches]
   - Tree 2: [Root + Branches]

5. CADEIAS DE ATAQUE IDENTIFICADAS (7 Famílias)
   - Chain 1: [Family + Steps]
   - Chain 2: [Family + Steps]

6. MECANISMOS DE PROTEÇÃO (PTES 3.3.2)
   - Network: [Lista]
   - Host: [Lista]
   - Application: [Lista]

7. PRIORIZAÇÃO (PTES 3.2 - Vulnerability Validation)
   - Critical: [Lista]
   - High: [Lista]
   - Medium: [Lista]

Próximos Passos

Após completar esta fase, prossiga para pentest-vulnerability-analysis (PTES Section 3)

---

🤖 AIRecon Integration for Threat Modeling

AIRecon é um agente autônomo de penetration testing (v0.1.7-beta) que pode ser invocado como ferramenta incremental durante threat modeling para automatizar análise de CVEs, construção de attack trees, e priorização de vulnerabilidades.

Invocando AIRecon para Threat Modeling

# AIRecon com keywords de threat modeling e attack analysis
airecon "pentest threat modeling aws iam attack trees"

# AIRecon detectará keywords e carregará:
# - pentest-threat-modeling.md (skill primária)
# - pentest-vulnerability-analysis.md (para CVE analysis)
# - MCP tools: cve-mcp, hexstrike, worstassume

# Para pfSense-specific threat modeling:
airecon "pfsense threat modeling attack tree 2.7.0"

# Para attack chain analysis:
airecon "analyze attack chains privilege escalation aws"

AIRecon Slash Commands Úteis para Threat Modeling

# CVE lookup e EPSS scoring
# AIRecon buscará CVEs relevantes e calculará risk scores
airecon "check CVE-2026-41940 risk score"

# Network scanning para identificar alvos
/naabu-scan --target target.com -p 443,8443

# API key discovery para credential exposure analysis
/api-keys --target ./src --recursive

MCP Tool Integration via AIRecon

Durante threat modeling, AIRecon pode invocar MCP tools automaticamente:

# cve-mcp: CVE lookup, EPSS scores, KEV status, risk calculation
airecon "get CVE summary for CVE-2026-41940"
# → Usará mcp__cve-mcp__get_cve_summary

airecon "calculate risk score for CVE-2026-31431"
# → Usará mcp__cve-mcp__calculate_risk_score

airecon "check if CVE-2026-41940 is in CISA KEV catalog"
# → Usará mcp__cve-mcp__check_kev

airecon "get EPSS scores for CVE-2026-41940,CVE-2026-31431"
# → Usará mcp__cve-mcp__get_epss_score

airecon "compare CVEs CVE-2026-41940 and CVE-2026-31431"
# → Usará mcp__cve-mcp__compare_cves

# hexstrike-local: Vulnerability scanning para validation
airecon "run nuclei scan on target.com for CVE detection"
# → Usará mcp__hexstrike-local__nuclei_scan

airecon "run nikto vulnerability scan on https://target.com"
# → Usará mcp__hexstrike-local__nikto_scan

# pentestswarm-remote: Automated threat modeling campaigns
airecon "start threat modeling campaign for target.com"
# → Usará mcp__pentestswarm-remote__start_campaign

Workflow Example: Threat Modeling com AIRecon + WorstAssume + CVE-MCP

# 1. Usar AIRecon para carregar threat modeling skill
airecon "pentest threat modeling aws"

# 2. AIRecon auto-carrega pentest-threat-modeling.md

# 3. Invocar WorstAssume para security assessment
airecon "run worst assume --min-severity HIGH"

# 4. Para cada CVE identificada, AIRecon buscará automaticamente:
#    - EPSS score (probabilidade de exploração)
#    - KEV status (CISA Known Exploited Vulnerabilities)
#    - PoC availability (GitHub, Exploit-DB)
#    - Risk score composto (0-100)

airecon "analyze CVEs found and prioritize by risk"

# 5. AIRecon gera attack trees baseados nas vulnerabilidades
# 6. Exportar threat model para relatório
airecon "export threat model to JSON"

Workflow Example: pfSense Threat Modeling com AIRecon

# 1. Identificar versão do pfSense
airecon "shodan search product:pfsense org:target"

# 2. Buscar CVEs para versão detectada
airecon "search CVEs for pfSense 2.7.0 severity CRITICAL"
# → Usará mcp__cve-mcp__search_cves

# 3. Para cada CVE, calcular risk score
airecon "calculate risk score CVE-2022-40624"  # pfBlockerNG RCE
airecon "calculate risk score CVE-2025-12490"  # Suricata Path Traversal

# 4. Verificar exploit availability
airecon "check exploit availability CVE-2022-40624"
# → Usará mcp__cve-mcp__check_exploit_availability

# 5. Gerar attack tree específico para pfSense
airecon "generate attack tree for pfSense 2.7.0"

# 6. Exportar threat model
airecon "export pfsense threat model"

AIRecon Auto-Skill Loading para Threat Modeling

Keywords Detectadas	Skills Carregadas	MCP Tools Ativados
threat model attack tree	pentest-threat-modeling	cve-mcp, hexstrike
cve vulnerability	pentest-vulnerability-analysis	cve-mcp, pentestswarm
pfsense firewall	pentest-pfsense, pentest-threat-modeling	cve-mcp, shodan
privilege escalation	pentest-threat-modeling, pentest-exploitation	worstassume, hexstrike
lateral movement	pentest-threat-modeling	worstassume, pentestswarm
aws iam	pentest-threat-modeling	worstassume, cve-mcp

AIRecon CVE Risk Prioritization

AIRecon usa o cve-mcp para priorizar vulnerabilidades automaticamente:

# AIRecon calcula risk score composto (0-100) baseado em:
# - CVSS score (severity base)
# - EPSS score (exploit probability)
# - KEV status (actively exploited)
# - PoC availability (exploit maturity)

airecon "prioritize CVEs by risk score"
# Output exemplo:
# 1. CVE-2026-41940 (cPanel) - Risk: 98/100 - CRITICAL
#    CVSS: 9.8, EPSS: 0.85, KEV: Yes, PoC: Available
# 2. CVE-2026-31431 (Linux LPE) - Risk: 92/100 - CRITICAL
#    CVSS: 8.4, EPSS: 0.72, KEV: No, PoC: Available
# 3. CVE-2022-40624 (pfBlockerNG) - Risk: 87/100 - HIGH
#    CVSS: 9.8, EPSS: 0.45, KEV: No, PoC: Available

AIRecon Attack Chain Generation

# AIRecon gera attack chains automaticamente
airecon "discover attack chains for Apache HTTP Server 2.4"
# → Usará mcp__hexstrike-local__discover_attack_chains

# Output: Multi-stage attack chains com:
# - Vulnerability combinations
# - Success probability estimates
# - Exploit availability status
# - Recommended exploitation order

AIRecon + WorstAssume Integration

# 1. WorstAssume enumera IAM e identifica vulnerabilidades
airecon "worst enumerate --profile my-profile --stealth"

# 2. AIRecon processa findings do WorstAssume
# 3. Para cada finding, AIRecon mapeia PATH-IDs
airecon "map findings to PATH-IDs"

# 4. AIRecon gera attack chains baseadas em PATH-IDs
airecon "generate attack chains from PATH-001,PATH-015,PATH-036"

# 5. Exportar attack chains para relatório
airecon "export attack chains to JSON"

---

Referências PTES

• PTES Section 3: Vulnerability Analysis
• PTES 3.1: Vulnerability Testing (Active, Passive, Automated Tools)
• PTES 3.2: Vulnerability Validation (Public Research, Target List)
• PTES 3.3: Attack Avenues (Attack Trees, Protection Mechanisms)