Paper, 2024.11

Implementation of an Automated Penetration Testing Tool Based on MITRE ATT&CK

This paper implements an automated penetration testing tool based on MITRE ATT&CK, aimed at finding and verifying vulnerabilities in cloud instances with less manual effort. In the draft version, the tool chains an nmap service scan, a service configuration scan, a CVE lookup with vulners-lookup, an exploit search with searchsploit/exploitdb, and a brute-force attack into one pipeline built from open tools on Kali Linux. Seunghyuk Kim is the first author, and Joonho Seo is the fifth of seven co-authors. The paper was presented orally at the Korea Institute of Information Security and Cryptology winter conference (CISC-W'24) on November 28, 2024.

Where

KIISC CISC-W 2024

My role

Co-author

Status

published