Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
Owner: User #71467
Cytolysis-1h HG v3.1.6 Test Plan
Test Plan for Cytolysis-1h v3.1.6
- HG Base
- Install
- IAC attack via admin subnet flux node
- Use remote to upload HG via admin subnet flux node
- Establish CTCounter Terrorism connection by triggering admin IP of DUT, call back to external web server flux node
- Record CPU and memory impacts throughout, verify no syslogs, traps or other alerting behavior
- Uninstall
- Uninstall HG using CTCounter Terrorism command
- Collect "show tech" and other info (look for assists on linecards)
- Reload
- Collect "show tech" and other info
- After install, uninstall by just reloading device
- Collect "show tech" and other info
- After intsall, uninstall by hard reset of device
- Collect "show tech" and other info
- Restart HG modules from CTCounter Terrorism session
- Verify no syslogs, traps or other alerting behavior
- Verify functionality of modules
- CT session
- Verify CTCounter Terrorism session functionality using different hosts to impersonate
- Capture and review wireshark of CTCounter Terrorism session establishment and operation
- Install
- Sup Failover Testing
- Verify state after failover
- Install on one SUP and then force failover through IOSApple operating system for small devices command
- Install on one SUP and then test crash to cause failover to other SUP
- Install on one SUP and then pull active SUP module to cause failover to other SUP
- Instlal on new SUP
- fail back to original and re-install
- Fail back to original and re-install
- Verify state after failover
- ACE
- Enter all commands foreseen during op, variety of show commands
- Boundary testing - test entering commands that don't exist, typos
- Enter unsupported non-show commands
- Verify command history - show history, show history all
- Verify no syslogs, traps or other alerting behavior
- SMITE - focus on options -ac -sm -t
- test that rules can be created/deleted/enabled/disabled with all parameters expected during op - timed rule, max times to affect, max per host
- test creating multiple rules at a time
- Test creating a rule that targets multiple source hosts to single destination as well as single source to single destination
- test that filterbroker can be restarted with active rules, with rules that are inactive, new rules can be entered after restart
- test iframe/exploitation of target
- Verify that counters increment in CTCounter Terrorism show commands related to SMITE
- Run wireshark on target and examen output of SIMTE session
- Verify no syslogs, DNSDomain Name System queries or SNMPSimple Network Management Protocol Traps sent during Iframe
- verify iframe not injected for traffic that does not match SMITE rule - from other hosts, from target host to different destination, traffic to other ports (test 443)
- Use SMITE while pps threshold is reached - verify whether rule is automatically re-enabled
- Verify that traffic from other hosts that are not targeted in SMITE rule is not impacted by SMITE rule