Hi, and welcome to this course, Discovery with Kismet,
which is a part of the Red Team Tools series on Pluralsight.
My name is Guillaume Ross, and I'm a security researcher,
as well as the head of security at a fintech.
Kismet is what we'll be talking about today,
which a lot of people call Kismet wireless because of its domain name.
Kismet was created by @dragorn, or Mike Kershaw.
It's a wireless network and device detector,
meaning it will see access points and the things that connect to them,
and you can use that to sniff, discover networks while performing wardriving,
but also to do things like wireless intrusion detection on your network.
Kismet is really a device detection tool and a wireless
network tool that lets you gather anything.
You'll know device names, what clients are connecting where on what channel,
what data is being transmitted, what encryption is in use,
and much more.
You can download it from its website at kismetwireless.net,
and I highly encourage you to download the official packages and not
use the ones that come with your distribution.
Because even though it is one of the first wireless security tools to be made,
it is still very actively maintained.
It came out back when 2.4 GHz wireless networks were the norm
and were just starting to become popular,
and pretty much everyone had cleartext or maybe WEP encryption.
And to this day,
it supports a variety of wireless cards and different interfaces,
including software‑defined radios, so it can do more than just Wi‑Fi.
If we look at the kill chain, Kismet definitely belongs on the recon section.
It's a tool that's going to let you gather a lot of information,
but it won't let you exploit any devices.
You'll use it to discover devices that might be exploitable,
to discover networks that might not be configured properly,
or even together network packets started being exchanged on those networks.
If we look at MITRE ATT&CK,
Kismet is essentially a discovery and a collection tool.
It will let you discover networks,
and it will let you collect information about that,
it can let you perform things like network information discovery,
network sniffing,
which is really close to eavesdropping on insecure network communications.
Even though that's part of ATT&CK Mobile,
we're essentially doing the same thing on the wireless network.
That being said, there is some overlap between the different tactics.
For example, while you're collecting data from a network,
you might get the data you were actually trying to exfiltrate.
And because Kismet is able to log it to your laptop,
that could count as exfiltration.
What if that data contained credentials?
Well, maybe that's a little bit of credential access.
Kismet is typically used with a laptop because it's easier to take with you.
You'll need a wireless network interface that has an antenna.
That can be the built‑in one,
but sometimes it's easier to use a USB device with an external
antenna if you want to receive everything.
And, of course,
the nearby wireless networks are sending data over the
airwaves on multiple different channels.
If there was only one channel,
wireless networks would always suffer from a lot of interference,
so you'll need to configure channel hopping.
That way,
your network card will only be on a certain channel
for a specific amount of time,
and it will cycle through all the channels so you
can detect all of the networks.
And once you identify one where you want to gather more information,
you can stop the channel hopping.
The prerequisites for this demo are going to be a VM or a system to run Kismet.
While Kismet supports Mac, Linux, and Windows,
we highly recommend using Kali Linux for the demo,
and you can use it in a virtual machine.
The Windows support for Kismet is not full support.
It's essentially the client part of Kismet.
So if you really need to gather the data from the wireless airwaves,
you'll need a Mac or a Linux system.
You also need a Wi‑Fi adapter that's compatible with Kismet.
If you're running Kismet on Mac,
most of the built‑in wireless adapters in the Mac are supported,
but it's usually simpler to use a USB device that
you'll link to the virtual machine.
That way,
your actual laptop's operating system can still use Wi‑Fi while you're
scanning for other Wi‑Fi networks. You can find links to the devices
supported by Kismet in the files of this module.
And, of course,
you'll need to be around some Wi‑Fi networks, but if you're looking at this,
it's safe to assume that you probably have some around you right now.