Sammi Notes

Properties1
tagssec-dashboard, quick-start, manual, splunk, hardware

sec-dashboard - Manual Rapido

Guia de referencia rápida para usar las herramientas de hardware y audit. Para detalle completo ver Guía de uso.

Tarjeta de referencia — 35 herramientas

CategoriaToolsInput
Network Recon (9)Port Scanner, DNS, Subdomain, HTTP Probe, Whois, Ping, Traceroute, SSL, CAADominio/IP
Web Security (10)Headers, Dir Fuzzer, SQLi, XSS, CORS, Tech, CSP, Open Redirect, HTTP Methods, RobotsURL
Vulnerability (3)CVE Search, Hash Lookup, Password AuditCustom input
System (6)Net Connections, Process Monitor, System Info, PS Audit, WiFi Marauder, M5StickNone / URL
OSINT (5)ASN, Reverse DNS, CT Logs, Shodan, GeoIPDominio/IP
Email Security (2)DNSSEC, Email Security (SPF/DKIM/DMARC)Dominio

3 herramientas nuevas — Setup en 1 minuto

1. PS Security Audit (Windows)

# Clonar (una sola vez)
git clone https://github.com/HOSTNAME/Auditing_with_PowerShell.git "$HOME\Auditing_with_PowerShell"
 
# Usar en dashboard: System -> PS Security Audit -> click (sin input)

2. WiFi Marauder Scan (M5StickC)

# Clonar y arrancar viewer
git clone https://github.com/HOSTNAME/wifi-marauder-viewer.git
cd wifi-marauder-viewer
pip install -r requirements.txt
python app.py
 
# Usar en dashboard: System -> WiFi Marauder Scan -> Run (URL default)

3. M5Stick Networks (M5Stick Plus 2)

# Clonar
git clone https://github.com/HOSTNAME/Visualizacion_extendida_M5StickPlus2.git
cd Visualizacion_extendida_M5StickPlus2
pip install -r requirements.txt
 
# Terminal 1: capturar serial
python src/serial_logger.py -b 115200 -o wifi_scan_evil.log
 
# Terminal 2: dashboard
python src/app.py
 
# Usar en dashboard: System -> M5Stick Networks -> Run (URL default)

Splunk — Ver reportes

Configurar Splunk en el dashboard

  1. Dashboard -> Splunk en la barra lateral
  2. URL: https://127.0.0.1:8089 | User: sammi | Index: sec_dashboard
  3. Save -> Test Connection -> Enable

Configurar props.conf (JSON parsing automatico)

Para que Splunk extraiga campos del JSON automáticamente (sin spath en cada busqueda), crear C:\Program Files\Splunk\etc\apps\search\local\props.conf:

[powershell:audit]
KV_MODE = json
SHOULD_LINEMERGE = false
TRUNCATE = 0
MAX_EVENTS = 10000
 
[wifi:marauder]
KV_MODE = json
SHOULD_LINEMERGE = false
TRUNCATE = 0
 
[m5stick:networks]
KV_MODE = json
SHOULD_LINEMERGE = false
TRUNCATE = 0

Reiniciar Splunk: & "C:\Program Files\Splunk\bin\splunk.exe" restart

Sin este props.conf, los eventos se ven como JSON crudo sin campos extraidos.

SPL para ver los 3 reportes

-- PS Audit: todos los modulos
index=sec_dashboard sourcetype=powershell:audit

-- PS Audit: solo usuarios
index=sec_dashboard sourcetype=powershell:audit module=02_Usuarios

-- WiFi Marauder: redes detectadas
index=sec_dashboard sourcetype=wifi:marauder

-- M5Stick: redes + clientes
index=sec_dashboard sourcetype=m5stick:networks

-- Las 3 herramientas a la vez
index=sec_dashboard (sourcetype=powershell:audit OR sourcetype=wifi:marauder OR sourcetype=m5stick:networks)

Sourcetypes

SourcetypeProcedenciaQue contiene
powershell:auditPS Security Audit1 evento por modulo (10 modulos)
wifi:marauderWiFi Marauder ScanRedes WiFi (BSSID, ESSID, RSSI, canal)
m5stick:networksM5Stick NetworksRedes + clientes (SSID, BSSID, n_clients)
_jsonTodas las toolsMetadata del scan (tool, status, elapsed)

Arrancar todo (cheat sheet)

# sec-dashboard
cd ~/sec-dashboard
python -m uvicorn backend.main:app --host 127.0.0.1 --port 8444
 
# PS Audit -- no necesita arrancar nada, el dashboard lo invoca
# Solo necesita el repo clonado en $HOME\Auditing_with_PowerShell
 
# WiFi Marauder viewer (si vas a usar WiFi Marauder Scan)
cd ~/wifi-marauder-viewer
python app.py
 
# M5Stick Plus 2 viewer (si vas a usar M5Stick Networks)
cd ~/Visualizacion_extendida_M5StickPlus2
python src/serial_logger.py -b 115200 -o wifi_scan_evil.log   # terminal 1
python src/app.py                                               # terminal 2

Abrir: http://localhost:8444

Troubleshooting rapido

ProblemaSolucion
Sidebar muestra “32 tools”Ctrl+F5 (cache del navegador). El badge se actualiza dinamico desde la API
Reportes en JSON crudo en SplunkFalta props.conf con KV_MODE = json (ver arriba)
PS Audit: “Script contained malicious content”Excluir carpeta en Windows Security + usar run-audit.ps1 (bypass AMSI)
PS Audit: “Invoke-SecurityAudit.ps1 not found”git clone https://github.com/HOSTNAME/Auditing_with_PowerShell.git "$HOME\Auditing_with_PowerShell"
PS Audit: timeout 600sEl script tarda 5-7 min. Tarda mas sin admin (modulos limitados)
WiFi: “Cannot connect to 5000”Arrancar el viewer: python app.py
Puerto 5000 ocupadoUsar --port 5001 en una de las apps
Splunk no recibe eventosDashboard -> Splunk -> Test Connection -> Enable
Splunk File Integrity Check warningBorrar .mdmp en C:\Program Files\Splunk\bin\ y reiniciar Splunk

Notas

Vista Gráfica

Retroenlaces