Scanning and Enumeration Phase

In today's distributed computing environment where computer networks and the Internet are the means of communication and information exchange, security is becoming more and more important. Security in computer networks and the Internet has serious implications for the current dynamic work environment. Security is now a basic requirement because distributed computing is insecure. In an organization, regardless of its size and volume, it is very important to improve the security of computer infrastructure. However, with the rapid emergence of new vulnerabilities and exploits, at some point even a fully-fledged system or network has security flaws. There are different security measures that can be applied to secure the network or system. The best way to ensure that your network or system is secure is Penetration Test, which can provide a realistic security assessment by identifying vulnerabilities and exploits in a network infrastructure. Penetration Test uses the same principles as hackers to infiltrate the computer network infrastructure and thus verify the presence of defects and vulnerabilities and help confirm security measures. The thesis begins with defining the theoretical background of a penetration test. It then proceeds to the phases that exist in a penetration test and the appropriate methodology. In the practical part we will see a simulation of attacks on a network with partial knowledge of the system or network. Open source tools for network monitoring, port scanners, vulnerability scanners and penetration test framework will be used. The aim of this thesis is to identify and explain a suitable methodology for penetration test, to illustrate relevant open source tools as well as to implement a vulnerability framework that can be used to ensure that an organization's network and systems are secure.

Network security faces significant challenges due to the increasing number and complexity of system vulnerabilities. This study aims to develop and evaluate a full combination method (ABC) integrating port scanning (Nmap), vulnerability scanning (OpenVAS), and penetration testing (Metasploit), and compare it with partial combinations (AB, BC, AC) for more effective vulnerability detection. Using a quantitative experimental approach within a controlled GNS3 TestBed, three key indicators were analyzed: number of vulnerabilities detected, detection time, and exploit validity. Experimental results show that the ABC method detected 62 potential vulnerabilities, including 11 high and medium severity CVEs, matching the AB method but significantly outperforming AC, which detected none. In terms of detection time, the ABC method achieved a balanced performance at 91 minutes, which is 31.5% faster than AB (133 minutes), while maintaining full exploit validation. Notably, the ABC method successfully validated 100% of critical vulnerabilities using Metasploit, confirming the practical applicability and reliability of the integrated approach compared to dual combinations. Overall, the findings demonstrate that the full combination method (ABC) offers superior accuracy and comprehensiveness in detecting and validating network vulnerabilities. This research contributes to cybersecurity practices by proposing an integrated detection workflow that effectively balances speed and depth of analysis, setting a practical benchmark for vulnerability detection systems applicable to both simulated and real-world network environments.

With the increasing reliance on web applications for business and personal use, ensuring website security has become a critical concern. Cyber threats such as SQL injection, cross-site scripting (XSS), malware infections, and unauthorized access pose significant risks to websites, leading to data breaches and service disruptions. This project aims to develop a comprehensive website security scanner that systematically identifies vulnerabilities and potential security risks.The proposed system integrates automated vulnerability scanning, penetration testing techniques, and real-time monitoring to detect security loopholes. Using machine learning and heuristic-based analysis, the scanner can identify malicious scripts, outdated software versions, weak authentication mechanisms, and misconfigured security policies. The system also performs network security assessments, analyzing potential DDoS (Distributed Denial-of-Service) attack risks and firewall configurations. The scanner generates detailed security reports, providing actionable insights and recommendations for website owners and administrators to mitigate risks effectively. Designed for continuous monitoring and proactive defense, the tool enhances cybersecurity resilience against evolving threats. This project contributes to web security advancements by offering an intelligent, automated, and scalable solution for safeguarding websites from cyberattacks. Keywords: Website Security | Vulnerability Scanner | Cyber Threats | SQL Injection | Cross-Site Scripting (XSS) | Penetration Testing | Machine Learning | Malware Detection | DDoS Protection | Authentication Security | Firewall Analysis | Web Application Security | Risk Assessment | Cybersecurity Resilience

Penetration testing helps to secure networks, and highlights the security issues. In this paper investigate different aspects of penetration testing including tools, attack methodologies, and defense strategies. More specifically, we performed different penetration tests using a private networks, devices, and virtualized systems and tools. We predominately used tools within the Kali Linux suite. The attacks we performed included: smartphone penetration testing, hacking phones Bluetooth, traffic sniffing, hacking WPA Protected Wifi, Man-in-the-Middle attack, spying (accessing a PC microphone), hacking phones Bluetooth, and hacking remote PC via IP and open ports using advanced port scanner. The results are then summarized and discussed. The paper also outlined the detailed steps and methods while conducting these attacks.

Chapter 3 - Enumeration and Scanning Your Network

Reconnaissance might be the longest phase, sometimes take weeks or months. The black hat makes use of passive information gathering techniques. Once the attacker has sufficient statistics, then the attacker starts the technique of scanning perimeter and internal network devices seeking out open ports and related services. In this paper we are showing traffic accountability and time to complete the specific task during reconnaissance phase active scanning with nmap tool and proposed strategies that how to deal with large volumes of hosts and conserve network traffic as well as time of the specific task.

Penetration testing plays an important role in the development of secure software products and electronic systems. Sustainability of commercial systems is ensured through the regular scans of vulnerability. In this era where quality assurance and testing organizations become increasingly widespread, the effectiveness of the used tools and methods are critical. This article describes the architecture of the software named VinJect, which is developed for efficient penetration testing and vulnerability scanning. The primary goal of this application is to detect vulnerable locations in a shorter time with running in a multi-threaded structure. Our proposed application uses Wapiti and SQLmap applications’ services in the background. With user-friendly interfaces, it is also aimed to remove the bad UX that these applications running on the command line have. In the tests we performed, WinJect was found to be more efficient in completing the vulnerability scans in a much shorter time.

This paper presents a thorough descriptive analysis of cyber security and ethical hacking showcasing the current digital era. This paper tries to analyse the relationship between these two domains focusing on their sufficiency for the protection of digital assets and information systems. This article provides in-depth analysis of concepts, practices and tools related to both cyber security and ethical hacking through reviewing a literature and the current practices in the industry. The paper also notes a significant shift towards this pitying method of ethical hacking as a means of assisting in finding work before problems arise. In addition, it seeks to address the ethical issues and legal aspects of the concept of ethical hacking. The evidence shows a positive contribution of ethical hacking in mainstream cyber security practices in many organizations, explaining more of its uses in security breach management and contingency planning. The present study fills a gap in the literature by accentuating to the field the increasing virtual threats emanating from computers and the mounting application of hostile hacking technologies. This study also examines the scope of organizations' difficulties in achieving sufficient cyber security and explains how these challenges can be overcome by ethical hacking. However, it also mentions the necessity of staying vigilant and resourceful in the sphere of cyber security due to the fact how quickly the threats can change. Various techniques of ethical hacking such as pentesting, vulnerability scan and social engineering are presented in conjunction with their ability to meet the goals faced by the organizations. It also looks into those risks scenarios where even ethical hacking may backfire and offers specific guidelines for the safe application of these instruments. Finally. it urges that ethical hackers and aim the comprehension of ethical hacking towards reinforcing boundaries of competent cyber threats and their misuse. Although it speaks of some perspectives for further studies designing an overall approach to hardening internal corporate information security is among these perspectives.

<div class="section abstract"><div class="htmlview paragraph">The added connectivity and transmission of personal and payment information in electric vehicle (EV) charging technology creates larger attack surfaces and incentives for malicious hackers to act. As EV charging stations are a major and direct user interface in the charging infrastructure, ensuring cybersecurity of the personal and private data transmitted to and from chargers is a key component to the overall security. Researchers at Southwest Research Institute® (SwRI®) evaluated the security of direct current fast charging (DCFC) EV supply equipment (EVSE). Identified vulnerabilities included values such as the MAC addresses of both the EV and EVSE, either sent in plaintext or encrypted with a known algorithm. These values allowed for reprogramming of non-volatile memory of power-line communication (PLC) devices as well as the EV’s parameter information block (PIB). Discovering these values allowed the researchers to access the IPv6 layer on the connection between the EV and EVSE and use traditional ethernet penetration testing methods, including port and vulnerability scanning. Port scanning exposed open SSH and HTTP services, the latter of which was vulnerable and allowed unauthenticated retrieval of proprietary information. The ports should be secured, or closed if unneeded, to prevent this type of vulnerability.</div></div>

OBJECTIVE. There are few articles in the literature describing the security and safety aspects of networked medical equipment in radiology departments. Most radiologists are unaware of the security issues. We review the security of the networked medical equipment of a typical radiology department. MATERIALS AND METHODS. All networked medical equipment in a radiology department was scanned for vulnerabilities with a port scanner and a network vulnerability scanner, and the vulnerabilities were classified using the Common Vulnerability Scoring System. A network sniffer was used to capture and analyze traffic on the radiology network for exposure of confidential patient data. We reviewed the use of antivirus software and firewalls on the networked medical equipment. USB ports and CD and DVD drives in the networked medical equipment were tested to see whether they allowed unauthorized access. Implementation of the virtual private network (VPN) that vendors use to access the radiology network was reviewed. RESULTS. Most of the networked medical equipment in our radiology department used vulnerable software with open ports and services. Of the 144 items scanned, 64 (44%) had at least one critical vulnerability, and 119 (83%) had at least one high-risk vulnerability. Most equipment did not encrypt traffic and allowed capture of confidential patient data. Of the 144 items scanned, two (1%) used antivirus software and three (2%) had a firewall enabled. The USB ports were not secure on 49 of the 58 (84%) items with USB ports, and the CD or DVD drive was not secure on 17 of the 31 (55%) items with a CD or DVD drive. One of three vendors had an insecure implementation of VPN access. CONCLUSION. Radiologists and the medical industry need to urgently review and rectify the security issues in existing networked medical equipment. We hope that the results of our study and this article also raise awareness among radiologists about the security issues of networked medical equipment.

Due to increase in problems like space allocation, web hosting, hardware failure which results in the loss of data. This problem can be solved by new technologies in cloud computing. With the passing of time and the advancements in technology, the usage of cloud storage has increased tremendously which has resulted in the increase of the threats on cloud. Attackers can easily find vulnerabilities present in the system and exploit the data that it holds by using a port scanner. In such a way the DDOS (Distributed Denial of Service) attack will compromise the machine. In such type of attacks, multi-step exploitation, low frequency vulnerability scanning, compromises other machines to develop zombie systems. Lastly, the attacks that are caused by those compromised machines are the problem seen in such type of attacks. To detect and prevent an attack on the system, a network intrusion detection selection is done on them with the help of honeypots. Honeypots lure attackers away from the main system preventing it from the attack and protecting its integrity. A Nice-A agent continuously monitors the network. The VM Profillerwill update the database forsuch attacks taking place on open ports in the network. This attack type is analysed by attack analyser. After recognizing the type of attack, it gives notification to network controller and suggest the countermeasure to be taken. The attack is further directed to honeypot. A security mechanism honeypot which detects and deflects an unauthorized user trying to access the information system. Honeypot thus tracks the attacker IP and its signature attack.

Port scanning is a first common discovering step which allows cyber malicious actors to gather valuable information about target hosts namely defense, governmental and banks servers by trying to identify instantly open ports, which correspond to specific services on the cloud, such as HTTP, DNS, and email. This paper aims to introduce a detection and evaluation approach for port scanning attacks in various contexts and levels of criticity based on fuzzy reasoning method. A new fuzzy logic controller, which uses fuzzy rules base and the Mamdani inference method is proposed as Intrusion Detection System as a Service, which dynamically detect and evaluate the criticity of port scanning. This SaaS enables network administrators and cyber security specialists to follow in real time the network traffic behavior, i.e., the Port Scanning Criticity Level (PSCL). A Dynamic dashboard is implemented to quickly and efficiently identify malicious port scanning activities. Experimentations and evaluations showed the efficiency of the proposed system in multilevel port scanning detection compared to Snort and the related IDS systems.

The 21 <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">st</sup> century has been characterized by the widespread proliferation and use of wireless networks, notably, Wireless LANs, that enhanced access to information and resources to businesses and the society at large. However, WLANs are vulnerable to a range of security issues such as replay and KRACK attacks. In addition, the underlying security protocols used within WLANs, including Wired-Equivalent Privacy and the different versions of the Wi-Fi Protected Access have had security vulnerabilities that led to deprecation of few previous versions. As such, in the process of hardening security of such networks, vulnerability assessment is important and for this, various vulnerability scanners are available on the market. This paper critically reviews and analyses key vulnerability scanners for the context of WLANs. As part of the investigation, four tools, notably Nessus Vulnerability Scanner, OpenVAS, Nexpose and GFI LanGuard are reviewed, and insights are provided following practical utilization. As key findings, different vulnerability scanners were found to address different kinds and number of vulnerabilities, where some of them can be more granular than others, even in terms of output provided to the user. Moreover, the scan duration was not consistent across tools and does not corelate with the number of vulnerabilities detected.

With the development of technology, people’s daily lives are closely related to networks. The importance of cybersecurity protection draws global attention. Automated penetration testing is the novel method to protect the security of networks, which enhances efficiency and reduces costs compared with traditional manual penetration testing. Previous studies have provided many ways to obtain a better policy for penetration testing paths, but many studies are based on ideal penetration testing scenarios. In order to find potential vulnerabilities from the perspective of hackers in the real world, this paper models the process of black-box penetration testing as a Partially Observed Markov Decision Process (POMDP). In addition, we propose a new algorithm named ND3RQN, which is applied to the automated black-box penetration testing. In the POMDP model, an agent interacts with a network environment to choose a better policy without insider information about the target network, except for the start points. To handle this problem, we utilize a Long Short-Term Memory (LSTM) structure empowering agent to make decisions based on historical memory. In addition, this paper enhances the current algorithm using the structure of the neural network, the calculation method of the Q-value, and adding noise parameters to the neural network to advance the generalization and efficiency of this algorithm. In the last section, we conduct comparison experiments of the ND3RQN algorithm and other recent state-of-the-art (SOTA) algorithms. The experimental results vividly show that this novel algorithm is able to find a greater attack-path strategy for all vulnerable hosts in the automated black-box penetration testing. Additionally, the generalization and robustness of this algorithm are far superior to other SOTA algorithms in different size simulation scenarios based on the CyberBattleSim simulation developed by Microsoft.

Network security assessment is a critical process for identifying vulnerabilities within computer systems and connected devices. Port scanning and network mapping are widely used techniques to discover open ports, active hosts, and running services in a network. Although several advanced tools such as Nmap are available, they are often complex and not user-friendly for beginners. This paper presents the design and implementation of a Custom Port Scanner and Network Mapping Tool developed using Python. The proposed system allows users to scan IP addresses and domains to detect open, closed, and filtered ports while identifying connected devices within the network. The tool integrates scanning techniques with a graphical user interface to visualize scan progress and results clearly. Experimental evaluation demonstrates that the developed tool provides accurate detection with efficient performance. The proposed system simplifies network security assessment and serves as an educational platform for cybersecurity learners and professionals.