Chigula: Framework for Wi-Fi IDS and Forensics
Vivek Ramachandran presents Chigula, an extensible open-source Python framework for 802.11 wireless intrusion detection, packet forensics, and automated attack fingerprinting.
Summary
The Need for Scriptable Wi-Fi Forensics
Traditional wireless intrusion detection and forensics have historically required either exorbitant commercial enterprise appliances or tedious manual packet filtering in Wireshark.
Introducing the Chigula Framework
Vivek Ramachandran introduces Chigula, an open-source, Python-based framework architected for deep 802.11 packet inspection, forensic analysis, and modular rule development.
Fingerprinting Offensive Wireless Toolkits
Chigula incorporates specialized detection modules that identify signature behaviors of popular wireless attack tools including Aireplay-NG, Airbase-NG, and MDK3, as well as multi-pot AP arrays.
Automating Wireless Incident Response
The author demonstrates deploying Chigula across distributed sensors to capture forensic packet pcaps, generate real-time alerts, and streamline wireless threat investigations.
Related talks
Main Stage·34 min
Vivek Ramachandran
Vivek Ramachandran introduces Chellam, a driverless Wi-Fi intrusion detection system and host firewall designed to detect Evil Twins, honeypots, and hosted network backdoors on Windows.
Videos·17 min
Martin G. Korman
Engineers explore architecture and security mechanisms for Martin G. Korman - Regipy: Automating registry forensics with python.
Main Stage·47 min
Alexei Bulazel
Alexei Bulazel presents reverse engineering windows defenders emulator: Windows Defender Antivirus's mpengine.dll implements the core of Defender's functionality in an enormous ~11 MB, 30,000+ function DLL.