[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AG5MRD5TWDYNPAK792VE0C":3,"skill-same:01M6AG5MRD5TWDYNPAK792VE0C":108},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":67,"commitSha":68,"skillDirectory":69,"forksCount":70,"repositoryHtmlUrl":71,"repositoryHomepageUrl":72,"ownerHtmlUrl":73,"ownerBlogUrl":74,"ownerDescription":75,"updatedAt":76,"install":77,"resources":90},"01M6AG5MRD5TWDYNPAK792VE0C","performing-wireless-security-assessment-with-kismet",null,"Conduct wireless network security assessments using Kismet to detect rogue access points, hidden SSIDs, weak encryption, and unauthorized clients through passive RF monitoring.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-wireless-security-assessment-with-kismet\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"performing wireless security assessment with kismet","assessment","security","wifi","rf-monitoring","wireless-ids","wids","wardriving","wifi-assessment","Kismet","802.11","rogue-AP","ids","encryption","network-security","network","monitoring","pr","cybersecurity","network security","2026-11-10 10:12:30",false,"---\nname: performing-wireless-security-assessment-with-kismet\ndescription: Conduct wireless network security assessments using Kismet to detect\n  rogue access points, hidden SSIDs, weak encryption, and unauthorized clients through\n  passive RF monitoring.\ndomain: cybersecurity\nsubdomain: network-security\ntags:\n- kismet\n- wireless-security\n- wifi-assessment\n- rogue-ap\n- 802.11\n- wardriving\n- wids\n- wireless-ids\n- rf-monitoring\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.IR-01\n- DE.CM-01\n- ID.AM-03\n- PR.DS-02\nmitre_attack:\n- T1046\n- T1040\n- T1557\n- T1071\n- T1573\n---\n\n# Performing Wireless Security Assessment with Kismet\n\n## Overview\n\nKismet is an open-source wireless network detector, packet sniffer, and wireless intrusion detection system (WIDS) supporting 802.11a\u002Fb\u002Fg\u002Fn\u002Fac\u002Fax. Unlike active scanners, Kismet operates in passive monitor mode, making it undetectable to the networks being assessed. It captures raw 802.11 frames, identifies access points, clients, probe requests, and encryption types without transmitting any packets. This skill covers deploying Kismet for comprehensive wireless security assessments, identifying rogue access points, detecting weak encryption, mapping hidden networks, and analyzing client behavior.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing wireless security assessment with kismet\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Linux system (Kali Linux, Ubuntu 22.04+) with Kismet 2023+ installed\n- Wireless adapter supporting monitor mode (e.g., Alfa AWUS036ACH, TP-Link TL-WN722N v1)\n- Written authorization for wireless assessment (legal requirement)\n- GPS receiver (optional, for geolocation mapping)\n- Target environment wireless network documentation\n\n## Core Concepts\n\n### Kismet Architecture\n\nKismet uses a client-server architecture:\n\n- **kismet** - Main server process that captures and processes packets\n- **kismet_cap_linux_wifi** - Capture source for Linux WiFi interfaces\n- **kismet_cap_linux_bluetooth** - Capture source for Bluetooth\n- **Web UI** - Browser-based interface at http:\u002F\u002Flocalhost:2501\n\n### Wireless Frame Types\n\n| Frame Type | Purpose | Security Relevance |\n|------------|---------|-------------------|\n| Beacon | AP announces its presence | SSID, encryption, vendor |\n| Probe Request | Client searches for networks | Reveals preferred networks |\n| Probe Response | AP responds to client probe | Hidden SSID disclosure |\n| Authentication | Client authenticates to AP | Auth type identification |\n| Deauthentication | Disconnects client from AP | Potential attack indicator |\n| Association | Client joins network | Client-AP relationship |\n\n### Encryption Assessment\n\n| Encryption | Status | Risk |\n|------------|--------|------|\n| Open (No encryption) | Insecure | Critical - all traffic visible |\n| WEP | Broken | Critical - crackable in minutes |\n| WPA-TKIP | Deprecated | High - known vulnerabilities |\n| WPA2-PSK (CCMP) | Acceptable | Medium - depends on passphrase strength |\n| WPA2-Enterprise (802.1X) | Recommended | Low - certificate-based |\n| WPA3-SAE | Best practice | Low - resistant to offline attacks |\n\n## Workflow\n\n### Step 1: Prepare Wireless Adapter\n\n```bash\n# Identify wireless interfaces\niwconfig\n\n# Check adapter capabilities\niw list | grep -A 10 \"Supported interface modes\"\n\n# Kill processes that may interfere\nsudo airmon-ng check kill\n\n# Enable monitor mode\nsudo ip link set wlan0 down\nsudo iw dev wlan0 set type monitor\nsudo ip link set wlan0 up\n\n# Verify monitor mode\niw dev wlan0 info | grep type\n```\n\n### Step 2: Configure and Launch Kismet\n\nEdit `\u002Fetc\u002Fkismet\u002Fkismet.conf`:\n\n```ini\n# Data sources\nsource=wlan0:name=WiFi-Monitor,channel_hop=true,channel_hoprate=5\u002Fsec\n\n# Logging configuration\nlog_types=kismet,pcapng\nlog_prefix=\u002Fopt\u002Fkismet\u002Flogs\u002Fassessment\n\n# Enable all 802.11 channels (2.4GHz and 5GHz)\nchannel_hop_speed=5\nchannel_list=IEEE80211:1,2,3,4,5,6,7,8,9,10,11,36,40,44,48,52,56,60,64,100,104,108,112,116,120,124,128,132,136,140,149,153,157,161,165\n\n# GPS configuration (if available)\ngps=gpsd:host=localhost,port=2947\n\n# Alert configuration\nalert=ADVCRYPTCHANGE,5\u002Fmin,1\u002Fsec\nalert=BSSTIMESTAMP,5\u002Fmin,1\u002Fsec\nalert=CRYPTODROP,5\u002Fmin,1\u002Fsec\nalert=DISASSOCTRAFFIC,10\u002Fmin,1\u002Fsec\nalert=DEAUTHFLOOD,10\u002Fmin,2\u002Fsec\nalert=PROBENOMFP,5\u002Fmin,1\u002Fsec\n```\n\nLaunch Kismet:\n\n```bash\n# Start Kismet server\nsudo kismet -c wlan0\n\n# Access web interface\n# Open browser to http:\u002F\u002Flocalhost:2501\n# Default credentials: kismet \u002F kismet (change immediately)\n```\n\n### Step 3: Conduct Assessment Scans\n\n**Rogue Access Point Detection:**\n\n```bash\n# Export device list via Kismet REST API\ncurl -u kismet:kismet http:\u002F\u002Flocalhost:2501\u002Fdevices\u002Fsummary\u002Fdevices.json | \\\n    python3 -m json.tool > all_devices.json\n\n# Filter for access points\ncurl -u kismet:kismet \\\n    'http:\u002F\u002Flocalhost:2501\u002Fdevices\u002Fsummary\u002Fdevices.json' \\\n    -d 'json={\"fields\":[\"kismet.device.base.macaddr\",\"kismet.device.base.name\",\"kismet.device.base.type\",\"kismet.device.base.crypt\",\"kismet.device.base.channel\",\"kismet.device.base.manuf\",\"dot11.device\u002Fdot11.device.advertised_ssid_map\u002Fdot11.advertisedssid.ssid\"]}' \\\n    > access_points.json\n```\n\n**Client Probe Analysis:**\n\nProbe requests reveal networks that clients have previously connected to, which can indicate:\n- Corporate devices connecting to insecure home networks\n- Devices searching for known-evil SSIDs (evil twin susceptibility)\n- Unauthorized personal devices in corporate space\n\n### Step 4: Analyze Results\n\nPython analysis script for Kismet database:\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"Analyze Kismet capture database for wireless security findings.\"\"\"\n\nimport sqlite3\nimport json\nimport sys\nfrom collections import defaultdict\n\n\ndef analyze_kismet_db(db_path: str):\n    \"\"\"Analyze Kismet SQLite database for security issues.\"\"\"\n    conn = sqlite3.connect(db_path)\n    cursor = conn.cursor()\n\n    findings = []\n\n    # Query all devices\n    cursor.execute(\"\"\"\n        SELECT devmac, type, device\n        FROM devices\n    \"\"\")\n\n    devices = cursor.fetchall()\n    ap_count = 0\n    client_count = 0\n    open_networks = []\n    wep_networks = []\n    wpa_tkip_networks = []\n    hidden_networks = []\n    all_aps = []\n\n    for mac, dev_type, device_json in devices:\n        try:\n            device = json.loads(device_json)\n        except json.JSONDecodeError:\n            continue\n\n        base = device.get('kismet.device.base.type', '')\n\n        if 'Wi-Fi AP' in base or 'Wi-Fi Device' in base:\n            ap_count += 1\n            ssid_map = device.get('dot11.device', {}).get(\n                'dot11.device.advertised_ssid_map', []\n            )\n            crypt = device.get('kismet.device.base.crypt', '')\n            name = device.get('kismet.device.base.name', 'Unknown')\n            channel = device.get('kismet.device.base.channel', '')\n            manuf = device.get('kismet.device.base.manuf', 'Unknown')\n\n            ap_info = {\n                'mac': mac,\n                'ssid': name,\n                'encryption': crypt,\n                'channel': channel,\n                'manufacturer': manuf,\n            }\n            all_aps.append(ap_info)\n\n            if 'None' in crypt or crypt == '':\n                open_networks.append(ap_info)\n            elif 'WEP' in crypt:\n                wep_networks.append(ap_info)\n            elif 'WPA+TKIP' in crypt and 'AES' not in crypt:\n                wpa_tkip_networks.append(ap_info)\n\n            for ssid_entry in ssid_map:\n                if isinstance(ssid_entry, dict):\n                    ssid = ssid_entry.get('dot11.advertisedssid.ssid', '')\n                    if ssid == '' or ssid is None:\n                        hidden_networks.append(ap_info)\n\n        elif 'Wi-Fi Client' in base:\n            client_count += 1\n\n    # Generate findings\n    print(f\"\\n{'='*70}\")\n    print(\"WIRELESS SECURITY ASSESSMENT REPORT\")\n    print(f\"{'='*70}\")\n    print(f\"\\nTotal Access Points Detected: {ap_count}\")\n    print(f\"Total Clients Detected: {client_count}\")\n\n    if open_networks:\n        print(f\"\\n[CRITICAL] Open Networks (No Encryption): {len(open_networks)}\")\n        for net in open_networks:\n            print(f\"  - SSID: {net['ssid']}, MAC: {net['mac']}, \"\n                  f\"Channel: {net['channel']}, Vendor: {net['manufacturer']}\")\n\n    if wep_networks:\n        print(f\"\\n[CRITICAL] WEP-Encrypted Networks: {len(wep_networks)}\")\n        for net in wep_networks:\n            print(f\"  - SSID: {net['ssid']}, MAC: {net['mac']}, \"\n                  f\"Channel: {net['channel']}\")\n\n    if wpa_tkip_networks:\n        print(f\"\\n[HIGH] WPA-TKIP Networks (Deprecated): {len(wpa_tkip_networks)}\")\n        for net in wpa_tkip_networks:\n            print(f\"  - SSID: {net['ssid']}, MAC: {net['mac']}, \"\n                  f\"Channel: {net['channel']}\")\n\n    if hidden_networks:\n        print(f\"\\n[MEDIUM] Hidden SSIDs Detected: {len(hidden_networks)}\")\n        for net in hidden_networks:\n            print(f\"  - MAC: {net['mac']}, Channel: {net['channel']}, \"\n                  f\"Vendor: {net['manufacturer']}\")\n\n    # Channel utilization analysis\n    channel_usage = defaultdict(int)\n    for ap in all_aps:\n        ch = ap.get('channel', 'Unknown')\n        channel_usage[ch] += 1\n\n    print(f\"\\n[INFO] Channel Utilization:\")\n    for ch, count in sorted(channel_usage.items()):\n        print(f\"  Channel {ch}: {count} APs\")\n\n    conn.close()\n\n\nif __name__ == '__main__':\n    db_path = sys.argv[1] if len(sys.argv) > 1 else 'Kismet-*.kismet'\n    analyze_kismet_db(db_path)\n```\n\n### Step 5: Detect Rogue Access Points\n\nCompare discovered APs against authorized inventory:\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"Detect rogue access points by comparing against authorized AP list.\"\"\"\n\nimport json\nimport sys\n\n\ndef load_authorized_aps(filepath: str) -> set:\n    \"\"\"Load authorized AP MAC addresses from file.\"\"\"\n    authorized = set()\n    with open(filepath, 'r') as f:\n        for line in f:\n            mac = line.strip().lower()\n            if mac and not mac.startswith('#'):\n                authorized.add(mac)\n    return authorized\n\n\ndef detect_rogues(kismet_json: str, authorized_file: str):\n    \"\"\"Compare discovered APs against authorized list.\"\"\"\n    authorized = load_authorized_aps(authorized_file)\n\n    with open(kismet_json, 'r') as f:\n        devices = json.load(f)\n\n    rogues = []\n    for device in devices:\n        mac = device.get('kismet.device.base.macaddr', '').lower()\n        dev_type = device.get('kismet.device.base.type', '')\n\n        if 'AP' in dev_type and mac not in authorized:\n            rogues.append({\n                'mac': mac,\n                'ssid': device.get('kismet.device.base.name', 'Unknown'),\n                'encryption': device.get('kismet.device.base.crypt', ''),\n                'channel': device.get('kismet.device.base.channel', ''),\n                'manufacturer': device.get('kismet.device.base.manuf', ''),\n                'signal': device.get('kismet.device.base.signal', {}).get(\n                    'kismet.common.signal.last_signal', 0),\n            })\n\n    if rogues:\n        print(f\"\\n[ALERT] {len(rogues)} ROGUE ACCESS POINTS DETECTED\\n\")\n        for rogue in rogues:\n            print(f\"  MAC: {rogue['mac']}\")\n            print(f\"  SSID: {rogue['ssid']}\")\n            print(f\"  Encryption: {rogue['encryption']}\")\n            print(f\"  Channel: {rogue['channel']}\")\n            print(f\"  Vendor: {rogue['manufacturer']}\")\n            print(f\"  Signal: {rogue['signal']} dBm\")\n            print()\n    else:\n        print(\"No rogue access points detected.\")\n\n\nif __name__ == '__main__':\n    if len(sys.argv) \u003C 3:\n        print(\"Usage: python detect_rogues.py \u003Ckismet_devices.json> \u003Cauthorized_aps.txt>\")\n        sys.exit(1)\n    detect_rogues(sys.argv[1], sys.argv[2])\n```\n\n## Assessment Checklist\n\n- [ ] All authorized APs identified and verified\n- [ ] Rogue\u002Funauthorized APs identified and located\n- [ ] Encryption types documented for all SSIDs\n- [ ] Hidden SSIDs discovered and documented\n- [ ] Client probe requests analyzed for sensitive patterns\n- [ ] Evil twin susceptibility assessed\n- [ ] WPS status checked on all APs\n- [ ] Signal coverage boundaries mapped\n- [ ] Guest network isolation verified\n- [ ] Management interfaces not exposed on wireless\n\n## Best Practices\n\n- **Written Authorization** - Always obtain signed authorization before performing wireless assessments\n- **Passive Only** - Use Kismet in passive mode; do not transmit deauth frames or probe requests\n- **Comprehensive Channel Coverage** - Scan both 2.4GHz and 5GHz bands including DFS channels\n- **Multiple Locations** - Perform captures from multiple physical locations for complete coverage\n- **Time Duration** - Capture for at least 30-60 minutes to observe intermittent devices\n- **GPS Mapping** - Use GPS to create heat maps for signal boundary analysis\n- **Baseline Comparison** - Maintain an authorized AP inventory and compare against each assessment\n\n## References\n\n- [Kismet Documentation](https:\u002F\u002Fwww.kismetwireless.net\u002Fdocs\u002F)\n- [CISA Kismet Resources](https:\u002F\u002Fwww.cisa.gov\u002Fresources-tools\u002Fservices\u002Fkismet)\n- [NIST SP 800-153 - Wireless Network Security](https:\u002F\u002Fcsrc.nist.gov\u002Fpublications\u002Fdetail\u002Fsp\u002F800-153\u002Ffinal)\n- [Wi-Fi Alliance WPA3 Specification](https:\u002F\u002Fwww.wi-fi.org\u002Fdiscover-wi-fi\u002Fsecurity)\n","# Performing Wireless Security Assessment with Kismet\n\n## Overview\n\nKismet is an open-source wireless network detector, packet sniffer, and wireless intrusion detection system (WIDS) supporting 802.11a\u002Fb\u002Fg\u002Fn\u002Fac\u002Fax. Unlike active scanners, Kismet operates in passive monitor mode, making it undetectable to the networks being assessed. It captures raw 802.11 frames, identifies access points, clients, probe requests, and encryption types without transmitting any packets. This skill covers deploying Kismet for comprehensive wireless security assessments, identifying rogue access points, detecting weak encryption, mapping hidden networks, and analyzing client behavior.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing wireless security assessment with kismet\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Linux system (Kali Linux, Ubuntu 22.04+) with Kismet 2023+ installed\n- Wireless adapter supporting monitor mode (e.g., Alfa AWUS036ACH, TP-Link TL-WN722N v1)\n- Written authorization for wireless assessment (legal requirement)\n- GPS receiver (optional, for geolocation mapping)\n- Target environment wireless network documentation\n\n## Core Concepts\n\n### Kismet Architecture\n\nKismet uses a client-server architecture:\n\n- **kismet** - Main server process that captures and processes packets\n- **kismet_cap_linux_wifi** - Capture source for Linux WiFi interfaces\n- **kismet_cap_linux_bluetooth** - Capture source for Bluetooth\n- **Web UI** - Browser-based interface at http:\u002F\u002Flocalhost:2501\n\n### Wireless Frame Types\n\n| Frame Type | Purpose | Security Relevance |\n|------------|---------|-------------------|\n| Beacon | AP announces its presence | SSID, encryption, vendor |\n| Probe Request | Client searches for networks | Reveals preferred networks |\n| Probe Response | AP responds to client probe | Hidden SSID disclosure |\n| Authentication | Client authenticates to AP | Auth type identification |\n| Deauthentication | Disconnects client from AP | Potential attack indicator |\n| Association | Client joins network | Client-AP relationship |\n\n### Encryption Assessment\n\n| Encryption | Status | Risk |\n|------------|--------|------|\n| Open (No encryption) | Insecure | Critical - all traffic visible |\n| WEP | Broken | Critical - crackable in minutes |\n| WPA-TKIP | Deprecated | High - known vulnerabilities |\n| WPA2-PSK (CCMP) | Acceptable | Medium - depends on passphrase strength |\n| WPA2-Enterprise (802.1X) | Recommended | Low - certificate-based |\n| WPA3-SAE | Best practice | Low - resistant to offline attacks |\n\n## Workflow\n\n### Step 1: Prepare Wireless Adapter\n\n```bash\n# Identify wireless interfaces\niwconfig\n\n# Check adapter capabilities\niw list | grep -A 10 \"Supported interface modes\"\n\n# Kill processes that may interfere\nsudo airmon-ng check kill\n\n# Enable monitor mode\nsudo ip link set wlan0 down\nsudo iw dev wlan0 set type monitor\nsudo ip link set wlan0 up\n\n# Verify monitor mode\niw dev wlan0 info | grep type\n```\n\n### Step 2: Configure and Launch Kismet\n\nEdit `\u002Fetc\u002Fkismet\u002Fkismet.conf`:\n\n```ini\n# Data sources\nsource=wlan0:name=WiFi-Monitor,channel_hop=true,channel_hoprate=5\u002Fsec\n\n# Logging configuration\nlog_types=kismet,pcapng\nlog_prefix=\u002Fopt\u002Fkismet\u002Flogs\u002Fassessment\n\n# Enable all 802.11 channels (2.4GHz and 5GHz)\nchannel_hop_speed=5\nchannel_list=IEEE80211:1,2,3,4,5,6,7,8,9,10,11,36,40,44,48,52,56,60,64,100,104,108,112,116,120,124,128,132,136,140,149,153,157,161,165\n\n# GPS configuration (if available)\ngps=gpsd:host=localhost,port=2947\n\n# Alert configuration\nalert=ADVCRYPTCHANGE,5\u002Fmin,1\u002Fsec\nalert=BSSTIMESTAMP,5\u002Fmin,1\u002Fsec\nalert=CRYPTODROP,5\u002Fmin,1\u002Fsec\nalert=DISASSOCTRAFFIC,10\u002Fmin,1\u002Fsec\nalert=DEAUTHFLOOD,10\u002Fmin,2\u002Fsec\nalert=PROBENOMFP,5\u002Fmin,1\u002Fsec\n```\n\nLaunch Kismet:\n\n```bash\n# Start Kismet server\nsudo kismet -c wlan0\n\n# Access web interface\n# Open browser to http:\u002F\u002Flocalhost:2501\n# Default credentials: kismet \u002F kismet (change immediately)\n```\n\n### Step 3: Conduct Assessment Scans\n\n**Rogue Access Point Detection:**\n\n```bash\n# Export device list via Kismet REST API\ncurl -u kismet:kismet http:\u002F\u002Flocalhost:2501\u002Fdevices\u002Fsummary\u002Fdevices.json | \\\n    python3 -m json.tool > all_devices.json\n\n# Filter for access points\ncurl -u kismet:kismet \\\n    'http:\u002F\u002Flocalhost:2501\u002Fdevices\u002Fsummary\u002Fdevices.json' \\\n    -d 'json={\"fields\":[\"kismet.device.base.macaddr\",\"kismet.device.base.name\",\"kismet.device.base.type\",\"kismet.device.base.crypt\",\"kismet.device.base.channel\",\"kismet.device.base.manuf\",\"dot11.device\u002Fdot11.device.advertised_ssid_map\u002Fdot11.advertisedssid.ssid\"]}' \\\n    > access_points.json\n```\n\n**Client Probe Analysis:**\n\nProbe requests reveal networks that clients have previously connected to, which can indicate:\n- Corporate devices connecting to insecure home networks\n- Devices searching for known-evil SSIDs (evil twin susceptibility)\n- Unauthorized personal devices in corporate space\n\n### Step 4: Analyze Results\n\nPython analysis script for Kismet database:\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"Analyze Kismet capture database for wireless security findings.\"\"\"\n\nimport sqlite3\nimport json\nimport sys\nfrom collections import defaultdict\n\n\ndef analyze_kismet_db(db_path: str):\n    \"\"\"Analyze Kismet SQLite database for security issues.\"\"\"\n    conn = sqlite3.connect(db_path)\n    cursor = conn.cursor()\n\n    findings = []\n\n    # Query all devices\n    cursor.execute(\"\"\"\n        SELECT devmac, type, device\n        FROM devices\n    \"\"\")\n\n    devices = cursor.fetchall()\n    ap_count = 0\n    client_count = 0\n    open_networks = []\n    wep_networks = []\n    wpa_tkip_networks = []\n    hidden_networks = []\n    all_aps = []\n\n    for mac, dev_type, device_json in devices:\n        try:\n            device = json.loads(device_json)\n        except json.JSONDecodeError:\n            continue\n\n        base = device.get('kismet.device.base.type', '')\n\n        if 'Wi-Fi AP' in base or 'Wi-Fi Device' in base:\n            ap_count += 1\n            ssid_map = device.get('dot11.device', {}).get(\n                'dot11.device.advertised_ssid_map', []\n            )\n            crypt = device.get('kismet.device.base.crypt', '')\n            name = device.get('kismet.device.base.name', 'Unknown')\n            channel = device.get('kismet.device.base.channel', '')\n            manuf = device.get('kismet.device.base.manuf', 'Unknown')\n\n            ap_info = {\n                'mac': mac,\n                'ssid': name,\n                'encryption': crypt,\n                'channel': channel,\n                'manufacturer': manuf,\n            }\n            all_aps.append(ap_info)\n\n            if 'None' in crypt or crypt == '':\n                open_networks.append(ap_info)\n            elif 'WEP' in crypt:\n                wep_networks.append(ap_info)\n            elif 'WPA+TKIP' in crypt and 'AES' not in crypt:\n                wpa_tkip_networks.append(ap_info)\n\n            for ssid_entry in ssid_map:\n                if isinstance(ssid_entry, dict):\n                    ssid = ssid_entry.get('dot11.advertisedssid.ssid', '')\n                    if ssid == '' or ssid is None:\n                        hidden_networks.append(ap_info)\n\n        elif 'Wi-Fi Client' in base:\n            client_count += 1\n\n    # Generate findings\n    print(f\"\\n{'='*70}\")\n    print(\"WIRELESS SECURITY ASSESSMENT REPORT\")\n    print(f\"{'='*70}\")\n    print(f\"\\nTotal Access Points Detected: {ap_count}\")\n    print(f\"Total Clients Detected: {client_count}\")\n\n    if open_networks:\n        print(f\"\\n[CRITICAL] Open Networks (No Encryption): {len(open_networks)}\")\n        for net in open_networks:\n            print(f\"  - SSID: {net['ssid']}, MAC: {net['mac']}, \"\n                  f\"Channel: {net['channel']}, Vendor: {net['manufacturer']}\")\n\n    if wep_networks:\n        print(f\"\\n[CRITICAL] WEP-Encrypted Networks: {len(wep_networks)}\")\n        for net in wep_networks:\n            print(f\"  - SSID: {net['ssid']}, MAC: {net['mac']}, \"\n                  f\"Channel: {net['channel']}\")\n\n    if wpa_tkip_networks:\n        print(f\"\\n[HIGH] WPA-TKIP Networks (Deprecated): {len(wpa_tkip_networks)}\")\n        for net in wpa_tkip_networks:\n            print(f\"  - SSID: {net['ssid']}, MAC: {net['mac']}, \"\n                  f\"Channel: {net['channel']}\")\n\n    if hidden_networks:\n        print(f\"\\n[MEDIUM] Hidden SSIDs Detected: {len(hidden_networks)}\")\n        for net in hidden_networks:\n            print(f\"  - MAC: {net['mac']}, Channel: {net['channel']}, \"\n                  f\"Vendor: {net['manufacturer']}\")\n\n    # Channel utilization analysis\n    channel_usage = defaultdict(int)\n    for ap in all_aps:\n        ch = ap.get('channel', 'Unknown')\n        channel_usage[ch] += 1\n\n    print(f\"\\n[INFO] Channel Utilization:\")\n    for ch, count in sorted(channel_usage.items()):\n        print(f\"  Channel {ch}: {count} APs\")\n\n    conn.close()\n\n\nif __name__ == '__main__':\n    db_path = sys.argv[1] if len(sys.argv) > 1 else 'Kismet-*.kismet'\n    analyze_kismet_db(db_path)\n```\n\n### Step 5: Detect Rogue Access Points\n\nCompare discovered APs against authorized inventory:\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"Detect rogue access points by comparing against authorized AP list.\"\"\"\n\nimport json\nimport sys\n\n\ndef load_authorized_aps(filepath: str) -> set:\n    \"\"\"Load authorized AP MAC addresses from file.\"\"\"\n    authorized = set()\n    with open(filepath, 'r') as f:\n        for line in f:\n            mac = line.strip().lower()\n            if mac and not mac.startswith('#'):\n                authorized.add(mac)\n    return authorized\n\n\ndef detect_rogues(kismet_json: str, authorized_file: str):\n    \"\"\"Compare discovered APs against authorized list.\"\"\"\n    authorized = load_authorized_aps(authorized_file)\n\n    with open(kismet_json, 'r') as f:\n        devices = json.load(f)\n\n    rogues = []\n    for device in devices:\n        mac = device.get('kismet.device.base.macaddr', '').lower()\n        dev_type = device.get('kismet.device.base.type', '')\n\n        if 'AP' in dev_type and mac not in authorized:\n            rogues.append({\n                'mac': mac,\n                'ssid': device.get('kismet.device.base.name', 'Unknown'),\n                'encryption': device.get('kismet.device.base.crypt', ''),\n                'channel': device.get('kismet.device.base.channel', ''),\n                'manufacturer': device.get('kismet.device.base.manuf', ''),\n                'signal': device.get('kismet.device.base.signal', {}).get(\n                    'kismet.common.signal.last_signal', 0),\n            })\n\n    if rogues:\n        print(f\"\\n[ALERT] {len(rogues)} ROGUE ACCESS POINTS DETECTED\\n\")\n        for rogue in rogues:\n            print(f\"  MAC: {rogue['mac']}\")\n            print(f\"  SSID: {rogue['ssid']}\")\n            print(f\"  Encryption: {rogue['encryption']}\")\n            print(f\"  Channel: {rogue['channel']}\")\n            print(f\"  Vendor: {rogue['manufacturer']}\")\n            print(f\"  Signal: {rogue['signal']} dBm\")\n            print()\n    else:\n        print(\"No rogue access points detected.\")\n\n\nif __name__ == '__main__':\n    if len(sys.argv) \u003C 3:\n        print(\"Usage: python detect_rogues.py \u003Ckismet_devices.json> \u003Cauthorized_aps.txt>\")\n        sys.exit(1)\n    detect_rogues(sys.argv[1], sys.argv[2])\n```\n\n## Assessment Checklist\n\n- [ ] All authorized APs identified and verified\n- [ ] Rogue\u002Funauthorized APs identified and located\n- [ ] Encryption types documented for all SSIDs\n- [ ] Hidden SSIDs discovered and documented\n- [ ] Client probe requests analyzed for sensitive patterns\n- [ ] Evil twin susceptibility assessed\n- [ ] WPS status checked on all APs\n- [ ] Signal coverage boundaries mapped\n- [ ] Guest network isolation verified\n- [ ] Management interfaces not exposed on wireless\n\n## Best Practices\n\n- **Written Authorization** - Always obtain signed authorization before performing wireless assessments\n- **Passive Only** - Use Kismet in passive mode; do not transmit deauth frames or probe requests\n- **Comprehensive Channel Coverage** - Scan both 2.4GHz and 5GHz bands including DFS channels\n- **Multiple Locations** - Perform captures from multiple physical locations for complete coverage\n- **Time Duration** - Capture for at least 30-60 minutes to observe intermittent devices\n- **GPS Mapping** - Use GPS to create heat maps for signal boundary analysis\n- **Baseline Comparison** - Maintain an authorized AP inventory and compare against each assessment\n\n## References\n\n- [Kismet Documentation](https:\u002F\u002Fwww.kismetwireless.net\u002Fdocs\u002F)\n- [CISA Kismet Resources](https:\u002F\u002Fwww.cisa.gov\u002Fresources-tools\u002Fservices\u002Fkismet)\n- [NIST SP 800-153 - Wireless Network Security](https:\u002F\u002Fcsrc.nist.gov\u002Fpublications\u002Fdetail\u002Fsp\u002F800-153\u002Ffinal)\n- [Wi-Fi Alliance WPA3 Specification](https:\u002F\u002Fwww.wi-fi.org\u002Fdiscover-wi-fi\u002Fsecurity)\n",{"name":5,"tags":49,"author":54,"domain":42,"license":15,"version":55,"nist_csf":56,"subdomain":38,"description":7,"mitre_attack":61},[50,51,32,52,53,31,30,29,28],"kismet","wireless-security","rogue-ap",802.11,"mahipal","1.0",[57,58,59,60],"PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02",[62,63,64,65,66],"T1046","T1040","T1557","T1071","T1573","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fperforming-wireless-security-assessment-with-kismet",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":78,"prompt":88,"zipAvailable":89},[79,82,85],{"tool":80,"command":81},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-wireless-security-assessment-with-kismet",{"tool":83,"command":84},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-wireless-security-assessment-with-kismet",{"tool":86,"command":87},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-wireless-security-assessment-with-kismet","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-wireless-security-assessment-with-kismet\u002FSKILL.md",true,[91,96,102],{"path":92,"resourceType":92,"resourceTypeDesc":93,"sizeBytes":94,"sourceHtmlUrl":95},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-wireless-security-assessment-with-kismet\u002FLICENSE",{"path":97,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":100,"sourceHtmlUrl":101},"references\u002Fapi-reference.md","REFERENCE","参考文档",2054,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-wireless-security-assessment-with-kismet\u002Freferences\u002Fapi-reference.md",{"path":103,"resourceType":104,"resourceTypeDesc":105,"sizeBytes":106,"sourceHtmlUrl":107},"scripts\u002Fagent.py","SCRIPT","脚本",5818,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-wireless-security-assessment-with-kismet\u002Fscripts\u002Fagent.py",[109,134,158,186,212,239],{"skillNo":110,"name":111,"nameZh":6,"description":112,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":113,"categories":114,"keywords":116,"publishedAt":44},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[115],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[117,118,119,120,26,42,121,122,41,123,124,125,126,127,128,129,130,131,132,133],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":135,"name":136,"nameZh":6,"description":137,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":138,"categories":139,"keywords":141,"publishedAt":44},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[140],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[142,130,143,144,26,145,42,41,146,147,148,149,150,151,152,153,154,155,156,157],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":159,"name":160,"nameZh":6,"description":161,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":162,"categories":163,"keywords":168,"publishedAt":44},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[164,167],{"categoryNo":165,"categoryName":166,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[152,169,170,171,172,42,173,174,146,175,176,177,178,179,180,181,182,183,184,185],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":187,"name":188,"nameZh":6,"description":189,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":190,"categories":191,"keywords":193,"publishedAt":44},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[192],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[194,195,196,42,197,198,199,200,201,202,203,204,205,206,207,208,149,209,210,211],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":213,"name":214,"nameZh":6,"description":215,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":216,"categories":217,"keywords":219,"publishedAt":44},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[218],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[220,221,222,42,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":240,"name":241,"nameZh":6,"description":242,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":243,"categories":244,"keywords":246,"publishedAt":44},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[245],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[26,247,42,248,249,250,251,252,253,254,255,181,256,182,257,258,259,260,261,262],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]