One-line mitigation for the highest-risk port

Assignment Help Computer Networking

Reference no: EM133969448

Penetration Testing and Countermeasures

Tutorial - Reconnaissance

This tutorial complements the lecture (concepts) by providing practical, step-by-step guidance.
Safety (read first)
• Only scan systems you own or instructor-provided targets.
• Always use VirtualBox host-only networking to isolate labs from the internet.
• Use Kali Linux (default), or alternatively BackBox or Parrot as your attacker VM.
• Wireshark is recommended for packet captures but optional this week.
• Slingshot may be used if the instructor provides lab topologies.
• Snapshot your VMs before active scanning.
• If you find real personal/sensitive data, stop and notify the lecturer immediately.
Choose a Target (pick one)

Option A - Juice Shop (Docker):
1. Install Docker.
2. Run: docker run -d --name juice -p 3000:3000 bkimminich/juice-shop
Target = localhost:3000
Stop/cleanup: docker stop juice && docker rm juice

Option B - Metasploitable2 (VirtualBox host-only):
1. Import the Metasploitable2 OVA into VirtualBox.
2. Attach Host-Only Adapter, start VM and note its IP (e.g., 192.168.56.101).
Target = VM IP.

Note: You may use Kali, BackBox, or Parrot as your attacking VM. If Docker/VM targets are not possible, consult your tutor for alternatives.
Workspace & Start Log
Open a terminal in your attacker VM and run:
mkdir -p ~/lab_recon/week1 && cd ~/lab_recon/week1
echo "$(date) | START Recon | operator: <YourName> | ID: <YourID>" >> commands-log.txt
Commands to Run (Kali/BackBox/Parrot)
Passive Recon (10-15 min):
# WHOIS (if you have a real domain)
whois lab.example.local > whois-lab.txt

# DNS queries
dig lab.example.local ANY +noall +answer > dig-any.txt
dig lab.example.local A +short > dig-A.txt
dig lab.example.local MX +short > dig-MX.txt
dig _dmarc.lab.example.local TXT +short > dig-dmarc.txt

Active Recon (20-25 min):
# Host discovery
nmap -sn 192.168.56.0/24 -oN nmap-discovery.txt
# OR for Juice Shop
nmap -p 3000 localhost -oN nmap-discovery.txt

# Service/version scan
nmap -sV -p 22,80,443 <targetIP> -oN nmap-sv-<targetIP>.txt
nmap -sV -p 3000 localhost -oN nmap-sv-juice.txt

# Banner grabs
echo -e "HEAD / HTTP/1.0\r\n\r\n" | nc <targetIP> 80 > banner-<targetIP>-80.txt
echo -e "HEAD / HTTP/1.0\r\n\r\n" | nc localhost 3000 > banner-juice-3000.txt
nc <targetIP> 25 > banner-<targetIP>-25.txt < /dev/null
Wireshark / Packet Capture (Optional)
If Wireshark is installed, start a capture while scanning and save as scan_capture.pcap.
Take a screenshot of filtered traffic (e.g., DNS queries or HTTP requests).
If Wireshark is not available, this step may be skipped.

Report (One Page)
1. Header: name, student ID, date/time, target type (Docker/VM)
2. Targets tested (domain/IPs - lab only)
3. Exact commands run (3-8 lines)
4. Top 3 findings table (ID | Target | Evidence filename | Short description | Risk | Recommendation)
5. Declaration: 'I confirm I ran tests only on lab targets and saved evidence.'
6. Answers to Q1-Q12 (concise, numbered)

Q1-Q12 (Answer in your Report)

Question 1: Domain(s) queried & filenames for WHOIS/DNS outputs

Question 2: WHOIS field(s) for registrar & name servers

Question 3: DNS record types queried & which file shows mail server config

Question 4: One follow-up active recon action you would plan Get dependable, budget-friendly assignment help-starting today!

Question 5: One Google dork (text) and why it might reveal sensitive data

Question 6: Filename of Nmap discovery file & IP you selected

Question 7: Filename of Nmap service/version output file

Question 8: Filenames of banner outputs

Question 9: Port numbers open on the chosen host

Question 10: One-line mitigation for the highest-risk port

Question 11: Exact ZIP filename you will upload

Question 12: Confirm (Y/N) that evidence-sha256.txt includes all hashes

Reference no: EM133969448

Questions Cloud

Create recovery management plan : You will create a recovery management plan. Recovery management plans can be useful tools for clients to refer to throughout counseling

What would be your treatment recommendation for zak : What would be your treatment recommendation for Zak? What might be the barriers to treatment?

Why is enumeration considered noisy compared to recon : What user or share information did enum4linux or smbclient provide and Why is enumeration considered noisy compared to recon

What is the appropriate level of service : The patient is diagnosed with otitis media and is given a prescription for antibiotics. What is the appropriate level of service?

One-line mitigation for the highest-risk port : Always use VirtualBox host-only networking to isolate labs from the internet and Use Kali Linux (default), or alternatively BackBox or Parrot as your attacker

What is the appropriate e-m level to code : What is the appropriate E/M level to code when an audio-video visit for the evaluation and management of a new patient?

Employee latest performance evaluation : you should make a copy of the employee's latest performance evaluation and attach it to the form. If the employee's current performance rating

Contrast modernity and post modernity : Compare and contrast modernity and post modernity. Make sure you define both in your answer. List a positive and a negative outcome for both.

What is the correct code assignment for the diagnosis : A patient with gastroesophageal reflux disease underwent outpatient manometry study. What is the correct code assignment for this diagnosis?

User Account

All Pages