Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1056.003_web-portal-capture
Adversaries may install code on externally facing portals, such as a VPN login page, to capture and transmit credentials of users who attempt to log into the service.
Passed 17 of 22 test cases with the skill, and 7 of 22 without it.
and 11 more in the full report
10 fixed7 passed either way5 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 10 test cases the skill fixed. Same model, same prompt, with and without the skill.
How many distinct MITRE ATT&CK mitigation controls and detection strategies are formally documented for web portal capture sub-technique T1056.003?
| Checked | Without skill | With skill |
|---|---|---|
| Specifies that exactly 1 known mitigation is documented for T1056.003. | Passed | Passed |
| Specifies that exactly 1 detection strategy is documented for T1056.003. | Missed | Passed |
The instructions your model reads when the skill loads.
Sub-technique of: T1056
Adversaries may install code on externally facing portals, such as a VPN login page, to capture and transmit credentials of users who attempt to log into the service. For example, a compromised login page may log provided user credentials before logging the user in to the service.
This variation on input capture may be conducted post-compromise using legitimate administrative access as a backup measure to maintain network access through External Remote Services and Valid Accounts or as part of the initial compromise by exploitation of the externally facing web service.
Platforms: Linux, macOS, Windows
Identify Attack Surface: Determine if the target environment is susceptible to Web Portal Capture by examining the target platforms (Linux, macOS, Windows).
Assess Existing Defenses: Review whether mitigations for T1056.003 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.
test cases passed, vs 7 / 22 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.