Evilgrade
Posted on 15 May 2011
From: famatoEvilgrade is a modular framework that allows the user to take advantage of poor upgrade implementations by injecting fake updates.
It comes with pre-made binaries (agents), a working default configuration for fast pentests, and has it's own WebServer and DNSServer modules.
Easy to set up new settings, and has an autoconfiguration when new binary agents are set.
* When should I use evilgrade?
This framework comes into play when the attacker is able to make hostname redirections (manipulation of victim's dns traffic), and such thing can be done on 2 scenarios:
Internal scenery:
- Internal DNS access
- ARP spoofing
- DNS Cache Poisoning
- DHCP spoofing
- TCP hijacking
- Wi-Fi Access Point impersonation
Evilgrade works with modules, in each module there's an implemented structure which is needed to emulate a fake update for an specific application/system.
