Skip to content

Commit 552cfb3

Browse files
jmarciljmarcil
committed
adding my attack tree examples with plantuml
those were made as part of my threat model toolkit talk and workshop https://linktr.ee/threatmodel
1 parent 1931646 commit 552cfb3

15 files changed

+889
-0
lines changed

‎Attack Tree/BLANK.plantuml

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
@startuml
2+
skinparam monochrome true
3+
skinparam defaultTextAlignment center
4+
5+
' Root nodes
6+
agent "Goal" as goal
7+
agent "What attackers want" as what
8+
9+
agent "Sub-goal" as subgoal
10+
goal --> subgoal
11+
12+
agent "Sub-goal 2" as subgoal2
13+
goal --> subgoal2
14+
15+
agent "Ways to get to goal" as subgoal3
16+
what --> subgoal3
17+
18+
agent "Sub-sub goal" as subsubgoal
19+
agent "Sub-sub goal 2" as subsubgoal2
20+
agent "Sub-sub goal 3" as subsubgoal3
21+
subgoal3 ---> subsubgoal
22+
subgoal3 ---> subsubgoal2
23+
subgoal3 ---> subsubgoal3
24+
25+
' Abstraction (not going to model that)
26+
cloud "**···**" as another
27+
subgoal ---> another
28+
subgoal2 ---> subsubgoal
29+
30+
' Leaf nodes
31+
agent "exploit" as exploit
32+
agent "ways to get in" as ways
33+
agent "weakness" as weakness
34+
35+
subsubgoal ---> exploit
36+
37+
' Chaining of exploits required to get to sub-sub goal
38+
interface "and" as and
39+
subsubgoal3 --> and
40+
and --> weakness
41+
and --> ways
42+
43+
@enduml

‎Attack Tree/BLANK.plantuml.svg

Lines changed: 51 additions & 0 deletions
Loading

‎Attack Tree/README.md

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
Examples using different tools to create attack trees.
2+
3+
Tool | File match |
4+
:--- | :---
5+
| [PlantUML](https://plantuml-editor.kkeisuke.com/) | `*.plantuml` |
6+

‎Attack Tree/cryptowallet.plantuml

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
@startuml
2+
skinparam monochrome true
3+
skinparam defaultTextAlignment center
4+
5+
agent "Steal cryptocurrency" as steal
6+
agent "Manipulate the market" as market
7+
agent "Invade privacy" as privacy
8+
9+
agent "Expose their spending habits" as spy
10+
privacy --> spy
11+
agent "View their transactions on blockchain" as blockchain
12+
spy --> blockchain
13+
14+
agent "Gain wallet access" as wallet
15+
steal --> wallet
16+
17+
agent "**I**nternet **C**on **O**peration" as con
18+
steal --> con
19+
20+
agent "Steal physical wallet\nand password" as phys
21+
agent "Find wallet seed" as seed
22+
agent "Gain access to\nlocal software wallet" as accesswallet
23+
agent "Gain access to\n web based wallet" as webwallet
24+
wallet --> phys
25+
wallet --> accesswallet
26+
wallet --> webwallet
27+
accesswallet --> seed
28+
29+
agent "Weak seeding algo" as weakseed
30+
seed --> weakseed
31+
32+
agent "Malware" as malware
33+
accesswallet --> malware
34+
35+
agent "Gain remote access\nto local API" as api
36+
agent "Authentication bypass" as lackauth
37+
agent "DNS rebinding attack" as dnsrebind
38+
accesswallet --> api
39+
interface "and" as and
40+
api --> and
41+
and --> lackauth
42+
and --> dnsrebind
43+
44+
agent "Gain exchange access" as xaccess
45+
agent "Steal account" as xaccount
46+
'agent "Compromise network" as xnetwork
47+
agent "API access" as xapi
48+
agent "Steal API keys" as xkeys
49+
agent "Authentication bypass" as xauthbypass
50+
steal --> xaccess
51+
xaccess ---> xaccount
52+
'xaccess --> xnetwork
53+
xaccess --> xapi
54+
xapi --> xkeys
55+
xapi --> xauthbypass
56+
xapi --> xaccount
57+
58+
agent "Denial of service" as dos
59+
market --> dos
60+
market --> xaccess
61+
'market -> steal
62+
63+
cloud "**···**" as another
64+
xaccount --> another
65+
cloud "**···**" as anothertwo
66+
cloud "**···**" as anotherthree
67+
xauthbypass --> anothertwo
68+
xkeys --> anotherthree
69+
70+
'spy --> xaccess
71+
'spy --> wallet
72+
73+
@enduml

‎Attack Tree/cryptowallet.plantuml.svg

Lines changed: 80 additions & 0 deletions
Loading

‎Attack Tree/iot-device/iot-device.part1.plantuml

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
@startuml
2+
skinparam monochrome true
3+
4+
agent "Mass mining" as mine
5+
agent "Mass scan" as scan
6+
agent "DDoS" as ddos
7+
agent "Control many devices \n(Botnet)" as botnet
8+
mine --> botnet
9+
scan --> botnet
10+
ddos --> botnet
11+
12+
agent "Use legit command" as legitcmd
13+
agent "Exploit device flaws" as flaws
14+
agent "Obtain device access" as access
15+
botnet --> legitcmd
16+
botnet --> flaws
17+
botnet --> access
18+
19+
agent "Get WiFi LAN access" as wifi
20+
agent "Get Physical access" as phys
21+
agent "Place Factory Backdoor" as factory
22+
agent "Hack cloud server" as cloud
23+
access --> wifi
24+
access --> phys
25+
access --> factory
26+
access --> cloud
27+
28+
agent "Make my life miserable" as life
29+
agent "Randomware" as ransomware
30+
agent "Invade my privacy" as privacy
31+
agent "Mess with the lights" as mess
32+
33+
life --> ransomware
34+
life --> privacy
35+
life --> mess
36+
37+
agent "View my habits" as habits
38+
agent "Spy me live" as spy
39+
privacy --> habits
40+
privacy --> spy
41+
42+
agent "Steal cloud data" as data
43+
habits --> data
44+
spy --> data
45+
data ---> cloud
46+
47+
agent "Sniff network" as sniff
48+
habits ---> sniff
49+
spy ---> sniff
50+
access --> sniff
51+
sniff --> wifi
52+
sniff --> phys
53+
54+
@enduml

0 commit comments

Comments
 (0)