EXPERIMENT 1

AIM:
To write a program to implement the Playfair Substitution Technique.

THEORY:

The Playfair Cipher is a classical symmetric encryption technique and a specific case of a
digraph substitution cipher, meaning that it encrypts pairs of letters (bigrams) instead of
single characters. This distinction significantly improves its resistance to simple frequency
analysis compared to monoalphabetic ciphers such as the Caesar Cipher.

It was invented in 1854 by Charles Wheatstone, but popularized by Lord Playfair, after whom
it is named. The cipher gained practical relevance in military communications and was used
by British forces during conflicts such as the Second Boer War and even to some extent
during World War I.

1. Fundamental Concept

Unlike simple substitution ciphers that replace each letter independently, the Playfair cipher
operates on the principle that:

●​ Language redundancy exists at the pair level, not just individual letters.
●​ Encrypting two-letter combinations obscures common frequency patterns (e.g.,
“TH”, “HE”, “IN”).

Thus, instead of mapping:

●​ A → D
●​ B → X

It maps:

●​ TH → XY
●​ HE → QP

This makes cryptanalysis more complex because:

●​ The number of possible digraphs = 26 × 26 = 676 combinations

●​ Compared to just 26 in monoalphabetic substitution
2. Key Matrix Construction

The Playfair cipher uses a 5×5 matrix of letters constructed using a keyword.

Steps:

●​ Choose a keyword (e.g., MONARCHY)

●​ Remove duplicate letters
●​ Fill remaining spaces with unused letters of the alphabet
●​ Typically, I and J are combined to fit 25 cells

Example Matrix (Keyword: MONARCHY)

M O N A R
C H Y B D
E F G I K
L P Q S T
U V W X Z

Key properties:

●​ Each letter appears exactly once

●​ Total letters = 25 (I/J combined)

3. Plaintext Preparation

Before encryption, the plaintext must be normalized:

●​ Convert all letters to uppercase

●​ Remove spaces, punctuation, and special characters
●​ Split into pairs (digraphs)

Special Rules:

●​ If both letters in a pair are the same → insert a filler letter (usually X)
○​ Example: BALLOON → BA LX LO ON
●​ If the message length is odd → append a filler letter (X)
4. Encryption Rules

Each digraph is encrypted using the matrix based on three cases:

Case 1: Same Row

●​ Replace each letter with the letter to its immediate right

●​ Wrap around if needed

Example:

●​ A → R (if A is last in row, wrap to first)

Case 2: Same Column

●​ Replace each letter with the letter below it

●​ Wrap around to the top if needed

Case 3: Rectangle Rule

●​ If letters form a rectangle:

○​ Replace each letter with the letter in the same row but column of the other
letter

Example:

●​ Pair: A and G
●​ Replace A with letter in A’s row, G’s column
●​ Replace G with letter in G’s row, A’s column

5. Decryption Process

Decryption is the reverse of encryption:

●​ Same row → move left

●​ Same column → move up
●​ Rectangle → same rule as encryption
6. Mathematical Interpretation

The Playfair cipher can be interpreted as a mapping function:

●​ Let the matrix be represented as coordinates (row, column)

●​ Encryption transforms a pair:​
​
E(a, b) → (f(a), f(b))​

Where transformation rules depend on:

●​ Row equivalence
●​ Column equivalence
●​ Coordinate swapping (rectangle case)

This introduces non-linearity, making it stronger than simple substitution.

7. Cryptographic Strength

Advantages:

●​ More secure than monoalphabetic ciphers

●​ Reduces effectiveness of frequency analysis
●​ Conceals common digraphs

Limitations:

●​ Still vulnerable to:

○​ Digraph frequency analysis
○​ Known-plaintext attacks
●​ Limited key space compared to modern cryptographic systems
●​ Cannot handle numbers or symbols directly
8. Security Perspective

From a modern network security standpoint:

●​ Playfair is considered insecure due to:

○​ Small key size
○​ Predictable structure
●​ However, it is important for understanding:
○​ Evolution of cryptography
○​ Transition from classical to modern encryption

It serves as a conceptual precursor to more complex systems like:

●​ Advanced Encryption Standard

●​ Data Encryption Standard

9. Applications (Historical & Educational)

●​ Military field communication (historical)

●​ Cryptography education
●​ Puzzle design and recreational cryptography

10. Conceptual Summary

●​ Type: Symmetric key cipher

●​ Category: Digraph substitution
●​ Key: 5×5 matrix derived from keyword
●​ Strength: Moderate (historically useful)
●​ Modern relevance: Educational
PRACTICAL:
def create_matrix(key):
key = [Link]().replace('J', 'I')
matrix = []
seen = set()
for char in key:
if [Link]() and char not in seen:
[Link](char)
[Link](char)
for char in "ABCDEFGHIKLMNOPQRSTUVWXYZ":
if char not in seen:
[Link](char)
[Link](char)
return [matrix[i:i+5] for i in range(0, 25, 5)]
def get_coords(matrix, char):
for r in range(5):
for c in range(5):
if matrix[r][c] == char:
return r, c
return None

def encrypt(plaintext, key):

matrix = create_matrix(key)
plaintext = [Link]().replace('J', 'I').replace(' ', '')
prepared_text = ""
i=0
while i < len(plaintext):
prepared_text += plaintext[i]
if i + 1 < len(plaintext) and plaintext[i] == plaintext[i+1]:
prepared_text += 'X'
i += 1
else:
if i + 1 < len(plaintext):
prepared_text += plaintext[i+1]
i += 2
else:
prepared_text += 'X'
i += 1
if len(prepared_text) % 2 != 0:
prepared_text += 'X'
ciphertext = ""
for i in range(0, len(prepared_text), 2):
r1, c1 = get_coords(matrix, prepared_text[i])
r2, c2 = get_coords(matrix, prepared_text[i+1])
if r1 == r2:
ciphertext += matrix[r1][(c1 + 1) % 5]
 ciphertext += matrix[r2][(c2 + 1) % 5]
elif c1 == c2:
ciphertext += matrix[(r1 + 1) % 5][c1]
ciphertext += matrix[(r2 + 1) % 5][c2]
else:
ciphertext += matrix[r1][c2]
ciphertext += matrix[r2][c1]
return ciphertext
key = "MONARCHY"
plaintext = "instruments"
ciphertext = encrypt(plaintext, key)
print(f"Key: {key}")
print(f"Plaintext: {plaintext}")
print(f"Ciphertext: {ciphertext}")

RESULT:
Successfully implemented and verified Playfair cipher.
 EXPERIMENT 2
AIM:
Study of Account and password management:
1) PAM
2) Password Cracking

THEORY:

Account and password management form a core component of system security

architecture, directly impacting the three foundational principles of information security:
confidentiality, integrity, and availability (CIA triad). Improper handling of authentication
mechanisms is one of the most common causes of system compromise.

This experiment focuses on two critical aspects:

●​ Pluggable Authentication Modules (PAM) – a framework for managing

authentication in a modular and flexible manner
●​ Password Cracking Techniques – methods used to evaluate and exploit
weaknesses in password security

1. Authentication and Access Control Context

Authentication is the process of verifying the identity of a user or system. It is a subset of the
broader concept of access control, which determines:

●​ Who can access a system

●​ What resources they can access
●​ Under what conditions

Password-based authentication remains the most widely used mechanism despite known
vulnerabilities.
2. Pluggable Authentication Modules (PAM)
2.1 Overview

Pluggable Authentication Modules (PAM) is a modular authentication framework used

primarily in Unix/Linux systems. It allows system administrators to configure authentication
policies independently of application logic.

Instead of hardcoding authentication into programs, PAM introduces a layer of abstraction,

enabling:

●​ Reusable authentication logic

●​ Centralized policy management
●​ Flexibility in integrating multiple authentication methods

2.2 PAM Architecture

PAM operates through a stack-based architecture consisting of modules. Each module

performs a specific function in the authentication process.

Core Components:

●​ Application (Client)​
Example: login, SSH, sudo
●​ PAM Library​
Interface between application and modules
●​ PAM Modules​
Actual authentication logic
●​ Configuration Files​
Located in /etc/pam.d/

2.3 Types of PAM Modules

PAM defines four primary module types:

●​ auth → Verifies user identity (password checking)

●​ account → Manages account policies (expiry, restrictions)
●​ password → Handles password changes
●​ session → Manages session setup and teardown
2.4 Control Flags in PAM

Each module is associated with a control flag determining how results affect the
authentication flow:

●​ required → Must succeed; failure recorded but processing continues

●​ requisite → Immediate failure if unsuccessful
●​ sufficient → If successful, no further modules needed
●​ optional → Result is generally ignored unless it's the only module

This enables fine-grained control over authentication logic.

2.5 Example Workflow

When a user logs in:

●​ Application calls PAM

●​ PAM reads configuration file (e.g., /etc/pam.d/login)
●​ Modules are executed sequentially
●​ Final decision is derived from aggregated module outcomes

2.6 Advantages of PAM

●​ Decouples authentication from applications

●​ Supports multiple authentication mechanisms:
○​ Passwords
○​ Biometrics
○​ Smart cards
●​ Enables centralized security policy enforcement

2.7 Security Considerations

●​ Misconfiguration can lead to authentication bypass

●​ Poor module ordering may weaken security
●​ Requires strict administrative control
3. Password Storage Mechanisms
Modern systems do not store passwords in plaintext. Instead, they store:

●​ Cryptographic hashes

Common storage location in Linux:

●​ /etc/shadow

3.1 Hashing

Hashing is a one-way function:

●​ Input: password
●​ Output: fixed-length hash

Common algorithms include:

●​ MD5 (obsolete, insecure)

●​ SHA-1 (deprecated)
●​ SHA-256
●​ bcrypt (recommended)

3.2 Salting

A salt is a random value added to the password before hashing:

●​ Prevents identical passwords from producing identical hashes

●​ Protects against precomputed attacks like rainbow tables

4. Password Cracking
Password cracking refers to techniques used to recover passwords from stored hashes
or to guess them directly.

It is used both:

●​ Offensively (by attackers)

●​ Defensively (by security professionals to audit systems)
4.1 Types of Password Cracking Attacks

1. Brute Force Attack

●​ Tries all possible combinations

●​ Guaranteed success given enough time
●​ Computationally expensive

2. Dictionary Attack

●​ Uses a predefined list of common passwords

●​ Faster than brute force
●​ Effective against weak passwords

3. Rainbow Table Attack

●​ Uses precomputed hash tables

●​ Efficient lookup instead of computation
●​ Ineffective if salting is used

4. Hybrid Attack

●​ Combines dictionary + variations

●​ Example: password → password123

5. Social Engineering

●​ Exploits human behavior rather than algorithms

●​ Example: phishing attacks
4.2 Password Cracking Tools

One widely used tool is:

●​ John the Ripper

Features:

●​ Supports multiple hash formats

●​ Highly optimized for performance
●​ Supports dictionary and brute-force modes

4.3 Attack Workflow (Conceptual)

●​ Obtain password hashes

●​ Identify hashing algorithm
●​ Select cracking strategy
●​ Run tool (e.g., John the Ripper)
●​ Analyze results

5. Defensive Measures
To mitigate password attacks:

5.1 Strong Password Policies

●​ Minimum length (≥ 12 characters)

●​ Mix of uppercase, lowercase, numbers, symbols
●​ Avoid dictionary words

5.2 Multi-Factor Authentication (MFA)

●​ Combines:
○​ Something you know (password)
○​ Something you have (OTP, token)
○​ Something you are (biometrics)
5.3 Account Lockout Mechanisms

●​ Lock account after multiple failed attempts

5.4 Secure Hashing

●​ Use adaptive hashing algorithms like:

○​ bcrypt
●​ Introduce computational cost to slow attacks

5.5 Monitoring and Logging

●​ Detect unusual login attempts

●​ Use SIEM systems for analysis

6. Security Perspective
From a network security standpoint:

●​ PAM represents defensive infrastructure

●​ Password cracking represents offensive evaluation

Together, they illustrate a fundamental principle:

Security must be tested from both sides — enforcement and exploitation.

7. Conceptual Summary
●​ PAM provides modular authentication control
●​ Passwords are stored as hashed values
●​ Password cracking exploits weaknesses in passwords or hashing
●​ Strong security requires:
○​ Good configuration
○​ Strong passwords
○​ Defensive monitoring

RESULT:
Successfully understood account and password management.
 EXPERIMENT 3
AIM:
To configure common services like IIS, Apache, Open SSH, WU-FTP

THEORY:

1. Conceptual Overview

Network services are software systems that provide standardized communication and
resource-sharing capabilities over a network. These services typically follow a client–server
architecture, where:

●​ Server: Hosts the service and listens for incoming requests.

●​ Client: Initiates requests and consumes the service.

Common services in this experiment include:

●​ Web services (Apache HTTP Server / IIS)

●​ Secure remote access (OpenSSH)
●​ File transfer services (FTP servers such as vsftpd or IIS FTP)

Each service operates on specific protocols and ports, forming the backbone of modern
networked systems.

2. Web Server Concepts (Apache / IIS)

Apache HTTP Server

●​ Open-source web server maintained by the Apache Software Foundation.

●​ Implements the HTTP/HTTPS protocol.
●​ Uses a modular architecture, allowing extension through modules (e.g., SSL, PHP).

Microsoft IIS (Internet Information Services)

●​ Proprietary web server by Microsoft.

●​ Integrated with Windows OS.
●​ Supports [Link], .NET Core, and Windows authentication mechanisms.

Key Functionalities

●​ Serving static content (HTML, CSS, JS)

●​ Dynamic content generation (via scripting languages)
●​ Virtual hosting (multiple websites on one server)
●​ Access control and authentication
●​ Logging and monitoring
Ports

●​ HTTP → 80
●​ HTTPS → 443

3. Apache Server Configuration Concepts

Apache configuration is primarily controlled via:

●​ [Link] (main configuration file)

●​ sites-available/ and sites-enabled/ directories (Linux-based systems)

Important Configuration Directives

●​ Listen: Defines the port Apache listens on

●​ DocumentRoot: Specifies the root directory of web content
●​ ServerName: Defines the server’s hostname
●​ <Directory>: Controls access permissions for directories

Modules

●​ mod_ssl: Enables HTTPS

●​ mod_rewrite: URL rewriting
●​ mod_auth: Authentication mechanisms

Access Control

●​ Based on IP addresses, user credentials, or directory restrictions

●​ Example mechanisms:
○​ Basic authentication (username/password)
○​ Digest authentication (hashed credentials)

4. IIS Configuration Concepts

IIS is managed through:

●​ IIS Manager (GUI-based)

●​ PowerShell / command-line tools

Core Components

●​ Sites: Collection of web applications

●​ Application Pools: Isolate applications for stability and security
●​ Bindings: Define IP address, port, and hostname mapping
Authentication Modes

●​ Anonymous authentication
●​ Windows authentication
●​ Basic authentication
●​ Forms authentication

Logging and Monitoring

●​ IIS logs requests in:

○​ C:\inetpub\logs\LogFiles
●​ Useful for:
○​ Traffic analysis
○​ Debugging
○​ Security auditing

5. OpenSSH (Secure Remote Access)

Definition

OpenSSH provides secure remote login and communication using the SSH protocol,
replacing insecure protocols like Telnet.

Key Features

●​ Encryption using strong cryptographic algorithms

●​ Authentication via:
○​ Passwords
○​ Public/private key pairs
●​ Secure file transfer using:
○​ scp
○​ sftp

Default Port

●​ SSH → 22

Architecture

●​ Client-side: Initiates connection (ssh user@host)

●​ Server-side: Runs sshd daemon

Security Mechanisms

●​ Encryption: Prevents eavesdropping

●​ Integrity checks: Prevents tampering
●​ Authentication: Verifies user identity
Configuration File

●​ /etc/ssh/sshd_config
●​ Key parameters:
○​ PermitRootLogin
○​ PasswordAuthentication
○​ Port
○​ AllowUsers

6. FTP (File Transfer Protocol) Concepts

Definition

FTP is a protocol used to transfer files between client and server over a network.

Modes

●​ Active Mode
○​ Client opens a port
○​ Server connects back to client
●​ Passive Mode
○​ Server opens ports
○​ Client initiates both connections

Ports

●​ Control connection → 21
●​ Data connection → dynamic ports

Security Concerns

●​ Traditional FTP is unencrypted

●​ Vulnerable to:
○​ Credential sniffing
○​ Man-in-the-middle attacks

Secure Alternatives

●​ FTPS (FTP over SSL/TLS)

●​ SFTP (SSH-based file transfer)
7. vsftpd (Very Secure FTP Daemon)

●​ Lightweight and secure FTP server commonly used in Linux systems.

●​ Focuses on:
○​ Minimal attack surface
○​ Strong security defaults

Key Configuration File

●​ /etc/[Link]

Important Parameters

●​ anonymous_enable=NO
●​ local_enable=YES
●​ write_enable=YES
●​ chroot_local_user=YES (restrict users to their directories)

8. Port-Based Service Communication

Each service operates using the Transport Layer (TCP):

●​ Apache / IIS → TCP 80, 443

●​ SSH → TCP 22
●​ FTP → TCP 21 (control), additional ports (data)

Understanding ports is critical for:

●​ Firewall configuration
●​ Service hardening
●​ Network troubleshooting

9. Security Considerations

When configuring network services, the following must be enforced:

●​ Principle of Least Privilege

●​ Strong authentication mechanisms
●​ Encryption (TLS/SSL, SSH)
●​ Firewall rules
●​ Regular patching and updates
●​ Logging and monitoring
Common Threats

●​ Unauthorized access
●​ Service misconfiguration
●​ Port scanning and exploitation
●​ Credential brute-force attacks

10. Expected Outcome of the Experiment

After performing the experiment, you should achieve:

●​ Running instances of:

○​ Web server (Apache/IIS)
○​ SSH service
○​ FTP service
●​ Ability to:
○​ Access services via client tools
○​ Modify configurations safely
○​ Verify functionality through logs or browser/terminal
●​ Understanding of:
○​ Service architecture
○​ Network ports and protocols
○​ Basic server hardening practices

PROCEDURE:
APACHE CONFIGURATION
1.​ Install Apache HTTP Server.

2.​ Start and enable the Apache service.

3.​ Verify server status.

4.​ Configure document root and test webpage.

5.​ Allow HTTP service through firewall.

6.​ Access the server via browser.

 7.​ Analyze logs for request handling.

OPENSSH CONFIGURATION
1.​ Install OpenSSH server.

2.​ Start and enable SSH service.

3.​ Verify SSH port and configuration.

 4.​ Test remote login using SSH client.

5.​ Modify SSH configuration for security.

​ Change:
PermitRootLogin no
PasswordAuthentication yes

6.​ Restart service and re-test.

FTP SERVER CONFIGURATION

1.​ Install FTP server (vsftpd).

2.​ Start and enable FTP service.

 3.​ Modify configuration file.

Modify:
anonymous_enable=YES
local_enable=YES
write_enable=YES
chroot_local_user=YES

4.​ Configure permissions and directory access.

5.​ Restart service.

6.​ Test FTP connection.

RESULT:
Successfully configured and verified Apache, SSH, and FTP services, confirming proper
network service deployment and accessibility.
 EXPERIMENT 4
AIM:
Study of Security analysis tools: Nessus, Microsoft baseline security analyzer

THEORY:

1. Conceptual Overview

Security analysis tools are used to perform vulnerability assessment on systems,

networks, and applications. The objective is to identify:

●​ Weak configurations
●​ Known vulnerabilities
●​ Missing patches
●​ Security misconfigurations

These tools operate in a non-intrusive (scanning) or semi-intrusive (active probing)

manner to simulate attacker behavior without exploiting systems.

2. Vulnerability Assessment Fundamentals

A vulnerability is a weakness that can be exploited to compromise:

●​ Confidentiality (data leakage)

●​ Integrity (data tampering)
●​ Availability (service disruption)

Key Components of Vulnerability Assessment

●​ Asset identification: What is being protected?

●​ Threat identification: What can go wrong?
●​ Vulnerability detection: Where are the weaknesses?
●​ Risk analysis: How severe is the issue?
●​ Remediation: Fixing or mitigating vulnerabilities
3. Nessus Scanner (Detailed Theory)

What is Nessus

Nessus is a widely used vulnerability scanning tool developed by Tenable. It is used for:

●​ Network vulnerability scanning

●​ Compliance checks
●​ Configuration auditing
●​ Malware detection (in advanced versions)

How Nessus Works

1.​ Host Discovery

○​ Identifies live hosts in the network
2.​ Port Scanning
○​ Detects open ports and services
3.​ Service Enumeration
○​ Identifies service versions
4.​ Vulnerability Matching
○​ Compares detected services with a database of known vulnerabilities (CVEs)
5.​ Report Generation
○​ Outputs detailed vulnerability reports with severity levels

Scanning Techniques

●​ Credentialed Scans
○​ Uses login credentials
○​ Provides deeper system-level analysis
●​ Non-credentialed Scans
○​ External perspective (like an attacker)
○​ Limited visibility
Vulnerability Database

●​ Uses CVE (Common Vulnerabilities and Exposures)

●​ Severity classification:
○​ Critical
○​ High
○​ Medium
○​ Low
○​ Info

Output of Nessus

●​ List of vulnerabilities
●​ Affected systems and services
●​ Risk ratings
●​ Suggested remediation steps

4. MBSA (Microsoft Baseline Security Analyzer)

What is MBSA

Microsoft Baseline Security Analyzer is a tool developed by Microsoft to scan Windows

systems for:

●​ Missing security updates

●​ Misconfigurations
●​ Weak passwords
●​ Administrative issues
Key Functions

●​ Checks Windows system security

●​ Verifies patch levels
●​ Evaluates security settings
●​ Provides compliance recommendations

Scope of MBSA

●​ Local machine or remote Windows systems

●​ Focuses primarily on:
○​ Windows OS
○​ Microsoft applications (e.g., IIS, SQL Server)

Limitations

●​ Limited to Microsoft environments

●​ Less advanced than modern vulnerability scanners
●​ Has been largely replaced by newer tools like Microsoft Defender Vulnerability
Management

5. Scanning Methodology

Step-by-Step Process

●​ 1. Network Discovery
○​ Identify active hosts
○​ Map network topology
●​ 2. Enumeration
○​ Identify OS, services, versions
○​ Gather system fingerprints
●​ 3. Vulnerability Matching
○​ Compare system details with known vulnerabilities
●​ 4. Risk Assessment
○​ Assign severity scores
○​ Prioritize vulnerabilities
●​ 5. Reporting
○​ Generate structured reports
○​ Include remediation guidance
6. Vulnerability Classification (Risk Analysis)

Common Risk Factors

●​ Exploitability
○​ Ease of exploitation
●​ Impact
○​ Damage caused if exploited
●​ Exposure
○​ Whether the system is publicly accessible

CVSS (Common Vulnerability Scoring System)

●​ Standard scoring system used by tools like Nessus

●​ Scores range from 0.0 to 10.0

Categories:

●​ 0.0 → None
●​ 0.1–3.9 → Low
●​ 4.0–6.9 → Medium
●​ 7.0–8.9 → High
●​ 9.0–10.0 → Critical

7. Types of Vulnerabilities Detected

1. Software Vulnerabilities

●​ Buffer overflows
●​ Code execution flaws
●​ Unpatched libraries

2. Configuration Issues

●​ Weak passwords
●​ Default credentials
●​ Open ports

3. Network Vulnerabilities

●​ Unencrypted traffic
●​ Weak protocols (e.g., Telnet, HTTP)
●​ Insecure services
4. OS-Level Issues

●​ Missing updates
●​ Misconfigured permissions
●​ Disabled security features

8. Reporting and Interpretation

A vulnerability scan report typically includes:

●​ Host details
●​ List of vulnerabilities
●​ Severity ratings
●​ Evidence of vulnerability
●​ Suggested fixes

How to Interpret Results

●​ Focus on critical and high vulnerabilities first

●​ Verify false positives
●​ Assess exploitability in your environment
●​ Plan remediation in phases

9. Remediation Strategies

Common remediation actions include:

●​ Patch management
○​ Installing security updates
●​ Configuration hardening
○​ Disabling unnecessary services
●​ Access control improvements
○​ Strong passwords, MFA
●​ Network security
○​ Firewall rules, segmentation
●​ Encryption
○​ TLS/SSL for data in transit
10. Security Best Practices

●​ Run scans periodically (not just once)

●​ Use credentialed scans for deeper analysis
●​ Maintain updated vulnerability databases
●​ Integrate scanning into DevSecOps pipelines
●​ Combine with other tools:
○​ IDS/IPS systems
○​ SIEM tools
○​ Penetration testing frameworks

11. Expected Outcome of the Experiment

After completing this experiment, you should:

●​ Be able to perform a vulnerability scan using Nessus or similar tools

●​ Understand how MBSA evaluates Windows system security
●​ Interpret vulnerability reports effectively
●​ Identify risks and suggest remediation steps
●​ Understand the difference between:
○​ Vulnerability scanning vs penetration testing

RESULT:
Vulnerability scanning identified system weaknesses and misconfigurations, demonstrating
effective risk assessment using security analysis tools.

EXPERIMENT 5
AIM:
To identify organizations firewall IP address
THEORY:

1. Conceptual Overview

A firewall is a network security device that monitors and controls incoming and outgoing
traffic based on predefined security rules. Identifying the firewall’s IP address (or the
organization’s edge gateway) helps in:

●​ Understanding network boundaries

●​ Analyzing traffic flow paths
●​ Detecting network segmentation
●​ Performing basic reconnaissance (defensive context)

2. Network Topology and Position of Firewall

In a typical enterprise network:

●​ Internal Network (LAN) → User devices, servers

●​ Firewall / Gateway → Security boundary
●​ External Network (Internet) → Public networks

The firewall sits at the edge of the network, acting as:

●​ A packet filter
●​ A stateful inspection device
●​ A traffic control point

It usually has:

●​ Internal interface IP (LAN side)

●​ External/public IP (WAN side)

3. Traceroute / Tracert Mechanism

What is Traceroute

Traceroute is a diagnostic tool that identifies the path packets take from a source to a
destination.

●​ On Linux: traceroute
●​ On Windows: tracert

Underlying Mechanism
It works using the TTL (Time-To-Live) field in IP packets:

●​ Each router decreases TTL by 1

●​ When TTL reaches 0 → router sends an ICMP "Time Exceeded" message
●​ Traceroute increases TTL incrementally to map each hop

4. How Firewall IP is Identified

When using traceroute:

●​ The first few hops → Local network devices (router, switches)

●​ The last internal hop → Often the firewall or gateway
●​ The first external hop → ISP or upstream router

Key Indicators of Firewall

●​ Appears as:
○​ Last private IP before public IP transition
○​ Hop with higher latency or filtering behavior
●​ May drop ICMP packets (common firewall behavior)
●​ Might show:
○​ * * * (no response) if filtering is enabled

5. IP Address Structure (Context)

Understanding IP ranges is essential:

Private IP Ranges

●​ [Link] – [Link]
●​ [Link] – [Link]
●​ [Link] – [Link]

These are internal and typically used behind a firewall.

Public IP

●​ Assigned to the firewall’s external interface

●​ Routable over the internet

6. Common Tools Used

1. Traceroute / Tracert

●​ Maps the network path

●​ Identifies intermediate hops

2. Ping

●​ Tests reachability
●​ Can infer gateway responsiveness

3. WHOIS / IP Lookup Tools

●​ Provide:
○​ IP ownership
○​ ISP information
○​ Geolocation (approximate)

4. Network Scanning Tools

●​ Help analyze open ports on gateway devices (in controlled environments)

7. Hop Analysis Strategy

To identify the firewall IP:

1.​ Start traceroute to a public domain (e.g., [Link])

2.​ Observe:
○​ First hop → your local router
○​ Second/third hop → likely internal network devices
3.​ Identify:
○​ Last private IP in the sequence
4.​ That IP is often:
○​ Firewall internal interface
○​ Or gateway device

8. Firewall Behavior in Traceroute

Firewalls may:

●​ Block ICMP packets

○​ Causes missing hops (* * *)
●​ Rate-limit responses
●​ Hide internal topology

This is a deliberate security mechanism to prevent:

 ●​ Network mapping by attackers
●​ Exposure of infrastructure

9. Types of Firewalls (Contextual Understanding)

●​ Packet Filtering Firewall

○​ Filters based on IP, port, protocol
●​ Stateful Firewall
○​ Tracks connection state
○​ Allows return traffic automatically
●​ Proxy Firewall
○​ Intercepts traffic
○​ Acts as intermediary
●​ Next-Generation Firewall (NGFW)
○​ Includes deep packet inspection
○​ Application-level filtering
○​ Intrusion prevention capabilities

10. Security Implications

Identifying firewall IP addresses is useful for:

●​ Network troubleshooting
●​ Performance monitoring
●​ Academic analysis

However, it also highlights:

●​ Attack surface exposure

●​ Possible misconfigurations
●​ Weak segmentation

Firewalls are designed to limit visibility, so:

●​
●​ Complete identification is often intentionally difficult
●​ Security relies on obscurity + control mechanisms

11. Risk Considerations

When analyzing firewall/gateway IP:

●​ Avoid unauthorized scanning (legal implications)

●​ Respect organizational policies
●​ Use results only for:
○​ Learning
○​ Authorized audits
○​ Lab environments

12. Expected Outcome of the Experiment

After completing this experiment, you should be able to:

●​ Perform a traceroute/tracert analysis

●​ Identify:
○​ Network hops
○​ Gateway / firewall location
●​ Understand:
○​ Network boundary architecture
○​ Packet routing behavior
●​ Interpret:
○​ Missing hops and timeouts
○​ Latency variations
●​ Gain foundational understanding of:
○​ Network security perimeter design

PROCEDURE:

1.​ Open terminal on the system.

2.​ Execute traceroute command to a public domain.

3.​ Observe intermediate hops in the route.

●​ Hop 1 → [Link]
 ●​ Hop 2 → [Link]
●​ Hop 3 → 172.16.x.x
●​ Hop 4 → 192.168.x.x
●​ Hop 5–7 → 172.x.x.x, 192.x.x.x
●​ Hop 8–9 → No response (* * *)
●​ Hop 10 onwards → Public IPs

4.​ Identify private and public IP transitions.

The initial hops belong to private IP ranges such as 192.168.x.x, 10.x.x.x, and
172.16–31.x.x, indicating internal network routing.

5.​ Determine the last internal hop before external network.

The transition from private IP addresses to public IP addresses was observed at

hop 10, where the address changed to [Link].

6.​ Analyze behavior of hops (timeouts, delays).

Hops 8 and 9 did not respond and are represented by "* * *", which indicates that
these nodes are likely configured to block ICMP packets. This behavior is typical of
firewall or security devices.

7.​ Identify the probable firewall/gateway IP.

The last visible private IP address before the transition to public IP space is
[Link] / [Link] (Hop 7).

Therefore, this hop is identified as the probable firewall or gateway of the internal
network.

RESULT:
The firewall/gateway was identified as the last internal node before public network transition
using traceroute analysis.

EXPERIMENT 6
AIM:
To study and implement Security Information and Event Management (SIEM) tools such as
Splunk and Wazuh for log analysis and threat detection.
THEORY:

1. Conceptual Overview

A SIEM (Security Information and Event Management) system aggregates, analyzes, and
correlates logs from multiple sources to detect security incidents in real time.

Core functions:

●​ Log collection (centralized ingestion)

●​ Normalization (standardizing formats)
●​ Correlation (linking related events)
●​ Alerting (triggering when anomalies are detected)
●​ Visualization (dashboards, reports)

2. SIEM Architecture

A typical SIEM system consists of:

●​ Data Sources
○​ Servers, firewalls, endpoints, applications, network devices
●​ Collectors / Agents
○​ Forward logs to the SIEM server
●​ Processing Engine
○​ Parses, normalizes, and correlates events
●​ Storage Layer
○​ Stores logs (hot, warm, cold storage tiers)
●​ Analytics Layer
○​ Runs detection rules and queries
●​ Visualization Layer
○​ Dashboards, alerts, reports

3. Splunk (Detailed Theory)

What is Splunk

Splunk is a powerful SIEM and data analytics platform used to:

 ●​ Ingest machine-generated data
●​ Perform real-time searches and analysis
●​ Build dashboards and alerts

How Splunk Works

1.​ Data Ingestion

○​ Logs are collected from sources (files, syslog, APIs)
2.​ Indexing
○​ Data is stored in indexed format for fast search
3.​ Search Processing Language (SPL)
○​ Query language used to analyze data
4.​ Visualization
○​ Dashboards, charts, alerts

Key Components

●​ Indexer → Stores and indexes data

●​ Search Head → Interface for queries
●​ Forwarder → Sends logs from source machines

Key Features

●​ Real-time log analysis

●​ Threat detection via correlation rules
●​ Alert generation
●​ Visualization dashboards
●​ Machine learning–based anomaly detection (advanced)

4. Splunk Search Processing Language (SPL)

SPL is used to query logs and extract insights.

Examples of capabilities:

●​ Filtering events
●​ Aggregating data
●​ Identifying patterns
●​ Correlating events across sources

Typical analytical tasks:

●​ Detect failed login attempts

●​ Track unusual traffic spikes
●​ Identify suspicious IP addresses
5. Wazuh (Detailed Theory)

What is Wazuh

Wazuh is an open-source security monitoring platform that provides:

●​ Intrusion detection
●​ Log analysis
●​ File integrity monitoring
●​ Vulnerability detection
●​ Compliance monitoring

It is often integrated with:

●​ Elasticsearch (for storage/search)

●​ Kibana (for visualization)

6. Wazuh Architecture

●​ Wazuh Agent
○​ Installed on endpoints (servers, workstations)
○​ Collects logs and system data
●​ Wazuh Manager
○​ Processes and analyzes incoming data
●​ Elastic Stack
○​ Elasticsearch → data storage and search
○​ Kibana → dashboards and visualization

7. Core Functionalities of Wazuh

●​ Log Analysis
○​ Detects suspicious activity patterns
●​ File Integrity Monitoring (FIM)
○​ Tracks changes to critical files
●​ Intrusion Detection System (HIDS)
○​ Monitors system-level activities

●​ Vulnerability Detection
○​ Identifies outdated or vulnerable software
●​ Compliance Monitoring
○​ Ensures adherence to security standards
8. Log Ingestion and Processing

Logs originate from:

●​ Operating systems (Linux /var/log, Windows Event Logs)

●​ Network devices (firewalls, routers)
●​ Applications (web servers, databases)

Processing Pipeline

1.​ Log generation

2.​ Collection via agents/forwarders
3.​ Parsing and normalization
4.​ Storage in SIEM
5.​ Analysis and correlation
6.​ Alert generation

9. Event Correlation

Event correlation is the process of linking multiple logs to identify patterns indicating:

●​ Security breaches
●​ Attack patterns
●​ Suspicious behavior

Example:

●​ Multiple failed logins → followed by successful login → possible brute force attack

10. Alerting Mechanisms

SIEM tools generate alerts based on:

●​ Predefined rules
●​ Thresholds (e.g., 5 failed logins)
 ●​ Behavioral anomalies

Alerts may include:

●​ Severity level (Low, Medium, High, Critical)

●​ Source IP
●​ Affected system
●​ Event timeline

11. Threat Detection Use Cases

1. Brute Force Detection

●​ Multiple failed login attempts

●​ Same IP or distributed IPs

2. Malware Detection

●​ Suspicious file execution

●​ Known malicious signatures

3. Unauthorized Access

●​ Access from unusual locations

●​ Privilege escalation attempts

4. Network Anomalies

●​ Unexpected traffic spikes

●​ Communication with suspicious IPs

12. Visualization and Dashboards

SIEM tools provide:

●​ Real-time dashboards
●​ Graphs and charts
●​ Event timelines

These help in:

●​ Identifying trends
●​ Monitoring system health
●​ Incident response
13. Security and Operational Benefits

●​ Centralized monitoring
●​ Faster incident detection
●​ Improved forensic analysis
●​ Compliance with security standards
●​ Reduced response time to threats

14. Limitations

●​ High resource consumption

●​ Requires tuning to reduce false positives
●​ Complex setup and maintenance
●​ Potential alert fatigue if not configured properly

15. Expected Outcome of the Experiment

After completing this experiment, you should be able to:

●​ Understand SIEM architecture and workflow

●​ Use Splunk or Wazuh to:
○​ Ingest logs
○​ Analyze events
○​ Generate alerts
●​ Interpret security events and anomalies
●​ Correlate logs across multiple systems
●​ Visualize security data through dashboards
●​ Understand real-world applications of SIEM in cybersecurity operations

PRACTICAL:
1.​ Download and install Splunk Enterprise.
​ [Link]
2.​ Start Splunk service.
3.​ Access Splunk Web Interface.

4.​ Perform basic log search and analysis.

5.​ Create alerts or dashboards.
RESULT:
The experiment demonstrated how SIEM tools like Splunk can be used to collect, analyze,
and monitor system logs for detecting potential security threats.

EXPERIMENT 7
AIM:
To perform network scanning using Nmap in order to discover active hosts, identify open
ports and services, and conduct basic risk assessment.

THEORY:

1. Conceptual Overview

Network scanning is a reconnaissance activity used to discover:

●​ Live hosts on a network

 ●​ Open ports and running services
●​ Operating system and version information
●​ Network topology and exposure

The primary tool used here is:

Nmap (Network Mapper)

It is widely used in:

●​ Network administration
●​ Security auditing
●​ Penetration testing (authorized environments only)

2. Purpose of Network Scanning

The main objectives are:

●​ Asset discovery → Identify active devices

●​ Service enumeration → Identify running services
●​ Security assessment → Detect exposed services
●​ Attack surface analysis → Understand potential entry points

3. Nmap Architecture and Working

Core Mechanism

Nmap operates by sending crafted packets and analyzing responses.

●​ Sends packets to target hosts

●​ Observes responses (or lack thereof)
●​ Infers:
○​ Port state
○​ Service type
○​ OS fingerprint

Port States Identified

●​ Open → Service is actively accepting connections

●​ Closed → Port is reachable but no service is running
●​ Filtered → Packet is blocked (firewall/IDS)
●​ Unfiltered → Port is reachable but state unknown

4. Types of Nmap Scans

1. TCP SYN Scan (-sS)

●​ Sends SYN packet only (half-open scan)

●​ Does not complete TCP handshake
●​ Stealthy (less likely to be logged)

2. TCP Connect Scan (-sT)

●​ Completes full TCP handshake

●​ Uses OS network stack
●​ More detectable

3. Service Version Detection (-sV)

●​ Identifies service and version running on ports

4. Aggressive Scan (-A)

●​ Combines multiple techniques:

○​ OS detection
○​ Version detection
○​ Script scanning
○​ Traceroute

5. Operating System Detection

Nmap performs OS detection by analyzing:

●​ TCP/IP stack behavior

●​ Packet responses
●​ Timing differences

It compares responses with a database of known OS fingerprints.

6. Nmap Scripting Engine (NSE)

The Nmap Scripting Engine allows automation using scripts.

●​ Written in Lua
●​ Used for:
○​ Vulnerability detection
○​ Service enumeration
○​ Exploit detection (non-invasive)

Example use cases:

●​ Detect weak configurations

●​ Identify known vulnerabilities
●​ Enumerate users or services

7. Scan Techniques and Network Behavior

Nmap manipulates packet types:

●​ TCP SYN, ACK, FIN, NULL, XMAS scans

●​ ICMP echo requests
●​ UDP packets

Each type provides different insights depending on how the target responds.

8. Firewall and IDS Evasion (Conceptual)

Nmap includes techniques to bypass detection:

●​ Fragmentation of packets
●​ Decoy scanning
●​ Idle scanning
●​ Timing adjustments

These are used to understand how systems react under stealth conditions.

9. Interpreting Nmap Output

Typical output includes:

●​ Host status → Up/Down

●​ Open ports list
●​ Service names and versions
●​ OS detection results
●​ MAC address (local networks)
Example Interpretation Logic

●​ Open port 22 → SSH is active

●​ Open port 80 → HTTP server running
●​ Open port 443 → HTTPS enabled
●​ Unknown service → possible custom application

10. Security Implications

Nmap is both:

●​ A defensive tool (security auditing)

●​ A reconnaissance tool (attackers use it too)

Risks Identified via Scanning

●​ Exposed services
●​ Outdated software
●​ Weak configurations
●​ Unnecessary open ports

Defensive Countermeasures

●​ Firewalls blocking scans

●​ IDS/IPS detection
●​ Rate limiting
●​ Port filtering

11. Ethical Considerations

Important constraints:

●​ Scanning without authorization is illegal

●​ Use only in:
○​ Lab environments
○​ Owned systems
○​ Authorized penetration tests

This experiment should be treated as a controlled security assessment.

12. Network Topology Insights

Nmap helps infer:

●​ Internal network structure

●​ Gateway behavior
●​ Service distribution across systems

It can reveal:

●​ Segmented networks
●​ Exposed DMZ servers
●​ Misconfigured systems

13. Performance and Timing

Nmap allows timing control:

●​ Faster scans → less accurate, more detectable

●​ Slower scans → more stealthy, more accurate

Timing templates range from:

●​ -T0 (very slow)

●​ -T5 (very fast)

14. Output Types

Nmap supports multiple output formats:

●​ Normal text output

●​ XML (for automation)
●​ Grepable output
●​ JSON (via external tools)

These are useful for:

●​ Report generation
●​ Integration with SIEM tools
 ●​ Automated analysis

15. Expected Outcome of the Experiment

After completing this experiment, you should be able to:

●​ Perform different types of Nmap scans:

○​ SYN scan
○​ Version detection
○​ Aggressive scan
●​ Identify:
○​ Open ports
○​ Running services
○​ Potential vulnerabilities
●​ Interpret scan results accurately
●​ Understand:
○​ Network exposure
○​ Service-level risks
●​ Gain foundational skills in network reconnaissance and auditing

PROCEDURE:
1.​ Install Nmap tool on the system.

2.​ Identify target host (local or remote).

We’ll go for localhost / [Link]

3.​ Perform basic host discovery scan.

 4.​ Perform TCP SYN scan to identify open ports.

5.​ Analyze output to identify open ports and services.

The following open ports and associated services were identified:
●​ 21/tcp → FTP (File Transfer Protocol)
●​ 22/tcp → SSH (Secure Shell)
●​ 80/tcp → HTTP (Web Server)
●​ 631/tcp → IPP (Internet Printing Protocol)
●​ 5432/tcp → PostgreSQL (Database Service)
●​ 9090/tcp → Zeus Admin / Web-based Admin Interface

6.​ Interpret results and identify potential risks.

The system exposes multiple services including FTP, SSH, HTTP, database, and
administrative interfaces. This increases the potential attack surface and makes the
system more vulnerable if proper security measures are not implemented.

RESULT:
Nmap successfully identified multiple open ports and active services on the system. The
results highlight the importance of monitoring open ports and securing services to minimize
potential vulnerabilities and unauthorized access.
 EXPERIMENT 8
AIM:
To study wireless network security with the objective of understanding vulnerabilities in
wireless security protocols.

THEORY:

1. Conceptual Overview

Wireless networks (Wi-Fi) enable communication over radio frequencies instead of wired
connections. This introduces a different threat model because:

●​ Signals propagate beyond physical boundaries

●​ Medium is inherently broadcast in nature
●​ Attackers can intercept traffic without physical access
Wireless security focuses on:

●​ Confidentiality (preventing eavesdropping)

●​ Authentication (verifying legitimate users)
●​ Integrity (preventing data tampering)
●​ Availability (preventing disruption)

2. IEEE 802.11 Standards

Wireless networking is governed by the IEEE 802.11 family of standards.

Key components:

●​ Access Point (AP) → Central device managing the network

●​ Station (STA) → Client devices (laptops, phones)
●​ SSID → Network name
●​ BSSID → MAC address of the access point

3. Wireless Communication Model

Wireless communication uses:

●​ Radio waves (2.4 GHz, 5 GHz, 6 GHz bands)

●​ Shared medium (multiple devices communicate over same channel)

Characteristics:

●​ Half-duplex communication
●​ Susceptible to interference
●​ Subject to signal attenuation and noise

4. Wireless Security Protocols

1. WEP (Wired Equivalent Privacy)

●​ Early Wi-Fi security standard

●​ Uses RC4 encryption
●​ Major weaknesses:
○​ Small IV (Initialization Vector)
○​ Easily crackable
 ●​ Considered obsolete and insecure

2. WPA (Wi-Fi Protected Access)

●​ Introduced to replace WEP

●​ Uses TKIP encryption
●​ Temporary fix before WPA2

3. WPA2

●​ Uses AES encryption

●​ Stronger and widely used
●​ Still vulnerable to:
○​ Weak passwords
○​ Implementation flaws

4. WPA3

●​ Latest standard
●​ Uses SAE (Simultaneous Authentication of Equals)
●​ Strong protection against:
○​ Offline dictionary attacks
○​ Password guessing

5. Encryption and Authentication Mechanisms

Encryption

●​ Converts plaintext into ciphertext

●​ Ensures confidentiality

Authentication

●​ Verifies identity of users/devices

●​ Methods include:
○​ Pre-shared keys (PSK)
○​ Enterprise authentication (802.1X, RADIUS)

Key Exchange

●​ WPA/WPA2 use a 4-way handshake to establish session keys

6. Wireless Attacks (Conceptual Understanding)

1. Eavesdropping (Sniffing)

●​ Capturing wireless traffic

●​ Possible due to broadcast nature

2. Deauthentication Attacks

●​ Forcing clients to disconnect from AP

●​ Used to capture handshakes

3. Evil Twin Attack

●​ Fake access point mimicking legitimate network

●​ Captures user credentials

4. Replay Attacks

●​ Reusing captured packets to gain access

5. Dictionary Attacks

●​ Trying common passwords to break encryption

7. Packet Capture and Monitoring

Wireless packet analysis involves:

●​ Capturing frames transmitted over the air

●​ Using tools capable of monitor mode

Captured data may include:

●​ Management frames
●​ Control frames
●​ Data frames

Frames in 802.11

●​ Management frames → Connection setup (beacons, probes)

●​ Control frames → Acknowledgements, flow control
 ●​ Data frames → Actual payload data

8. Handshake Analysis (WPA/WPA2)

The 4-way handshake is critical for authentication:

1.​ AP sends nonce to client

2.​ Client generates key and responds
3.​ AP verifies and sends confirmation
4.​ Secure session established

Capturing this handshake allows:

●​ Offline password cracking attempts (with proper tools and permission)

9. Signal Strength and Network Analysis

Important parameters:

●​ RSSI (Received Signal Strength Indicator) → Signal strength

●​ Channel → Frequency band used
●​ Noise level → Interference measurement

Network performance depends on:

●​ Distance from AP
●​ Physical obstructions
●​ Channel congestion

10. Tools Used in Wireless Analysis

Common tools include:

●​ Wireshark → Packet analysis and visualization

●​ Aircrack-ng suite → Wireless security auditing
●​ Kismet → Wireless network detection and monitoring

These tools are used for:

 ●​ Capturing traffic
●​ Analyzing encryption
●​ Identifying networks and clients

11. Vulnerabilities in Wireless Networks

1. Weak Passwords

●​ Susceptible to dictionary attacks

2. Outdated Encryption

●​ WEP and WPA are insecure

3. Misconfiguration

●​ Open networks without encryption

●​ Weak authentication methods

4. Rogue Access Points

●​ Unauthorized APs inside network

5. Man-in-the-Middle (MITM)

●​ Interception and manipulation of traffic

12. Defensive Measures

To secure wireless networks:

●​ Use WPA3 or WPA2-AES

●​ Strong, complex passwords
●​ Disable WPS (Wi-Fi Protected Setup)
●​ Use 802.1X authentication for enterprises
●​ Regularly update firmware
●​ Monitor network for unauthorized devices
●​ Segment networks (guest vs internal)

13. Regulatory and Ethical Constraints

Wireless analysis must be conducted under strict constraints:

 ●​ Only in authorized environments
●​ Avoid capturing traffic from unauthorized users
●​ Respect privacy laws and organizational policies

Unauthorized interception can violate:

●​ Cyber laws
●​ Privacy regulations

14. Expected Outcome of the Experiment

After completing this experiment, you should be able to:

●​ Understand wireless network architecture and protocols

●​ Differentiate between WEP, WPA, WPA2, and WPA3
●​ Analyze wireless security mechanisms
●​ Identify common wireless vulnerabilities
●​ Conceptually understand packet capture and handshake processes
●​ Evaluate wireless security risks and mitigation strategies

RESULT:
Wireless protocols and vulnerabilities were analyzed, demonstrating the importance of
secure encryption and authentication mechanisms.

EXPERIMENT 9
AIM:
To perform password decryption using John the Ripper when hash values are available.

THEORY:

1. Conceptual Overview

Password “decryption” is a misnomer in strict cryptographic terms. In practice, passwords

are not encrypted but hashed.

●​ Encryption → reversible (with a key)

●​ Hashing → one-way transformation (irreversible)

This experiment focuses on recovering plaintext passwords from hashes using:

●​ Dictionary attacks
●​ Brute-force attacks
●​ Rule-based attacks
2. Cryptographic Hash Functions

A hash function takes input data and produces a fixed-length output (hash/digest).

Properties:

●​ Deterministic → same input gives same output

●​ One-way → cannot derive input from hash
●​ Fixed output size → regardless of input length
●​ Collision resistance → hard to find two inputs with same hash

3. Common Hash Algorithms

●​ MD5
○​ Fast but insecure
○​ Vulnerable to collisions
●​ SHA-1
○​ Also deprecated due to vulnerabilities
●​ SHA-256
○​ Widely used and currently secure
●​ bcrypt / scrypt / Argon2
○​ Designed specifically for password hashing
○​ Include salt + computational cost

4. Password Storage Mechanism

When a user sets a password:

1.​ Password is taken as input

2.​ A hash function is applied
3.​ Hash (not plaintext) is stored in system
Example:

●​ Password: password123
●​ Hash: ef92b778... (stored in /etc/shadow or database)

5. Salt and Its Importance

A salt is a random value added before hashing:

●​ Prevents rainbow table attacks

●​ Ensures identical passwords have different hashes

Process:

hash = H(password + salt)

Without salt:

●​ Same password → same hash → easier to crack

6. Password Cracking Techniques

1. Dictionary Attack

●​ Uses a list of common passwords

●​ Faster but limited by dictionary size

2. Brute Force Attack

●​ Tries all possible combinations

●​ Extremely time-consuming

3. Hybrid Attack

●​ Combines dictionary + mutations

●​ Example: password → password1, Password!

4. Rule-Based Attack

●​ Applies transformation rules

●​ Example:
○​ Append numbers
○​ Capitalize letters
7. Hash Cracking Workflow

Typical cracking process:

1.​ Obtain hash values

2.​ Identify hash algorithm
3.​ Use cracking tool
4.​ Apply attack method (dictionary/brute force)
5.​ Compare generated hash with target
6.​ If match → password recovered

8. John the Ripper Tool

A widely used password cracking tool:

John the Ripper

Capabilities

●​ Supports multiple hash types

●​ Dictionary and brute-force attacks
●​ Rule-based password mutation
●​ Multi-platform support

Working Principle

●​ Takes hash input

●​ Iterates through candidate passwords
●​ Hashes each candidate
●​ Compares with target hash
●​ Stops when a match is found

9. Types of Hashes in Systems

Linux Systems

●​ Hashes stored in:

○​ /etc/shadow
 ●​ Common formats:
○​ $1$ → MD5
○​ $5$ → SHA-256
○​ $6$ → SHA-512

Windows Systems

●​ Stored in:
○​ NTLM hashes
●​ Found in:
○​ SAM database

10. Attack Scenarios

1. Offline Attack

●​ Attacker has access to hash file

●​ Can attempt unlimited cracking attempts
●​ Hard to detect

2. Online Attack

●​ Attempts login repeatedly

●​ Limited by:
○​ Rate limiting
○​ Account lockout policies

11. Time Complexity Factors

Cracking difficulty depends on:

●​ Password length
●​ Character set (uppercase, lowercase, symbols)
●​ Hashing algorithm strength
●​ Use of salt
●​ Hardware capability (CPU/GPU acceleration)

12. Security Implications

Weak password practices lead to:

●​ Unauthorized system access

●​ Privilege escalation
●​ Data breaches

Common issues:

●​ Short passwords
●​ Predictable patterns
●​ Reused passwords
●​ Lack of salting

13. Defensive Strategies

To prevent password cracking:

●​ Use strong hashing algorithms:

○​ bcrypt, Argon2
●​ Always use salt
●​ Enforce strong password policies:
○​ Length ≥ 12 characters
○​ Mixed character types
●​ Implement:
○​ Account lockout mechanisms
○​ Rate limiting
●​ Use multi-factor authentication (MFA)

14. Ethical Considerations

Password cracking must only be performed:

●​ On systems you own

●​ In lab environments
●​ With explicit authorization

Unauthorized cracking is:

●​ Illegal
●​ A violation of cybersecurity laws
●​ A serious ethical breach

15. Expected Outcome of the Experiment

After completing this experiment, you should:

●​ Understand how passwords are stored using hashing

●​ Differentiate between hashing and encryption
●​ Use tools like John the Ripper for controlled cracking
●​ Identify different attack methodologies:
○​ Dictionary
○​ Brute force
○​ Hybrid
●​ Understand the importance of:
○​ Salting
○​ Strong hash functions
●​ Analyze the security of password systems

PROCEDURE:
1.​ Install John the Ripper tool.

2.​ Create or obtain sample password hashes.

3.​ Identify the hash format.

(DES)

4.​ Run John the Ripper using dictionary mode.

 5.​ Display cracked passwords.

RESULT:
Password hashes were successfully cracked using John the Ripper, demonstrating the risks
of weak passwords and insecure hashing.

EXPERIMENT 10
AIM:
To study and implement access control mechanisms for securing system resources.

THEORY:

1. Conceptual Overview

Access control mechanisms define who can access what resources and what actions
they can perform on a system. This is a core component of system security and enforces:

●​ Confidentiality → Prevent unauthorized data access

●​ Integrity → Prevent unauthorized modification
●​ Availability → Ensure authorized users can access resources

It operates through two key principles:

●​ Authentication → Verifying identity

●​ Authorization → Determining permissions after identity is verified

2. Access Control Models

1. Discretionary Access Control (DAC)

 ●​ Resource owner controls access
●​ Permissions are assigned at the discretion of the user
●​ Example:
○​ File owner decides who can read/write the file

2. Mandatory Access Control (MAC)

●​ Central authority defines access policies

●​ Users cannot change permissions
●​ Used in high-security environments (military systems)

3. Role-Based Access Control (RBAC)

●​ Access is based on user roles

●​ Roles define permissions
●​ Example:
○​ Admin → full access
○​ User → limited access

4. Attribute-Based Access Control (ABAC)

●​ Access depends on attributes:

○​ User attributes (role, department)
○​ Resource attributes
○​ Environment attributes (time, location)

3. Linux File Permission System

Linux uses a permission-based model for access control.

Each file/directory has:

●​ Owner (user)
●​ Group
●​ Others (world)

4. Permission Types

Each entity has three types of permissions:

●​ Read (r) → View file contents

●​ Write (w) → Modify file
 ●​ Execute (x) → Run file (if executable)

5. Permission Representation

Permissions are shown as:

rwxr-xr--

Breakdown:

●​ First 3 → Owner permissions

●​ Next 3 → Group permissions
●​ Last 3 → Others

6. Numeric (Octal) Representation

Permissions can also be represented numerically:

●​ Read (r) = 4
●​ Write (w) = 2
●​ Execute (x) = 1

Examples:

●​ 7 (rwx) → 4+2+1
●​ 6 (rw-) → 4+2
●​ 5 (r-x) → 4+1
●​ 0 (---) → no access

7. Permission Management Commands

chmod (Change Mode)

Used to modify permissions.

Example:

chmod 755 [Link]

 ●​ Owner → rwx
●​ Group → r-x
●​ Others → r-x

chown (Change Owner)

Used to change file ownership.

Example:

chown user:group [Link]

umask

●​ Defines default permissions for newly created files

●​ Subtracts permissions from default values

8. Access Control Lists (ACLs)

ACLs provide fine-grained permission control beyond standard Linux permissions.

They allow:

●​ Assigning permissions to multiple users

●​ Setting specific access rules per user/group

Example:

setfacl -m u:john:rwx [Link]

9. User and Group Management

Users

●​ Individual accounts on the system

Groups

●​ Collection of users with shared permissions

Benefits:
 ●​ Easier permission management
●​ Group-based access control

10. Authentication vs Authorization

●​ Authentication
○​ Confirms identity
○​ Example: username + password
●​ Authorization
○​ Determines access rights
○​ Example: can read/write a file

Both are essential for enforcing access control.

11. Security Policies in Access Control

A security policy defines:

●​ Who can access resources

●​ Under what conditions
●​ What actions are allowed

Policies may enforce:

●​ Least privilege principle

●​ Separation of duties
●​ Need-to-know access

12. Principle of Least Privilege

Each user/process should have only the minimum access necessary.

Benefits:

●​ Limits damage from compromised accounts

●​ Reduces attack surface
●​ Improves system security
13. Common Access Control Mechanisms

●​ File permissions (Linux/Unix)

●​ Windows NTFS permissions
●​ ACLs
●​ Role-based systems
●​ Firewall rules
●​ Application-level authorization

14. Windows Access Control (Brief Overview)

Windows uses:

●​ NTFS permissions
●​ Access Control Lists (ACLs)
●​ Security Identifiers (SIDs)

Permissions include:

●​ Full control
●​ Modify
●​ Read & execute
●​ List folder contents
●​ Read
●​ Write

15. Security Implications

Weak access control can lead to:

●​ Unauthorized data access

●​ Privilege escalation
●​ Data modification or deletion
●​ System compromise

Common issues:

●​ Misconfigured permissions
●​ Overly permissive access
●​ Shared credentials
●​ Lack of auditing
16. Auditing and Monitoring

Access control systems should include:

●​ Logging access attempts

●​ Monitoring permission changes
●​ Detecting unusual access patterns

This helps in:

●​ Incident response
●​ Forensics
●​ Compliance

17. Hardening Access Control

Best practices:

●​ Use strong user authentication

●​ Apply least privilege strictly
●​ Regularly review permissions
●​ Use groups instead of individual assignments
●​ Disable unused accounts
●​ Enable logging and auditing
●​ Use multi-factor authentication (MFA)

18. Expected Outcome of the Experiment

After completing this experiment, you should:

●​ Understand different access control models (DAC, MAC, RBAC, ABAC)

●​ Manage Linux file permissions using:
○​ chmod
○​ chown
○​ umask
●​ Apply and interpret permission settings
●​ Understand ACL-based fine-grained control
●​ Differentiate between authentication and authorization
 ●​ Analyze security implications of improper access control
●​ Implement basic access restrictions on a system

PRACTICAL:
1.​ Create sample files and directories.

2.​ View default file permissions.

3.​ Modify permissions using chmod.

4.​ Change ownership using chown.

5.​ Create users and groups.

6.​ Assign group permissions.

7.​ Implement Access Control Lists (ACLs).

8.​ Verify access restrictions.

 9.​ Analyze permission behavior.

RESULT:
The experiment demonstrated how Linux access control mechanisms can be used to restrict
and manage user permissions effectively using chmod, chown, and ACLs.