KANWAR AZLAN

Procedure:

• Becoming a Certificate Authority (CA)
• Creating a Certificate for SEEDPKILab2020.com
• Deploying Certificate in an HTTPS Web Server
• Deploying Certificate in an Apache-Based HTTPS Website
• Launching a Man-In-The-Middle Attack
• Launching a Man-In-The-Middle Attack with a Compromised CA

Procedure:

• First we have our main user interface (UI) or our main page that gives three options to the user that either user want to scan the image by opening the camera, or user can upload an image or user can upload PDF document.
• Then firstly, our software extracts the text from the image by the help of OCR. It works at the back end by separating the colours of the image or pixels and background and foreground and then extract the text easily.
• Now comes the main task of this App, this text is being converted to another language (Target language) by the help of NLP (natural language processing).

Description:

The main purpose to serve the people with an enhanced and useful application that brings them much faster as the world is growing. To capture the idea of dealing with the android application is chosen due to the vast and hands on experience of the users to the android app. As far as project idea is concern, it gives us the full exposure to use of two languages in parallel.

Procedure:

• The first task involves using Hashcat, a powerful password recovery tool, to crack hashed passwords.
• The second task focuses on setting up and using OpenVAS for vulnerability scanning. We installed OpenVAS, perform initial scans on target IPs, and analyze the scan results to identify high, medium, and low severity vulnerabilities.
• We used Nmap to perform network scans: identify live hosts, open ports, running services, and detect operating systems.
• Final step involves using OWASP ZAP to test web applications for common vulnerabilities such as SQL injection, XSS, and CSRF. Focuses on establishing ongoing monitoring and incident response capabilities. A Security Information and Event Management (SIEM) system is set up to monitor network traffic, generate security events, with alerts configured for suspicious activities and potential incidents.

Description:

We map the network topology using tools like Nmap and Wireshark, perform vulnerability scans with OpenVAS or Nessus, and conduct penetration testing using tools like Metasploit and Burp Suite. The project includes implementing security measures such as network segmentation, patch management, and endpoint security, and developing an incident response plan. The project concludes with a detailed report and presentation of findings and recommendations to business stakeholders.

Procedure:

• Set up a Kali Linux VM as the attacker machine and an Ubuntu VM as the victim machine.
• Configure the network adapters of both virtual machines to 'Host-Only' mode to isolate the environment into a private local network.
• Clone the official GMT repository.
• Configure the build using CMake, explicitly passing flags to disable security features (–fno-stack-protector -z execstack), and compile the source code into executable binaries.
• Generate a 5,000-byte payload consisting of padding characters ('A') on the Kali machine and host it via a local Python HTTP server.
• Construct a malicious Python script (ace_exploit.py) configured with the calculated offset, custom Linux x64 shellcode (/bin/sh), and target stack addresses to output a weaponized binary payload (exploit.bin).
• Re-run the binary against the malicious payload to verify that the application rejects the input safely and exits gracefully without crashing.

Description:

During execution of the vulnerable code path, passing an excessively long string to the gmt which module bypasses safe boundaries, allowing the overflow to alter memory positions where instructions are sequentially processed. While the architectural properties of 64-bit binaries restricted a full shell hijack in this demonstration due to null-byte constraints, the system's susceptibility to total service disruption highlights the criticality of replacing legacy functions like strcpy with safe alternatives that strictly enforce bounds checking.

Procedure:

• Enter the Input: When you run the app, enter the text you want to encrypt in plain text.
• Enter the Secret Code: Now enter the secret password you set at the back end through coding.
• Encrypt the Message: Now hit encrypt and you will be prompted with the encrypted Text.
• Send Encrypted Text: Now send the text to someone.
• Decryption of Text: The receiver will perform the same operation backward with the same secret code and it can decrypt the message.

Description:

The application has a main screen where users can input text and a secret code. Upon entering the correct code e.g ('1234'), users can choose to either encrypt the entered text or decrypt a previously encoded message. If the code is incorrect or missing, appropriate error messages are displayed. The encryption and decryption processes utilize Base64 encoding as a basic operation, which converts text to a secure format and then decodes it back to the original form. This project provides a practical application of Python programming and GUI development skills.

Procedure:

• Define character set. Include all possible characters for guessing. Convert this into a usable form for iteration.
• Take password input from the user. Prompt user securely (without showing input on screen) using pyautogui.password().
• Start the timer. Record the start time using time.time().
• Brute-force guessing loop. Iterate through possible guess lengths (from 1 to the length of the password). For each guess length, generate all possible combinations of characters using itertools.product(). Convert each combination into a string ("".join(guess)). Keep track of number of attempts.
• Password match check. Compare each generated guess with the actual password.
• If matched. Record the end time. Calculate total elapsed time (end – start). Print the cracked password, total attempts, and time taken.

Description:

This project aims to build a brute force attack simulator. We have used multiple python libraries such as itertools, pyautogui and time module which estimates the time required to crack a password. The attack simultaneously starts the timer and try to guess the password, if matched, it calculates the estimated time taken and displayed on the input. The password which we have tested generated on the random input combination of alphabets, special characters and numbers.