Red Teaming: Top tools and gadgets for physical assessments
Understanding the strengths and weaknesses of physical security controls in critical infrastructures is a valuable part of cybersecurity. Because from this angle, adversaries can obtain confidential information about targeted assets. Imagine that you access the main door, enter the lift and take a photo of the building's floor plan. These techniques can provide you with a lot of information about critical locations to keep under the radar.
While many organizations have a strong awareness of emerging cyberattacks, their concerns are not as well observed regarding physical security. The risk associated with physical attacks is high because there is often no adequate protection against daily situations. For instance, imagine a simulation that includes bypassing the door locks, stealing devices, or even using social engineering strategies to get valuable information. This scenario could include convincing the employee to connect a USB device to their computer, take photos from long-range to capture sensitive information from an opened window, or even using the same uniform of the cleaning services to access the servers' room.
In this sense, there is a broad set of approaches and strategies to address this kind of attack. The benefits are apparent:
- Exposing weak physical barriers, such as gaps in fences, not monitored doors, and taking advantage of internet connection plug in the building.
- Understanding the risk, the damage of a well-succeded attack, which information could be impacted and exfiltrated, and so on.
What should you learn next?
Most popular tools and gadgets
This section will list some gadgets and tools associated often used by red teaming experts when executing physical security assessments.
Crazyradio: USB radio dongle based on the nRF24LU1+ from Nordic Semiconductor. 2.4GHz ISM band radio. For instance, you can control vulnerable mouse devices and introduce a new reverse-shell on the target. This hardware device is compatible with mousejack, keyjack, keysniffer and JackIt projects.
Ubertooth: This hardware is extremely useful for sniffing Bluetooth close ranges. With this device in place, executing experiments in Bluetooth packers is possible.
HackRF: HackRF, one from Great Scott Gadgets, is a software-defined radio peripheral capable of transmitting or receiving radio signals from 1 MHz to 6 GHz. Designed to enable the test and development of modern and next-generation radio technologies, HackRF One is an open-source hardware platform that can be used as a USB peripheral or programmed for stand-alone operation.
More details on the GitHub repository are here.
AirDrive Keylogger: The AirDrive Keylogger is an innovative ultra-small USB hardware keylogger that can be accessed with any Wi-Fi device such as a computer, laptop, tablet, or smartphone. It can record keystrokes from any keyboard, works as a Wi-Fi hotspot, and has a simple and straightforward HTTP interface to obtain the collected information.
USB rubber ducky: With this device, just plugging an innocent USB drive into a target computer can install backdoors, exfiltrate documents or simply capture credentials. With a few lines of code, anything is possible.
Packet squirrel: The man-in-the-middle device is very stealthy and capable of giving you covert remote access, painless packet captures, and performing secure VPN connections. The ability to gain persistent, remote access via VPNs and reverse shells is a straightforward process via the power of this device.
LAN turtle: The LAN Turtle is a covert Systems Administration and Penetration Testing tool providing stealth remote access, network intelligence gathering, and man-in-the-middle surveillance capabilities through a simple graphic shell. In short: "drop a LAN turtle, and you can get a shell."
WIFI PINEAPPLE: Automate Wi-Fi auditing and get actionable results from vulnerability assessment reports. This hardware allows airspace command with a new interactive recon dashboard and stays on-target and in-scope with the leading rogue access point suite for advanced man-in-the-middle attacks.
The importance of physical security
Although this is not an extensive list of tools and gadgets, we have presented some of the most notable gadgets that can be used in physical attacks against critical infrastructures. Maybe this can be the right moment to highlight this type of attack scenario on the agenda - a surface more exposed to attacks and a desirable vertex for opponents.
FREE role-guided training plans
Let's make physical security part of our cybersecurity strategy!
Sources:
- Red teaming list, GitHub
- Awesome Red Teaming, GitHub
- Physical Penetration Test, Red Team Secure
- Red Teaming tools, GitBook Segurança Informatica
In this Series
- Red Teaming: Top tools and gadgets for physical assessments
- Top 10 Linux distro for ethical hacking and penetration testing
- Penetration testing steps: How-to guide on pentesting
- How does automated penetration testing work?
- Intelligence-led pentesting and the evolution of Red Team operations
- Red Teaming: Taking advantage of Certify to attack AD networks
- How ethical hacking and pentesting is changing in 2022
- Ransomware penetration testing: Verifying your ransomware readiness
- Red Teaming: Main tools for wireless penetration tests
- Fundamentals of IoT firmware reverse engineering
- Red teaming: Initial access and foothold
- Top tools for red teaming
- What is penetration testing, anyway?
- Red Teaming: Persistence Techniques
- Red Teaming: Credential dumping techniques
- Top 6 bug bounty programs for cybersecurity professionals
- Tunneling and port forwarding tools used during red teaming assessments
- SigintOS: Signal Intelligence via a single graphical interface
- Top tools for mobile android assessments
- Top tools for mobile iOS assessments
- Red Team: C2 frameworks for pentesting
- Inside 1,602 pentests: Common vulnerabilities, findings and fixes
- Red teaming tutorial: Active directory pentesting approach and tools
- Red Team tutorial: A walkthrough on memory injection techniques
- Python for active defense: Monitoring
- Python for active defense: Network
- Python for active defense: Decoys
- How to write a port scanner in Python in 5 minutes: Example and walkthrough
- Using Python for MITRE ATT&CK and data encrypted for impact
- Explore Python for MITRE ATT&CK exfiltration and non-application layer protocol
- Explore Python for MITRE ATT&CK command-and-control
- Explore Python for MITRE ATT&CK email collection and clipboard data
- Explore Python for MITRE ATT&CK lateral movement and remote services
- Explore Python for MITRE ATT&CK account and directory discovery
- Explore Python for MITRE ATT&CK credential access and network sniffing
- Top 10 security tools for bug bounty hunters
- Kali Linux: Top 5 tools for password attacks
- Kali Linux: Top 5 tools for post exploitation
- Kali Linux: Top 5 tools for database security assessments
- Kali Linux: Top 5 tools for information gathering
- Kali Linux: Top 5 tools for sniffing and spoofing
- Kali Linux: Top 8 tools for wireless attacks
- Kali Linux: Top 5 tools for penetration testing reporting
- Kali Linux overview: 14 uses for digital forensics and pentesting
- Top 19 Kali Linux tools for vulnerability assessments
- Explore Python for MITRE ATT&CK persistence
- Explore Python for MITRE ATT&CK defense evasion
- Explore Python for MITRE ATT&CK privilege escalation
- Explore Python for MITRE ATT&CK initial access
- Top 18 tools for vulnerability exploitation in Kali Linux
- Explore Python for MITRE PRE-ATT&CK, network scanning and Scapy
Get certified and advance your career!
- Exam Pass Guarantee
- Live instruction
- CompTIA, ISACA, ISC2, Cisco, Microsoft and more!
Penetration testing
Top 10 Linux distro for ethical hacking and penetration testing
Penetration testing
Penetration testing
Penetration testing
Intelligence-led pentesting and the evolution of Red Team operations