ETHICAL

HACKING
 Protection of Websites

Website protection involves

implementing security measures to
prevent cyber threats such as hacking,
data breaches, and malware infections.
One of the primary ways to secure a
website is through HTTPS , which
ensures data transmitted between the
server and the user remains encrypted.
Websites should also have Web
Application Firewalls (WAF) to filter and
block malicious traffic
 Protection of Websites
Key Measures for Website Protection:

1. HTTPS and SSL/TLS Encryption: HTTPS (HyperText Transfer Protocol Secure) encrypts
communication between a web server and a user's browser using SSL/TLS certificates.

● Why it’s important: It prevents attackers from intercepting sensitive data such as passwords, credit card
details, and personal information.

● Example: A banking website ensures all transactions are encrypted with HTTPS, making it difficult for
hackers to steal login credentials.

2. Web Application Firewall (WAF): What it is: A WAF is a security solution that monitors and filters
HTTP/HTTPS traffic to protect web applications from attacks such as SQL injection, cross-site scripting
(XSS), and distributed denial-of-service (DDoS) attacks.

● Why it’s important: It acts as a barrier between the website and malicious users.

● Example: An e-commerce website uses a WAF to detect and block malicious scripts trying to exploit
security vulnerabilities.
Feature HTTP HTTPS WAF (Web Application
Firewall)
Definition Protocol for transferring Secure version of HTTP Security system that
web data with encryption protects websites from
attacks
Security 🚫 Not secure (data is in 🔐 Secure (encrypts data Blocks malicious traffic
plain text) using SSL/TLS) and cyberattacks
Encryption ❌ No encryption ✅ Uses SSL/TLS for 🚫 Does not encrypt but
encryption monitors traffic
Data Protection ⚠️Data can be intercepted ✅ Data is protected from ✅ Protects websites from
hackers cyber threats
Browser Indication No padlock ([Link] 🔒 Padlock ([Link] No direct browser
indication (works in the
background)
Example [Link] 🔒[Link] Cloudflare WAF, AWS
WAF)
Usage Used for general websites Used for secure transactions Used to protect web
(non-secure) (banking, e-commerce) applications from cyber
attacks
 Protection of Websites

3. Secure Authentication and Authorization: What it is: Implementing strong authentication

mechanisms such as multi-factor authentication (MFA) and secure password policies.

● Why it’s important: It reduces the risk of unauthorized access.

● Example: A social media platform enforces MFA, requiring users to enter a one-time password (OTP) in
addition to their login credentials.

4. Regular Security Updates and Patch Management: What it is: Keeping software, plugins, and
content management systems (CMS) updated to patch known vulnerabilities.

● Why it’s important: Cybercriminals exploit outdated software to inject malware or gain unauthorized
access.

● Example: A company updates its WordPress CMS and plugins to prevent vulnerabilities from being
exploited by hackers.
 Intrusion Detection System (IDS)
An Intrusion Detection System (IDS) is a security mechanism that monitors network traffic and system
activities for suspicious behavior. It helps detect security threats before they cause harm. IDS can be
broadly classified into:
● Network-based Intrusion Detection System (NIDS)
● Host-based Intrusion Detection System (HIDS)

How IDS Works:

1. Data Collection: Captures network packets or system logs.

2. Signature-Based Detection: Compares activities with known attack patterns.
3. Anomaly-Based Detection: Detects unusual behavior based on predefined rules.
4. Alerts & Responses: Sends alerts to administrators when suspicious activities are detected.

Example: An IDS identifies multiple failed login attempts from an unfamiliar IP address, suggesting a
brute-force attack and notifying the security team.
 Network-based Intrusion Detection System
A (NIDS)
Network-based Intrusion Detection System (NIDS) is installed at key points within a network to
monitor traffic and detect malicious activities.

Features of NIDS:
● Monitors real-time network traffic
● Detects external threats before reaching endpoints
● Analyzes packet headers and payloads for malicious content
Advantages of NIDS:
● Detects attacks at an early stage before they reach individual systems.
● Provides network-wide visibility of security threats.
● Can detect large-scale attacks such as DDoS and port scanning.
 Network-based Intrusion Detection System
(NIDS)
Limitations of NIDS:
● Cannot detect encrypted malicious traffic.
● May generate false positives due to high network activity.
● Ineffective against internal threats or attacks originating from inside the network.
Example of NIDS:
● A company deploys Snort (an open-source NIDS) at its network gateway to detect malicious traffic
patterns, such as port scanning attempts by attackers.
 Host-based Intrusion Detection System
(HIDS)
A Host-based Intrusion Detection System (HIDS) is installed on individual devices (servers, workstations)
to monitor system logs, configurations, and file integrity.

Features of HIDS:
● Monitors system-level activities such as file modifications, registry changes, and user activity.
● Detects malware infections, insider threats, and unauthorized access.
● Works closely with antivirus and endpoint protection solutions.

Advantages of HIDS:
● Detects attacks that bypass network defenses.
● Provides detailed logs of system activities.
● Can identify rootkits and file tampering.
 Host-based Intrusion Detection System
(HIDS)
Limitations of HIDS:
● Cannot monitor network-wide activity like NIDS.
● May consume system resources (CPU and memory), affecting performance.
● Can be disabled by advanced malware or attackers.

Example of HIDS:
● A HIDS like OSSEC is deployed on a database server to detect unauthorized modifications to critical
system files and alert administrators if changes occur.
Comparison of NIDS and HIDS

Feature NIDS (Network-based IDS) HIDS (Host-based IDS)

Deployment Location Network Gateway or Individual Hosts (Servers,

Firewall Workstations)
Detection Focus Network traffic monitoring System logs, files, and
processes
Threats Detected External attacks (DDoS, port Internal threats, malware,
scanning) file tampering
Visibility Network-wide Specific host/system

Example Tool Snort, Suricata OSSEC, Tripwire

Performance Impact Minimal Higher (depends on

system load)
 Basic Computer Network Protocols
A computer network protocol is a set of rules that defines how data is transmitted and received across
networks. These protocols ensure smooth communication between devices, regardless of their underlying
hardware and software. They cover aspects such as data formatting, error handling, and security.

Types of Network Protocols: Network protocols are classified into different categories based on their function,
such as:

● Communication Protocols (e.g., TCP(Transmission Control Protocol), UDP(User Datagram Protocol),

HTTP(Hypertext Transfer Protocol))
● Network Management Protocols (e.g., SNMP(Simple Network Management Protocol), ICMP(Internet
Control Message Protocol))
● Security Protocols (e.g., SSL/ TLS(Secure Socket Layer/Transport Layer Security), IPSec(Internet
Protocol Security))
● Routing Protocols (e.g., OSPF(Open Shortest Path First), BGP(Border Gateway Protocol))
 Common Network Protocols and Their Functions
1. Transmission Control Protocol (TCP):

● Function: TCP is a reliable, connection-oriented protocol that ensures data is delivered accurately and in
the correct order.
● How it Works: It breaks data into packets, numbers them, and ensures they are reassembled correctly at
the destination. If packets are lost, TCP retransmits them.
● Example: When you download a file from the internet, TCP ensures all parts of the file are received in the
correct order.

2. User Datagram Protocol (UDP):

● Function: UDP is a fast, connectionless protocol that sends data without establishing a prior connection. It
does not guarantee delivery, making it suitable for real-time applications.
● How it Works: Data is sent as independent packets, and if any are lost, they are not retransmitted.
● Example: Online video streaming and VoIP calls use UDP to avoid delays caused by retransmission.
 Common Network Protocols and Their
Functions
3. Internet Protocol (IP):

● Function: IP is responsible for addressing and routing packets across networks. It assigns unique IP
addresses to devices to ensure proper delivery of data.
● Versions:

IPv4: Uses a 32-bit address (e.g., [Link]).

IPv6: Uses a 128-bit address (e.g., 2001:db8::ff00:42:8329) to support more devices.

● Example: When you access a website, IP routes data from your computer to the web server using its IP
address.

4. File Transfer Protocol (FTP):

● Function: FTP is used to transfer files between computers on a network. It requires a client-server
connection and supports authentication.
● Example: Web developers use FTP to upload website files to a web server.
 Common Network Protocols and Their
Functions
5. HyperText Transfer Protocol (HTTP) & HTTPS:

● Function: HTTP is used for transmitting web pages over the internet. HTTPS is a secure version that
encrypts data using SSL/TLS.
● How it Works: A client (browser) requests a web page from a server using HTTP, and the server responds
with the requested content.
● Example: When you browse a website, your browser sends an HTTP/HTTPS request to fetch the
webpage.

6. Simple Mail Transfer Protocol (SMTP) & Post Office Protocol (POP3)/IMAP:

● Function: SMTP is used for sending emails, while POP3 and IMAP are used for retrieving emails. IMAP
allows accessing emails from multiple devices.
● Example: When you send an email, SMTP forwards it to the recipient’s mail server.
 Common Network Protocols and Their
Functions
6. Domain Name System (DNS):

● Function: DNS translates domain names (e.g., [Link]) into IP addresses, allowing users to
access websites without memorizing numeric addresses.
● Example: When you type "[Link]" into your browser, DNS resolves it to its IP address,
enabling connection to the correct server.

7. Secure Shell (SSH):

● Function: SSH provides secure remote access to networked devices using encryption.
● Example: System administrators use SSH to manage servers remotely.
 TCP/IP Model
The TCP/IP model is the foundation of modern networking. It defines how data is transmitted across networks
using a four-layer architecture.

Layer Function Key Protocols

Application Layer Provides network services to HTTP, HTTPS, FTP, DNS,

end-users SMTP

Transport Layer Ensures reliable or fast data TCP, UDP

delivery

Internet Layer Handles addressing and IP, ICMP, ARP

routing

Network Access Layer Manages physical data Ethernet, Wi-Fi

transmission
 Layers of TCP/IP Model
1. Application Layer:

● Purpose: Provides services that allow users to interact with the network.
● Key Protocols: HTTP, HTTPS, FTP, SMTP, DNS.
● Example: When you send an email, the SMTP protocol operates at this layer to transmit the message.

2. Transport Layer:

● Purpose: Ensures reliable or fast delivery of data.

● Key Protocols:

○ TCP: Reliable, error-checked communication.

○ UDP: Fast but unreliable data transfer.

● Example: A video call uses UDP to ensure real-time communication without delays.
 Layers of TCP/IP Model
3. Internet Layer:

● Purpose: Handles addressing and routing of data packets.

● Key Protocols: IP (IPv4 & IPv6), ICMP (used for error reporting, e.g., ping command).
● Example: When accessing a website, IP ensures your request is routed to the correct server.

4. Network Access Layer:

● Purpose: Controls hardware connections and physical data transmission.

● Key Protocols: Ethernet, Wi-Fi.
● Example: Your laptop connects to a Wi-Fi network using this layer.
 TCP/IP Model vs. OSI Model
The OSI model (Open Systems Interconnection) is another networking model with seven layers, whereas the
TCP/IP model has four layers.
OSI Model TCP/IP Model Function
Application Application Provides services (e.g., HTTP,
FTP)
Presentation Merged into Application Formats and encrypts data
Session Merged into Application Manages sessions between devices

Transport Transport Ensures data delivery (TCP, UDP)

Network Internet Handles routing (IP, ICMP)

Data Link Network Access Defines physical transmission
methods
Physical Network Access Deals with network hardware
 Importance of TCP/IP Model
Importance of TCP/IP Model:

● Standardization: Provides a universal framework for data communication.

● Scalability: Supports large-scale networks like the internet.
● Interoperability: Allows different devices and networks to communicate.

Example of TCP/IP in Action:

● You type "[Link]" in your browser.

● DNS (Application Layer) translates the domain name to an IP address.
● TCP (Transport Layer) ensures reliable connection to the server.
● IP (Internet Layer) routes data packets to Google’s servers.
● Ethernet/Wi-Fi (Network Access Layer) transmits data over the internet.
● Google’s server responds, and the webpage loads on your browser.
 Firewalls and Their Types
Firewalls are security mechanisms designed to monitor, filter, and control incoming and outgoing network
traffic based on predefined security rules. They act as a barrier between a trusted internal network and untrusted
external networks, such as the internet. Firewalls help prevent unauthorized access, mitigate cyber threats, and
enhance overall network security.

Firewalls can be categorized based on their functionality and implementation, such as:

● Packet filter firewalls

● Packet inspection firewalls
● Application proxy firewalls
● Hardware firewalls
● Software firewalls.
 Firewalls and Their Types
Packet Filter Firewalls:

Packet filter firewalls operate at the network layer (Layer 3) and transport layer (Layer 4) of the OSI model.
They examine each packet's header information, including source and destination IP addresses, port numbers,
and protocol types, to determine whether to allow or block traffic based on a set of rules. Packet filtering is a
basic yet efficient technique, but it does not inspect the actual data content of packets, making it vulnerable to
sophisticated attacks like IP spoofing and fragmented packet-based exploits.
Examples of packet filter firewalls include simple Access Control Lists (ACLs) in routers and basic firewall
implementations in operating systems.
Firewalls and Their Types

Packet Inspection Firewalls:

Packet inspection firewalls, also known as stateful inspection firewalls, enhance traditional packet filtering
by monitoring the state of active connections. They track the state and context of network traffic, ensuring
that only legitimate packets that belong to an established session are allowed through. These firewalls
analyze not only packet headers but also some of the payload content to detect malicious patterns. Since they
maintain a session table to track active connections, they provide better security than basic packet filters.
However, they require more processing power, which may impact network performance under heavy traffic
loads.
 Firewalls and Their Types
Application Proxy Firewalls:

Application proxy firewalls, also called application-level gateways, operate at the application layer (Layer 7)
of the OSI model. Instead of allowing direct communication between the client and the server, these firewalls
act as intermediaries, inspecting and filtering traffic at a more granular level. They analyze application-specific
data, such as HTTP, FTP, and SMTP traffic, to detect malicious payloads, enforce security policies, and prevent
common cyber threats like malware and phishing. Since they perform deep inspection, they provide a high
level of security but may introduce latency due to processing overhead.
Examples of application proxy firewalls include Squid Proxy and Microsoft Forefront TMG.
Firewalls and Their Types

Hardware Firewalls:

Hardware firewalls are physical devices placed between a network and an external connection, such as the
internet. These firewalls are commonly used in enterprises and data centers to protect entire networks from
external threats. They offer high-performance traffic filtering, intrusion prevention, and VPN capabilities.
Hardware firewalls typically operate as dedicated appliances with specialized firmware and are managed via
web-based interfaces or command-line tools. Since they are standalone devices, they provide robust security
with minimal impact on the performance of individual systems.
Examples of hardware firewalls include Cisco ASA, FortiGate, and Palo Alto Networks firewalls.
 Firewalls and Their Types

Software Firewalls:

Software firewalls are installed on individual devices, such as computers and servers, to provide endpoint
protection. They filter network traffic based on predefined rules and allow users to configure security settings
according to their needs. Software firewalls can be host-based or integrated into security suites that offer
additional features like antivirus, intrusion detection, and application control. While they provide flexibility
and user-specific protection, they consume system resources and may require regular updates to stay effective
against emerging threats.
Examples of software firewalls include Windows Defender Firewall, ZoneAlarm, and Norton Internet Security.
 Introduction to VMware and
Virtualization
VMware is a powerful virtualization software that allows users to create and manage virtual machines (VMs)
on a single physical computer. Virtualization enables multiple operating systems to run simultaneously on the
same hardware, making it ideal for cybersecurity training, testing new software, and simulating network
environments. VMware Workstation (for Windows/Linux) and VMware Fusion (for macOS) are commonly
used virtualization tools for personal and academic use. Virtual machines (VMs) provide an isolated
environment where students can safely perform forensic investigations, penetration testing, and system
analysis without risking the stability of their primary system.
 Creating a Virtual Machine in VMware
1. Installing VMware: Download and install VMware Workstation or VMware Fusion from the official VMware
website. Ensure that system requirements are met for smooth operation. Go to the VMware website and
download the appropriate version of VMware Workstation for your operating system. VMware Workstation
Player is free for non-commercial use, while VMware Workstation Pro offers more features and requires a
license.
 Creating a Virtual Machine in VMware
2. Launch VMware Workstation: Once installed, open VMware Workstation. You'll be greeted with
the main interface where you can create and manage your virtual machines
 Creating a Virtual Machine in VMware

3. Creating a New Virtual Machine: Open VMware and select “Create a New Virtual Machine.” from
the Home tab or select “File” > “New Virtual Machine”. Choose the Configuration Type:
 Creating a Virtual Machine in VMware

You’ll be prompted to choose between "Typical (recommended)" and "Custom (advanced)". For beginners,
the Typical option is recommended. Select the Installation Media:

You have three options here:

Installer disc: Insert a physical installation disc.

Installer disc image file (ISO): Browse to the location of an ISO file.

I will install the operating system later: This option allows you to create a blank VM and install the OS later.

Select the appropriate option and click “Next”.

Select the Guest Operating System:

Creating a Virtual Machine in VMware
Creating a Virtual Machine in VMware
Creating a Virtual Machine in VMware
Creating a Virtual Machine in VMware
 Creating a Virtual Machine in VMware
Choose the type of operating system you plan to install (e.g., Windows, Linux) and the specific version. Click
“Next”. Define name of the Virtual Machine:
 Creating a Virtual Machine in VMware
Give your VM a name and choose the location where the VM files will be stored. Click “Next”.
Specify Disk Capacity:
 Creating a Virtual Machine in VMware
Decide how much disk space to allocate to the VM. You can also choose whether to store the virtual disk as a
single file or split it into multiple files. Click “Next”.
Customize Hardware (optional):
 Creating a Virtual Machine in VMware
Before finishing, you can customize the hardware settings such as memory, processors, network adapters, and
more by clicking on “Customize Hardware…”.
Adjust the settings according to your needs and click “Close”.
Finish the Wizard:
Review your settings and click “Finish” to create the VM.
Creating a Virtual Machine in VMware
Creating a Virtual Machine in VMware
Creating a Virtual Machine in VMware
 Creating a Virtual Machine in VMware
4. Install the Operating System
Power on the VM:
Select your new VM from the library and click “Power on this virtual machine”. Follow the OS Installation
Process:
 Creating a Virtual Machine in VMware
The VM will boot from the installation media you provided.
Follow the on-screen instructions to install the operating system. Install VMware Tools:
Creating a Virtual Machine in VMware
Creating a Virtual Machine in VMware
Creating a Virtual Machine in VMware
Creating a Virtual Machine in VMware
Creating a Virtual Machine in VMware
Creating a Virtual Machine in VMware
Creating a Virtual Machine in VMware
Creating a Virtual Machine in VMware
Creating a Virtual Machine in VMware
Creating a Virtual Machine in VMware
Once the OS is installed, it's recommended to install VMware Tools.
VMware Tools enhance the performance of the VM and improve the integration between the host and guest
operating systems.
● To install VMware Tools, go to the VM menu and select “Install VMware Tools”.
Creating a Virtual Machine in VMware
 Creating a Virtual Machine in VMware
5. Configure Your Virtual Machine:

After installing the operating system and VMware Tools, you can further configure your VM:

Adjust Hardware Settings: If needed, adjust the hardware settings by right-clicking on the VM and selecting
“Settings”.

Set up Networking: Configure network settings to ensure your VM can access the internet or communicate
with other machines on your network.

Create Snapshots: Snapshots allow you to save the state of your VM at a particular point in time.

You can create a snapshot by going to the VM menu and selecting “Snapshot” > “Take Snapshot”.
Creating a Virtual Machine in VMware
 Installing Windows 7 in VMware
1. Create a new virtual machine. Once you open VMware Workstation, click "Create a New Virtual
Machine".
 Installing Windows 7 in VMware
2. Select type of configuration. You will see a New Virtual Machine Wizard dialog box. There are two
options which are Typical and Custom. Keep the default and click "Next" button.
Installing Windows 7 in VMware
3. Choose "Installer disc image file". This type matches the iso file you download. Click "Browse" to
locate your Windows 7 iso file. Then, click "Next".
 Installing Windows 7 in VMware
4. Select the version of Windows to install. The version depends on the iso file you download. You can
set your product key and personalize Windows later. Click "Next" button to continue.
 Installing Windows 7 in VMware

5. Wait for the dialog to pop up. If you do not enter the Windows product key, click "Yes" to continue.
 Installing Windows 7 in VMware
6. Name the virtual machine. Change the name and location if you want. Click "Browse" to modify the
path. Then, click "Next".
 Installing Windows 7 in VMware
7. Specify Disk Capacity. Click the arrow button to change the maximum size of virtual machine's hard
disk. You can also choose store as one or more files on host computer. Click "Next" button to continue.
Installing Windows 7 in VMware
8. Confirm the setting. This step lists the settings the virtual machine will create. Click "Customize
Hardware" button to change any of the details.
 Installing Windows 7 in VMware
9. Change Memory. If you want to change the memory of the virtual machine, select the arrow button or
drag the slider tab. Click "Close" to go back to the last dialog box.
Installing Windows 7 in VMware
10. Create the new virtual machine. After confirming that the settings are all accurate, click the "Finish“
button to start the process.
Installing Kali Linux in VMware
Section 1: Configure Kali Linux ISO File on Vmware
Step 1: Browse to the Official Kali Linux Page.. Click on the Download Symbol to get the ISO File.
Installing Kali Linux in VMware
Step 2: Open the VMware & select the option Create New Virtual Machine.
Installing Kali Linux in VMware
Step 3: Upload the ISO File & Select Next.
Installing Kali Linux in VMware
Step 4: Provide the Virtual Machine OS Name & select Next.
Installing Kali Linux in VMware
Step 5: It is time to set the Disk Size of the Virtual Machine. It will be better to click on the Next without
making any changes.
Installing Kali Linux in VMware
Step 6: Click on Finish to save the changes.
 Installing Kali Linux in VMware
Section 2: Install Kali Linux in VMware

Step 1: Click on the option Play Virtual Machine.

Installing Kali Linux in VMware
Step 2: Click on the Install Button.
Installing Kali Linux in VMware
Step 3: After selecting Language & Country, provide Username & Password. Click Continue to move
ahead.
 Installing Kali Linux in VMware
Step 4: At last, the Installation of Kali Linux will be completed. Click on Continue to go through the System
Reboot to start the OS.
Practical Applications in Cybersecurity and
Forensics
By setting up Windows 7 and Kali Linux in VMware, students gain hands-on experience with system
administration, forensic analysis, and penetration testing techniques. Some practical exercises include:

1. Forensic Analysis in Windows 7:

● Recovering deleted files using forensic tools like FTK Imager and Autopsy.
● Analyzing Windows registry and event logs for evidence collection.
● Identifying malware activity using memory forensics tools like Volatility.

2. Penetration Testing with Kali Linux:

● Scanning networks using Nmap and Zenmap.

● Exploiting vulnerabilities with Metasploit Framework.
● Cracking passwords using John the Ripper and Hashcat.
● Conducting Wi-Fi security testing using Aircrack-ng.
 Windows Hacking Using Metasploit
Metasploit is one of the most powerful and widely used penetration testing frameworks, designed to help
cybersecurity professionals identify, exploit, and mitigate vulnerabilities in systems. It provides a robust
platform for conducting ethical hacking, penetration testing, and security assessments. Windows hacking using
Metasploit involves exploiting vulnerabilities in Windows operating systems to gain unauthorized access,
execute payloads, and demonstrate security risks. Ethical hackers and security researchers use Metasploit to
assess system security, simulate attacks, and develop countermeasures against real-world cyber threats.

Introduction to Metasploit Framework

The Metasploit Framework (MSF) is an open-source tool that provides a vast library of exploits, payloads, and
auxiliary modules for penetration testing. It is available in different versions, including:
● Metasploit Framework (MSF) – A free command-line tool for penetration testing.
● Metasploit Pro – A commercial version with a graphical interface and additional automation features for
enterprise security assessments.
Metasploit simplifies the hacking process by automating vulnerability discovery, exploitation, and post-
exploitation tasks. It supports multiple attack vectors, including remote code execution, privilege
escalation, and credential harvesting, making it a valuable tool for testing Windows security.
Windows Hacking Using Metasploit
Setting Up Metasploit for Windows Hacking:

To begin Windows hacking using Metasploit, follow these steps:

1. Installing Metasploit:

● Metasploit comes pre-installed in Kali Linux, but it can also be installed on Windows or Linux-based
systems.
● Start Metasploit by running:
 Windows Hacking Using Metasploit
2. Gathering Target Information:

● Use reconnaissance tools like Nmap to scan the target Windows machine for open ports and services:

● Identify vulnerabilities using Metasploit auxiliary scanners:

 Windows Hacking Using Metasploit
Exploiting Windows Vulnerabilities with Metasploit: Once the target system's details are gathered, the next
step is exploiting vulnerabilities. Some common Windows exploits include:

1. Exploiting SMB Vulnerabilities (EternalBlue - MS17-010): EternalBlue is a well-known exploit

targeting Windows SMBv1, used in the WannaCry ransomware attack. It allows remote attackers to
execute arbitrary code on a vulnerable Windows machine.

● Load the EternalBlue exploit module:

● Once exploited, a Meterpreter session opens, allowing remote control over the target system.
 Windows Hacking Using Metasploit
2. Exploiting Windows Remote Desktop Protocol (RDP) Vulnerabilities: If a Windows system has
Remote Desktop Protocol (RDP) enabled, attackers can attempt brute-force attacks or exploit weak RDP
configurations.

● Use an RDP exploit module:

 Windows Hacking Using Metasploit

● If vulnerable, launch the exploit:

 Windows Hacking Using Metasploit

Post-Exploitation with Metasploit: After successfully gaining access to a Windows system, Metasploit provides
post-exploitation features to maintain access, gather information, and escalate privileges.

1. Gaining System Privileges: Once inside the system, elevate privileges to gain full control:

If successful, the attacker obtains NT AUTHORITY\SYSTEM access, the highest privilege level in Windows.
 Windows Hacking Using Metasploit
2. Extracting Password Hashes: Retrieve stored password hashes for further attacks:

The extracted hashes can be cracked using tools like John the Ripper or Hashcat.

3. Enabling a Persistent Backdoor: To maintain access even after a reboot, use a persistent backdoor:

This ensures that the system remains compromised.

 Defending Against Metasploit Attacks
While Metasploit is a powerful tool for ethical hacking, organizations must implement strong security
measures to defend against similar attacks:

1. Patch Vulnerabilities: Regularly update Windows systems to fix known exploits like EternalBlue and
BlueKeep.

2. Disable Unused Services: Turn off SMBv1 and restrict RDP access to prevent unauthorized remote
access.

3. Use Strong Passwords: Implement multi-factor authentication (MFA) and complex passwords to prevent
brute-force attacks.

4. Monitor Network Activity: Deploy intrusion detection systems (IDS) and firewall rules to detect
malicious traffic.

5. Regular Security Audits: Conduct penetration testing and vulnerability assessments to identify and
mitigate security weaknesses.
Windows Hacking Using Metasploit
Windows hacking using Metasploit demonstrates how attackers exploit system vulnerabilities to gain
unauthorized access. By understanding Metasploit’s capabilities, cybersecurity professionals can better
defend against real-world threats. Ethical hacking and penetration testing with Metasploit allow security
teams to proactively identify and fix security gaps, ensuring that Windows systems remain protected
against cyberattacks.
Password Hacking: John the Ripper, Hydra, and
Medusa
Password hacking is a critical aspect of ethical hacking and penetration testing. It involves testing password
security to identify weak credentials and improve authentication mechanisms. Various tools are used for
password cracking, including John the Ripper (JtR), Hydra, and Medusa. These tools employ different
techniques like brute-force attacks, dictionary attacks, and hybrid attacks to crack passwords. Ethical hackers
and security professionals use them to assess password strength and recommend better security measures.

1. John the Ripper (JtR)

Introduction

John the Ripper (JtR) is a widely used open-source password cracking tool designed for auditing password
security. It supports multiple password hash formats, including Linux shadow files, Windows NTLM, MD5,
SHA-256, and more. It works by attempting to guess passwords using dictionary attacks and brute-force
methods.
 Password Hacking: John the Ripper
Installing John the Ripper
● John the Ripper comes pre-installed in Kali Linux. To install it manually:

● Verify installation by running:

Password Hacking: John the Ripper
Cracking Password Hashes Using John the Ripper

Step 1: Obtaining the Hash File: Extract password hashes from a system

(Requires root privileges in Linux systems.)

Extract Windows password hashes using Mimikatz or pwdump.

Step 2: Running a Dictionary Attack: John the Ripper compares hash values against words in a dictionary
file.

[Link] is a popular password dictionary file containing real-world passwords.

 Password Hacking: John the Ripper
Step 3: Running a Brute-Force Attack: If a dictionary attack fails, John the Ripper can attempt brute-force
cracking:

This method tries all possible combinations, making it time-consuming.

Step 4: Displaying Cracked Passwords: After running John the Ripper, display found passwords with:
 Password Hacking: John the Ripper
Defending Against John the Ripper Attacks:

● Use strong passwords (long, complex, and unique).

● Implement multi-factor authentication (MFA).
● Store password hashes using strong cryptographic algorithms (bcrypt, Argon2).
● Limit login attempts to prevent brute-force attacks.
 Dictionary Attack Using Hydra
Hydra is a powerful login cracker that supports various authentication protocols like SSH, FTP, HTTP, and
RDP. It performs dictionary attacks by systematically testing username-password combinations from a
predefined wordlist.

Installing Hydra

● Hydra is pre-installed in Kali Linux. To install it manually:

● Verify installation:
 Dictionary Attack Using Hydra
Hydra is commonly used to crack online services like SSH, FTP, and web login forms.

1. SSH Login Attack

● -l root → Specifies the username ( root ).

● -P [Link] → Uses a password dictionary.
● ssh://[Link] → Targets an SSH service.

2. FTP Login Attack

This tests passwords for the admin account on an FTP server.

 Dictionary Attack Using Hydra
3. HTTP Brute-Force Attack (Website Login)

● This attempts logins on a web form.

● ^USER^ and ^PASS^ represent usernames and passwords from wordlists.
Dictionary Attack Using Hydra
Defending Against Hydra Attacks:

● Implement account lockout policies after multiple failed login attempts.

● Use CAPTCHAs to prevent automated attacks.
● Enforce strong passwords and multi-factor authentication (MFA).
● Monitor and block repeated login attempts from the same IP.
Medusa: Fast Parallel Brute-Force Attack
Tool
Medusa is a fast brute-force tool designed for parallel attacks, meaning it can test multiple usernames and
passwords simultaneously. It supports various authentication services like SSH, RDP, SMB, FTP, MySQL,
and more.

Installing Medusa

● Medusa is included in Kali Linux. To install it manually:

● Verify installation:
 Dictionary Attack Using Medusa
1. SSH Brute-Force Attack

● -h → Target IP.
● -u root → Specifies the username.
● -P [Link] → Uses a password wordlist.
● -M ssh → Specifies SSH as the attack module.
Dictionary Attack Using Medusa
2. SMB Login Attack (Windows Authentication)

● Targets Windows authentication using the SMB protocol.

3. FTP Brute-Force Attack

● Tests login credentials for an FTP server.

Dictionary Attack Using Medusa
Defending Against Medusa Attacks:

● Use account lockout policies after failed login attempts.

● Enable intrusion detection systems (IDS) to monitor brute-force activity.
● Use firewalls to block repeated login attempts from suspicious IPs.
● Implement two-factor authentication (2FA) for extra security.

Advantages of Medusa Over Hydra:

● Faster performance due to parallel brute-force attempts.

● Supports multiple target hosts simultaneously.
● Flexible modular architecture for different attack types.
Dictionary Attack Using Medusa
Password cracking tools like John the Ripper, Hydra, and Medusa demonstrate how weak credentials
can be easily compromised. While these tools are used by penetration testers for ethical hacking,
attackers also leverage them for unauthorized access. Organizations must enforce strong password
policies, implement multi-factor authentication, and monitor login attempts to defend against brute-force
and dictionary attacks. Strengthening authentication mechanisms is crucial for securing sensitive systems
from cyber threats.