Kali Linux Lab Activity for Cybersecurity

Objective

This lab activity is designed to introduce students to Kali Linux, a popular distribution for penetration testing and ethical hacking. Students will learn to set up a Kali Linux environment, explore common security tools, and perform various cybersecurity exercises with a special focus on wireless network security.

Prerequisites

• VMware Workstation Player installed on your computer

• Kali Linux ISO file downloaded from the official website (https://www.kali.org/get-kali/)

• A USB wireless adapter (for wireless security exercises)

Part 1: Setting up the Kali Linux Virtual Machine

Step 1: Create a New Virtual Machine

1. Open VMware Workstation Player

2. Click on "Create a New Virtual Machine"

3. Choose "Installer disc image file (iso)" and select your Kali Linux ISO

4. Follow the wizard, allocating at least 50GB of disk space and 4GB of RAM

Step 2: Install Kali Linux

1. Start the virtual machine and follow the Kali Linux installation prompts

2. Choose "Graphical Install" for a user-friendly installation process

3. Select your language, location, and keyboard layout

4. Create a user account with a strong password

Step 3: Update Kali Linux

1. Log in to your Kali Linux system

2. Open a terminal (use the terminal icon or press Ctrl+Alt+T)

3. Update the system with the following commands:

4. Reboot the system after updates are complete:

Part 2: Exploring Kali Linux and Basic Tools

Step 1: Familiarize with the Kali Linux Environment

1. Explore the application menu and note the categories of tools available

2. Open the terminal and practice basic Linux commands:

Step 2: Network Reconnaissance with Nmap

1. Open a terminal and use Nmap to scan your local network:

   (Replace 192.168.1.0/24 with your local network range)

2. Perform a more detailed scan on a specific IP (use your VM's IP or a device you own):

Step 3: Web Application Analysis with Burp Suite

1. Launch Burp Suite from the applications menu

2. Configure your browser to use Burp Suite as a proxy (usually 127.0.0.1:8080)

3. Visit a test website (like http://testphp.vulnweb.com) and observe the traffic in Burp Suite

4. Explore the different tabs in Burp Suite (Proxy, Target, Spider, etc.)

Part 3: Wireless Network Security

Step 1: Wireless Interface Management

1. List available network interfaces:

2. If using a virtual machine, attach your USB wireless adapter

3. Put your wireless interface into monitor mode:

   (Replace wlan0 with your wireless interface name)

Step 2: Capture Wireless Traffic

1. Use airodump-ng to capture nearby wireless traffic:

2. Observe the different networks and clients

Step 3: Focused Capture on a Specific Access Point

1. Choose a target network (use only networks you own or have permission to test)

2. Capture traffic for the specific network:

   Replace [channel] and [BSSID] with the target network's information

Step 4: Deauthentication Attack Demonstration

1. In a new terminal, perform a deauthentication attack:

   This sends 10 deauthentication packets to the target network

2. Observe the effect in the airodump-ng window

Step 5: Cracking WEP (if applicable)

1. If you've captured sufficient data from a WEP network:

2. Discuss why WEP is insecure and should not be used

Step 6: Cracking WPA/WPA2 using a Wordlist

1. Convert the capture to a hashcat-compatible format:

2. Use hashcat to attempt cracking:

3. Discuss the importance of strong, unique passwords

Step 7: Evil Twin Attack Setup

1. Create a fake access point:

2. Set up DHCP on the fake AP:

3. Discuss the risks of connecting to unknown Wi-Fi networks

Step 8: Wi-Fi Pineapple Emulation

1. Install create_ap:

2. Create a Wi-Fi hotspot that automatically responds to probe requests:

3. Discuss how this technique can be used for man-in-the-middle attacks

Step 9: Wireless IDS/IPS with Kismet

1. Install Kismet:

2. Run Kismet:

3. Explore the web interface (usually at http://localhost:2501)

4. Discuss how Kismet can be used to detect wireless attacks

Step 10: Secure Wi-Fi Setup

1. Discuss best practices for securing wireless networks:

   • Using WPA3 or WPA2-Enterprise

   • Implementing strong, unique passwords

   • Enabling network encryption

Part 4: Password Cracking with John the Ripper

Step 1: Create a Sample Password File

1. Create a file with some sample hashed passwords:

Step 2: Use John the Ripper to Crack Passwords

1. Run John the Ripper on the password file:

2. Observe the cracking process and results

Part 5: Vulnerability Scanning with OpenVAS

Step 1: Set up OpenVAS

1. Install OpenVAS:

2. Set up OpenVAS:

   This may take some time to complete.

Step 2: Perform a Vulnerability Scan

1. Access the OpenVAS web interface (usually at https://localhost:9392)

2. Create a new target using an IP address you have permission to scan

3. Create a new task to scan this target

4. Run the scan and analyze the results

Conclusion

In this comprehensive lab, you've learned how to set up a Kali Linux environment and use various cybersecurity tools. You've performed network reconnaissance, analyzed web application traffic, explored wireless network security in depth, cracked passwords, and conducted vulnerability scanning. These skills form a solid foundation for further exploration of ethical hacking and penetration testing.

Activity

Create a Metasploit module that takes a URL as input and checks if the corresponding website is online.

check_online.rb

Save the module as check_online.rb in the Metasploit modules/auxiliary/scanner/http directory.

Restart Metasploit to ensure it loads custom modules from ~/.msf4/modules.

Load the Module

Run the Module

Ubuntu Server LTS Lab Activity for Cybersecurity

Objective

This lab activity is designed to introduce undergraduate cybersecurity students to Ubuntu Server LTS, focusing on basic system administration, security configurations, and common cybersecurity tools in a server environment.

Ubuntu Linux Hacking Lab Activity for Cybersecurity

Objective

This advanced lab activity builds upon the previous Ubuntu 22 Server lab, focusing on more complex ethical hacking techniques targeting Ubuntu Linux systems. Students will explore vulnerable web applications, container escapes, and advanced privilege escalation techniques.

1: Setting up Ruby

Before we dive into learning Ruby, make sure you have the latest version of Ruby installed on your system. You can download it from the official Ruby website.

Once you have Ruby installed, open a terminal or command prompt and type ruby -v to verify that it's working correctly.

Problem 1: Math Operations

Write a Ruby script that takes two integers as input, adds them together, and returns the result.

Example Input: ruby script.rb 2 3 Expected Output: 5

Solution Outline:

• Define a method add_numbers that takes two integers as input.

• Use the '+' operator to add the two numbers together.

• Return the result.

Problem 2: String Manipulation

Write a Ruby script that takes a string as input and returns the string with all vowels removed.

Example Input: "Hello World" Expected Output: "Hll Wrld"

Solution Outline:

• Define a method remove_vowels that takes a string as input.

• Use regular expressions to match all vowels (both lowercase and uppercase) in the string.

• Replace each vowel with an empty string using the gsub method.

Problem 3: File Reading

Write a Ruby script that reads a file named "input.txt" and prints its contents to the console.

Assumptions:

• The file exists in the same directory as the script.

• The file contains only text data.

Solution Outline:

• Define a method read_file that takes a file name as input.

• Open the file in read-only mode using the File.open method and assign it to a variable.

• Read the contents of the file using the read method.

Problem 4: Array Sorting

Write a Ruby script that takes an array of integers as input, sorts it in ascending order, and prints the sorted array.

Example Input: [3, 1, 2, 6] Expected Output: [1, 2, 3, 6]

Solution Outline:

• Define a method sort_array that takes an array of integers as input.

• Use the sort method to sort the array in ascending order.

• Return the sorted array.

Problem 5: Hash Creation

Write a Ruby script that takes two arrays as input (keys and values) and creates a hash from them. Print the resulting hash.

Example Input: ["name", "age"], ["John", 30] Here is the rest of the combined version:

Problem 5: Hash Creation

Write a Ruby script that takes two arrays as input (keys and values) and creates a hash from them. Print the resulting hash.

Example Input: ["name", "age"], ["John", 30]

Solution Outline:

• Define a method create_hash that takes two arrays as input.

• Use the zip method to combine the keys and values into an array of arrays.

• Use the to_h method to convert the array of arrays into a hash.

Problem 6: IP Address Validation

Write a Ruby script that takes an IP address as input and returns true if it is valid, and false otherwise.

Example Input: "192.168.1.1" Expected Output: true

Solution Outline:

• Define a method is_valid_ip that takes an IP address as input.

• Use regular expressions to match the IP address format.

• Split the IP address into its four parts and convert each part to an integer.

• Check if each part is within the range of 0-255 using the between?

Problem 7: String Search

Write a Ruby script that takes a string and a search term as input, and returns the index of the first occurrence of the search term in the string. If the search term is not found, return -1.

Example Input: "Hello World", "World" Expected Output: 6

Solution Outline:

• Define a method find_string that takes a string and a search term as input.

• Use the index method to find the index of the search term in the string.

• If the search term is not found, return -1 using the || operator.

Metasploit on Kali Linux: A Step-by-Step Tutorial

Disclaimer: This tutorial is intended for educational purposes only. Always ensure you have explicit permission to perform penetration testing on any network or system. Unauthorized access to computer systems is illegal and unethical.

Table of Contents

1. Introduction to Metasploit

2. Setting Up the Environment

3. Starting Metasploit Framework

4. Basic Commands in Metasploit

1. Introduction to Metasploit

Metasploit Framework is a powerful tool used by cybersecurity professionals for penetration testing and vulnerability assessments. It provides a suite of tools for simulating attacks on networks and systems to identify security weaknesses.

2. Setting Up the Environment

Prerequisites

• Kali Linux installed on your machine (bare-metal, virtual machine, or live boot).

• Basic understanding of networking and command-line interface.

Updating Kali Linux

Before starting, ensure your system is up-to-date:

3. Starting Metasploit Framework

Metasploit comes pre-installed on Kali Linux.

To start the Metasploit console:

1. Open a terminal window.

2. Initialize the PostgreSQL database (required for Metasploit):

3. Start the Metasploit console:

You should see the Metasploit banner and the msf> prompt.

You can also find it by navigating in the Kali Linux menu system.

4. Basic Commands in Metasploit

Familiarize yourself with some basic commands:

• help: Displays help menu with a list of commands.

• version: Shows the current version of Metasploit.

• search: Searches for exploits, payloads, and modules.

5. Scanning and Enumerating Targets

Before exploiting, gather information about the target.

Using Nmap within Metasploit

1. Run Nmap scan:

   Replace 192.168.1.10 with the target IP address.

2. View the scanned hosts:

3. List open services and ports:

6. Selecting and Configuring Exploits

Searching for Exploits

1. Use the search command with relevant keywords:

Selecting an Exploit

1. Choose an exploit module:

2. View exploit options:

Setting Exploit Options

1. Set the target IP address:

2. Confirm the options are set:

7. Choosing and Configuring Payloads

Listing Available Payloads

1. Show compatible payloads:

Selecting a Payload

1. Choose a payload (e.g., reverse TCP shell):

2. Set the local host IP (your machine's IP):

   Replace 192.168.1.5 with your Kali Linux IP address.

3. (Optional) Set the local port:

8. Executing the Exploit

1. Run the exploit:

   Metasploit will attempt to exploit the target and establish a Meterpreter session.

9. Post-Exploitation with Meterpreter

Once a session is established, you can interact with the target system.

Basic Meterpreter Commands

• sysinfo: Displays system information.

• getuid: Shows user ID.

• shell: Drops into a shell on the target system.

Exiting Meterpreter

• exit: Closes the Meterpreter session.

10. Closing the Session and Exiting Metasploit

1. List active sessions:

2. Interact with a session:

3. Close a session:

4. Exit Metasploit:

11. Best Practices and Ethical Considerations

• Legal Authorization: Always obtain written permission before performing any penetration testing.

• Ethical Responsibility: Use Metasploit to improve security, not to exploit vulnerabilities for malicious purposes.

• Confidentiality: Keep any sensitive data obtained during testing confidential.

• Reporting: Provide detailed reports of your findings to the appropriate parties to help remediate vulnerabilities.

Note: Always remember the importance of legality and ethics in cybersecurity work. Use these skills responsibly to contribute to a safer digital environment.