2025

Practical Manual

MODULE 1: INTRODUCTION TO CYBERSECURITY, CYBER

ETHICS, CYBER LAW AND CYBER POLICY
TAPAN KUMAR JHA

RPS CONSULTING | Bangalore

1|Page

Table of Content

Module 1:

1. JPS Virus Maker …………………………………………………………………………… 3

2. Dark Comet Trojan ……………………………………………………………………….13

3. Zphisher Software for Phishing ……………………………………………………… 21

4. All in One Keylogger ……………………………………………………………………. .28

5. Nmap ………………………………………………………………………………………. .36

6. Identify exploit on GitHub …………………………………………………………….. 42

7. Exploit vulnerable port using GitHub Exploits ……………………………………46

8. Tbomb for SMS Spamming ……………………………………………………………. 52

9. Email Spoofing …………………………………………………………………………….58

Cyber Security Training Lab Manual

2|Page

Module 1:
Offensive Security Techniques & Threat Simulation
Objective:

To understand how attackers use common tools and techniques to exploit systems and
users. This module helps learners identify, simulate, and analyse threats such as
phishing, keylogging, trojans, malware, and exploitation of vulnerable ports to better
prepare for real-world cybersecurity challenges.

Prerequisites:

• Basic knowledge of networking and operating systems (Windows & Linux)

• Virtualization software (VirtualBox or VMware)

• Pre-installed:

o Kali Linux VM (as attacker system)

o Windows 10/7 VM (as victim system)

o Python and Git

• Internet access (restricted/sandboxed)

• Optional: Metasploitable 2 VM for exploitation labs

• Installed tools:

o Wireshark

o Sysinternals Suite

o Burp Suite (Community Edition)

Cyber Security Training Lab Manual

3|Page

[Link] Manual: JPS VIRUS MAKER

Lab Title: Creating and Simulating a Custom Virus Using JPS Virus Maker (Educational
Use Only)

Objective:

To simulate the behavior of custom malware by using JPS Virus Maker to configure and
generate a virus executable. This lab helps students understand how real malware can
alter system settings and behaviors, improving awareness for malware defense
strategies.

Ethical & Legal Disclaimer:

This lab is for educational purposes only. Do NOT use this virus or its components
outside a controlled virtual lab environment. The virus must not be deployed on live
systems, personal devices, or production networks. Doing so may be illegal and
unethical.

Prerequisites:

• VMware/VirtualBox setup with:

o Windows 11 VM (Attacker)

o Windows Server 2019 VM (Victim)

• JPS Virus Maker software (located at E:\CEH-TOOLS\CEHv12 Module 07 Malware

Threats\Virus Maker)

• Mapped/shared network folder (e.g., Z:\) between VMs

• Administrative privileges on both machines

• Network adapter configured for internal/host-only networking

Theory:

JPS Virus Maker is a malware-building tool that allows attackers to embed a variety of
destructive behaviors into a single executable. While such tools are illegal to use
maliciously, cybersecurity professionals must understand their capabilities in order to
detect and defend against them effectively.

Cyber Security Training Lab Manual

4|Page

Procedure:

Step 1: Start Virtual Machines

• Power on both Windows 11 (attacker) and Windows Server 2019 (victim) in

VMware.

Step 2: Launch JPS Virus Maker

• On the Windows 11 machine, navigate to:

Malware Threats\Virus Maker

• Double-click [Link].

• If a security warning appears, click Run.

Step 3: Configure the Virus

• In the JPS Virus Maker interface:

o Check the Auto Startup box to run the virus on boot.

Cyber Security Training Lab Manual

5|Page

Step 4–5: Select Virus Payload Options

• From the "Virus Options" window, check the following:

o Disable Task Manager

o Disable Windows Update

o Disable Control Panel

o Disable Drivers

o Hide Windows Clock

o Hide Desktop Icons

o Enable Remote Desktop

o Remove Bluetooth

o Turn off Windows Firewall

o Turn off Windows Defender

o Enable Auto Startup

Cyber Security Training Lab Manual

6|Page

Step 6–7: Advanced Configuration

• Ensure None is selected under "Trigger Event".

• Click the right arrow icon to access advanced virus settings.

Cyber Security Training Lab Manual

7|Page

Step 8–10: Customize Virus Identity

• In the new window:

o Check Change Windows Password and provide a new password.

o Check Change Computer Name and enter a name (e.g., Test).

o Under "Change Icons", select JPG Icon.

o Under "Trigger Event", ensure None is selected.

Cyber Security Training Lab Manual

8|Page

Step 11–12: Create the Virus

• Click Create Virus!

• Choose architecture: x86(64bits)

• A popup confirms: “Virus Created Successfully”. Click OK.

Cyber Security Training Lab Manual

9|Page

Step 13: Locate the Virus File

• The virus file [Link] is created in the same folder as [Link]:

Malware Threats\Virus Maker

Step 14–15: Share the Virus File

• Transfer [Link] to the victim using:

o A mapped network drive (e.g., Z:\)

o ( Never use real email or messaging apps)

Cyber Security Training Lab Manual

10 | P a g e

Step 16–17: Execute the Virus on Victim System

• On Windows Server 2019, navigate to:

Malware Threats\Virus Maker

• Double-click [Link].

Step 18–21: Observe Effects

• Screen may go blank — indicating infection.

• Restart the victim system.

• At login, attempt your original password (it should fail).

• Try the password you set during virus creation.

Cyber Security Training Lab Manual

11 | P a g e

• Open Task Manager — an error message appears.

• Repeat for other disabled components (e.g., Control Panel, Windows Update).

Cyber Security Training Lab Manual

12 | P a g e

Observation:

• The virus disables core system functionality as configured.

• A new password is enforced, locking out original users.

• Many system tools (Task Manager, Defender, etc.) are non-functional.

Conclusion:

This simulation shows how malware can modify core system behaviors and disable
security features. Understanding such attacks helps in building effective defenses like
endpoint protection, application control, and system monitoring.

Cyber Security Training Lab Manual

13 | P a g e

2. Lab Manual: Dark Comet Trojan

Lab Title: Deploying and Testing Remote Access via Dark Comet RAT

Objective:

To simulate how threat actors use a Remote Access Trojan (RAT) like Dark Comet to
gain full control of a victim’s machine. This lab demonstrates how attackers build,
deliver, and execute a malicious RAT payload.

Legal and Ethical Warning:

This lab is intended strictly for educational use in isolated lab environments. Never
deploy RATs on real devices or networks. Unauthorized use of RAT tools is a criminal
offense under global cybersecurity laws.

Prerequisites:

• Windows 10/11 virtual machine (host)

• Another Windows VM (victim system)

• Pre-installed Dark Comet 5.3.1 or later (in a test environment)

• Network configured between VMs (Host-only or NAT)

• Basic knowledge of networking and malware behavior

Theory:

Dark Comet is a legacy Remote Access Trojan used by attackers for full control over
infected systems. It offers features like keystroke logging, remote desktop, file theft,
and webcam access. While no longer maintained, it remains a popular tool for
malware simulation labs.

Procedure:

Cyber Security Training Lab Manual

14 | P a g e

Step 1: Launch Dark Comet Client

• Navigate to the Dark Comet folder (e.g., C:\Tools\DarkComet)

• Double-click on [Link]

A “Malicious file” warning may appear (due to signature detection).

Click “More info” → “Run anyway”.

Cyber Security Training Lab Manual

15 | P a g e

Step 2: Create the RAT Server (Trojan)

• In Dark Comet, click on “Edit Server” from the menu bar

• Choose “Server Module”

Step 3: Generate a Process Mutex

• Click the “Generate” button next to the Mutex field

Cyber Security Training Lab Manual

16 | P a g e

(This creates a unique identifier to prevent multiple RAT instances.)

Step 4: Configure Network Settings

• Navigate to the “Network Settings” tab

• Under “IP/DNS”, enter the IP address of your attacker machine

o Use ipconfig in Command Prompt to get your local IP

• Leave port as default (e.g., 1604)

Step 5: Customize Trojan Icon

• Go to the “Choose Icon” tab

Cyber Security Training Lab Manual

17 | P a g e

• Browse and select any common program icon (e.g., Firefox, PDF, etc.)

Step 6: Build the Server (Trojan)

• Click “Build Module”

• Then select “Build Server”

• Save the output file as [Link] on the Desktop

Step 7: Deploy the Trojan

IMPORTANT: Do not execute this file on real machines.

• Switch to your victim VM

Cyber Security Training Lab Manual

18 | P a g e

• Transfer and run the [Link] file (simulate execution by user)

• You may need to disable antivirus temporarily in lab mode

Step 8: Confirm Connection

• On the attacker VM, the Dark Comet interface will now show a new session
under Active Connections

Cyber Security Training Lab Manual

19 | P a g e

Step 9: Gain Remote Access

• Right-click the active session

• Go to:

Quick Windows Open → Remote Desktop

• You should now have full control of the victim’s desktop environment

Cyber Security Training Lab Manual

20 | P a g e

Observation:

• Dark Comet enables:

o Live screen control

o File explorer access

o Webcam & microphone access

o Keylogger logs

• Communication happens over specified IP and port

• Stealth features hide the payload from basic system tools

Conclusion:

This lab illustrates how attackers configure and deploy a Remote Access Trojan to
control a target system. Understanding this process is key for reverse engineering,
endpoint detection, and forensic investigation.

Cyber Security Training Lab Manual

21 | P a g e

3. Lab Manual: Zphisher Software for Phishing

Lab Title: Phishing Simulation Using Zphisher in Kali Linux

Objective:

To simulate a phishing attack by cloning a real login page (Instagram) and capturing user
credentials using Zphisher, an open-source tool. This helps learners understand how
attackers manipulate human behavior and replicate login interfaces.

Ethical & Legal Disclaimer:

This lab is strictly for educational use in a closed virtual environment. Do not target
real people or services. Launching phishing pages publicly or sending them to users
without consent is illegal and unethical under global cybercrime laws (e.g., GDPR, IT
Act, CFAA).

Prerequisites:

• Kali Linux with internet access

• Firefox browser

• Git installed (sudo apt install git -y)

• Awareness of phishing techniques and legal limitations

Theory:

Zphisher is a powerful open-source tool used to create phishing pages of popular

websites (e.g., Instagram, Facebook, Gmail). It provides various hosting options and
phishing templates. Zphisher is often used by ethical hackers and researchers to
understand how users can be deceived through visual mimicry.

Procedure:

Step 1: Log in to Kali Linux

Cyber Security Training Lab Manual

22 | P a g e

• Username: kali

• Password: kali

Step 2: Download Zphisher

• Open Firefox

• Google search:

zphisher github

• Click on the first GitHub link (usually: [Link]

Step 3: Review and Copy Installation Commands

• Scroll to the “Installation” section of the GitHub page

• Locate the command to clone the repository:

git clone [Link]

Cyber Security Training Lab Manual

23 | P a g e

Step 4: Install Zphisher in Terminal

In Kali terminal:

#cd Desktop

#git clone [Link]

#cd zphisher

#bash [Link]

The script will auto-install dependencies (php, curl, wget, etc.).

Cyber Security Training Lab Manual

24 | P a g e

Step 5: Launch Phishing Page

Once loaded, you’ll see a list of platforms.

• Type:

02

(for Instagram)

Cyber Security Training Lab Manual

25 | P a g e

Step 6: Choose Phishing Page Type

• Type:

01

(Traditional Login Page)

Step 7: Choose Hosting Option

• Type:

01

(to host locally)

• When prompted for custom port selection:

(Use default port 8080)

Zphisher will generate a local link:

[Link]

Cyber Security Training Lab Manual

26 | P a g e

Step 8: Open the Fake Page in Browser

• Copy the local link

• Paste it into Firefox browser:

[Link]

• A fake Instagram login page appears

Step 9: Simulate Credential Capture

Cyber Security Training Lab Manual

27 | P a g e

• Enter test credentials (e.g., testuser/testpass)

• Switch back to the terminal

• You’ll see the captured credentials displayed like:

[+] Username: testuser

[+] Password: testpass

Observation:

• Zphisher mimics a legitimate Instagram login page

• It captures input fields and displays them in plaintext

• Localhost hosting keeps the phishing page confined to your machine

Conclusion:

This lab demonstrates how easily phishing pages can be created using open-source
tools. It highlights the importance of user awareness and web content inspection when
entering credentials.

Cyber Security Training Lab Manual

28 | P a g e

4. Lab Manual: All in One Keylogger

Lab Title: Activity Surveillance Using All-in-One Keylogger

Objective:

To understand how keyloggers operate by silently recording keystrokes and screen

activity, and to analyze logs generated by the tool. This lab also helps in learning how
such software can be used for surveillance, as well as how to detect its presence in
defensive scenarios.

Ethical & Legal Disclaimer:

Keylogging software must never be used on real users or systems without explicit,
legal consent. This lab is for educational use only, performed in isolated virtual
machines with no external access. Unauthorized use of surveillance tools can result in
criminal prosecution.

Prerequisites:

• Windows 10/11 VM (non-networked)

• “All-in-One Keylogger” installer (ensure legal lab license or trial)

• Administrator access on the VM

• No antivirus running (to avoid installation blocks)

• Awareness of privacy laws and responsible use

Theory:

A keylogger records all keyboard input from a victim's machine. Many commercial tools
like All-in-One Keylogger also capture screen recordings, clipboard content, website
visits, and more. While typically marketed for parental control or employee monitoring,
these tools are often misused in cyber espionage or insider threat attacks.

Procedure:

Cyber Security Training Lab Manual

29 | P a g e

Step 1: Install the Keylogger Software

• Double-click the installer file (e.g., keylogger_setup.exe)

• Accept terms and conditions

• Follow the setup wizard instructions

Cyber Security Training Lab Manual

30 | P a g e

Cyber Security Training Lab Manual

31 | P a g e

Step 2: Set a Secure Access Password

• During installation, you’ll be prompted to set a password

This will be used later to access or uninstall the software.

Step 3: Verify Background Execution

• After installation, the software will run in stealth mode.

• Click the up arrow on the Windows taskbar (System Tray).

• You should see an invisible or disguised icon representing the keylogger.

Cyber Security Training Lab Manual

32 | P a g e

Step 4: Access Software Settings via Hotkeys

• Open the keylogger by using the keyboard shortcut you selected during setup.
Example: Ctrl + Shift + Alt + K

• Enter the password you defined to unlock the interface.

Cyber Security Training Lab Manual

33 | P a g e

Step 5: Review Settings and Log Viewer

• Navigate to the “Settings” → “Password” section to review:

o Hotkey combinations

o Startup options

o Visibility controls

• Go to the “Open Log Viewer” to access recorded data.

Cyber Security Training Lab Manual

34 | P a g e

Step 6: Analyze Collected Logs

• In the Log Viewer, choose from:

o Textual Logs – shows typed keystrokes and app activity

o Visual Logs – captures screenshots of the user desktop

o Clipboard Logs, App Usage, Web Activity, etc.

Use this step to simulate how attackers or investigators review stolen or monitored
data.

Cyber Security Training Lab Manual

35 | P a g e

Observation:

• Keylogger records all inputs, including passwords, messages, and URLs.

• No visible indicator of logging while it is active.

• The logs are encrypted and password-protected.

• The tool can bypass antivirus if obfuscated properly.

Conclusion:

This lab demonstrates how keylogging software can invisibly monitor a user's activity. It
underscores the need for endpoint monitoring, anti-keylogger defenses, and user
awareness training.

Cyber Security Training Lab Manual

36 | P a g e

5. Lab Manual: Nmap Scans

Lab Title: Nmap Scanning Techniques

Objective:

To understand and perform different types of scans using Nmap for network
reconnaissance and vulnerability assessment.

Prerequisites:

• Kali Linux (or any Linux with Nmap installed)

• Target machine (e.g., Metasploitable or any VM with open ports)

• Basic understanding of networking and TCP/IP

Theory:

Nmap (Network Mapper) is an open-source tool used to discover hosts and services on
a network by sending packets and analyzing responses.

Procedure:

Step 1: Open the Kali Linux, Metasploitable 2 in vmware

Login Credentials for Kali:

1. Username: kali
2. Password: kali

Login Credentials for Metasploitable 2:

1. Username: msfadmin
2. Password: msfadmin

Kali Linux

Cyber Security Training Lab Manual

37 | P a g e

Metasploitable 2:

Step 2: Check the metasploitable 2 IP Address by $ifconfig command.

Cyber Security Training Lab Manual

38 | P a g e

IP Address: [Link]

Step 3: Open the kali linux terminal and type the following commands:

1. Ping Scan

Used to check if the host is online (up).

#nmap -sn [Link]

2. Port Scan

Cyber Security Training Lab Manual

39 | P a g e

Scans for open TCP ports.

#nmap -p 1-1000 [Link]

3. Service and Version Detection

#nmap -sV [Link]

4. OS Detection

#sudo nmap -O [Link]

Cyber Security Training Lab Manual

40 | P a g e

5. Aggressive Scan

Performs OS detection, version detection, script scanning, and traceroute.

#nmap -A [Link]

Observation:

• Note down the live hosts, open ports, running services, and detected OS.

Cyber Security Training Lab Manual

41 | P a g e

• Aggressive scan may return detailed data but can be noisy on the network.

Conclusion:

Nmap is essential for network reconnaissance. Each scan type serves a unique purpose
in identifying vulnerabilities or understanding network layout.

Cyber Security Training Lab Manual

42 | P a g e

6. Lab Manual: Identify Exploit on Github

Lab Title: Identifying Vulnerable Services and Finding Public Exploits on GitHub and
Exploit-DB

Objective:

To perform vulnerability assessment by scanning open ports on a target machine,

identifying running services and their versions, and then searching for corresponding
public exploits on platforms like Exploit-DB or GitHub.

Prerequisites:

• Kali Linux VM (Attacker)

• Metasploitable 2 VM (Target)

• VMware or VirtualBox installed with internal network or host-only setup

• Internet access

• Basic knowledge of:

o Port scanning using Nmap

o Searching exploit databases (Exploit-DB, GitHub)

Theory:

Cybersecurity professionals often begin with reconnaissance by scanning open ports

and fingerprinting service versions. Public databases like Exploit-DB and GitHub can be
searched for known exploits corresponding to specific versions of vulnerable services.

Procedure:

Step 1: Set Up the Environment

• Start Kali Linux and Metasploitable 2 VMs using VMware or VirtualBox.

• Ensure both are connected on the same host-only or internal network.

Cyber Security Training Lab Manual

43 | P a g e

Step 2: Scan for Open Ports (FTP Example)

Run an Nmap scan targeting port 21 (FTP) on Metasploitable:

nmap -sV -p 21 [Link]

Now you know the service (vsftpd) and its version (2.3.4), which is vulnerable.

Step 3: Search for an Exploit on Exploit-DB

1. Open your browser and go to: [Link]

Cyber Security Training Lab Manual
44 | P a g e

2. In the search bar, type the service and version:

vsftpd 2.3.4

3. Locate the exploit result (e.g., Backdoor Command Execution).

Step 4: Download the Exploit

• Click on the exploit title.

• Review the description and exploit code.

• Download the exploit code using the link provided, or use:

wget [Link] -O vsftpd_exploit.py

• OR clone from GitHub if available:

git clone [Link]

Cyber Security Training Lab Manual

45 | P a g e

Observation:

• The scan revealed an outdated FTP service (vsftpd 2.3.4).

• You were able to identify a working exploit for this version on Exploit-DB.

• The exploit can now be tested in a controlled lab to validate the vulnerability
(optional next step).

Important Note:

Do not use these exploits on real or unauthorized systems. This lab is strictly for
educational purposes in a safe lab environment.

Conclusion:

This lab shows how port scanning, version identification, and exploit research can be
combined to assess a system's vulnerabilities. These steps form the basis of real-world
penetration testing and vulnerability assessment workflows.

Cyber Security Training Lab Manual

46 | P a g e

7. Lab Manual: Exploit vulnerable port using

Github Exploits

Lab Title: Exploit vsftpd 2.3.4 Vulnerability via GitHub Code in Kali Linux

Objective:

To demonstrate how publicly available exploits can be used to compromise a vulnerable

FTP server (vsftpd 2.3.4) using a script obtained from GitHub. This lab aims to teach
vulnerability validation, exploit usage, and ethical attack simulation.

Ethical & Legal Disclaimer:

This lab is meant for educational use only in a controlled, isolated environment (e.g.,
using Metasploitable 2 VM). Never exploit live systems or production infrastructure
without explicit authorization.

Prerequisites:

• Kali Linux (attacker VM)

• Metasploitable 2 (victim VM)

• Both VMs should be on the same network (e.g., Host-Only or NAT)

• Internet access on Kali to fetch GitHub scripts

• Python 2 or 3 installed

Theory:

vsftpd (Very Secure FTP Daemon) version 2.3.4 has a known backdoor vulnerability
where a malicious smiley :) in the username field opens a command shell on port 6200.
This was an intentional backdoor in a compromised release of vsftpd, now removed in
newer versions.

Procedure:

Cyber Security Training Lab Manual

47 | P a g e

Step 1: Identify the Vulnerability

• Open Kali Linux Terminal

• Use Nmap to scan Metasploitable 2:

nmap -sV -p 21 [Link]

Output will confirm that vsftpd 2.3.4 is running on port 21 (FTP).

Cyber Security Training Lab Manual

48 | P a g e

Step 2: Search for Exploit on Google

• Open Firefox or use Google:

vsftpd 2.3.4 exploit site:[Link]

• Identify a working exploit. Example:

[Link] or given
below:

Step 3: Download the Exploit

Back in the Kali terminal:

#cd Desktop

#git clone [Link]

#cd exploits

Or just download the specific file:

Cyber Security Training Lab Manual

49 | P a g e

wget
[Link]

Step 4: Prepare Environment

• Ensure Python is installed:

#python --version # For Python 2

#python3 --version # For Python 3

• Some scripts may require telnetlib (usually preinstalled in Python)

If needed, convert the script to Python 3 or run using python2.

Cyber Security Training Lab Manual

50 | P a g e

Step 5: Run the Exploit

Use the script with your Metasploitable 2 IP:

#python vsftpd_2.3.4_exploit.py [Link] 21

Step 6: Observe the Results

If successful:

• You will get a shell prompt (#)

Cyber Security Training Lab Manual

51 | P a g e

• You can run commands like ls, whoami, uname -a

If unsuccessful:

• Check if port 6200 is open

• Or try exploiting via Metasploit as a fallback

Observation:

• The vulnerability opens a backdoor shell on port 6200

• This allows unauthorized remote command execution

• It demonstrates the danger of backdoored binaries

Conclusion:

This lab highlights how known exploits can compromise outdated services like vsftpd
2.3.4. It emphasizes the importance of regular patching, vulnerability scanning, and
monitoring public exploit databases.

Cyber Security Training Lab Manual

52 | P a g e

8. Lab Manual: Tbomb for SMS Spamming

Lab Title: Simulating SMS Bombing Using Tbomb (GitHub-Based Tool)

Objective:

To demonstrate how open-source tools like Tbomb can be used to flood a mobile
number with SMS messages, simulating a Denial-of-Service (DoS) style attack against
telecom APIs. This helps learners understand how such attacks occur and how to
defend against them.

Ethical & Legal Disclaimer:

This lab is intended only for educational use in a controlled environment. DO NOT
target real users or mobile numbers. Use either:

• A virtual mobile emulator (like Android Studio AVD), or

• A personal number with prior consent and limited test values.

SMS bombing is illegal if performed on real systems without authorization and can lead
to criminal charges.

Prerequisites:

• Kali Linux installed in VMware/VirtualBox

• Internet connectivity

• Access to terminal and Firefox browser

• Python 3 installed

Theory:

SMS Bombing is a form of attack where an automated script sends hundreds or

thousands of SMS messages to a target number, usually by abusing the OTP or
notification APIs of public platforms. The goal is to flood the device or disrupt
legitimate communication.

Tools like Tbomb aggregate API calls from multiple services to simulate this.

Cyber Security Training Lab Manual

53 | P a g e

Procedure:

Step 1: Log in to Kali Linux

• Username: kali

• Password: kali

Step 2: Search for Tbomb GitHub Repository

• Open Firefox

• Search:

Tbomb GitHub

• Click on the official repository (usually: [Link]

Step 3: Read Installation Instructions

• Scroll to the Installation section on the GitHub README.

• Locate the instructions for:

For Debian-based GNU/Linux distributions

Cyber Security Training Lab Manual

54 | P a g e

Step 4: Clone the Repository and Install

Open a terminal:

#cd Desktop

#git clone [Link]

#cd TBomb

Install dependencies and run the setup:

#chmod +x [Link]

#./[Link]

It will check for Python and required modules (requests, etc.).

Cyber Security Training Lab Manual

55 | P a g e

Step 5: Launch SMS Bombing Mode

After setup, you’ll be prompted with an option menu.

Enter:

Option 1 = SMS Bomber

Step 6: Input Required Details

Follow the prompts:

#Enter Country Code (e.g., 91 for India): 91

#Enter Target Phone Number: [TEST_NUMBER]

#Enter Time Interval (in seconds): 10

#Enter Number of Threads: 50

• Press Enter to begin bombing.

Cyber Security Training Lab Manual

56 | P a g e

Do not use a real or unauthorized number.

Cyber Security Training Lab Manual

57 | P a g e

Observation:

• The tool attempts to send multiple SMS requests via public APIs.

• You’ll see HTTP request logs or success messages.

• The actual delivery depends on the availability of abused APIs.

Conclusion:

This lab shows how open-source automation tools can be used for SMS flooding
attacks. It highlights the importance of rate-limiting, CAPTCHA, and OTP abuse
prevention in web and mobile application APIs.

Cyber Security Training Lab Manual

58 | P a g e

9. Lab Manual: Email Spoofing

Lab Title: Simulating Email Spoofing using a Web-Based Fake Email Service

Objective:

To understand how attackers can manipulate the “From” field in an email to spoof
identities using freely available online tools. This lab demonstrates social engineering
tactics used in phishing and impersonation attacks.

Ethical & Legal Disclaimer:

This lab is for educational purposes only. Email spoofing is illegal and unethical when
performed outside of a controlled lab environment or without consent. Do not send
spoofed emails to real people or systems. Use only temporary email services in this lab.

Prerequisites:

• Kali Linux, Windows, or any system with:

o Internet access

o Google Chrome or Firefox

• A temporary/disposable email provider (e.g., [Link], [Link])

• Awareness of social engineering threats

Theory:

Email spoofing is a technique used to forge the sender's identity in an email. This is
commonly used in phishing attacks to impersonate trusted individuals or services.
Tools like [Link] allow users to simulate spoofed emails without authentication,
exploiting SMTP weaknesses in older or misconfigured email systems.

Procedure:

Cyber Security Training Lab Manual

59 | P a g e

Step 1: Open Fake Email Sender Tool

• Open Chrome or Firefox.

• Navigate to:

[Link]

• This site provides a web form to craft and send spoofed emails.

Step 2: Open a Temporary Email Service

• In a new browser tab, go to:

[Link]

OR

[Link]

Cyber Security Training Lab Manual

60 | P a g e

• Copy the temporary email address shown.

Step 3: Fill the Spoof Email Form

On [Link], fill the following:

• To: Paste the temporary email address.

• From name: Any name you want to impersonate (e.g., "Bank Security")

• From email: A spoofed sender address (e.g., support@[Link])

• Subject: “Urgent Account Verification”

• Message: “Click this link to verify your account.” (no malicious links!)

Keep it simple and safe — no attachments, links, or scripts.

Cyber Security Training Lab Manual

61 | P a g e

Step 4: Send and Check Spoofed Email

• Click “Send” on [Link].

• Switch to the tab with your temp email inbox.

• Within seconds, you should see the spoofed email appear.

Cyber Security Training Lab Manual
62 | P a g e

• Observe the fake “From” email address and any headers (optional).

Observation:

• The spoofed email appears to come from a trusted address.

• The receiving mail server didn’t authenticate the sender.

• The spoofed email bypasses basic filters on some free email systems.

Conclusion:

This lab demonstrates how easy it is to spoof emails using free tools and weakly-
configured SMTP environments. Understanding this technique is critical for identifying
phishing threats and implementing SPF, DKIM, and DMARC protections on real mail
servers.

Cyber Security Training Lab Manual

63 | P a g e

Cyber Security Training Lab Manual