https://www.veil-framework.com/component---src-components-page-tem…s-veil-tutorial-mdx-ea533ee4927b297a0012.js

1"use strict";(self.webpackChunkveil_framework=self.webpackChunkveil_framework||[]).push([[2186],{7304:function(e,t,n){n.d(t,{A:function(){return r}});var a=n(6540);function l({href:e,children:t,className:n,...l}){return a.createElement("a",Object.assign({href:e,target:"_blank",rel:"sponsored nofollow noopener",className:n},l),t)}function r(){const e="/veil-recommends/infosec-fundamentals";return a.createElement("aside",{className:"fc-wrap","aria-label":"Recommended course"},a.createElement("div",{className:"fc-header"},a.createElement("span",{className:"fc-dot fc-dot-r","aria-hidden":"true"}),a.createElement("span",{className:"fc-dot fc-dot-a","aria-hidden":"true"}),a.createElement("span",{className:"fc-dot fc-dot-g","aria-hidden":"true"}),a.createElement("span",{className:"fc-header-label"},"course_spotlight.sh")),a.createElement(l,{href:e,className:"fc-image-link","aria-label":"View Information Security Fundamentals course"},a.createElement("img",{src:"/img/hero/infosec-fundamentals.webp",alt:"Information Security Fundamentals course cover",className:"fc-image",loading:"lazy",width:"300",height:"169"})),a.createElement("div",{className:"fc-body"},a.createElement("div",{className:"fc-tag"},"Recommended Course"),a.createElement("h3",{className:"fc-title"},a.createElement(l,{href:e,className:"fc-title-link"},"Information Security Fundamentals")),a.createElement("p",{className:"fc-desc"},"Build a solid foundation in cybersecurity. Covers network fundamentals, common attack vectors, defensive controls, and the mindset needed for security research."),a.createElement("ul",{className:"fc-features"},a.createElement("li",{className:"fc-feature"},a.createElement("span",{className:"fc-feature-icon","aria-hidden":"true"},"▸"),"Beginner-friendly — no prior experience needed"),a.createElement("li",{className:"fc-feature"},a.createElement("span",{className:"fc-feature-icon","aria-hidden":"true"},"▸"),"Network attacks & defences"),a.createElement("li",{className:"fc-feature"},a.createElement("span",{className:"fc-feature-icon","aria-hidden":"true"},"▸"),"Real-world security concepts")),a.createElement(l,{href:e,className:"fc-cta"},"View Course",a.createElement("span",{className:"fc-cta-arrow","aria-hidden":"true"}," →")),a.createElement("p",{className:"fc-disclosure"},"We may earn a commission if you enrol via our link, at no extra cost to you.")))}},8453:function(e,t,n){n.d(t,{RP:function(){return r}});var a=n(6540);const l=a.createContext({});function r(e){const t=a.useContext(l);return a.useMemo(()=>"function"==typeof e?e(t):{...t,...e},[t,e])}},8752:function(e,t,n){n.d(t,{A:function(){return l}});var a=n(6540);function l({sourceUrl:e}){const{0:t,1:n}=(0,a.useState)("idle"),{0:l,1:r}=(0,a.useState)("");return a.createElement("aside",{className:"nl-sw-wrap","aria-label":"Newsletter signup"},a.createElement("div",{className:"nl-sw-header"},a.createElement("span",{className:"nl-sw-dot nl-sw-dot-r","aria-hidden":"true"}),a.createElement("span",{className:"nl-sw-dot nl-sw-dot-a","aria-hidden":"true"}),a.createElement("span",{className:"nl-sw-dot nl-sw-dot-g","aria-hidden":"true"}),a.createElement("span",{className:"nl-sw-title"},"intel_feed.sh")),a.createElement("div",{className:"nl-sw-body"},a.createElement("p",{className:"nl-sw-prompt"},a.createElement("span",{className:"nl-sw-caret","aria-hidden":"true"},"$")," ","subscribe --to evasion-intel"),a.createElement("h3",{className:"nl-sw-heading"},"Stay ahead of the curve"),a.createElement("p",{className:"nl-sw-desc"},"AV bypass techniques, detection gaps, and lab-tested research — delivered before the mainstream catches up."),"done"===t?a.createElement("div",{className:"nl-sw-success",role:"status"},a.createElement("span",{className:"nl-sw-check","aria-hidden":"true"},"✓"),a.createElement("div",null,a.createElement("strong",null,"Subscribed."),a.createElement("br",null),a.createElement("span",{className:"nl-sw-success-sub"},"Confirm your email to activate."))):a.createElement("form",{onSubmit:async function(e){e.preventDefault();const t=e.currentTarget,a=new FormData(t);if(!a.get("company")){n("loading"),r("");try{const e=await fetch("/api/subscribe",{method:"POST",body:a}),l=await e.json();l.success?(n("done"),t.reset()):(n("err"),r(l.error||"Something went wrong."))}catch{n("err"),r("Network error — please try again.")}}},className:"nl-sw-form",noValidate:!0},a.createElement("input",{type:"hidden",name:"site",value:"veil-framework"}),a.createElement("input",{type:"hidden",name:"source_url",value:e||""}),a.createElement("input",{type:"text",name:"company",tabIndex:"-1","aria-hidden":"true",className:"nl-sw-hp",autoComplete:"off"}),a.createElement("label",{htmlFor:"nl-sw-name",className:"nl-sw-label"},"Your name"),a.createElement("input",{id:"nl-sw-name",type:"text",name:"name",placeholder:"alias or handle",required:!0,autoComplete:"given-name",className:"nl-sw-input",disabled:"loading"===t}),a.createElement("label",{htmlFor:"nl-sw-email",className:"nl-sw-label"},"Email address"),a.createElement("input",{id:"nl-sw-email",type:"email",name:"email",placeholder:"[email protected]",required:!0,autoComplete:"email",className:"nl-sw-input",disabled:"loading"===t}),"err"===t&&a.createElement("p",{className:"nl-sw-error",role:"alert"},l),a.createElement("button",{type:"submit",className:"nl-sw-btn",disabled:"loading"===t},"loading"===t?"Connecting…":"Subscribe to intel →"),a.createElement("p",{className:"nl-sw-legal"}

1,"No spam. No vendor fluff. Unsubscribe any time."))))}},8812:function(e,t,n){n.r(t),n.d(t,{Head:function(){return E},default:function(){return h}});var a=n(8453),l=n(6540);function r(e){const t=Object.assign({h1:"h1",p:"p",h2:"h2",ul:"ul",li:"li",strong:"strong",ol:"ol",code:"code",a:"a"},(0,a.RP)(),e.components);return l.createElement(l.Fragment,null,l.createElement(t.h1,null,"Veil Tutorial: Getting Started"),"\n",l.createElement(t.p,null,"This tutorial walks you through setting up the Veil Framework in a controlled lab environment, generating your first test payload, and interpreting the results from a defensive perspective. By the end, you will have a working lab, a generated payload, and — more importantly — the telemetry data that tells you what your detection stack caught and what it missed."),"\n",l.createElement(t.p,null,"We cover the lab environment, the monitoring stack, running the framework, and analyzing the output. If you have done this kind of work before, feel free to skip to the section that matches your current setup."),"\n",l.createElement(t.h2,null,"Prerequisites"),"\n",l.createElement(t.p,null,"Before starting, you need:"),"\n",l.createElement(t.ul,null,"\n",l.createElement(t.li,null,l.createElement(t.strong,null,"A virtualization platform")," — VMware Workstation, VirtualBox, or equivalent. Hyper-V works but has networking quirks that can complicate lab setups."),"\n",l.createElement(t.li,null,l.createElement(t.strong,null,"An attack host")," — Kali Linux or Parrot OS are common choices. You can also run the framework on any Linux system with Python 3 installed."),"\n",l.createElement(t.li,null,l.createElement(t.strong,null,"Target systems")," — At least one Windows 10/11 VM. A Windows Server VM with Active Directory is useful for PowerView testing."),"\n",l.createElement(t.li,null,l.createElement(t.strong,null,"Isolation")," — Your lab network must be isolated from production. Use a host-only or internal network adapter."),"\n"),"\n",l.createElement(t.p,null,"Do not run the framework on systems connected to production networks. This is not a theoretical concern — accidental execution on the wrong network can cause real problems and may violate laws."),"\n",l.createElement(t.h2,null,"Step 1: Lab Network Configuration"),"\n",l.createElement(t.p,null,"Set up an isolated network segment:"),"\n",l.createElement(t.ol,null,"\n",l.createElement(t.li,null,'Create a host-only network in your virtualization platform (e.g., VMware\'s "Host-Only" adapter or VirtualBox\'s "Internal Network")'),"\n",l.createElement(t.li,null,"Assign static IPs to your attack host and target systems"),"\n",l.createElement(t.li,null,"Verify connectivity between lab machines"),"\n",l.createElement(t.li,null,"Verify there is no route to your production network or the internet"),"\n"),"\n",l.createElement(t.p,null,"A common layout:"),"\n",l.createElement(t.ul,null,"\n",l.createElement(t.li,null,"Attack host: ",l.createElement(t.code,null,"10.10.10.5")),"\n",l.createElement(t.li,null,"Windows target: ",l.createElement(t.code,null,"10.10.10.10")),"\n",l.createElement(t.li,null,"Domain controller (optional): ",l.createElement(t.code,null,"10.10.10.1")),"\n"),"\n",l.createElement(t.h2,null,"Step 2: Monitoring Stack"),"\n",l.createElement(t.p,null,"Set up monitoring before you generate any payloads. The telemetry is the entire point."),"\n",l.createElement(t.p,null,"On your Windows target(s):"),"\n",l.createElement(t.ul,null,"\n",l.createElement(t.li,null,"Install Sysmon with a tuned configuration"),"\n",l.createElement(t.li,null,"Enable PowerShell script block logging (Group Policy → Administrative Templates → Windows Components → Windows PowerShell)"),"\n",l.createElement(t.li,null,"Enable process creation auditing (Event ID 4688 with command-line logging)"),"\n",l.createElement(t.li,null,"If available, install your organization's EDR agent in audit/passive mode"),"\n"),"\n",l.createElement(t.p,null,"On your attack host or a separate monitoring VM:"),"\n",l.createElement(t.ul,null,"\n",l.createElement(t.li,null,"Set up a log collector (ELK stack, Splunk Free, or even just Windows Event Forwarding to a central collector)"),"\n"),"\n",l.createElement(t.p,null,"This takes more time than generating the payload, but it is the step that makes everything else valuable."),"\n",l.createElement(t.h2,null,"Step 3: Framework Installation"),"\n",l.createElement(t.p,null,"On your attack host:"),"\n",l.createElement(t.p,null,"Clone the repository and run the setup. The framework requires Python 3 and several dependencies. On Kali Linux, most prerequisites are pre-installed."),"\n",l.createElement(t.p,null,"Verify the installation by launching the interactive menu. You should see the module selection interface listing available payload types."),"\n",l.createElement(t.h2,null,"Step 4: Your First Payload"),"\n",l.createElement(t.p,null,"For a first test, start with a simple Python-based payload:"),"\n",l.createElement(t.ol,null,"\n",l.createElement(t.li,null,"Launch the framework and select the Evasion module"),"\n",l.createElement(t.li,null,"Browse the available payload types"),"\n",l.createElement(t.li,null,"Select a Python-based payload (these are simpler to analyze)"),"\n",l.createElement(t.li,null,"Accept the default options for your first run"),"\n",l.createElement(t.li,null,"Note the output file path"),"\n"),"\n",l.createElement(t.p,null,"The framework generates the payload and saves it to your output directory. Before moving it to your target, ensure your monitoring is active and capturing events."),"\n",l.createElement(t.h2,null,"Step 5: Deployment and Analysis"),"\n",l.createElement(t.p,null,"Transfer the generated file to your target VM (use a shared folder or SCP — not email or cloud storage). Execute it and observe:"),"\n",l.createElement(t.ul,null,"\n",l.createElement(t.li,null,l.createElement(t.strong,null,"On the target:")," Does your AV/EDR flag it? Does it execute? What processes spawn?"),"\n",l.createElement(t.li,null,l.createElement(t.strong,null,"In your logs:")," What events did Sysmon capture? What PowerShell events fired? What network connections appeared?"),"\n",l.createElement(t.li,null,l.createElement(t.strong,null,"In your SIEM/collector:")," Can you build a timeline of the execution from log data alone?"),"\n"),"\n",l.createElement(t.p,null,'The answers to these questions are the deliverable of evasion testing. Whether the payload "worked" is secondary to whether your detection stack saw it happen.'),"\n",l.createElement(t.h2,null,"Next Steps"),"\n",l.createElement(t.p,null,"Once you are comfortable with the basic workflow:"),"\n",l.createElement(t.ul,null,"\n",l.createElement(t.li,null,l.createElement(t.strong,null,l.createElement(t.a,{href:"/veil-command-line-usage/"},"Command-Line Usage"))," — Learn the CLI flags for scripted and automated testing"),"\n",l.createElement(t.li,null,l.createElement(t.strong,null,l.createElement(t.a,{href:"/framework/veil-evasion/"},"Veil-Evasion"))," — Deep dive into the evasion module"),"\n",l.createElement(t.li,null,l.createElement(t.strong,null,l.createElement(t.a,{href:"/powershell-payloads/"},"PowerShell Payloads"))," — PowerShell-specific testing considerations"),"\n",l.createElement(t.li,null,l.createElement(t.strong,null,l.createElement(t.a,{href:"/modules/"},"Modules"))," — Explore all available framework modules"),"\n"))}var o=function(e={}){const{wrapper:t}=Object.assign({},(0,a.RP)(),e.components);return t?l.createElement(t,e,l.createElement(r,e)):r(e)},s=n(9329),i=n(1744),c=n(8963),m=n(8752),u=n(7304);function d(e){if(!e)return null;try{return new Intl.DateTimeFormat("en-GB",{day:"numeric",month:"long",year:"numeric",timeZone:"UTC"}).format(new Date(e))}catch{return null}}function p({pageContext:e,children:t}){const{frontmatter:n}=e,a=(null==n?void 0:n.title)||"",r=(null==n?void 0:n.description)||"",o=(null==n?void 0:n.slug)||"",i=(null==n?void 0:n.heroImage)||null,p=(null==n?void 0:n.date)||null,h=(null==n?void 0:n.lastmod)||null,E=d(p),f=h&&h!==p?d(h):null;return l.createElement(s.A,null,i&&l.createElement(c.A,{title:a,subtitle:r,backgroundImage:i}),l.createElement("article",{className:"page-content"},l.createElement("div",{className:"container"},E&&l.createElement("p",{className:"post-meta"},l.createElement("time",{dateTime:p},"Published ",E),f&&l.createElement(l.Fragment,null," · ",l.createElement("time",{dateTime:h}

1,"Updated ",f))),l.createElement("div",{className:"post-layout-grid"},l.createElement("div",{className:"post-main"},t),l.createElement("aside",{className:"post-sidebar","aria-label":"Sidebar"},l.createElement("div",{className:"post-sidebar-scroll"},l.createElement(u.A),l.createElement(m.A,{sourceUrl:o})))))))}function h(e){return l.createElement(p,e,l.createElement(o,e))}function E({pageContext:e}){const{frontmatter:t}=e,n=null!=t&&t.heroImage?`https://www.veil-framework.com${t.heroImage}`:null;return l.createElement(i.A,{title:null==t?void 0:t.title,description:null==t?void 0:t.description,pathname:null==t?void 0:t.slug},(null==t?void 0:t.date)&&l.createElement("meta",{property:"article:published_time",content:t.date}),(null==t?void 0:t.lastmod)&&l.createElement("meta",{property:"article:modified_time",content:t.lastmod}),n&&l.createElement("meta",{property:"og:image",content:n}),n&&l.createElement("meta",{name:"twitter:image",content:n}))}},8963:function(e,t,n){n.d(t,{A:function(){return l}});var a=n(6540);function l({title:e,subtitle:t,primaryLink:n,primaryText:l,secondaryLink:r,secondaryText:o,backgroundImage:s}){const i=s?{backgroundImage:`linear-gradient(135deg, rgba(37, 99, 235, 0.85) 0%, rgba(13, 33, 55, 0.9) 100%), url(${s})`,backgroundSize:"cover",backgroundPosition:"center"}:{};return a.createElement("section",{className:"hero blueprint-section-subtle",style:i},a.createElement("div",{className:"container"},a.createElement("h1",null,e),t&&a.createElement("p",null,t),(n||r)&&a.createElement("div",{style:{display:"flex",gap:"var(--space-md)",flexWrap:"wrap"}},n&&a.createElement("a",{href:n,className:"btn btn-primary"},l||"Get Started"),r&&a.createElement("a",{href:r,className:"btn btn-outline"},o||"Learn More"))))}}}]);
2//# sourceMappingURL=component---src-components-page-template-jsx-content-file-path-content-posts-veil-tutorial-mdx-ea533ee4927b297a0012.js.map