performing-wireless-security-assessment-with-kismet

Conduct wireless network security assessments using Kismet to detect rogue access points, hidden SSIDs, weak encryption, and unauthorized clients through passive RF monitoring.

跳到安装

仓库: mukul975/Anthropic-Cybersecurity-Skills
最近来源活动: 2026年6月1日 10:13
检测到的 SKILL.md 语言: 英语
星标: 27,732
分支: 3,366

安装方式

默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。

用 Codex 或 Claude 帮你安装复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。

直接命令不会经过审查 Prompt；运行前请先检查来源。

npx skills add https://github.com/mukul975/Anthropic-Cybersecurity-Skills --skill performing-wireless-security-assessment-with-kismet

命令会保持在同一行。复制前请横向滚动并检查完整内容。

想先保存到本地？可下载 SkillsMP 当前能够提供的文件。

检查来源文件

决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。

文件资源管理器

4 个文件

SKILL.md

来源说明 · 只读预览

返回搜索返回安装

abusing-dpapi-for-credential-access

Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys) online or offline using SharpDPAPI, SharpChrome, Mimikatz, or Impacket's dpapi.py, including domain-wide decryption via the DPAPI backup key. Use during authorized red-team credential-access engagements after gaining a foothold or when triaging DPAPI blobs pulled from a host.

2026-08-02

abusing-shadow-credentials-for-privesc

Take over Active Directory accounts by writing attacker-controlled public keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, or Certipy, then authenticate via PKINIT to recover the target's NT hash without a password reset. Use when BloodHound shows GenericWrite/GenericAll/AddKeyCredentialLink over a target, as a stealthier alternative to ForceChangePassword, during authorized red-team engagements.

2026-08-02

acquiring-disk-image-with-dd-and-dcfldd

Create forensically sound bit-for-bit disk images with dd or dcfldd on a Linux forensic workstation, preserving evidence integrity through hash verification (MD5/SHA) during acquisition. Use when imaging a suspect drive, USB device, or memory card for investigation, preserving volatile disk evidence during incident response, or producing a verified copy for legal or law-enforcement proceedings before any destructive analysis.

2026-08-02

查看这个仓库的全部 Skills

Performing Wireless Security Assessment with Kismet

Overview

Kismet is an open-source wireless network detector, packet sniffer, and wireless intrusion detection system (WIDS) supporting 802.11a/b/g/n/ac/ax. Unlike active scanners, Kismet operates in passive monitor mode, making it undetectable to the networks being assessed. It captures raw 802.11 frames, identifies access points, clients, probe requests, and encryption types without transmitting any packets. This skill covers deploying Kismet for comprehensive wireless security assessments, identifying rogue access points, detecting weak encryption, mapping hidden networks, and analyzing client behavior.

When to Use

When conducting security assessments that involve performing wireless security assessment with kismet
When following incident response procedures for related security events
When performing scheduled security testing or auditing activities
When validating security controls through hands-on testing

Prerequisites

Linux system (Kali Linux, Ubuntu 22.04+) with Kismet 2023+ installed
Wireless adapter supporting monitor mode (e.g., Alfa AWUS036ACH, TP-Link TL-WN722N v1)
Written authorization for wireless assessment (legal requirement)
GPS receiver (optional, for geolocation mapping)
Target environment wireless network documentation

Core Concepts

Kismet Architecture

Kismet uses a client-server architecture:

kismet - Main server process that captures and processes packets
kismet_cap_linux_wifi - Capture source for Linux WiFi interfaces
kismet_cap_linux_bluetooth - Capture source for Bluetooth
Web UI - Browser-based interface at http://localhost:2501

Wireless Frame Types

Frame Type	Purpose	Security Relevance
Beacon	AP announces its presence	SSID, encryption, vendor
Probe Request	Client searches for networks	Reveals preferred networks
Probe Response	AP responds to client probe	Hidden SSID disclosure
Authentication	Client authenticates to AP	Auth type identification
Deauthentication	Disconnects client from AP	Potential attack indicator
Association	Client joins network	Client-AP relationship

Encryption Assessment

Encryption	Status	Risk
Open (No encryption)	Insecure	Critical - all traffic visible
WEP	Broken	Critical - crackable in minutes
WPA-TKIP	Deprecated	High - known vulnerabilities
WPA2-PSK (CCMP)	Acceptable	Medium - depends on passphrase strength
WPA2-Enterprise (802.1X)	Recommended	Low - certificate-based
WPA3-SAE	Best practice	Low - resistant to offline attacks

Workflow

Step 1: Prepare Wireless Adapter

# Identify wireless interfaces
iwconfig

# Check adapter capabilities
iw list | grep -A 10 "Supported interface modes"

# Kill processes that may interfere
sudo airmon-ng check kill

# Enable monitor mode
sudo ip link set wlan0 down
sudo iw dev wlan0 set type monitor
sudo ip link set wlan0 up

# Verify monitor mode
iw dev wlan0 info | grep type

Step 2: Configure and Launch Kismet

Edit /etc/kismet/kismet.conf:

# Data sources
source=wlan0:name=WiFi-Monitor,channel_hop=true,channel_hoprate=5/sec

# Logging configuration
log_types=kismet,pcapng
log_prefix=/opt/kismet/logs/assessment

# Enable all 802.11 channels (2.4GHz and 5GHz)
channel_hop_speed=5
channel_list=IEEE80211:1,2,3,4,5,6,7,8,9,10,11,36,40,44,48,52,56,60,64,100,104,108,112,116,120,124,128,132,136,140,149,153,157,161,165

# GPS configuration (if available)
gps=gpsd:host=localhost,port=2947

# Alert configuration
alert=ADVCRYPTCHANGE,5/min,1/sec
alert=BSSTIMESTAMP,5/min,1/sec
=CRYPTODROP,/min,/sec
=DISASSOCTRAFFIC,/min,/sec
=DEAUTHFLOOD,/min,/sec
=PROBENOMFP,/min,/sec

Launch Kismet:

# Start Kismet server
sudo kismet -c wlan0

# Access web interface
# Open browser to http://localhost:2501
# Default credentials: kismet / kismet (change immediately)

Step 3: Conduct Assessment Scans

Rogue Access Point Detection:

# Export device list via Kismet REST API
curl -u kismet:kismet http://localhost:2501/devices/summary/devices.json | \
    python3 -m json.tool > all_devices.json

# Filter for access points
curl -u kismet:kismet \
    'http://localhost:2501/devices/summary/devices.json' \
    -d 'json={"fields":["kismet.device.base.macaddr","kismet.device.base.name","kismet.device.base.type","kismet.device.base.crypt","kismet.device.base.channel","kismet.device.base.manuf","dot11.device/dot11.device.advertised_ssid_map/dot11.advertisedssid.ssid"]}' \
    > access_points.json

Client Probe Analysis:

Probe requests reveal networks that clients have previously connected to, which can indicate:

Corporate devices connecting to insecure home networks
Devices searching for known-evil SSIDs (evil twin susceptibility)
Unauthorized personal devices in corporate space

Step 4: Analyze Results

Python analysis script for Kismet database:

#!/usr/bin/env python3
"""Analyze Kismet capture database for wireless security findings."""

import sqlite3
import json
import sys
from collections import defaultdict


def analyze_kismet_db(db_path: str):
    """Analyze Kismet SQLite database for security issues."""
    conn = sqlite3.connect(db_path)
    cursor = conn.cursor()

    findings = []

    # Query all devices
    cursor.execute("""
        SELECT devmac, type, device
        FROM devices
    """)

    devices = cursor.fetchall()
    ap_count = 0
    client_count = 0
    open_networks = []
    wep_networks = []
    wpa_tkip_networks = []
    hidden_networks = []
    all_aps = []

    for mac, dev_type, device_json in devices:
        try:
            device = json.loads(device_json)
        except json.JSONDecodeError:
            continue

        base = device.get('kismet.device.base.type', '')

        if 'Wi-Fi AP' in base or 'Wi-Fi Device' in base:
            ap_count += 1
            ssid_map = device.get('dot11.device', {}).get(
                'dot11.device.advertised_ssid_map', []
            )
            crypt = device.get('kismet.device.base.crypt', '')
            name = device.get('kismet.device.base.name', 'Unknown')
            channel = device.get('kismet.device.base.channel', '')
            manuf = device.get('kismet.device.base.manuf', )

            ap_info = {
                : mac,
                : name,
                : crypt,
                : channel,
                : manuf,
            }
            all_aps.append(ap_info)

               crypt  crypt == :
                open_networks.append(ap_info)
               crypt:
                wep_networks.append(ap_info)
               crypt     crypt:
                wpa_tkip_networks.append(ap_info)

             ssid_entry  ssid_map:
                 (ssid_entry, ):
                    ssid = ssid_entry.get(, )
                     ssid ==   ssid  :
                        hidden_networks.append(ap_info)

           base:
            client_count += 

    
    ()
    ()
    ()
    ()
    ()

     open_networks:
        ()
         net  open_networks:
            (
                  )

     wep_networks:
        ()
         net  wep_networks:
            (
                  )

     wpa_tkip_networks:
        ()
         net  wpa_tkip_networks:
            (
                  )

     hidden_networks:
        ()
         net  hidden_networks:
            (
                  )

    
    channel_usage = defaultdict()
     ap  all_aps:
        ch = ap.get(, )
        channel_usage[ch] += 

    ()
     ch, count  (channel_usage.items()):
        ()

    conn.close()


 __name__ == :
    db_path = sys.argv[]  (sys.argv) >   
    analyze_kismet_db(db_path)

Step 5: Detect Rogue Access Points

Compare discovered APs against authorized inventory:

#!/usr/bin/env python3
"""Detect rogue access points by comparing against authorized AP list."""

import json
import sys


def load_authorized_aps(filepath: str) -> set:
    """Load authorized AP MAC addresses from file."""
    authorized = set()
    with open(filepath, 'r') as f:
        for line in f:
            mac = line.strip().lower()
            if mac and not mac.startswith('#'):
                authorized.add(mac)
    return authorized


def detect_rogues(kismet_json: str, authorized_file: str):
    """Compare discovered APs against authorized list."""
    authorized = load_authorized_aps(authorized_file)

    with open(kismet_json, 'r') as f:
        devices = json.load(f)

    rogues = []
    for device in devices:
        mac = device.get('kismet.device.base.macaddr', '').lower()
        dev_type = device.get('kismet.device.base.type', '')

        if 'AP' in dev_type and mac not in authorized:
            rogues.append({
                'mac': mac,
                : device.get(, ),
                : device.get(, ),
                : device.get(, ),
                : device.get(, ),
                : device.get(, {}).get(
                    , ),
            })

     rogues:
        ()
         rogue  rogues:
            ()
            ()
            ()
            ()
            ()
            ()
            ()
    :
        ()


 __name__ == :
     (sys.argv) < :
        ()
        sys.exit()
    detect_rogues(sys.argv[], sys.argv[])

Assessment Checklist

Best Practices

Written Authorization - Always obtain signed authorization before performing wireless assessments
Passive Only - Use Kismet in passive mode; do not transmit deauth frames or probe requests
Comprehensive Channel Coverage - Scan both 2.4GHz and 5GHz bands including DFS channels
Multiple Locations - Perform captures from multiple physical locations for complete coverage
Time Duration - Capture for at least 30-60 minutes to observe intermittent devices
GPS Mapping - Use GPS to create heat maps for signal boundary analysis
Baseline Comparison - Maintain an authorized AP inventory and compare against each assessment

name	performing-wireless-security-assessment-with-kismet
description	Conduct wireless network security assessments using Kismet to detect rogue access points, hidden SSIDs, weak encryption, and unauthorized clients through passive RF monitoring.
domain	cybersecurity
subdomain	network-security
tags	["kismet","wireless-security","wifi-assessment","rogue-ap",802.11,"wardriving","wids","wireless-ids","rf-monitoring"]
version	1.0
author	mahipal
license	Apache-2.0

name	performing-wireless-security-assessment-with-kismet
description	Conduct wireless network security assessments using Kismet to detect rogue access points, hidden SSIDs, weak encryption, and unauthorized clients through passive RF monitoring.
domain	cybersecurity
subdomain	network-security
tags	["kismet","wireless-security","wifi-assessment","rogue-ap",802.11,"wardriving","wids","wireless-ids","rf-monitoring"]
version	1.0
author	mahipal
license	Apache-2.0

performing-wireless-security-assessment-with-kismet

来源信息

安装方式

检查来源文件

同仓库更多 Skills

同仓库更多 Skills

Performing Wireless Security Assessment with Kismet

Overview

When to Use

Prerequisites

Core Concepts

Kismet Architecture

Wireless Frame Types

Encryption Assessment

Workflow

Step 1: Prepare Wireless Adapter

Step 2: Configure and Launch Kismet

Step 3: Conduct Assessment Scans

Step 4: Analyze Results

Step 5: Detect Rogue Access Points

Assessment Checklist

Best Practices

References