Explore Python for MITRE PRE-ATT&CK, network scanning and Scapy
MITRE PRE-ATT&CK
The MITRE ATT&CK® framework is a tool developed by the MITRE Corporation to help build understanding of how cyberattacks work. It breaks the cyberattack lifecycle into several stages (called tactics) and describes various means of achieving the goals of each tactic.
Previously, MITRE PRE-ATT&CK was its own matrix within the MITRE ATT&CK framework; however, a recent edit revised it into the first two columns of the enterprise matrix. The tactics associated with MITRE PRE-ATT&CK are reconnaissance and resource development, covering what an attacker may do before initiating an attack.
When implementing PRE-ATT&CK functionality in Python, most of the focus is on the reconnaissance tactic. This is because Python makes it possible to automate some reconnaissance functionality, and the steps needed for resource development are more difficult to predict and automate.
FREE role-guided training plans
Introduction to network scanning
Network scanning is one of the techniques used to accomplish reconnaissance goals in MITRE ATT&CK. Scapy is a useful tool for implementing reconnaissance in Python.
Introduction to Scapy
Scapy is one of the many packages available for the Python programming language. Scapy is an invaluable tool for cybersecurity because it makes it possible to build custom packets and send them over the network and to sniff, dissect and analyze received traffic.
Scapy is useful for reconnaissance because it provides all of the necessary building blocks for building a custom network or vulnerability scanner like Nmap or Nessus. A penetration tester can quickly and easily define a network scan or a custom packet to test for a particular vulnerability over the network.
Network scanning with Python
The network scanning demo for the Python for Cybersecurity Learning Path focused on building a custom network scanner using Python and Scapy.
The sample code for this is shown above and available on Github. As shown, this code is designed to perform a SYN scan against a particular IP address and to perform DNS lookups for a domain name.
This combination can identify the IP address of an organization’s servers using DNS and determine if services are listening on certain TCP ports on the target machine. The code can easily be tweaked to implement other scans, such as an XMAS tree or ACK scan.
Introduction to open technical databases
The use of open technical databases is another technique in the MITRE PRE-ATT&CK framework for performing reconnaissance. This technique takes advantage of the fact that there are a number of different publicly accessible sources of information about companies and their IT infrastructure, such as the DNS system.
DNS exploration with Python
The previous example showed how to use scapy to perform a DNS lookup for a particular domain name. The demo for this section uses DNS infrastructure to explore the registered hostnames within a target environment.
The code sample above (available here) performs forward and reverse DNS lookups to explore a target environment. Using a base domain (Google.com in this case) and a list of common subdomains, the script tests to see if a DNS record exists for each combination.
For each IP address found, the script also performs a reverse DNS lookup, which sees which DNS records are associated with a particular IP address. This makes it possible to identify multiple different roles that a particular machine may be filling (such as a combined email and web server).
Using Python for reconnaissance penetration testing
Reconnaissance is an important part of penetration testing because it gives the tester an understanding of the purpose of different elements of the target environment. Python can be used to automate the reconnaissance process in a variety of ways, including acting as a network scanner and crawling DNS records.
FREE role-guided training plans
Sources:
MITRE ATT&CK, MITRE
Nmap, Nmap
Nessus, Tenable
Python for Cybersecurity, Github
- 12 pre-built training plans
- Employer-requested skills
- Personalized, hands-on training
In this Series
- Explore Python for MITRE PRE-ATT&CK, network scanning and Scapy
- Intelligence-led pentesting and the evolution of Red Team operations
- Red Teaming: Taking advantage of Certify to attack AD networks
- How ethical hacking and pentesting is changing in 2022
- Ransomware penetration testing: Verifying your ransomware readiness
- Red Teaming: Main tools for wireless penetration tests
- Fundamentals of IoT firmware reverse engineering
- Red Teaming: Top tools and gadgets for physical assessments
- Red teaming: Initial access and foothold
- Top tools for red teaming
- What is penetration testing, anyway?
- Red Teaming: Persistence Techniques
- Red Teaming: Credential dumping techniques
- Top 6 bug bounty programs for cybersecurity professionals
- Tunneling and port forwarding tools used during red teaming assessments
- SigintOS: Signal Intelligence via a single graphical interface
- Top tools for mobile android assessments
- Top tools for mobile iOS assessments
- Red Team: C2 frameworks for pentesting
- Inside 1,602 pentests: Common vulnerabilities, findings and fixes
- Red teaming tutorial: Active directory pentesting approach and tools
- Red Team tutorial: A walkthrough on memory injection techniques
- Python for active defense: Monitoring
- Python for active defense: Network
- Python for active defense: Decoys
- How to write a port scanner in Python in 5 minutes: Example and walkthrough
- Using Python for MITRE ATT&CK and data encrypted for impact
- Explore Python for MITRE ATT&CK exfiltration and non-application layer protocol
- Explore Python for MITRE ATT&CK command-and-control
- Explore Python for MITRE ATT&CK email collection and clipboard data
- Explore Python for MITRE ATT&CK lateral movement and remote services
- Explore Python for MITRE ATT&CK account and directory discovery
- Explore Python for MITRE ATT&CK credential access and network sniffing
- Top 10 security tools for bug bounty hunters
- Kali Linux: Top 5 tools for password attacks
- Kali Linux: Top 5 tools for post exploitation
- Kali Linux: Top 5 tools for database security assessments
- Kali Linux: Top 5 tools for information gathering
- Kali Linux: Top 5 tools for sniffing and spoofing
- Kali Linux: Top 8 tools for wireless attacks
- Kali Linux: Top 5 tools for penetration testing reporting
- Kali Linux overview: 14 uses for digital forensics and pentesting
- Top 19 Kali Linux tools for vulnerability assessments
- Explore Python for MITRE ATT&CK persistence
- Explore Python for MITRE ATT&CK defense evasion
- Explore Python for MITRE ATT&CK privilege escalation
- Explore Python for MITRE ATT&CK initial access
- Top 18 tools for vulnerability exploitation in Kali Linux
- Kali Linux: Top 5 tools for social engineering
- Basic snort rules syntax and usage [updated 2021]
- Exploiting NFS share [updated 2021]
Get certified and advance your career
- Exam Pass Guarantee
- Live instruction
- CompTIA, ISACA, (ISC)², Cisco, Microsoft and more!
Penetration testing
Intelligence-led pentesting and the evolution of Red Team operations
Penetration testing
Red Teaming: Taking advantage of Certify to attack AD networks
Penetration testing
Penetration testing
Ransomware penetration testing: Verifying your ransomware readiness