Pentest Threat Modeling

PTES Phase 3: Threat Modeling

🎯 pfSense Detection & Routing

IMPORTANTE: Se durante o threat modeling você identificar pfSense como alvo, ATIVE A SKILL pentest-pfsense para modelagem específica.

pfSense Threat Modeling

Attack Surface Mapping

pfSense Attack Vectors:
├── Web GUI (443/tcp)
│   ├── Authentication bypass
│   ├── Command injection (diag_*.php)
│   ├── XSS (stored/reflected)
│   └── File read/write arbitrary
├── SSH (22/tcp)
│   ├── Brute force
│   └── Terrapin attack (CVE-2023-48795)
├── VPN Services
│   ├── OpenVPN (1194)
│   ├── IPsec (500/4500)
│   └── WireGuard (51820)
├── Packages
│   ├── pfBlockerNG (RCE CVE-2022-40624)
│   ├── Suricata (Path Traversal CVE-2025-12490)
│   └── Snort (File Oracle CVE-2025-34173)
└── HA/CARP
    ├── XMLRPC sync abuse
    └── Config sync injection

High-Value Targets

• /cf/conf/config.xml - Todas as credenciais e configurações
• OpenVPN/IPsec credentials - Acesso VPN
• HA sync credentials - Controle do cluster
• Package configurations - Persistência

Ação Imediata

# Se pfSense identificado → ATIVAR pentest-pfsense skill
# Esta skill continua para threat modeling geral
# Use pentest-pfsense para:
# - Attack tree específico para firewall
# - Feature-based threat modeling (158 features)
# - CVE prioritization (EPSS/CVSS)
# - Privilege escalation paths

Objetivo

Analisar dados coletados para identificar vetores de ataque, alvos de alto valor e caminhos de exploração prioritários, alinhado com PTES Section 3.3 (Attack Avenues) e Section 3.2 (Vulnerability Validation).

Referências PTES para Threat Modeling

PTES 3.3 - Attack Avenues

• 3.3.1 Creation of Attack Trees: Mapear caminhos de exploração
• 3.3.2 Identify protection mechanisms:
  • 3.3.2.1 Network protections (packet filters, traffic shaping, DLP)
  • 3.3.2.2 Host based protections (stack/heap, whitelisting, AV)
  • 3.3.2.3 Application level protections

PTES 3.2 - Vulnerability Validation

• 3.2.1 Public Research: Common/default passwords, CVE research
• 3.2.2 Establish target list:
  • 3.2.2.1 Mapping Versions
  • 3.2.2.2 Identifying Patch Levels
  • 3.2.2.3 Looking for Weak Web Applications
  • 3.2.2.4 Identify Weak Ports and Services
  • 3.2.2.5 Identify Lockout threshold

Análise de Dados com WorstAssume

1. Executar Security Assessment (PTES 3.1 - Vulnerability Testing)

# Rodar assessment completo (PTES 3.1.2 - Automated Tools)
worst assess

# Assessment com filtro de severidade (PTES 3.1.1 - Active)
worst assess --min-severity HIGH

# Assessment de conta específica
worst assess --account-id 123456789012

# Assessment focado em IAM (PTES 3.2.2.4 - Weak Services)
worst assess --focus iam

2. Categorias de Ameaças a Modelar (PTES 3.3 - Attack Avenues)

WEAK_TRUST - Trust Policies Problemáticas (PTES 3.3.2 - Protection Mechanisms)

• Roles com Principal: "*" (wildcard público)
• Cross-account trust sem ExternalId
• Service principals amplos (ex: sts.amazonaws.com)
• Federated trust sem condições sub/aud
• Root account trust de outras contas

PERMISSIVE_POLICY - Permissões Excessivas (PTES 3.2.2.4 - Weak Services)

• AdministratorAccess attached
• PowerUserAccess attached
• IAMFullAccess attached
• Políticas customizadas com *:*
• Group-based privilege inheritance

RESOURCE_WILDCARD - Recursos sem Restrição

• Write actions em Resource: "*"
• iam:PassRole sem restrição de recurso
• s3:* em todos os buckets
• secretsmanager:GetSecretValue global

USER_CONFIG - Misconfigurações de Usuário (PTES 3.2.2.5 - Lockout Threshold)

• Console access sem MFA
• Access keys > 90 dias
• Access keys > 365 dias (CRITICAL)
• Users com múltiplas access keys ativas

GROUP_CONFIG - Grupos Perigosos

• Grupos com AdministratorAccess
• Grupos com IAM manipulation permissions
• Group membership escalation paths

3. Modelagem de Ameaças por Categoria (PTES 3.3.1 - Attack Trees)

A. Ameaças de Identidade (IAM) - PTES 3.3.2.2 Host Based Protections

ATTACK VECTOR: IAM Policy Manipulation
├── PATH-001: CreatePolicyVersion → Admin em qualquer policy
├── PATH-002: SetDefaultPolicyVersion → Ativar versão permissiva
├── PATH-003: AttachUserPolicy → Attach admin policy em user
├── PATH-004: AttachRolePolicy → Attach admin policy em role
├── PATH-005: AttachGroupPolicy → Attach admin policy em group
├── PATH-006: PutUserPolicy → Inline policy em user
├── PATH-007: PutRolePolicy → Inline policy em role
├── PATH-008: PutGroupPolicy → Inline policy em group
├── PATH-009: AddUserToGroup → Herdar permissões do grupo
├── PATH-010: UpdateAssumeRolePolicy → Modificar trust policy
├── PATH-011: CreateAccessKey → Criar chave persistente
├── PATH-012: CreateLoginProfile → Criar console access
└── PATH-013: UpdateLoginProfile → Overwrite senha console

B. Ameaças de PassRole - PTES 3.3.2.3 Application Level Protections

ATTACK VECTOR: PassRole + Compute Services
├── PATH-015: EC2 RunInstances → Roubar creds via IMDS
├── PATH-016: Lambda CreateFunction → Executar como role
├── PATH-018: Lambda EventSourceMapping → Trigger automático
├── PATH-021: Glue CreateDevEndpoint → SSH + creds
├── PATH-023: CloudFormation CreateStack → Service role abuse
├── PATH-024: DataPipeline CreatePipeline → Shell activity
├── PATH-025: SageMaker CreateNotebook → Notebook com creds
└── PATH-027: CodeStar CreateProject → Project role abuse

C. Ameaças de Resource Abuse - PTES 3.3.2.1 Network Protections

ATTACK VECTOR: Resource-Based Lateral Movement
├── PATH-014: IMDSv1 → Roubar instance role
├── PATH-019: Lambda UpdateFunctionCode → Inject code
├── PATH-020: Lambda UpdateConfiguration → Malicious layer
├── PATH-022: Glue UpdateDevEndpoint → SSH key injection
├── PATH-026: SageMaker CreatePresignedUrl → Hijack session
├── PATH-030: AssumeRole (same-account) → Assumir role
├── PATH-031: AssumeRole (cross-account) → Pivot conta
├── PATH-032: SSM SendCommand → RCE via Run Command
├── PATH-033: EC2 Instance Connect → SSH via public key
├── PATH-035: S3 PutBucketPolicy → Access bucket externo
├── PATH-036: SecretsManager GetSecretValue → Harvest creds
└── PATH-037: ECS Task Metadata → Roubar task role

D. Ameaças de Defensive Blinding - PTES 3.3.2 - Identify Protection Mechanisms

ATTACK VECTOR: Blindar Defesas
└── PATH-042: CloudTrail StopLogging / GuardDuty DeleteDetector

E. Ameaças de Network-Based Attacks - PTES 3.3.2.1 Network Protections

ATTACK VECTOR: Network Scanning e Firewall Bypass (hping3)
├── Network Reconnaissance
│   ├── Host discovery via SYN scan
│   ├── Port scanning com flags customizadas
│   └── Firewall ruleset mapping
├── IDS/IPS Evasion
│   ├── XMAS scan (-FPU flags)
│   ├── NULL scan (sem flags)
│   ├── Fragmented packets (-f)
│   └── Random source IP (--rand-source)
├── Covert Channels
│   ├── ICMP tunneling (-1 -d <size>)
│   └── Beaconing simulation (-i <interval>)
└── Lateral Movement
    ├── Internal network pivoting
    ├── Database port discovery (3306, 5432, 1433)
    └── SMB/NetBIOS enumeration (445, 139)

Network Threat Model com hping3 (PTES 3.3.1 - Attack Trees)

ATTACK TREE: Network Compromise via hping3
Root: Obter acesso à rede interna
├── Branch 1: Host Discovery
│   ├── SYN scan em subnet (-S -p <port> --scan)
│   ├── ICMP discovery (-1)
│   └── UDP scan (-2 -p 53)
├── Branch 2: Firewall Analysis
│   ├── ACK scan para stateless detection (-A)
│   ├── SYN scan para stateful detection (-S)
│   └── TTL analysis para OS fingerprinting (-t)
├── Branch 3: IDS Evasion
│   ├── Fragmentation (-f)
│   ├── XMAS scan (-F -P -U)
│   ├── NULL scan (-O)
│   └── Source spoofing (-a, --rand-source)
└── Branch 4: Lateral Movement
    ├── Internal port scanning
    ├── Database discovery
    └── SMB/NetBIOS enumeration

4. Criação de Attack Trees (PTES 3.3.1 - Creation of Attack Trees)

Attack Tree 1: Privilege Escalation to Admin

Root: Obter AdministratorAccess
├── Branch 1: IAM Policy Modification
│   ├── PATH-001: CreatePolicyVersion
│   ├── PATH-003: AttachUserPolicy
│   └── PATH-009: AddUserToGroup
├── Branch 2: Credential Creation
│   ├── PATH-011: CreateAccessKey
│   └── PATH-012: CreateLoginProfile
└── Branch 3: Role Assumption
    ├── PATH-030: AssumeRole (same-account)
    └── PATH-031: AssumeRole (cross-account)

Attack Tree 2: Cross-Account Compromise

Root: Comprometer Conta Secundária
├── Branch 1: Wildcard Trust Abuse
│   └── PATH-031: AssumeRole com Principal: *
├── Branch 2: Credential Harvesting
│   └── PATH-036: SecretsManager GetSecretValue
└── Branch 3: PassRole Attack
    ├── PATH-016: Lambda CreateFunction
    └── PATH-023: CloudFormation CreateStack

Attack Tree 3: Data Exfiltration

Root: Exfiltrar Dados Sensíveis
├── Branch 1: S3 Access
│   └── PATH-035: S3 PutBucketPolicy
├── Branch 2: Secret Access
│   └── PATH-036: SecretsManager GetSecretValue
└── Branch 3: Database Access
    └── PATH-032: SSM SendCommand → RDS access

5. Análise de Cadeias de Ataque (7 Famílias) - PTES 3.3.1

Family I - IAM Self-Modification

CreatePolicy + AttachUserPolicy → Self Admin Escalation
CreatePolicy + AttachRolePolicy → Role Privilege Escalation

Family II - PassRole + Compute Service

PassRole + Lambda → Steal Execution Role
PassRole + EC2 → IMDS Credential Theft
PassRole + CloudFormation → IAM User Creation
PassRole + ECS → Task Role Theft
PassRole + Glue → Code Execution
PassRole + SageMaker → Container Execution
PassRole + CodeBuild → Shell Execution

Family III - Compute Credential Theft

SSM SendCommand → Instance Profile Theft
EC2 ModifyUserData → Credential Exfil via UserData
Lambda UpdateCode → Execution Role Theft
ECS UpdateService → Task Role Theft

Family IV - Secret Exfiltration → Credential Reuse

SecretsManager GetSecretValue → IAM Key Reuse
SSM GetParameter → Credential Theft
Lambda GetFunction → Env Variable Secrets
S3 GetObject → Credential Files (.aws/credentials, id_rsa)

Family V - Account Takeover

UpdateLoginProfile → Console Takeover
MFA Bypass + UpdateLogin → Takeover sem MFA
CreateAccessKey → Persistent Admin Access
UpdateAssumeRolePolicy + AssumeRole → Role Takeover

Family VI - Group Membership

AddUserToGroup → Join High-Privilege Group
PutGroupPolicy + AddUserToGroup → Self-Escalation via Group

Family VII - Cross-Account Lateral Movement

WildcardTrust → Any Principal Assumes High-Priv Role
CrossAccount Trust → Dangerous Role → Lateral Movement

6. Identificação de Mecanismos de Proteção (PTES 3.3.2)

Network Protections (PTES 3.3.2.1)

• VPC Flow Logs habilitados
• Security Groups restritivos
• NACLs configurados
• VPC Endpoints para serviços AWS
• Transit Gateway com inspeção

Host Based Protections (PTES 3.3.2.2)

• IMDSv2 forçado (bloqueia IMDSv1)
• SSM Session Manager (sem SSH direto)
• GuardDuty habilitado
• CloudTrail em todas as regiões
• Config Rules ativas

Application Level Protections (PTES 3.3.2.3)

• SCPs (Service Control Policies)
• Permission Boundaries
• MFA obrigatório para ações críticas
• ExternalId para cross-account
• Resource-based policies restritivas

7. Priorização de Ameaças por Impacto (PTES 3.2 - Vulnerability Validation)

CRITICAL (Exploração Imediata) - PTES 3.2.2 Establish Target List

• Wildcard trust policies (Principal: "*")
• IAMFullAccess + CreatePolicyVersion
• UpdateLoginProfile em admin users
• PassRole + CloudFormation/CreateStack
• Cross-account wildcard trust

HIGH (Exploração Prioritária)

• AdministratorAccess attached
• Console access sem MFA
• PassRole + Lambda/EC2/ECS
• SSM SendCommand em EC2
• SecretsManager GetSecretValue global

MEDIUM (Exploração Secundária)

• Access keys > 90 dias
• IMDSv1 habilitado
• Group-based escalation
• Resource wildcard permissions

8. Mapeamento de Alvos de Alto Valor (PTES 3.2.2 - Establish Target List)

Crown Jewels (Alvos Críticos) - PTES 3.2.2.1 Mapping Versions

• IAM Admin roles/users
• Root account equivalents
• Secrets Manager com creds produção
• KMS keys mestras
• Cross-account hub roles

Dados Sensíveis - PTES 3.2.2.3 Looking for Weak Applications

• S3 buckets com dados sensíveis
• RDS databases
• DynamoDB tables críticos
• EBS snapshots sensíveis

Controle de Infraestrutura - PTES 3.2.2.4 Identify Weak Ports/Services

• CloudFormation stacks
• Lambda functions críticas
• ECS/EKS clusters produção
• VPC networking core

9. Matriz de Ameaças por Serviço (PTES 3.3 - Attack Avenues)

10. Output da Fase de Threat Modeling (PTES Deliverables)

Documento de Threat Model (PTES 3.3.1 - Attack Trees)

1. IDENTIDADE INICIAL (PTES 2.5 - Footprinting)
   - ARN: arn:aws:iam::123456789012:user/auditor
   - Permissões: [Lista]
   - Restrições: [Lista]

2. VETORES PRIORITÁRIOS (PTES 3.3 - Attack Avenues)
   - Vetor 1: [Descrição + PATH-ID]
   - Vetor 2: [Descrição + PATH-ID]
   - Vetor 3: [Descrição + PATH-ID]

3. ALVOS DE ALTO VALOR (PTES 3.2.2 - Target List)
   - Alvo 1: [ARN + Justificativa]
   - Alvo 2: [ARN + Justificativa]

4. ATTACK TREES (PTES 3.3.1 - Creation of Attack Trees)
   - Tree 1: [Root + Branches]
   - Tree 2: [Root + Branches]

5. CADEIAS DE ATAQUE IDENTIFICADAS (7 Famílias)
   - Chain 1: [Family + Steps]
   - Chain 2: [Family + Steps]

6. MECANISMOS DE PROTEÇÃO (PTES 3.3.2)
   - Network: [Lista]
   - Host: [Lista]
   - Application: [Lista]

7. PRIORIZAÇÃO (PTES 3.2 - Vulnerability Validation)
   - Critical: [Lista]
   - High: [Lista]
   - Medium: [Lista]

Próximos Passos

Após completar esta fase, prossiga para pentest-vulnerability-analysis (PTES Section 3)

🤖 AIRecon Integration for Threat Modeling

AIRecon é um agente autônomo de penetration testing (v0.1.7-beta) que pode ser invocado como ferramenta incremental durante threat modeling para automatizar análise de CVEs, construção de attack trees, e priorização de vulnerabilidades.

Invocando AIRecon para Threat Modeling

# AIRecon com keywords de threat modeling e attack analysis
airecon "pentest threat modeling aws iam attack trees"

# AIRecon detectará keywords e carregará:
# - pentest-threat-modeling.md (skill primária)
# - pentest-vulnerability-analysis.md (para CVE analysis)
# - MCP tools: cve-mcp, hexstrike, worstassume

# Para pfSense-specific threat modeling:
airecon "pfsense threat modeling attack tree 2.7.0"

# Para attack chain analysis:
airecon "analyze attack chains privilege escalation aws"

AIRecon Slash Commands Úteis para Threat Modeling

# CVE lookup e EPSS scoring
# AIRecon buscará CVEs relevantes e calculará risk scores
airecon "check CVE-2026-41940 risk score"

# Network scanning para identificar alvos
/naabu-scan --target target.com -p 443,8443

# API key discovery para credential exposure analysis
/api-keys --target ./src --recursive

MCP Tool Integration via AIRecon

Durante threat modeling, AIRecon pode invocar MCP tools automaticamente:

# cve-mcp: CVE lookup, EPSS scores, KEV status, risk calculation
airecon "get CVE summary for CVE-2026-41940"
# → Usará mcp__cve-mcp__get_cve_summary

airecon "calculate risk score for CVE-2026-31431"
# → Usará mcp__cve-mcp__calculate_risk_score

airecon "check if CVE-2026-41940 is in CISA KEV catalog"
# → Usará mcp__cve-mcp__check_kev

airecon "get EPSS scores for CVE-2026-41940,CVE-2026-31431"
# → Usará mcp__cve-mcp__get_epss_score

airecon "compare CVEs CVE-2026-41940 and CVE-2026-31431"
# → Usará mcp__cve-mcp__compare_cves

# hexstrike-local: Vulnerability scanning para validation
airecon "run nuclei scan on target.com for CVE detection"
# → Usará mcp__hexstrike-local__nuclei_scan

airecon "run nikto vulnerability scan on https://target.com"
# → Usará mcp__hexstrike-local__nikto_scan

# pentestswarm-remote: Automated threat modeling campaigns
airecon "start threat modeling campaign for target.com"
# → Usará mcp__pentestswarm-remote__start_campaign

Workflow Example: Threat Modeling com AIRecon + WorstAssume + CVE-MCP

# 1. Usar AIRecon para carregar threat modeling skill
airecon "pentest threat modeling aws"

# 2. AIRecon auto-carrega pentest-threat-modeling.md

# 3. Invocar WorstAssume para security assessment
airecon "run worst assume --min-severity HIGH"

# 4. Para cada CVE identificada, AIRecon buscará automaticamente:
#    - EPSS score (probabilidade de exploração)
#    - KEV status (CISA Known Exploited Vulnerabilities)
#    - PoC availability (GitHub, Exploit-DB)
#    - Risk score composto (0-100)

airecon "analyze CVEs found and prioritize by risk"

# 5. AIRecon gera attack trees baseados nas vulnerabilidades
# 6. Exportar threat model para relatório
airecon "export threat model to JSON"

Workflow Example: pfSense Threat Modeling com AIRecon

# 1. Identificar versão do pfSense
airecon "shodan search product:pfsense org:target"

# 2. Buscar CVEs para versão detectada
airecon "search CVEs for pfSense 2.7.0 severity CRITICAL"
# → Usará mcp__cve-mcp__search_cves

# 3. Para cada CVE, calcular risk score
airecon "calculate risk score CVE-2022-40624"  # pfBlockerNG RCE
airecon "calculate risk score CVE-2025-12490"  # Suricata Path Traversal

# 4. Verificar exploit availability
airecon "check exploit availability CVE-2022-40624"
# → Usará mcp__cve-mcp__check_exploit_availability

# 5. Gerar attack tree específico para pfSense
airecon "generate attack tree for pfSense 2.7.0"

# 6. Exportar threat model
airecon "export pfsense threat model"

AIRecon Auto-Skill Loading para Threat Modeling

AIRecon CVE Risk Prioritization

AIRecon usa o cve-mcp para priorizar vulnerabilidades automaticamente:

# AIRecon calcula risk score composto (0-100) baseado em:
# - CVSS score (severity base)
# - EPSS score (exploit probability)
# - KEV status (actively exploited)
# - PoC availability (exploit maturity)

airecon "prioritize CVEs by risk score"
# Output exemplo:
# 1. CVE-2026-41940 (cPanel) - Risk: 98/100 - CRITICAL
#    CVSS: 9.8, EPSS: 0.85, KEV: Yes, PoC: Available
# 2. CVE-2026-31431 (Linux LPE) - Risk: 92/100 - CRITICAL
#    CVSS: 8.4, EPSS: 0.72, KEV: No, PoC: Available
# 3. CVE-2022-40624 (pfBlockerNG) - Risk: 87/100 - HIGH
#    CVSS: 9.8, EPSS: 0.45, KEV: No, PoC: Available

AIRecon Attack Chain Generation

# AIRecon gera attack chains automaticamente
airecon "discover attack chains for Apache HTTP Server 2.4"
# → Usará mcp__hexstrike-local__discover_attack_chains

# Output: Multi-stage attack chains com:
# - Vulnerability combinations
# - Success probability estimates
# - Exploit availability status
# - Recommended exploitation order

AIRecon + WorstAssume Integration

# 1. WorstAssume enumera IAM e identifica vulnerabilidades
airecon "worst enumerate --profile my-profile --stealth"

# 2. AIRecon processa findings do WorstAssume
# 3. Para cada finding, AIRecon mapeia PATH-IDs
airecon "map findings to PATH-IDs"

# 4. AIRecon gera attack chains baseadas em PATH-IDs
airecon "generate attack chains from PATH-001,PATH-015,PATH-036"

# 5. Exportar attack chains para relatório
airecon "export attack chains to JSON"

Referências PTES

• PTES Section 3: Vulnerability Analysis
• PTES 3.1: Vulnerability Testing (Active, Passive, Automated Tools)
• PTES 3.2: Vulnerability Validation (Public Research, Target List)
• PTES 3.3: Attack Avenues (Attack Trees, Protection Mechanisms)