Introduction to cyber

security & Network

Defence Tools (Unit - 1)
HARSH PANCHAL
Outline
o Introduction o Network Vulnerabilities:
o Overview of vulnerability scanning
o Computer Security
o Open Port / Service Identification
o Threats
o Banner / Version Check
o Harm
o Traffic Probe
o Vulnerabilities
o Vulnerability Probe
o Controls
o Authentication o Vulnerability Examples
o Access Control and Cryptography o OpenVAS
o Web attack:
o Browser Attacks o Metasploit
o Web Attacks Targeting Users o Networks Vulnerability Scanning (Netcat, Socat)
o Obtaining User or Website Data
o Email Attacks o Network Sniffers and Injection tools
What is Computer Security?
Computer Security refers to the protection of computer systems and networks from information
disclosure, theft of or damage to hardware, software, or data, as well as from disruption or
misdirection of services.
Also known as:
◦ Cybersecurity
◦ Information Security (when dealing with data specifically)
 Computer Security (also called cybersecurity or IT security) is
the practice of protecting computer systems, networks, and
data from:

Unauthorized access

Computer
Malicious attacks
Security

Theft or damage

Disruption or misuse of services

 Protection against:

• Malware & Ransomware

• Phishing & Identity Theft
Why Is
• Data Breaches
Computer
Security
Important? Ensures:

• Business continuity
• Legal compliance (e.g., GDPR, HIPAA)
• Trust in systems and data
The CIA Triad – Key Security Objectives

C = CONFIDENTIALITY I = INTEGRITY - KEEP A = AVAILABILITY -

- KEEP DATA SECRET DATA ACCURATE KEEP DATA ACCESSIBLE
Confidentiality
Goal: Prevent unauthorized access to information.
Real-Time Examples:
◦ Banking App: Only you can view your transactions; end-to-end encryption is used.
◦ Healthcare Systems: Patient data is encrypted; access is role-based.
◦ Exam Scenario Tip: “If a hacker steals private company emails, what has been violated?” →
Confidentiality
Integrity
Goal: Ensure data is accurate and hasn’t been altered.
Real-Time Examples:
◦ Online Voting Systems: A vote cast remains unchanged during transmission and storage.
◦ Digital Signatures: Used to verify file authenticity.
◦ Exam Scenario Tip: “If a virus modifies stored records in a hospital database, what’s affected?” →
Integrity
Availability
Goal: Ensure systems and data are accessible when needed.
Real-Time Examples:
◦ DDoS Attack on Websites: Makes services unavailable (e.g., banking or e-commerce site outage).
◦ Power Redundancy in Data Centers: Ensures uptime even during power failures.
◦ Exam Scenario Tip: “A web service is down due to a cyberattack. What principle is impacted?” →
Availability
CIA Triad in a Nutshell
Objective Focus Real-World Threat

Confidentiality Unauthorized access Data breach

Integrity Tampering / unauthorized changes Malware altering files

Availability System uptime & access DDoS attack

Common Security
1. Firewalls
◦ Acts as a barrier between internal networks and untrusted external networks (e.g., the internet)
◦ Filters incoming and outgoing traffic based on security rules
◦ Example: Blocks unauthorized ports used by hackers

2. Antivirus Software
◦ Detects and removes malicious software (malware) such as viruses, trojans, and spyware
◦ Regular updates are crucial to keep up with evolving threats
◦ Example: Prevents infection from an infected email attachment
Common Security
3. Encryption
◦ Converts data into a secure format (ciphertext) that can only be read by someone with the decryption
key
◦ Used in data storage and transmission (e.g., HTTPS, encrypted databases)
◦ Example: Secures sensitive information like passwords or payment details during online transactions

4. Intrusion Detection Systems (IDS)

◦ Monitors network or system activities for suspicious behavior
◦ Alerts admins when potential threats or policy violations are detected
◦ Example: Detects a brute-force login attempt on a server
Common Security
Breach Example What Happened Consequences

Personal data (SSNs, DOBs) of

Legal fines, loss of public trust,
Equifax Data Breach (2017) 147 million people stolen due to
executives fired
an unpatched vulnerability

Encrypted files across 150+

WannaCry Ransomware Attack Hospitals, businesses disrupted;
countries; targeted outdated
(2017) millions in damages
Windows systems

Personal data of millions

Major privacy backlash;
Facebook (Cambridge Analytica) harvested without consent via
Congressional hearings
app
Key Focus
No system is 100% secure—security is an ongoing process.
Attacks can be technical (malware) or social (phishing).
Organizations must use multiple layers of defense (“Defense in Depth”) to reduce risk.
Security breaches can lead to financial losses, reputational damage, legal penalties, and loss of
data integrity.
What is a Threat?
A threat is any potential danger that could exploit a vulnerability in a computer system,
network, or application and cause harm.
Threats can be intentional (e.g., hacking, malware) or unintentional (e.g., human error, system
failure).
Types of Threats
1. Malware (Malicious Software)
Software designed to damage, disrupt, or gain unauthorized access to systems.
Virus: Attaches itself to clean files and spreads by infecting other programs or files.
Worm: Self-replicates and spreads across networks without needing a host file.
Trojan Horse: Disguises itself as legitimate software but creates a backdoor for attackers.
Example: A user downloads a free game infected with a Trojan that gives hackers control of their
system.
Types of Threats
2. Phishing & Social Engineering
Tricks users into revealing sensitive information by posing as trustworthy entities.
Phishing: Fake emails or websites that mimic real ones to steal passwords, credit card info, etc.
Social Engineering: Manipulating people into giving up confidential data (e.g., pretending to be
IT support).
Example: An employee clicks on a fake email from "HR" and enters login credentials into a fake
portal.
Types of Threats
3. Insider Threats
Security threats that come from people within the organization.
Could be intentional (disgruntled employee stealing data) or unintentional (careless data
handling).
Often the hardest to detect because insiders already have access to systems.
Example: An employee copies customer data to a USB and sells it to competitors.
Types of Threats
4. Denial of Service (DoS) Attacks
Attackers flood a server, website, or network with traffic, causing it to crash or become
unusable.
DoS: Single system overloads the target.
DDoS (Distributed DoS): Multiple systems (botnets) attack the target at once.
Impact: System downtime, lost revenue, customer dissatisfaction.
Example: A shopping website is flooded with requests during a product launch, causing it to go
offline.
Types of Threats
Threat Type Main Goal Example

Malware Damage or steal data Trojan hiding in pirated software

Phishing Steal credentials Fake email from a bank

Insider Threat Misuse of access Employee leaking sensitive files

DoS Attack Disrupt services Botnet attack on a website

Harm – Effects of Security Breaches
What Happens When Security Fails?
When a security breach occurs, organizations and individuals may suffer from a range of
harmful consequences. These harms can be immediate, long-term, tangible, or intangible.
Harm Type Impact Example
Data Loss/Theft Exposure of sensitive info Customer emails stolen in a breach
Company pays ransom and loses
Financial Loss Recovery costs, fines, lost revenue
customers
Reputation Damage Public backlash, lost trust Users delete accounts, stock drops
Violations of GDPR lead to legal
Legal Consequences Lawsuits, fines, regulatory penalties
action
Controls – Measures to Prevent or
Mitigate Threats
What are Security Controls?
Security controls are safeguards or countermeasures put in place to:
Prevent, detect, or respond to security threats.
Reduce risk and minimize the impact of attacks or system failures.
These controls are essential in building a layered security defense (also called Defense in
Depth).
Control Type Purpose Examples
Preventive Stop threats beforehand Firewalls, Antivirus, Training
Detective Identify & alert IDS, Log Monitoring
Corrective Recover from damage Patch Management, Backups
Access Control – Restricting System
Access
What is Access Control?
Access Control is a security technique used to restrict access to systems, network
Key Concept: “Only the right people can access the right resources at the right time.”s, files,
or data only to authorized users.
Why Access Control Matters
Prevents unauthorized access
Protects sensitive data and critical systems
Supports compliance with laws (e.g., GDPR, HIPAA)
Helps reduce internal threats and human errors
Minimizes risk by enforcing "least privilege" — users only get the access they need
Types of Access Control
1️⃣ Discretionary Access Control (DAC)
Definition:
Access is controlled by the data owner, who decides who can access what.
Example:
A user shares a folder on their personal computer and chooses who can view or edit it.
Pros:
Flexible and user-friendly
Cons:
Less secure; users may give access carelessly
Types of Access Control
2️⃣ Mandatory Access Control (MAC)
Definition:
Access is controlled by a central authority based on strict policies and security labels (e.g.,
classification levels: Confidential, Secret, Top Secret).
Example:
Government or military systems where only users with proper clearance can view classified
documents.
Pros:
Highly secure and rule-based
Cons:
Less flexible, harder to manage
Types of Access Control
3️⃣ Role-Based Access Control (RBAC)
Definition: Access is granted based on a user's role within the organization, not the individual. Roles are
assigned specific permissions.
Example:
A Finance role gets access to accounting software, but not to HR records.
A Doctor role can view patient records; a Receptionist cannot.
Pros:
Scalable and efficient
Easy to manage access across large organizations
Cons:
Requires well-defined roles and responsibilities
Type Who Controls Access? Example Use Case Security Level
DAC Data Owner File-sharing on a PC Low–Moderate
MAC System Admin / Policy Military or Gov't High
RBAC Based on User Role Corporate Networks Moderate–High
Authentication – Verifying User Identity
What is Authentication?
Authentication is the process of verifying the identity of a user, device, or system before granting
access to data, services, or resources.
Key Idea: “Are you really who you say you are?”
It's the first line of defense against unauthorized access in cybersecurity.
Why Is Authentication Important?
Prevents unauthorized access
Protects sensitive data and systems
Forms the foundation for secure communication and transactions
Helps organizations comply with security regulations (e.g., GDPR, HIPAA)
Minimizes risk by enforcing "least privilege" — users only get the access they need
Common Authentication Methods
Method Type Example

Password / PIN Knowledge-based Email login, ATM PIN

Two-Factor Auth (2FA) Multi-step login Password + SMS code

Biometric Authentication Inherence-based Fingerprint, Face ID

 Key Takeaways
• Use strong, unique passwords and avoid reuse.
• Enable 2FA wherever possible — it stops most common attacks.
• Biometrics are convenient but should be paired with another method for maximum security.
Cryptography – Protecting Data Using
Codes
What is Cryptography?
Cryptography is the science of protecting data by converting it into a format (called
ciphertext) that only authorized parties can understand.
Key Concept:
“Make data unreadable to unauthorized users — and readable again only with the right
key.”
Used to ensure:
◦ Confidentiality – Keep data private
◦ Integrity – Ensure data hasn’t been altered
◦ Authentication – Confirm identities
◦ Non-repudiation – Prove message origin
Types of Cryptography
1️⃣ Symmetric Encryption
Definition: Same key is used for both encryption and decryption.
Example Algorithm: AES (Advanced Encryption Standard)
Use Cases: File encryption, secure disk storage, VPNs
Example:
Alice encrypts a message using a secret key. Bob uses the same key to decrypt it.
Fast and efficient, but key sharing must be secure

Plaintext → [Encrypt with Secret Key] → Ciphertext

Ciphertext → [Decrypt with Same Key] → Plaintext
Types of Cryptography
2️⃣ Asymmetric Encryption
Definition: Uses a public key to encrypt and a private key to decrypt.
Example Algorithm: RSA (Rivest-Shamir-Adleman)
Use Cases: Secure email, SSL/TLS (HTTPS), digital signatures
Example:
Alice sends Bob a message encrypted with Bob’s public key. Only Bob can decrypt it with his
private key.
Secure for communication, but slower than symmetric encryption.

Sender: Plaintext → [Encrypt with Receiver's Public Key] → Ciphertext

Receiver: Ciphertext → [Decrypt with Private Key] → Plaintext
Types of Cryptography
3️⃣ Hash Functions
Definition: Convert input data into a fixed-length unique value (called a hash). One-way –
cannot be reversed.
Example Algorithm: SHA-256 (Secure Hash Algorithm)
Use Cases: Password storage, data integrity checks, digital signatures
Example:
When you log into a website, your password is hashed and compared to the stored hash value.
Even small changes in input produce a completely different hash.

Input (any size) → [Hash Function] → Output (fixed size hash)

Applications of Cryptography
Application Purpose Used Technologies

Encrypt messages over the

Secure Communication SSL/TLS, AES, RSA
internet

Digital Signatures Verify sender & message integrity RSA, SHA-256

Prevent plain-text storage of

Password Storage Hash functions (SHA-256)
passwords

Data Protection Secure files and databases AES, RSA

Web Attacks – Threats on the Web
What Are Web Attacks?
Web attacks are cyber threats that exploit vulnerabilities in web browsers, websites, or user
behavior to gain unauthorized access, steal data, or install malicious software.

Categories of Web Attacks

Browser Attacks
Web Attacks Targeting Users
Attacks That Exploit Web Applications
Browser Attacks
Target: The user's web browser (Chrome, Firefox, etc.)
Malicious Extensions
Browser add-ons that appear useful but secretly steal data or track activity.
Example: A fake ad blocker that logs keystrokes and sends data to attackers.
Drive-by Downloads
Download and install malware without the user’s knowledge just by visiting a compromised
website.
No click is needed — just visiting the page is enough.
Tip: Always update browsers and avoid untrusted sites/extensions.
Web Attacks Targeting Users
Target: Trick or exploit users while they browse legitimate websites
Phishing
Fake websites or forms that mimic real ones to steal credentials.
Often sent via email, ads, or search engine results.
Example: A login page that looks like your bank but sends your password to a hacker.
Session Hijacking
Stealing a user's active session ID (cookie) to impersonate them.
Used to bypass login, especially on unsecured networks or poorly coded sites.
Tip: Always log out and use HTTPS.
Attacks That Exploit Web Applications
Target: The website or web application itself.
SQL Injection (SQLi)
Inserting malicious SQL code into input fields (like login forms) to access or modify the database.
Example: Entering 'OR '1'='1 in a login field to bypass authentication.
Impact: Hackers can extract, delete, or change data (like user info or admin access).

Cross-Site Scripting (XSS)

Injecting malicious scripts into web pages that are executed in users' browsers.
Example: An attacker posts a comment with JavaScript that steals cookies from other users who
view it.
Impact: Can lead to session hijacking, defacement, or phishing.
Attack Type Target Example
Malicious Extensions Web browser Fake ad blocker steals data
Drive-by Downloads Website → Browser Malware installs on page load
Phishing User Fake login page

Stolen cookies used to

Session Hijacking User session
impersonate user

SQL Injection Website database Login bypass or data theft

XSS User via website Injected scripts steal session data
How to Prevent Web Attacks
Use updated browsers and antivirus software
Never click on suspicious links or emails
Implement input validation and output encoding on websites
Use HTTPS, 2FA, and secure cookies
Regularly scan websites for vulnerabilities
Email Attacks – Threats Delivered via
Email
What Are Email Attacks?
Email attacks are cyber threats delivered through email, targeting users to:
◦ Steal credentials or data
◦ Spread malware
◦ Trick victims into transferring money or disclosing sensitive information

Emails remain one of the most common and successful attack vectors in
cybercrime
1️⃣ Phishing Emails
Fraudulent emails that trick recipients into revealing personal or confidential information
Often appear to come from trusted sources like banks, employers, or government agencies
Example:
"You need to verify your bank account. Click here to log in." → Leads to a fake site.
Variants:
Spear Phishing – Personalized phishing aimed at specific individuals
Whaling – Targeting high-level executives or VIPs
2️⃣ Malware Attachments
Emails that contain malicious file attachments (e.g., .docx, .pdf, .exe)
Once opened, the file installs malware such as:
◦ Ransomware (locks files)
◦ Keyloggers (records keystrokes)
◦ Remote Access Trojans (RATs)

Example:
"Please see attached invoice." → Attachment installs a keylogger when opened.
3️⃣ Business Email Compromise (BEC)
A sophisticated scam where attackers impersonate executives or employees to trick others
(often in finance or HR) into:
◦ Sending money
◦ Revealing sensitive info

Attackers may gain access to a real email account (via phishing or password reuse), or spoof an
email address.
Example:
Fake CEO email: “Urgent – wire $50,000 to this vendor before 5 PM.”
How to Prevent Email Attacks
Verify sender addresses before clicking or responding
Never open unexpected attachments
Use email filters, antivirus, and sandboxing tools
Train employees in phishing awareness
Enable multi-factor authentication (MFA) to protect accounts
Phishing Email
From: IT Support <support@[Link]>
Subject: Mandatory Password Reset Notification
Date: August 6, 2025
To: user@[Link]
Dear User,
Due to a recent system update, you are required to reset your email password within the next
24 hours to avoid being locked out.
Please click the link below to verify your account:
Reset Your Password Now
This is a mandatory update as part of our new security policy. Failure to comply may result in
suspension of your account.
Thank you for your cooperation,
IT Help Desk
Company IT Department
Network Vulnerabilities – Finding
Weaknesses Before Attackers Do
What Are Network Vulnerabilities?
Network vulnerabilities are weaknesses in network systems, configurations, or
protocols that can be exploited by attackers to:
• Gain unauthorized access
• Intercept sensitive data
• Disrupt services
These vulnerabilities may exist in routers, firewalls, open ports, outdated
software, or misconfigured settings.
Open Port / Service Identification
Purpose: Discover which ports are open on a system and what services are
running on them.
Why it matters: Open ports may expose unnecessary or vulnerable services.
Example Tool: nmap
Example: Port 21 (FTP) is open → may allow unencrypted access.
Banner Grabbing / Version Check
Purpose: Identify the version of software/services running on open ports.
Why it matters: Knowing the version helps determine if it's outdated or
vulnerable.
Example Tool: Netcat, Nmap, Telnet
Example: Apache 2.2 found on port 80 → known vulnerabilities exist in that
version.
Traffic Probing / Packet Inspection
Purpose: Analyze network traffic to detect anomalies, unauthorized
communications, or exposed credentials.
Why it matters: Helps reveal data leaks, cleartext logins, or malware
communications.
Example Tool: Wireshark
Example: Capturing traffic shows login credentials being sent in plain text over
HTTP.
Online Vulnerability & Port Scanning
Tools
Shodan – [Link]
Censys – [Link]
Nmap Online Scanner (HackerTarget) – [Link]
Pentest Tools – Network Vulnerability Scanner – [Link]
vulnerability-scanning
VirusTotal (File/IP/URL Scanner) – [Link]
Security Headers – [Link]
Wireshark (Downloadable) – [Link]
Vulnerability Examples – Tools & Exploits
What Are Vulnerabilities?
A vulnerability is a weakness or flaw in a computer system, software application,
network, or security process that can be exploited by a threat actor (hacker,
malware, or insider) to:
o Gain unauthorized access
o Steal, alter, or delete data
o Disrupt services
o Bypass security controls
Types of Vulnerabilities

Category Examples
Software Vulnerabilities Buffer overflow, code injection, memory leaks
Network Vulnerabilities Open ports, weak firewall rules, exposed services
Default passwords, unrestricted permissions,
Configuration Issues
unencrypted data
Authentication Flaws Weak passwords, no MFA, session fixation
Human-related (Social Engineering) Phishing, poor security awareness
Vulnerability Scanners
OpenVAS
Open-source, full-featured vulnerability scanner for networks and hosts.
[Link]
Nessus (by Tenable)
Industry-leading commercial vulnerability scanner with free trial versions.
[Link]
Qualys FreeScan
Cloud-based vulnerability scanning for websites and networks.
[Link]
Nikto
Open-source web server scanner focusing on outdated software and misconfigurations.
[Link]
Exploitation Frameworks
Metasploit Framework
Comprehensive toolkit for exploiting vulnerabilities, post-exploitation, and payload generation.
[Link]
BeEF (Browser Exploitation Framework)
Focuses on browser-based exploits and social engineering attacks.
[Link]
SQLmap
Automated tool for detecting and exploiting SQL injection vulnerabilities.
[Link]
Responder
Tool to exploit network protocols like NetBIOS, LLMNR, and WPAD for credential harvesting.
[Link]
OpenVAS: Basic Vulnerability Scan Demo
Setup: Install OpenVAS in a lab VM or use Greenbone’s Community Edition.
Demo: Scan your local network or a test VM with vulnerable services (e.g.,
Metasploitable).
Output: Review the report showing open ports, vulnerabilities, CVE IDs, and risk
ratings.
Goal: Learn how to interpret scanner results and prioritize fixes.
Metasploit: Exploit a Known Vulnerability
Setup: Use a vulnerable VM like Metasploitable2 or Windows XP test machine.
Demo: Launch Metasploit, select an exploit (e.g., vsftpd backdoor), set the
target IP, and run it.
Output: Gain a shell on the target machine (simulated “hack”).
Goal: Understand how exploits work and why patching matters.
Nikto: Scan a Web Server
Setup: Point Nikto at a test web server (can be local or hosted).
Demo: Run Nikto and see if it finds outdated software or security headers
missing.
Output: A list of possible web vulnerabilities and recommendations.
Goal: Understand common web server misconfigurations.
Network Vulnerability Scanning Tools
Netcat
◦ Port scanning and banner grabbing tool
◦ Used to check open ports and grab service info
◦ Lightweight and versatile for network debugging
Socat
◦ Network relay and debugging utility
◦ Can forward ports, create proxies, and test connections
◦ Useful for advanced network troubleshooting
Network Vulnerability Scanning Tools
Network Sniffers
◦ Wireshark: Graphical packet capture and analysis tool
◦ tcpdump: Command-line packet analyzer for capturing network traffic
◦ Capture and analyze live network data to detect suspicious activity
Injection Tools
◦ SQLmap: Automated SQL injection detection and exploitation tool
◦ Burp Suite: Integrated platform for web application security testing, including
injection vulnerabilities
Netcat
Link: [Link]
Description: Port scanning, banner grabbing, network debugging [Link]
Demo:
◦ Scan open ports on a local machine: nc -zv [Link] 20-80
◦ Grab a banner (e.g., HTTP server): nc [Link] 80 GET / HTTP/1.0
Socat
Link: [Link]
Description: Network relay, port forwarding, and debugging tool.
Practical Demo:
Forward local port 8080 to remote host port 80:
◦ socat TCP-LISTEN:8080,fork TCP:[Link]:80