PRANVEER SINGH INSTITUTE OF TECHNOLOGY, KANPUR

DEPARTMENT OF DATA SCIENCE

Odd Semester 2025-26

B. Tech.- Fourth Year

Semester- VII

Lab File
Ethical Hacking Lab
(BCCS751)

Submitted To: Submitted By:

Faculty Name:_________________ Name :_________________
Designation:_________________ Roll No. :_________________
Section :_________________
 Table of Contents
• Vision and Mission Statements of the Institute
Vision and Mission Statements of the Department
•

• PEOs, POs, PSOs of the Department

• Course Objective and Outcomes

• List of Experiments

• Index
 Department Vision Statement
To be a recognized Department of Data Science that produces versatile computer engineers,
capable of adapting to the changing needs of computer and related industry.

Department Mission Statements

The mission of the Department of Data Science is: i. To provide broad based quality education with

knowledge and attitude to succeed in Data Science careers.

ii. To prepare students for emerging trends in computer and related industry.

iii. To develop competence in students by providing them skills and aptitude to foster culture of
continuous and lifelong learning.
iv. To develop practicing engineers who investigate research, design, and find workable solutions to
complex engineering problems with awareness & concern for society as well as environment.

Program Educational Objectives (PEOs)

i. The graduates will be efficient leading professionals with knowledge ofData Science discipline that
enables them to pursue higher education and/or successful careers in various domains.
ii. Graduates will possess capability of designing successful innovative solutions to real life
problems that are technically sound, economically viable and socially acceptable.
iii. Graduates will be competent team leaders, effective communicators and capable of working in
multidisciplinary teams following ethical values.
iv. The graduates will be capable of adapting to new technologies/tools and constantly upgrading
their knowledge and skills with an attitude for lifelong learning
 Department Program Outcomes (POs)
The students of Data Science Department will be able:

1. Engineering knowledge: Apply the knowledge of mathematics, science,data Science

fundamentals, and an engineering specialization to the solution of complex

engineering problems.

2. Problem analysis: Identify, formulate, review research literature, and analyze complex
engineering problems reaching substantiated conclusions using first principles of mathematics,
natural sciences, andData Science sciences.

3. Design/development of solutions: Design solutions for complex Computer Science &

Engineering problems and design system components or processes that meet the specified needs
with appropriate consideration for the public health and safety, and the cultural, societal, and
environmental considerations.
4. Investigation: Use research-based knowledge and research methods including design of
experiments, analysis and interpretation of data, and synthesis of the information to provide valid
conclusions.

5. Modern tool usage: Create, select, and apply appropriate techniques, resources, and modern
engineering and IT tools including prediction and modelling to complex Computer Science &
Engineering activities with an understanding of the limitations.

6. The Engineering and Society: Apply reasoning informed by the contextual knowledge to
assess societal, health, safety, legal and cultural issues and the consequent responsibilities relevant
to the professional engineering practice in the field of Data Science.

7. Environment and sustainability: Understand the impact of the professional Computer Science
& Engineering solutions in societal and environmental contexts, and demonstrate the knowledge
of, and need for sustainable development.

8. Ethics: Apply ethical principles and commit to professional ethics and responsibilities and
norms of theData Science practice.
9. Individual and team work: Function effectively as an individual, and as a member or leader in
diverse teams, and in multidisciplinary settings.
10. Communication: Communicate effectively on complex Data Science
activities with the engineering community and with society at large, such as, being able to
comprehend and write effective reports and design documentation, make effective presentations,
and give and receive clear instructions.
11. Project management and finance: Demonstrate knowledge and understanding of the Computer
Science & Engineering and management principles and apply these to one’s own work, as a
member and leader in a team, to manage projects and in multidisciplinary environments.
12. Life-long learning: Recognize the need for, and have the preparation and ability to engage in
independent and life-long learning in the broadest context of technological change.
 Department Program Specific Outcomes (PSOs)
The students will be able to:

1. Use algorithms, data structures/management, software design, concepts of programming

languages and computer organization and architecture.

2. Understand the processes that support the delivery and management of information systems
within a specific application environment.

Course Outcomes
*Level of Bloom’s Level to be
*Level of Bloom’s Taxonomy Level to be met
Taxonomy met
L1: Remember 1 L2: Understand 2
L3: Apply 3 L4: Analyse 4
L5: Evaluate 5 L6: Create 6

CO Number Course Outcomes

BCCS-751.1 Describe [ L2:Understand] basic network packet inspection and analyze
malicious traffic.
.
BCCS-751.2 Illustrate [ L3: Apply] various types of security infringement activities and
attacks using various security analysis tools.
 List of Experiments

S. No. Topic COs

Basic Packet Inspection: Capture network traffic using Wire shark
and analyse basic protocols like HTTP, DNS, and SMTP to
1 understand how data is transmitted and received CO2

Detecting Suspicious Activity: Analyse network traffic to identify

2 suspicious patterns, such as repeated connection attempts or CO3
unusual communication between hosts.
Malware Traffic Analysis: Analyse captured traffic to identify
3 signs of malware communication, such as command-and-control CO3
traffic or data infiltration.

Password Sniffing: Simulate a scenario where a password is

transmitted in plaintext. Use Wireshark to capture and analyze the
packets to demonstrate the vulnerability and the importance of
4 encryption. CO3
ARP Poisoning Attack: Set up an ARP poisoning attack using tools
like Ettercap. Analyze the captured packets to understand how the
5 attack can lead to a Man-in-the-Middle scenario. CO3

UNIX commands used by hackers/attackers such as

6 CO3
ls,cd,cat,grep

LINUX based commands used by ethical hackers netstat,

7 CO1
ifconfig,chmod/chown

8 How attackers can use crontab command to harm the system CO2

Linux Based tools used by rthical hackers for packet sniffing

9 CO3
and other network related attacks such as nmap,metasploit

Use the command used by ethical hackers or attackers such as

10 CO2
wget, rm,netcat and trace route
 INDEX
S Lab Experiment Date of Date of Marks Faculty
No Experiment Submission Signature
0

10
 Ethical Hacking Workshop

Introduction to Wireshark
Wireshark is a network packet analyzer. A network packet analyzer presents captured packet data in as
much detail as possible.
You could think of a network packet analyzer as a measuring device for examining what’s happening inside
a network cable, just like an electrician uses a voltmeter for examining what’s happening inside an electric
cable (but at a higher level, of course)

Downloading Steps:

1. Your first step is to head to the Wireshark download page and locate the Windows installer.

Once your file is downloaded, you can open the file from your Download folder.
2. You will be presented with the Wireshark wizard to guide you through the installation. Click
“Next.”

3. Next, you can review, agree to the license agreement, and click “Noted” to continue.
4. The next screen will ask if you want to donate to the Wireshark Foundation to help support
Wireshark and Sharkfest at [Link] Click “Next” when finished.
5. Next, you will be asked what components you want to install. You can make your choice and then
click “Next.”

6. The following screen will ask if you want to create any shortcuts and if you want to associate trace
file extensions with Wireshark (recommended).
 7. Now you must install Ncap (an open-source library for packet capture and network analysis). It’s a
library allowing Wireshark to capture and analyze network traffic effectively. It enhances Wireshark's
capabilities by providing optimized packet capture.
8. Wireshark will now begin the installation process.

Objective 1:
Basic Packet Inspection: Capture network traffic using Wire shark and analyze basic protocols like HTTP,
DNS, and SMTP to understand how data is transmitted and received.
Tool Used: Wireshark

Protocols used in different OSI Layers:

SENDER/ BROWSER RECEIVER/SERVER

Commands used for making Reference Table:
• Ipconfig /all (for getting informationoflocal host)
• arp -a (for getting MAC address of Gateway)
• ping [Link] for capturing httppackets
 1. Steps to Analyse HTTP protocol
Step 1: Open ether/wifi adapter in wireshark
Step2: Apply http filter as given below:
Step 3: Start Capturing
Step 4: open [Link] in the browser
Step 5: Analyse the TCP data (source port, destination port), source Mac, Destination Mac, Source Ip etc.
and compare it with the reference table
Step 6: check 3way handshaking befor establishing http connection by using the filter [Link]==56368*
Step 7: Now finally record the data for http header in the table given below:

2. Steps to analyse DNS protocol

DNS:
Command for cmd:
ipconfig /displaydns
ipconfig /flushdns

DNS observation
Step 1: Start capturing via Wireshark
Step 2: ping [Link] (command prompt)
Step 3: Apply dns protocol filter in wireshark
Step 4: Observe the data in the given table:

3. Stepto analyse SMTP protocol Step1:Start capturing via

Wireshark
Step2:Enable the telnet feature by usin windows feature service
Step3:telnet [Link] 25 (command prompt)
Helo sahil
quit
Commands to use:

Step 3: Apply smtp protocol filter in wireshark

Step 4: Observe the data in SMTP:

 Experiment 2

Objective : Detecting Suspicious Activity: Analyze network tra8ic to identify suspicious patterns,
such as repeated connection attempts or unusual communication between hosts.
Tool and Package Required:
Sec-sick [Link]

[Link]
Arp_poison.pcap

Step 1: Check the normal activity of di8erent protocol on the network by checking protocol
hierarchy and find the normal information being transferred under di8erent protocols susch as TCP
and UDP.
Protocol heirarchy:
Step 2: Open [Link] and observer the suspisious data being trasnferred in TCP
protocol and observe the path of the same.
Sec sick client:

Step 3: Load the other package “[Link]”- Spear Phishing attack and observe the line no 6 for
iframe attack

Line 6 I frame attack:

Step 4: Observe line 21 as some gif data is being transferred with unreadable language.
Line 21 :
Step 5: Check the TCP data by following TCP stream of the same and observe that the hacker is
trying to access the adming control by getting password and other credentials.

Line 25- TCP stream:

Step 6: Observe the suspicious activity by loading the package “ arp_poison.pcap” and check that
there is man in the middle attack is being happened in line no. 54, 55,56 and 57.
Experiment 3
Objective: Malware Traffic Analysis:Analyze capturedtraffic to identify signs of malware
communication, such as command-and-control traffic or data infiltration.
Package: [Link]
What are we looking for:

1. What are the infected file(s) downloaded and their hashes?

2. What is URL/ Domain of the infected site?

3. What is the IP address of the infected website?

4. What is the IP address of the infected machine ?

5. What is the hostname of the infected machine?

6. What is the mac address of the infected machine ?
To see only Get and Post Request : Filter --- → [Link]

To get the better understanding of destination: Right Click on host user HTTP

Now check Host Column

Sort column by Content type

We can save all suspicious files

We can directly upload the files to virus total but we avoid due to confidentiality, instead we
find the hash of file and then check for malicious activity.
Now, we checked the hash in virus total and found it infected.
2. What is URL/ Domain of the infected site?
Answer: see the host name of infected file.
[Link]

3. What is the IP address of the infected website?

[Link]

4. What is the IP address of the infected machine ?

[Link]

5. What is the hostname of the infected machine?

K34EN6W3N-PC

6. What is the mac address of the infected machine ?

f0:19:af:02:9b:f1

Host name using DHCP:

 1

EXPERIMENT 4
Objective 1: Simulate a scenario where a password is transmitted in plaintext. Use wire shark to capture and
analyze the packets to demonstrate the vulnerability and the importance of encryption.
Tool Used: Wireshark

Password Capturing/Sniffing
Wireshark can capture not only passwords but any type of information transmitted over the network: usernames,
email addresses, personal information, etc. As long as we can capture network traffic, Wireshark can sniff
passing passwords.
In sniffing can include passwords for various protocols such as HTTP, FTP, Telnet, etc. the captured data
can be used to troubleshoot network problems, but can also be used maliciously to gain unauthorized access
to sensitive information. So, here we will see how we can capture the password using the Wireshark network
capture analyzer. and
see the outputs of the following steps.
Step 1: First of all, open your Wireshark tool in your window or in Linux virtual machine. and start
capturing the network. suppose I am capturing my wireless fidelity.

Step 2: After starting the packet capturing we will go to the website and login the credential on that website
as you can see in the image.
 2

Step 3: Now after completing the login credential wewillgo and capture the password in Wireshark. for that we
have to use some filter that helps to find the logincredential through the packet capturing.
Step 4: Wireshark has captured some packets butwespecifically looking for HTTP packets. so in the
display filter bar we use some command to find allthecaptured HTTP packets. as you can see in the below
image the green bar where we apply the filter.

http
3

Step 5: So there are some HTTP packets are captured but we specifically looking for form data that the user
submitted to the website. for that, we have a separate filter
As we know that there are main two methods used for submitting form data from web pages like login forms
to the server. the methods are-
GET
POST
Step 6: So firstly for knowing the credential we use the first method and apply the filter for the GET
methods as you can see below.
[Link] == "GET"

GET method
As you can see in the image there are two packets where the login page was requested with a GET request as
well, but there is no form data submitted with a GET request.
Step 7: Now after checking the GET method if we didn’t find the form data, then we will try the POST
method for that we will apply the filter on Wireshark as you can see.
[Link] == "POST"
 4

As you can see we have a packet with form data clickon the packet with user info and the application URL
encoded. and click on the down-
HTML form URL Encoded where the login credentialis found. login credential as it is the same that we
filed on the website in step 2.
Form item: "uname" = "Tonystark_44"
Form item: "pass" = "tony@1234"
 Experiment 5

Objective: ARP Poisoning Attack: Set up an ARP poisoning attack using tools like Ettercap. Analyze
the captured packets to understand how the attack can lead to a Man-in-the-Middle scenario.
Install Virtual Box Manager on Windows

Install Kali Linux through Virtual Box

Choose Installer Image

Start Kali Linux:
Open Terminal and write command: ip add

Copy MAC address from above and run command in wireshark @kali

We observe: No traffic is being captured

Aim is to capture the traffic between Target and default gate way on same line.
So we go to Target Device (Windows) and find IP address and default gateway.
IPv4 Address. . . . . . . . . . . : [Link]
Default Gateway . . . . . . . . . : [Link]
We are going to sniff traffic once we enable ARP poising using Tool Ettercap

OR

Click on three dots and scan for hosts

Select Ip Address and Add to Target 1
Select Default Gateway and Add to Target 2

Still Nothing is capturing

Select Current Targets

Click ARP Poisoning and start sniffing

Now we can see, packets are being captured

Open Wireshark on target Machine and check ARP Poisoning

 Experiment 6

Objective:- To be able to find important file, sub directory looking , find sensitive information and
searching for classified information on the Unix server.

ls: Lists directory contents, often used with flags like –a discover hidden files.
cd: Changes the current directory to navigate the file system.
cat: Concatenates and displays file contents, often used to view sensitive files like /etc/passwd or
/etc/shadow
grep: Searches for specific patterns within files, useful for extracting information like passwords from
large log files or configuration files.
 Experiment 7

Objective:- Use of command by hackers to change ownership and permission of the file, to find the
ip address of the system and network status.

Theory:
netstat / ifconfig: Used for network discovery to identify open ports, active connections, and
network interface information.
chmod / chown: Commands used to change file permissions and ownership. Attackers might use
chmod to make a malicious script executable or chown to gain control over critical files.
 Experiment 8

Objective:- Hot persistent access hackers run malicious code periodically. Used to schedule tasks.
Attackers can create persistent access by adding a malicious script to run periodically via a cron job.
Crontab is a utility in Unix-like operation systems used to schedule commands or scripts to runn
automatically at specified intervals. The syntax of a crontab entry consists of five time-and-date
fields followed by the command to be executed.

Crontab Syntax: MIN HOUR DOM MON DOW COMMAND MIN(Minute): 0-59 HOUR(Hour): 0-23

DOM(Day of Month): 1-31 MON(Month): 1-12(or JAN-DEC) DOW(Day of Week):0-7(0 and 7 are

both Sunday, 1 is Monday, etc. ,or SUN-SAT) COMMAND: The command or script to be executed.
 Experiment 9

Objective: Use Linux Based tools to sniff data packets, network protocol used and other network related
information
Theory:
1. Packet Sniffing
Packet sniffing is the process of monitoring and capturing data packets traversing a network.
Promiscuous Mode: For a sniffer to work, the Network Interface Card (NIC) must be set to
"Promiscuous Mode." This forces the NIC to accept all traffic on the network segment, not just packets
addressed to its own MAC address.
Types:
Passive Sniffing: Listening without altering traffic (common in Hub networks).
Active Sniffing: injecting traffic (e.g., ARP Spoofing) to redirect packets through the attacker's
machine (required in Switch networks).

2. Network Protocol Analysis

Ethical hackers analyze protocols to understand traffic flow and identify security gaps.
TCP/IP: Analyzed to check connection states (SYN/ACK flags) and detect scanning attempts.
Clear-Text Protocols: Protocols like HTTP, FTP, and Telnet are targeted because they transmit credentials
without encryption.

3. Tool Descriptions
A. Tcpdump
Tcpdump is a lightweight, command-line packet analyzer based on the libpcap library. It captures raw packets
and is essential for low-level analysis. It allows users to filter traffic by IP, port, or protocol to inspect packet
headers for anomalies or handshake failures.
B. Nmap (Network Mapper)
Nmap is the standard tool for network discovery and security auditing. It sends specially crafted packets to:
Discover Hosts: Identify live devices on the network.
Scan Ports: Enumerate open ports to define the attack surface.
Service & OS Detection: Determine running application versions and the target Operating System
(Fingerprinting).
C. Metasploit Framework
While primarily an exploitation tool, Metasploit contains Auxiliary Modules specifically for reconnaissance.
It is used to scan for specific services (like SMB or SSH), enumerate users, and check for known
vulnerabilities in discovered protocols without executing a full exploit.

Conclusion
In this experiment, we studied the mechanism of packet sniffing and the importance of Promiscuous mode.
We learned that Tcpdump provides deep visibility into packet structures, while Nmap and Metasploit are
essential for active network mapping and service enumeration, forming the basis of network security
auditing.
 Experiment 10

Objective: Downloading of file on internet, deleting files and directories and finding what route data packet
takes to reach to it’s destination( commonly used by attackers/ethical hackers).
Theory:

1. Network Reconnaissance
Reconnaissance is the first phase of ethical hacking, where the attacker gathers information about the target network
structure.
Traceroute:
Description: A network diagnostic tool that displays the path (hops) and transit delays of packets across an
Internet Protocol (IP) network.
Theoretical Utility: It works by sending a sequence of packets (ICMP or UDP) with gradually increasing Time-
To-Live (TTL) values. As each router discards the packet when the TTL hits zero, it sends back an error
message, allowing the sender to identify the router. Ethical hackers use this to map the network topology and
identify firewalls or security gateways between them and the target.

2. Data Transfer and Connectivity (Living off the Land)

Hackers often use standard system tools to move data or establish connections to avoid detection by antivirus software.
Wget (World Wide Web Get):
Description: A free utility for non-interactive downloading of files from the web. It supports HTTP, HTTPS,
and FTP protocols.
Theoretical Utility: Since wget is pre-installed on most Linux systems, attackers use it to download malicious
scripts, exploits, or backdoors from a remote server onto the victim machine without needing a GUI (headless
operation).
Netcat (nc):
Description: Known as the "Swiss Army Knife" of networking, Netcat reads and writes data across network
connections using TCP or UDP.
Theoretical Utility: It is a versatile tool used for:
Port Scanning: Identifying open ports.
File Transfer: Moving data between machines.
Backdoors: Setting up "Reverse Shells" (where the victim connects back to the attacker) or "Bind Shells"
(opening a port on the victim for the attacker to connect to).

3. Anti-Forensics
The final phase of an attack often involves removing evidence to prevent tracing.
rm (Remove):
Description: The standard command used to delete files and directories in Unix-like operating systems.
Theoretical Utility: In a security context, this is used for "Covering Tracks." After an attacker has successfully
exploited a system and gathered data, they use rm to delete the exploit scripts, temporary files, and sometimes
log files (though specific log-wiping tools are preferred) to hinder forensic analysis.