Network & Cyber Security Lab Manual (Simplified)
Short Python snippets with sample input/output for each experiment.
1. Port Scanning with NMAP
Scans a target for open ports using python-nmap.
Code:
import nmap
sc = [Link]()
[Link]("[Link]", "20-100")
for host in sc.all_hosts():
for port in sc[host]["tcp"]:
print(port, sc[host]["tcp"][port]["state"])
Sample Output:
Input: target="[Link]"
Output:
22 open
25 filtered
80 open
Note: Requires: pip install python-nmap, and nmap installed. Scan only authorized hosts.
2. Honeypot Setup & Monitoring
Opens a fake service on a port and logs any connection attempts.
Code:
import socket, datetime
s = [Link]()
[Link](("[Link]", 2121))
[Link](5)
print("Honeypot running on port 2121")
while True:
conn, addr = [Link]()
print([Link](), "Connection from", addr)
[Link](b"220 Fake FTP Ready\r\n")
[Link]()
Sample Output:
Input: attacker runs -> nc <ip> 2121
Output:
Honeypot running on port 2121
2026-07-13 10:02:44 Connection from ('[Link]', 53210)
Note: Run only inside an isolated lab network.
3. Symmetric, Asymmetric, Hash & Digital Signature
Shows AES, RSA, SHA-256 hashing, and RSA signing/verification in a few lines each.
Code:
from [Link] import Fernet
import hashlib
key = Fernet.generate_key()
token = Fernet(key).encrypt(b"Hello")
print("AES:", Fernet(key).decrypt(token))
print("Hash:", hashlib.sha256(b"Hello").hexdigest())
Sample Output:
Output:
AES: b'Hello'
Hash: 185f8db32271fe25f561a6fc938b2e26...
Note: Full RSA encrypt/sign example available on request; kept short here.
4. Generate 10 Passwords (12 chars) using OpenSSL
Calls OpenSSL from Python to create strong random passwords.
Code:
import subprocess
for i in range(10):
raw = subprocess.check_output(["openssl","rand","-base64","16"]).decode()
pwd = "".join(c for c in raw if [Link]())[:12]
print(f"Password {i+1}: {pwd}")
Sample Output:
Output:
Password 1: aQ7zR2mLp9Kx
Password 2: fT4nUw8CyBd1
...
Password 10: wD3fRn7UmAq5
5. Footprinting - Target Information Gathering
Gets IP, WHOIS info, and server banner for a domain.
Code:
import socket, whois, requests
domain = "[Link]"
print("IP:", [Link](domain))
print("Registrar:", [Link](domain).registrar)
print("Server:", [Link](f"[Link]
Sample Output:
Output:
IP: [Link]
Registrar: RESERVED-Internet Assigned Numbers Authority
Server: ECS (nyb/1D2A)
Note: pip install python-whois requests. Only use on authorized domains.
6. Sniffing Network Traffic (Wireshark-style)
Captures live packets and prints source/destination info.
Code:
from [Link] import sniff, IP
def show(pkt):
if IP in pkt:
print(pkt[IP].src, "->", pkt[IP].dst)
sniff(iface="eth0", prn=show, count=5)
Sample Output:
Output:
[Link] -> [Link]
[Link] -> [Link]
Note: Requires root privileges and Scapy. Capture only on authorized networks.
7. Real-Time Traffic Analysis with Snort
Runs Snort and prints alerts as they're logged.
Code:
import subprocess, time
[Link](["snort","-i","eth0","-c","/etc/snort/[Link]","-A","fast"])
with open("/var/log/snort/alert") as f:
[Link](0, 2)
while True:
line = [Link]()
if line:
print("ALERT:", [Link]())
[Link](1)
Sample Output:
Output:
ALERT: ICMP PING NMAP
ALERT: SCAN nmap TCP
Note: Requires Snort installed and root access. Lab environment only.
8. Email Analysis
Extracts sender, subject, and attachments from a .eml file.
Code:
import email
from email import policy
msg = email.message_from_binary_file(open("[Link]","rb"), policy=[Link])
print("From:", msg["From"])
print("Subject:", msg["Subject"])
for part in msg.iter_attachments():
print("Attachment:", part.get_filename())
Sample Output:
Output:
From: sender@[Link]
Subject: Invoice Attached
Attachment: [Link]
9. Registry Analysis & Boot-Time Logging
Reads Windows startup registry keys and system boot time.
Code:
import winreg, psutil, datetime
print("Boot time:", [Link](psutil.boot_time()))
key = [Link](winreg.HKEY_LOCAL_MACHINE,
r"SOFTWARE\Microsoft\Windows\CurrentVersion\Run")
i = 0
while True:
try:
print([Link](key, i))
i += 1
except OSError:
break
Sample Output:
Output:
Boot time: 2026-07-13 07:42:18
('SecurityHealth', '%ProgramFiles%\\Windows Defender\\[Link]', 1)
Note: Windows only. Requires: pip install psutil.
10. File Type Detection (Autopsy-style)
Checks real file type by signature, not just extension.
Code:
import magic, os
for f in [Link]("./evidence_folder"):
print(f, "->", magic.from_file(f"./evidence_folder/{f}", mime=True))
Sample Output:
Output:
[Link] -> application/[Link]...
fake_image.jpg -> application/x-dosexec
Note: pip install python-magic
11. Memory Capture & Analysis (FTK Imager + Volatility)
Runs Volatility on a memory image captured earlier with FTK Imager.
Code:
import subprocess
out = [Link](
["[Link]","-f","[Link]","--profile","Win10x64_19041","pslist"],
capture_output=True, text=True)
print([Link])
Sample Output:
Output:
Name PID PPID
[Link] 3124 2988
[Link] 4460 3124
Note: FTK Imager (GUI) captures the RAM image; Volatility3 analyzes it.
12. Network Analysis from PCAP (NetworkMiner-style)
Lists hosts and TCP sessions found in a saved packet capture.
Code:
from [Link] import rdpcap, IP
pkts = rdpcap("[Link]")
hosts = {p[IP].src for p in pkts if IP in p} | {p[IP].dst for p in pkts if IP in p}
print("Hosts:", hosts)
Sample Output:
Output:
Hosts: {'[Link]', '[Link]'}