# Kali Linux (repositorio oficial)
sudo apt install kismet -y

# Repositorio oficial kismetwireless.net (última versión)
wget -O - https://www.kismetwireless.net/repos/kismet-release.gpg.key |   sudo gpg --dearmor -o /usr/share/keyrings/kismet.gpg
echo "deb [signed-by=/usr/share/keyrings/kismet.gpg] https://www.kismetwireless.net/repos/apt/release/$(lsb_release -cs) $(lsb_release -cs) main" |   sudo tee /etc/apt/sources.list.d/kismet.list
sudo apt update && sudo apt install kismet -y

# Añadir usuario al grupo kismet (captura sin sudo)
sudo usermod -aG kismet $USER && newgrp kismet

# Verificar versión y primer arranque
kismet --version
kismet -c wlan0
INFO: Starting Kismet 2023-07-R1
INFO: Web interface listening on http://localhost:2501
INFO: Beginning packet capture...

# ~/.config/kismet/kismet_site.conf

## SERVIDOR WEB
httpd_port=2501
httpd_bind_address=127.0.0.1

## CREDENCIALES
httpd_username=admin
httpd_password=tu_contraseña_segura

## LOGGING
log_prefix=/tmp/kismet/
log_types=kismet,pcapng
log_title=mi_survey

## GPS
gps=gpsd:host=localhost,port=2947

## FUENTES DE CAPTURA
source=wlan0:name=wifi_alfa,type=linuxwifi

## ALERTAS WIDS
alert_backlog=50
alert_throttle=10

## FUENTE WI-FI BÁSICA
kismet -c wlan0
kismet -c wlan0mon       # interfaz ya en monitor

## MÚLTIPLES FUENTES
kismet -c wlan0 -c wlan1 -c wlan2

## CON OPCIONES
kismet -c "wlan0:name=alfa_2.4,channels=1,6,11"
kismet -c "wlan0:name=mi_card,hop=true,hoprate=5/sec"

## TIPOS DE FUENTE DISPONIBLES
linuxwifi  → adaptadores Wi-Fi Linux (modo monitor automático)
pcapfile   → reproducir una captura .pcap existente
btkernel   → Bluetooth via kernel Linux (hci0)
ubertooth  → Ubertooth One para Bluetooth Classic
nrfsniff   → nRF52840 para BTLE
rtl433     → RTL-SDR para sensores de radio
rtladsb    → RTL-SDR para ADSB (aviones)

## REPRODUCIR CAPTURA EXISTENTE
kismet -c "pcapfile:/tmp/captura.pcap"

## CAPTURA REMOTA
kismet_cap_linux_wifi --connect servidor:3501 --source wlan0

# Acceso local
firefox http://localhost:2501

# Tunnel SSH para acceso remoto seguro
ssh -L 2501:localhost:2501 usuario@servidor_kismet

# Arrancar en background (daemon)
kismet -c wlan0 --daemonize --log-prefix /tmp/kismet/survey
kismet --kill

## ARRANQUE BÁSICO
kismet -c wlan0

## DOS INTERFACES (2.4GHz + 5GHz)
kismet -c "wlan0:name=alfa_2g" -c "wlan1:name=alfa_5g"

## QUÉ DETECTA EN WI-FI
Access Points: SSID, BSSID, canal, cifrado (WPA3/WPA2/WEP/Open),
  señal dBm, fabricante por OUI, WPS, velocidades soportadas
Clientes: MAC, AP al que está conectado, probe requests
Redes ocultas: detectadas por beacons sin SSID
Datos: conteo de paquetes, tasa, IP si no cifrada

## BLUETOOTH CON ADAPTADOR LINUX
hciconfig
hci0: BD Address: 00:1A:7D:DA:71:13  UP RUNNING

kismet -c "hci0:name=bt_interno,type=btkernel"
kismet -c wlan0 -c "hci0:type=btkernel"  # Wi-Fi + BT simultáneo

## BTLE CON nRF SNIFFER
kismet -c "/dev/ttyACM0:name=nrf_btle,type=nrfsniff"

## UBERTOOTH ONE
sudo apt install ubertooth -y
kismet -c "ubertooth-0:name=ubertooth,type=ubertooth"

## QUÉ DETECTA
Classic: dirección BD, nombre, clase del dispositivo, RSSI
BTLE: advertising packets, UUID de servicios, nombre, fabricante

## CASOS DE USO
- Inventario de dispositivos BT en instalaciones
- Detectar teclados inalámbricos y wearables en oficinas
- Identificar beacons (iBeacon, Eddystone)
- Forense: confirmar presencia de dispositivos

# Instalar dependencias
sudo apt install rtl-sdr librtlsdr-dev -y
rtl_test
Found 1 device(s): 0: Realtek, RTL2832U

## ADS-B — AVIONES (1090 MHz)
sudo apt install kismet-capture-rtl-adsb -y
kismet -c "rtladsb-0:name=adsb_aviones"
ICAO: A12345  Flight: IBE3401  Alt: 35000ft  Speed: 480kt

## RTL-433 — SENSORES 433 MHz (temperatura, TPMS, etc.)
sudo apt install kismet-capture-rtl-433 -y
kismet -c "rtl433-0:name=sensores_433"
Sensor: Oregon Scientific  Temp: 22.4°C  Humidity: 58%
TPMS: Pressure: 2.4 bar  Temp: 28°C

## TODAS LAS FUENTES A LA VEZ
kismet -c wlan0        -c "hci0:type=btkernel"        -c "rtladsb-0:name=adsb"        -c "rtl433-0:name=sensores"

## HOPPING AUTOMÁTICO (por defecto — 5 canales/seg)
kismet -c wlan0

## CANALES ESPECÍFICOS
kismet -c "wlan0:channels=1,6,11"        # no solapados 2.4GHz
kismet -c "wlan0:channels=36,40,44,48"  # 5GHz
kismet -c "wlan0:channels=6"            # canal fijo sin hopping

## VELOCIDAD DE HOPPING
kismet -c "wlan0:hoprate=3/sec"         # más lento — más tiempo por canal
kismet -c "wlan0:hoprate=10/sec"        # más rápido — más cobertura

## DOS INTERFACES — cobertura 2.4 + 5GHz simultánea
kismet -c "wlan0:channels=1,2,3,4,5,6,7,8,9,10,11"        -c "wlan1:channels=36,40,44,48,52,56,60,64,100,104"

## CAMBIAR CANAL EN TIEMPO REAL (REST API)
curl -s -X POST http://localhost:2501/datasource/by-uuid/UUID/set_channel.json   -u admin:pass -d '{"channel": "6"}'

## CONFIGURAR LOGGING
kismet -c wlan0   --log-types kismet,pcapng,wiglecsv   --log-prefix /tmp/kismet_logs/   --log-title mi_auditoria

## ARCHIVOS GENERADOS
mi_auditoria-20240115-14-32-00-1.kismet   ← SQLite (base de datos)
mi_auditoria-20240115-14-32-00-1.pcapng   ← PCAP para Wireshark
mi_auditoria-20240115-14-32-00-1.wiglecsv ← WiGLE CSV

## CONSULTAR CON SQLITE3
sqlite3 mi_auditoria-*.kismet ".tables"
alerts  datasources  devices  packets  snapshots

sqlite3 mi_auditoria-*.kismet   "SELECT devmac, type, phyname FROM devices LIMIT 10;"
A4:91:B1:2C:3D:E0|Wi-Fi AP|IEEE802.11
00:1A:7D:DA:71:13|Bluetooth|Bluetooth

## EXPORTAR CON kismetdb_dump_devices
kismetdb_dump_devices --in mi_auditoria-*.kismet --json > dispositivos.json
kismetdb_dump_devices --in mi_auditoria-*.kismet --csv  > dispositivos.csv

## ANALIZAR CON PYTHON
python3 << 'EOF'
import sqlite3, json
db = sqlite3.connect('mi_auditoria-20240115-14-32-00-1.kismet')
c = db.cursor()
for row in c.execute(
    "SELECT devmac, device FROM devices WHERE phyname='IEEE802.11' AND type='Wi-Fi AP'"
):
    dev = json.loads(row[1])
    signal = dev.get('kismet.device.base.signal',{}).get('kismet.common.signal.last_signal',0)
    ssid_map = dev.get('dot11.device',{}).get('dot11.device.advertised_ssid_map',{})
    ssid = list(ssid_map.keys())[0] if ssid_map else '[Hidden]'
    print(f"{row[0]}  {ssid:<30}  {signal} dBm")
db.close()
EOF

## EXPORTAR KML PARA GOOGLE EARTH
kismetdb_to_kml --in mi_auditoria-*.kismet --out mapa_wifi.kml

## VER ALERTAS VIA REST API
curl -s http://localhost:2501/alerts/all_alerts.json   -u admin:pass | python3 -m json.tool

## ALERTAS WIDS DISPONIBLES
DEAUTHFLOOD  → flood de deautenticaciones (posible ataque)
BEACONFLOOD  → flood de beacons (falsos APs)
APSPOOF      → Evil Twin — mismo SSID con BSSID diferente
WEPUSE       → red usando WEP obsoleto
CRYPTODROP   → AP bajando cifrado (downgrade attack)
PROBENOJOIN  → dispositivo enviando probes sin asociarse

## MONITORIZACIÓN CONTINUA
python3 << 'EOF'
import requests, time
URL, AUTH, last_ts = "http://localhost:2501", ("admin", "pass"), 0
print("[*] Monitor WIDS activo. Ctrl+C para detener.")
while True:
    try:
        for a in requests.get(f"{URL}/alerts/all_alerts.json", auth=AUTH, timeout=5).json():
            ts = a.get('kismet.alert.timestamp', 0)
            if ts > last_ts:
                last_ts = ts
                print(f"[{a.get('kismet.alert.header')}] {a.get('kismet.alert.text')}")
        time.sleep(2)
    except KeyboardInterrupt:
        break
EOF

## ENDPOINTS PRINCIPALES
GET /system/status.json           → estado del servidor
GET /devices/all_devices.json     → todos los dispositivos
GET /datasource/all_sources.json  → fuentes activas
GET /alerts/all_alerts.json       → alertas WIDS
GET /channels/channels.json       → actividad por canal

## CURL — ejemplos
curl -s -u admin:pass http://localhost:2501/system/status.json | python3 -m json.tool

## PYTHON — listar todos los APs Wi-Fi
python3 << 'EOF'
import requests
BASE, AUTH = "http://localhost:2501", ("admin", "contraseña")
payload = {
    "fields": ["kismet.device.base.macaddr", "kismet.device.base.name",
               "kismet.device.base.signal/kismet.common.signal.last_signal"],
    "regex": [["kismet.device.base.phyname", "IEEE802.11"]]
}
for dev in requests.post(f"{BASE}/devices/summary/devices.json", auth=AUTH, json=payload).json():
    mac    = dev.get('kismet.device.base.macaddr', '')
    name   = dev.get('kismet.device.base.name', '')
    signal = dev.get('kismet.common.signal.last_signal', 0)
    print(f"{mac:<20}{name:<30}{signal}")
EOF

## CONTROLAR FUENTES EN TIEMPO REAL
curl -s -X POST -u admin:pass   http://localhost:2501/datasource/by-uuid/UUID/pause_source.json
curl -s -X POST -u admin:pass   http://localhost:2501/datasource/by-uuid/UUID/resume_source.json

## PASO 1: Preparar entorno
mkdir -p /tmp/kismet_survey

## PASO 2: GPS (si disponible)
sudo systemctl start gpsd
gpsd /dev/ttyUSB0 -F /var/run/gpsd.sock
cgps -s  # verificar fix GPS

## PASO 3: Iniciar Kismet
kismet -c wlan0   --log-types kismet,pcapng,wiglecsv   --log-prefix /tmp/kismet_survey/   --log-title edificio_A

## PASO 4: Supervisar
firefox http://localhost:2501 &

## PASO 5: Detener y analizar
kismet --kill

sqlite3 /tmp/kismet_survey/edificio_A-*.kismet << 'SQL'
SELECT json_extract(device,'$.dot11.device.dot11.device.last_beaconed_ssid') as ssid,
       devmac as bssid,
       json_extract(device,'$.kismet.device.base.signal.kismet.common.signal.last_signal') as signal
FROM devices WHERE phyname='IEEE802.11' AND type='Wi-Fi AP'
ORDER BY signal DESC;
SQL

## PASO 6: Exportar KML
kismetdb_to_kml --in /tmp/kismet_survey/edificio_A-*.kismet   --out /tmp/mapa_survey.kml

## CREAR SERVICIO SYSTEMD
sudo tee /etc/systemd/system/kismet-ids.service << 'EOF'
[Unit]
Description=Kismet Wireless IDS
After=network.target

[Service]
User=kismet
Group=kismet
ExecStart=/usr/bin/kismet -c wlan0   --log-types kismet   --log-prefix /var/log/kismet/   --daemonize
Restart=always

[Install]
WantedBy=multi-user.target
EOF

sudo systemctl enable kismet-ids
sudo systemctl start kismet-ids
sudo systemctl status kismet-ids

## SCRIPT MONITOR DE ALERTAS
python3 << 'EOF'
import requests, time, logging
logging.basicConfig(filename='/var/log/kismet_alerts.log',
    format='%(asctime)s %(message)s', level=logging.INFO)
ALERTAS = ['DEAUTHFLOOD', 'APSPOOF', 'BEACONFLOOD', 'CRYPTODROP']
URL, AUTH, ts = "http://localhost:2501", ("admin", "pass"), 0
while True:
    try:
        for a in requests.get(f"{URL}/alerts/all_alerts.json",
                              auth=AUTH, timeout=5).json():
            t = a.get('kismet.alert.timestamp', 0)
            if t > ts and a.get('kismet.alert.header') in ALERTAS:
                ts = t
                logging.warning(f"[{a['kismet.alert.header']}] {a['kismet.alert.text']}")
    except: pass
    time.sleep(3)
EOF

python3 << 'EOF'
import sqlite3, json, sys

DB = sys.argv[1] if len(sys.argv) > 1 else "kismet.kismet"
db = sqlite3.connect(DB)
db.row_factory = sqlite3.Row
c = db.cursor()

print(f"{'='*60}
ANÁLISIS: {DB}
{'='*60}")

# Resumen
total = c.execute("SELECT COUNT(*) FROM devices").fetchone()[0]
print(f"
Total dispositivos: {total}")

# Por protocolo
print(f"
{'PROTOCOLO':<25}{'DISPOSITIVOS':>12}")
for row in c.execute("SELECT phyname, COUNT(*) n FROM devices GROUP BY phyname ORDER BY n DESC"):
    print(f"  {row['phyname']:<23}{row['n']:>12}")

# APs Wi-Fi
print(f"
{'─'*60}
ACCESS POINTS WI-FI
{'─'*60}")
print(f"{'BSSID':<20}{'SSID':<28}{'SEÑAL':>8}{'CIFRADO':>10}")
print("-" * 66)
for row in c.execute("""
    SELECT devmac, device FROM devices
    WHERE phyname='IEEE802.11' AND type='Wi-Fi AP'
    ORDER BY json_extract(device,'$.kismet.device.base.signal.kismet.common.signal.last_signal') DESC
"""):
    dev    = json.loads(row['device'])
    signal = dev.get('kismet.device.base.signal',{}).get('kismet.common.signal.last_signal',0)
    ssid_m = dev.get('dot11.device',{}).get('dot11.device.advertised_ssid_map',{})
    ssid   = list(ssid_m.keys())[0] if ssid_m else '[Hidden]'
    cmap   = list(ssid_m.values())[0].get('dot11.advertisedssid.crypt_set',0) if ssid_m else 0
    enc    = 'WPA3' if cmap&512 else ('WPA2' if cmap&64 else ('WPA' if cmap&32 else ('WEP' if cmap&4 else 'Open')))
    print(f"  {row['devmac']:<18}{ssid:<28}{signal:>8}{enc:>10}")

# Alertas
n_alerts = c.execute("SELECT COUNT(*) FROM alerts").fetchone()[0]
if n_alerts:
    print(f"
ALERTAS WIDS ({n_alerts} total):")
    for row in c.execute("SELECT header, text FROM alerts ORDER BY tm DESC LIMIT 10"):
        print(f"  [{row['header']}] {row['text'][:60]}")

db.close()
EOF