# CSAF | Cyber Security Awareness Framework **URL:** \ **Category:** Tools & Scripts\ **Tags:** tools, hacking\ **Created:** [April 26, 2024, 8:32pm UTC](https://onehack.st/t/csaf-cyber-security-awareness-framework/281896 "2024-04-26T20:32:13Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![BlueHacker](https://onehack.st/user_avatar/onehack.st/bluehacker/32/174721_2.png) [@BlueHacker](https://onehack.st/u/BlueHacker)\ **Post date:** [April 26, 2024, 8:32pm UTC](https://onehack.st/t/csaf-cyber-security-awareness-framework/281896/1 "2024-04-26T20:32:14Z")
![image](https://onehack.st/uploads/default/original/3X/0/6/06dd7706844384934713e0ebe05cf818542efdbb.png) [![Platform](https://camo.githubusercontent.com/3128092e781398b6dc60aa0da4b44bf17b7d9b625fabb185f114018d787c9253/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f706c6174666f726d2d6f73782532466c696e757825324677696e646f77732d677265656e2e737667)](https://github.com/csalab-id/csaf/) [![Join the chat](https://camo.githubusercontent.com/5971dd58ba98044814a528cbb6488d7940237e421d19995e30ec4ff56214a3de/68747470733a2f2f6261646765732e6769747465722e696d2f7265706f2e737667)](https://app.gitter.im/#/room/#csaf:gitter.im) [![Docker Pulls](https://camo.githubusercontent.com/003bc9f12676909841462124f5a094ecf70ada09c3e1063827575d12d49489f9/68747470733a2f2f696d672e736869656c64732e696f2f646f636b65722f70756c6c732f6373616c61622f637361663f7374796c653d736f6369616c)](https://hub.docker.com/r/csalab/csaf/) [![Documentation](https://camo.githubusercontent.com/7d51766f7908cd7c6a2dc00dbfba99a85f470e52376f2fad98db58bade225928/68747470733a2f2f72656164746865646f63732e6f72672f70726f6a656374732f637361662f62616467652f3f76657273696f6e3d6c6174657374)](https://csaf.readthedocs.io/en/latest/) The Cyber Security Awareness Framework (CSAF) is a structured approach aimed at enhancing cybersecurity awareness and understanding among individuals, organizations, and communities. It provides guidance for the development of effective cybersecurity awareness programs, covering key areas such as assessing awareness needs, creating educational materials, conducting training and simulations, implementing communication campaigns, and measuring awareness levels. By adopting this framework, organizations can foster a robust security culture, enhance their ability to detect and respond to cyber threats, and mitigate the risks associated with attacks and security breaches. # Requirements ## Software - Docker - Docker-compose ## Hardware ### Minimum - 4 Core CPU - 10GB RAM - 60GB Disk free ### Recommendation - 8 Core CPU or above - 16GB RAM or above - 100GB Disk free or above # Installation Clone the repository ```auto git clone https://github.com/csalab-id/csaf.git ``` Navigate to the project directory ```auto cd csaf ``` Pull the Docker images ```auto docker-compose --profile=all pull ``` Generate wazuh ssl certificate ```auto docker-compose -f generate-indexer-certs.yml run --rm generator ``` For security reason you should set env like this first ```auto export ATTACK_PASS=ChangeMePlease export DEFENSE_PASS=ChangeMePlease export MONITOR_PASS=ChangeMePlease export SPLUNK_PASS=ChangeMePlease export GOPHISH_PASS=ChangeMePlease export MAIL_PASS=ChangeMePlease export PURPLEOPS_PASS=ChangeMePlease ``` Start all the containers ```auto docker-compose --profile=all up -d ``` You can run specific profiles for running specific labs with the following profiles - all - attackdefenselab - phisinglab - breachlab - soclab For example ```auto docker-compose --profile=attackdefenselab up -d ``` # Proof [![Caldera](https://github.com/csalab-id/csaf/raw/main/.github/images/caldera.png)](https://github.com/csalab-id/csaf/blob/main/.github/images/caldera.png) [![Secure DVWA](https://github.com/csalab-id/csaf/raw/main/.github/images/dvwa_modsecurity.png)](https://github.com/csalab-id/csaf/blob/main/.github/images/dvwa_modsecurity.png) [![Gitea](https://github.com/csalab-id/csaf/raw/main/.github/images/gitea.png)](https://github.com/csalab-id/csaf/blob/main/.github/images/gitea.png) [![Gophish](https://github.com/csalab-id/csaf/raw/main/.github/images/gophish.png)](https://github.com/csalab-id/csaf/blob/main/.github/images/gophish.png) [![Infectionmonkey](https://github.com/csalab-id/csaf/raw/main/.github/images/infectionmonkey.png)](https://github.com/csalab-id/csaf/blob/main/.github/images/infectionmonkey.png) [![Iredmail](https://github.com/csalab-id/csaf/raw/main/.github/images/iredmail.png)](https://github.com/csalab-id/csaf/blob/main/.github/images/iredmail.png) [![Juice Shop](https://github.com/csalab-id/csaf/raw/main/.github/images/juiceshop.png)](https://github.com/csalab-id/csaf/blob/main/.github/images/juiceshop.png) [![Mitmproxy](https://github.com/csalab-id/csaf/raw/main/.github/images/mitmproxy.png)](https://github.com/csalab-id/csaf/blob/main/.github/images/mitmproxy.png) [![Phising](https://github.com/csalab-id/csaf/raw/main/.github/images/phising.png)](https://github.com/csalab-id/csaf/blob/main/.github/images/phising.png) [![PurpleOps](https://github.com/csalab-id/csaf/raw/main/.github/images/purpleops.png)](https://github.com/csalab-id/csaf/blob/main/.github/images/purpleops.png) [![Roundcube](https://github.com/csalab-id/csaf/raw/main/.github/images/roundcube.png)](https://github.com/csalab-id/csaf/blob/main/.github/images/roundcube.png) [![Splunk](https://github.com/csalab-id/csaf/raw/main/.github/images/splunk.png)](https://github.com/csalab-id/csaf/blob/main/.github/images/splunk.png) [![Wackopicko](https://github.com/csalab-id/csaf/raw/main/.github/images/wackopicko.png)](https://github.com/csalab-id/csaf/blob/main/.github/images/wackopicko.png) [![Wazuh](https://github.com/csalab-id/csaf/raw/main/.github/images/wazuh.png)](https://github.com/csalab-id/csaf/blob/main/.github/images/wazuh.png) # Exposed Ports An exposed port can be accessed using a proxy socks5 client, SSH client, or HTTP client. Choose one for the best experience. - Port 6080 (Access to attack network) - Port 7080 (Access to defense network) - Port 8080 (Access to monitor network) # Example usage ## Access internal network with proxy socks5 - curl --proxy socks5://ipaddress:6080 [http://10.0.0.100/vnc.html](http://10.0.0.100/vnc.html) - curl --proxy socks5://ipaddress:7080 [http://10.0.1.101/vnc.html](http://10.0.1.101/vnc.html) - curl --proxy socks5://ipaddress:8080 [http://10.0.3.102/vnc.html](http://10.0.3.102/vnc.html) ## Remote ssh with ssh client - ssh kali@ipaddress -p 6080 (default password: attackpassword) - ssh kali@ipaddress -p 7080 (default password: defensepassword) - ssh kali@ipaddress -p 8080 (default password: monitorpassword) ## Access kali linux desktop with curl / browser - curl [http://ipaddress:6080/vnc.html](http://ipaddress:6080/vnc.html) - curl [http://ipaddress:7080/vnc.html](http://ipaddress:7080/vnc.html) - curl [http://ipaddress:8080/vnc.html](http://ipaddress:8080/vnc.html) # Domain Access - [http://attack.lab/vnc.html](http://attack.lab/vnc.html) (default password: attackpassword) - [http://defense.lab/vnc.html](http://defense.lab/vnc.html) (default password: defensepassword) - [http://monitor.lab/vnc.html](http://monitor.lab/vnc.html) (default password: monitorpassword) - [https://gophish.lab:3333/](https://gophish.lab:3333/) (default username: admin, default password: gophishpassword) - [https://server.lab/](https://server.lab/) (default username: [postmaster@server.lab](mailto:postmaster@server.lab), default passowrd: mailpassword) - [https://server.lab/iredadmin/](https://server.lab/iredadmin/) (default username: [postmaster@server.lab](mailto:postmaster@server.lab), default passowrd: mailpassword) - [https://mail.server.lab/](https://mail.server.lab/) (default username: [postmaster@server.lab](mailto:postmaster@server.lab), default passowrd: mailpassword) - [https://mail.server.lab/iredadmin/](https://mail.server.lab/iredadmin/) (default username: [postmaster@server.lab](mailto:postmaster@server.lab), default passowrd: mailpassword) - [http://phising.lab/](http://phising.lab/) - [http://10.0.0.200:8081/](http://10.0.0.200:8081/) - [http://gitea.lab/](http://gitea.lab/) (default username: csalab, default password: giteapassword) - [http://dvwa.lab/](http://dvwa.lab/) (default username: admin, default passowrd: password) - [http://dvwa-monitor.lab/](http://dvwa-monitor.lab/) (default username: admin, default passowrd: password) - [http://dvwa-modsecurity.lab/](http://dvwa-modsecurity.lab/) (default username: admin, default passowrd: password) - [http://wackopicko.lab/](http://wackopicko.lab/) - [http://juiceshop.lab/](http://juiceshop.lab/) - [https://wazuh-indexer.lab:9200/](https://wazuh-indexer.lab:9200/) (default username: admin, default passowrd: SecretPassword) - [https://wazuh-manager.lab/](https://wazuh-manager.lab/) - [https://wazuh-dashboard.lab:5601/](https://wazuh-dashboard.lab:5601/) (default username: admin, default passowrd: SecretPassword) - [http://splunk.lab/](http://splunk.lab/) (default username: admin, default password: splunkpassword) - [https://infectionmonkey.lab:5000/](https://infectionmonkey.lab:5000/) - [http://purpleops.lab/](http://purpleops.lab/) (default username: [admin@purpleops.com](mailto:admin@purpleops.com), default password: purpleopspassword) - [http://caldera.lab/](http://caldera.lab/) (default username: red/blue, default password: calderapassword) # Network / IP Address ## Attack - 10.0.0.100 attack.lab - 10.0.0.200 phising.lab - 10.0.0.201 server.lab - 10.0.0.201 mail.server.lab - 10.0.0.202 gophish.lab - 10.0.0.110 infectionmonkey.lab - 10.0.0.111 mongodb.lab - 10.0.0.112 purpleops.lab - 10.0.0.113 caldera.lab ## Defense - 10.0.1.101 defense.lab - 10.0.1.10 dvwa.lab - 10.0.1.13 wackopicko.lab - 10.0.1.14 juiceshop.lab - 10.0.1.20 gitea.lab - 10.0.1.110 infectionmonkey.lab - 10.0.1.112 purpleops.lab - 10.0.1.113 caldera.lab ## Monitor - 10.0.3.201 server.lab - 10.0.3.201 mail.server.lab - 10.0.3.9 mariadb.lab - 10.0.3.10 dvwa.lab - 10.0.3.11 dvwa-monitor.lab - 10.0.3.12 dvwa-modsecurity.lab - 10.0.3.102 monitor.lab - 10.0.3.30 wazuh-manager.lab - 10.0.3.31 wazuh-indexer.lab - 10.0.3.32 wazuh-dashboard.lab - 10.0.3.40 splunk.lab ## Public - 10.0.2.101 defense.lab - 10.0.2.13 wackopicko.lab ## Internet - 10.0.4.102 monitor.lab - 10.0.4.30 wazuh-manager.lab - 10.0.4.32 wazuh-dashboard.lab - 10.0.4.40 splunk.lab ## Internal - 10.0.5.100 attack.lab - 10.0.5.12 dvwa-modsecurity.lab - 10.0.5.13 wackopicko.lab # License This Docker Compose application is released under the MIT License. See the [LICENSE](https://www.mit.edu/~amini/LICENSE.md) file for details. ## GitHub: > **[GitHub - csalab-id/csaf: Cyber Security Awareness Framework (CSAF)](https://github.com/csalab-id/csaf)** > > Cyber Security Awareness Framework (CSAF)