CATSploit: An automated penetration testing tool

CATSploit

CATSploit is an automated penetration testing tool using the Cyber Attack Techniques Scoring (CATS) method that can be used without a pentester. Currently, pentesters implicitly make the selection of suitable attack techniques for target systems to be attacked. CATSploit uses system configuration information such as OS, open ports, and software version collected by the scanner and calculates a score value for capturing eVc and detectability eVd of each attack technique for the target system. By selecting the highest score values, it is possible to select the most appropriate attack technique for the target system without a hack knack(professional pentester’s skill).

CATSploit automatically performs penetration tests in the following sequence:

1. Information gathering and prior information input First, gathering information on target systems. CATSploit supports nmap and OpenVAS to gather information on target systems. CATSploit also supports prior information on target systems if you have one.

2. Calculating score value of attack techniques Using information obtained in the previous phase and the attack techniques database, evaluation values of capture (eVc) and detectability (eVd) of each attack technique are calculated. For each target computer, the values of each attack technique are calculated.

3. Selection of attack techniques by using scores and making attack scenarios Select attack techniques and create attack scenarios according to pre-defined policies. For example, for a policy that prioritized hard-to-detect, the attack techniques with the lowest eVd(Detectable Score) will be selected.

4. Execution of attack scenario CATSploit executes the attack techniques according to the attack scenario constructed in the previous phase. CATSploit uses Metasploit as a framework and Metasploit API to execute actual attacks.

Install & Use

Copyright 2023 Mitsubishi Electric Corporation