Ccs354 Network Security Lab
Ccs354 Network Security Lab
NAME:
REG NO:
YEAR:
SEMESTER:
BRANCH:
1
Dept. of CSE
BONAFIDE CERTIFICATE
2023-2024.
2
Dept. of CSE Jeppiaar Ins 琀椀 tute of Technology
INSTITUTE VISION
INSTITUTE MISSION
IM4: To strive for productive partnership between the Industry and the Institute
for research anddevelopment in the emerging fields and creating opportunities for
employability.
IM5: To serve the global community by instilling ethics, values and life skills
among the studentsneeded to enrich their lives.
3
Dept. of CSE Jeppiaar Ins 琀椀 tute of Technology
DEPARTMENT VISION
To impart futuristic technological education, innovation and collaborative research
in the field of Computer Science and Engineering and to develop Quality
Professionals for the improvement of the society and industry.
DEPARTMENT MISSION
DM1: Develop the students as professionally competent and disciplined engineers
for the benefit of thedevelopment of the country.
DM2: Produce excellent infrastructure to adopt latest technologies, industry-
institute interaction andencouraging research activities.
DM3: Provide multidisciplinary technical skills to pursue research activities, higher
studies,entrepreneurship and perpetual learning.
DM4: Enrich students with professional integrity and ethical standards to
handle social challengessuccessfully in their life.
Graduates can
PEO1 Apply their technical competence in computer science to solve real world
problems, with technical and people leadership.
PEO2 Conduct cutting edge research and develop solutions on problems of social
relevance.
PEO3 Work in a business environment, exhibiting team skills, work ethics,
adaptability and lifelong learning.
4
Dept. of CSE Jeppiaar Ins 琀椀 tute of Technology
PROGRAM OUTCOMES
5
Dept. of CSE Jeppiaar Ins 琀椀 tute of Technology
ANNA UNIVERSITY SYLLABUS CCS354 –
NETWORK SECURITY LABORATORY
LTPC
2023
4. Installation
of Wire shark, tcpdump and observe data transferred in client-server
communication using UDP/TCP and identify the UDP/TCP datagram.
6
Dept. of CSE Jeppiaar Ins 琀椀 tute of Technology
INDEX
7
Dept. of CSE Jeppiaar Ins 琀椀 tute of Technology
Ex. No: 1 a) Date:Data Encryption Standard (DES) Algorithm (User Message Encrypti
AIM:
To use Data Encryption Standard (DES) Algorithm for a practical application like User
Message Encryption.
ALGORITHM:
PROGRAM:
DES.java
import java.security.InvalidKeyException; import
java.security.NoSuchAlgorithmException; import
javax.crypto.BadPaddingException; import
javax.crypto.Cipher;
import javax.crypto.IllegalBlockSizeException; import
javax.crypto.KeyGenerator;
import javax.crypto.NoSuchPaddingException; import
javax.crypto.SecretKey;
public class DES
{
public static void main(String[] argv) { try{
System.out.println("Message Encryption Using DES Algorithm\n---------------------");
KeyGenerator keygenerator = KeyGenerator.getInstance("DES"); SecretKey
myDesKey = keygenerator.generateKey();
Cipher desCipher;desCipher = Cipher.getInstance("DES/ECB/PKCS5Padding");
8
Dept. of CSE Jeppiaar Ins 琀椀 tute of Technology
desCipher.init(Cipher.ENCRYPT_MODE, myDesKey); byte[] text
= "Secret Information ".getBytes(); System.out.println("Message
[Byte Format] : " + text); System.out.println("Message : " + new
String(text)); byte[] textEncrypted = desCipher.doFinal(text);
System.out.println("Encrypted Message: " + textEncrypted);
desCipher.init(Cipher.DECRYPT_MODE, myDesKey); byte[]
textDecrypted = desCipher.doFinal(textEncrypted);
System.out.println("Decrypted Message: " + new
String(textDecrypted));
}catch(NoSuchAlgorithmException e){
e.printStackTrace();
}catch(NoSuchPaddingException e){
e.printStackTrace();
}catch(InvalidKeyException e){
e.printStackTrace();
}catch(IllegalBlockSizeException e){
e.printStackTrace();
}catch(BadPaddingException e){
e.printStackTrace();
}
}
}
OUTPUT:
RESULT:
Thus the java program for DES Algorithm has been implemented
and the output verified successfully.
9
Dept. of CSE Jeppiaar Ins 琀椀 tute of Technology
Ex. No: 1 b) Date:
Advanced Encryption Standard (AES) Algorithm (URL Encryption)
AIM:
To use Advanced Encryption Standard (AES) Algorithm for a practical application
like URL Encryption.
ALGORITHM:
PROGRAM:
AES.java
import java.io.UnsupportedEncodingException; import
java.security.MessageDigest;
import java.security.NoSuchAlgorithmException; import
java.util.Arrays;
import java.util.Base64; import
javax.crypto.Cipher;
import javax.crypto.spec.SecretKeySpec; public
class AES {
private static SecretKeySpec secretKey;
private static byte[] key;
public static void setKey(String myKey) {
MessageDigest sha = null;
try {
key = myKey.getBytes("UTF-8");
sha = MessageDigest.getInstance("SHA-1"); key =
sha.digest(key);
key = Arrays.copyOf(key, 16);
secretKey = new SecretKeySpec(key, "AES");
} catch (NoSuchAlgorithmException e) {
e.printStackTrace();} catch (UnsupportedEncodingException e) {
e.printStackTrace();
}
}
10
Dept. of CSE Jeppiaar Ins 琀椀 tute of Technology
public static String encrypt(String strToEncrypt, String secret) { try {
setKey(secret);
Cipher cipher = Cipher.getInstance("AES/ECB/PKCS5Padding");
cipher.init(Cipher.ENCRYPT_MODE, secretKey);
return Base64.getEncoder().encodeToString(cipher.doFinal(strToEncrypt.getBytes("U TF-
8")));
} catch (Exception e) {
System.out.println("Error while encrypting: " + e.toString());
}
return null;
}
public static String decrypt(String strToDecrypt, String secret) { try {
setKey(secret);
Cipher cipher = Cipher.getInstance("AES/ECB/PKCS5PADDING");
cipher.init(Cipher.DECRYPT_MODE, secretKey);
return new String(cipher.doFinal(Base64.getDecoder().decode(strToDecrypt)));
} catch (Exception e) {
System.out.println("Error while decrypting: " + e.toString());
}
return null;
}
public static voidmain(String[] args) { final
String secretKey = "annaUniversity";
String originalString = "www.annauniv.edu";
String encryptedString = AES.encrypt(originalString, secretKey); String
decryptedString = AES.decrypt(encryptedString, secretKey);
System.out.println("URL Encryption Using AES Algorithm\n--------------------------");
System.out.println("Original URL: " + originalString);
8System.out.println("Encrypted URL: " + encryptedString);
System.out.println("Decrypted URL: " + decryptedString);
}
}
11
Dept. of CSE Jeppiaar Ins 琀椀 tute of Technology
OUTPUT:
URL Encryption Using AES Algorithm
RESULT:
Thus the java program for AES Algorithm has been implemented for
URL Encryption and the output verified successfully
12
Dept. of CSE Jeppiaar Ins 琀椀 tute of Technology
Ex. No: 2 a) Date:
RSA Algorithm
AIM:
ALGORITHM:
PROGRAM:
rsa.html
<html>
<head>
<title>RSA Encryption</title>
<meta name="viewport" content="width=device-width, initial-scale=1.0">
</head>
<body>
<center>
<h1>RSA Algorithm</h1>
<h2>Implemented Using HTML & Javascript</h2>
<hr>
<table>
<tr>
<td>Enter First Prime Number:</td>
<td><input type="number" value="53" id="p"></td>
</tr>
<tr>
13
Dept. of CSE Jeppiaar Ins 琀椀 tute of Technology
<td>Enter Second Prime Number:</td>
<td><input type="number" value="59" id="q"></p>
</td></tr>
<tr>
<td>Enter the Message(cipher text):<br>[A=1, B=2,...]</td>
<td><input type="number" value="89" id="msg"></p>
</td>
</tr>
<tr>
<td>Public Key:</td>
<td>
<p id="publickey"></p>
</td>
</tr>
<tr>
<td>Exponent:</td>
<td>
<p id="exponent"></p>
</td>
</tr>
<tr>
<td>Private Key:</td>
<td>
<p id="privatekey"></p>
</td>
</tr>
<tr>
<td>Cipher Text:</td>
<td>
<p id="ciphertext"></p>
</td>
</tr>
<tr>
<td><button onclick="RSA();">Apply RSA</button></td>
</tr>
</table>
</center>
</body>
<script type="text/javascript">
function RSA() {
var gcd, p, q, no, n, t, e, i, x;
gcd = function (a, b) { return (!b) ? a : gcd(b, a % b); }; p =
document.getElementById('p').value;
14
Dept. of CSE Jeppiaar Ins 琀椀 tute of Technology
11q = document.getElementById('q').value; no =
document.getElementById('msg').value; n = p * q;
t = (p - 1) * (q - 1);
for (e = 2; e < t; e++) { if
(gcd(e, t) == 1) { break;
}
}
for (i = 0; i < 10; i++) { x =
1+i*t
if (x % e == 0) { d
= x / e;
break;
}
}
ctt = Math.pow(no, e).toFixed(0); ct =
ctt % n;
dtt = Math.pow(ct, d).toFixed(0); dt =
dtt % n;
document.getElementById('publickey').innerHTML = n;
document.getElementById('exponent').innerHTML = e;
document.getElementById('privatekey').innerHTML = d;
document.getElementById('ciphertext').innerHTML = ct;
}
</script>
</html>
15
Dept. of CSE Jeppiaar Ins 琀椀 tute of Technology
OUTPUT:
RESULT:
Thus the RSA algorithm has been implemented using HTML & CSS and the
output has been verified successfully.
16
Dept. of CSE Jeppiaar Ins 琀椀 tute of Technology
Ex. No: 2b) Date:Diffie-Hellman key exchange algorithm
AIM:
ALGORITHM:
1. Alice and Bob publicly agree to use a modulus p = 23 and base g = 5 (which is
a primitive root modulo 23).
2. Alice chooses a secret integer a = 4, then sends Bob A = g a mod p
o A = 5 4 mod 23 = 4
3. Bob chooses a secret integer b = 3, then sends Alice B = g b mod p
o B = 5 3 mod 23 = 10
4. Alice computes s = B a mod p
o s = 10 4 mod 23 = 18
5. Bob computes s = A b mod p
o s = 4 3 mod 23 = 18
6. Alice and Bob now share a secret (the number 18).
PROGRAM:
DiffieHellman.java
class DiffieHellman {
public static void main(String args[]) {
int p = 23; /* publicly known (prime number) */ int g =
5; /* publicly known (primitive root) */ int x = 4; /*
only Alice knows this secret */
int y = 3; /* only Bob knows this secret */ double
aliceSends = (Math.pow(g, x)) % p;
double bobComputes = (Math.pow(aliceSends, y)) % p; double
bobSends = (Math.pow(g, y)) % p;
double aliceComputes = (Math.pow(bobSends, x)) % p; double
sharedSecret = (Math.pow(g, (x * y))) % p;
System.out.println("simulation of Diffie-Hellman key exchange algorithm\n-----
");
System.out.println("Alice Sends : " + aliceSends); System.out.println("Bob
Computes : " + bobComputes);
17
Dept. of CSE Jeppiaar Ins 琀椀 tute of Technology
System.out.println("Bob Sends : " + bobSends);System.out.println("Alice Computes :
" + aliceComputes);
System.out.println("Shared Secret : " + sharedSecret);
/* shared secrets should match and equality is transitive */
if ((aliceComputes == sharedSecret) && (aliceComputes == bobComputes))
System.out.println("Success: Shared Secrets Matches! " + sharedSecret); else
System.out.println("Error: Shared Secrets does not Match");
}
}
OUTPUT:
simulation of Diffie-Hellman key exchange algorithm
RESULT:
Thus the Diffie-Hellman key exchange algorithm has been implemented using Java
Program and the output has been verified successfully.
18
Dept. of CSE Jeppiaar Ins 琀椀 tute of Technology
Ex. No: 3 Digital Signature Standard
Date:
AIM:
ALGORITHM:
PROGRAM:
import java.security.KeyPair;
import java.security.KeyPairGenerator;
import java.security.PrivateKey; import
java.security.Signature;
import java.util.Scanner;
public class CreatingDigitalSignature {
public static void main(String args[]) throws Exception { Scanner
sc = new Scanner(System.in); System.out.println("Enter some
text");
String msg = sc.nextLine();
KeyPairGenerator keyPairGen = KeyPairGenerator.getInstance("DSA");
keyPairGen.initialize(2048);
KeyPair pair = keyPairGen.generateKeyPair();
PrivateKey privKey = pair.getPrivate(); Signature sign
=
Signature.getInstance("SHA256withDSA");sign.initSign(privKey); byte[] bytes =
"msg".getBytes();
sign.update(bytes);
byte[] signature = sign.sign();
System.out.println("Digital signature for given text: "+new String(signature, "UTF8"));
19
Dept. of CSE Jeppiaar Ins 琀椀 tute of Technology
}
}
OUTPUT:
RESULT:
Thus the Digital Signature Standard Signature Scheme has been
implemented and the output has been verified successfully.
20
Dept. of CSE Jeppiaar Ins 琀椀 tute of Technology
Ex. No: 4
Date: Installation of Wire shark, tcp dump and observe data transferred in cl
Aim:
To install the Wire shark,TCP dump and observe data transferred in client- server
communication using UDP/TCP and identity the TCP/UDP datagram.
Procedure:
There are many ways to cause your computer to send and receive UDP messages
since UDP is widelyused as a transport protocol. The easiest options are to:
Do nothing but wait for a while. UDP is used for many “system protocols” that
typically run in the background and produce small amounts of traffic, e.g., DHCP
for IP address assignment andNTP for time synchronization.
Use your browser to visit sites. UDP is used by DNS for resolving domain
names to IP addresses,so visiting fresh sites will cause DNS traffic to be sent. Be
careful not to visit unsafe sites; pick recommended sites or sites you know about
but have not visited recently. Simply browsing the web is likely to cause a steady
stream of DNS traffic.
Start up a voice-over-IP call with your favorite client. UDP is used by RTP, which
is the protocol commonly used to carry media samples in a voice or video call
overthe Internet.
3. Wireshark will automatically start capturing packets on the network. Now, enter a
filter of udp. (This is shown below).
Figure 3: Setting up the capture options.
4. When the capture is started, it will collect UDP traffic automatically.
5. Wait a little while (say 60 seconds) after you have stopped your activity to also
observe any background UDP traffic. It is likely that you will observe
a trickle of UDP traffic because system activity often uses UDP to
communicate. We want to see some of this activity.
Different computers are likely to capture different kinds of UDP traffic depending on the
network setup and local activity. Observe that the protocol column is likely to show multiple
protocols, none of which is UDP. This is because the listed protocol is an application
protocol layered on top of UDP. Wireshark gives the name of the application protocol, not
the (UDP) transport protocol unless Wireshark cannot determine the application protocol.
However, even if the packets are listed as an application protocol, they will have a UDP
protocol header for us to study, following the IP and lower-layer protocol headers.
Select different packets in the trace (in the top panel) and browse the expanded UDP
header (in the mid- dle panel). You will see that it contains the following fields:
Source Port, the port from which the UDP message is sent. It is given as a number
and possibly a text name; names are given to port values that are registered for use
with a specific application.
Destination Port. This is the port number and possibly name to which the UDP
message is des-tined. Ports are the only form of addressing in UDP. The computer is
identified using the IP ad-dress in the lower IP layer.
Checksum. A checksum over the message that is used to validate its contents. Is your
checksum carrying 0 and flagged as incorrect for UDP messages sent from your
computer? On some com- puters, the operating system software leaves the checksum
blank (zero) for the NIC to compute and fill in as the packet is sent. This is called
protocol offloading. It happens after Wireshark seesthe packet, which causes Wireshark
to believe that the checksum is wrong and flag it with a dif- ferent color to signal a
problem. You can remove these false errors if they are occurring by tell- ing Wireshark
not to validate the checksums. Select “Preferences” from the Wireshark menus and
expand the “Protocols” area. Look under the list until you come to UDP. Uncheck
“Validate checksum if possible”.
The UDP header has different values for different messages, but as you can see, it is short
and sweet. The remainder of the message is the UDP payload that is normally identified the
higher-layer protocol that it carries, e.g., DNS, or RTP.
The figure below shows the UDP message structure as you observed. It shows the position
of the IP header, UDP header, and UDP payload. Within the UDP header, it shows the
position and size of each UDP field. Note how the Length field gives the length of the UDP
payload plus the UDP header. The checksum is 16 bits long and the UDP header is 8 bytes
long.
The Protocol field in the IP header is how IP knows that the next higher protocollayer is
UDP. The IP Pro-tocol field value of 17 indicates UDP.
You might be surprised to find UDP messages in your trace that neither come from your
computer or aresent only to your computer. You can see this by sorting on the Source and
Destination columns. The source and destinations will be domain names, if Network layer
name resolution is turned on, and oth- erwise IP addresses. (You can toggle this setting using
the View menu and selecting Name resolution.) You can find out the IP address of your
computer using the “ipconfig” command(Windows).
The reason you may find UDP messages without your computer’s IP address as either the
source or des-tination IP address is that UDP is widely used as part of system protocols.
These protocols often send messages to all local computers who are interested in them using
broadcast and multicast addresses. In our traces, we find DNS (the domain name system),
MDNS (DNS traffic that uses IP multicast), NTP (for time synchronization), NBNS
(NetBIOS traffic), DHCP (for IP addressassignment), SSDP (a service discov- ery protocol),
STUN (a NAT traversal protocol), RTP (for carrying audio and video samples), and more.
A variety of broadcast and multicast addresses may be found. These include the Internet
broadcast ad- dress of 255.255.255.255, subnet broadcast addresses such as 192.168.255.255
and multicast IP ad- dresses such as 224.0.xx.xx for multicast DNS.
Note also that UDP messages can be as large as roughly 64Kbytes but most often they
are a few hun-dred bytes or less, typically around 100 bytes.
TCP
Objective
To see the details of TCP (Transmission Control Protocol). TCP is the main transport
layer protocol usedin the Internet.
First comes the source port, then the destination port. This is the addressing that TCP
adds be- yond the IP address. The source port is likely to be 80 since the packet was
sent by a web server and the standard web server port is 80.
Then there is the sequence number field. It gives the position in the byte stream of
the first pay-load byte.
Next is the acknowledgement field. It tells the last received position in the reverse
byte stream.
The flags field has multiple flag bits to indicate the type of TCP segment. You can
expand it andlook at the possible flags.
There may be an Options field with various options. You can expand this field and
explore if youwould like, but we will look at the options in more detail later.
Finally, there may be a TCP payload, carrying the bytes that are being transported.
As well as the above fields, there may be other informational lines that Wireshark provides
to help youinterpret the packet. We have covered only the fields that are carried across the
network.
The Header length and Flags fields are combined into a 2-byte quantity. It is not easy
to deter-mine their bit lengths with Wireshark.
The Urgent Pointer field is shown as dotted. This field is typically not used, and so does
not showup in Wireshark and we do not expect you to have it in your drawing. You can
notice its exist- ence in Wireshark, however, by observing the zero bytes in the segment
that are skipped over as you select the different fields.
The Options field is shown dotted, as it may or may not be present for the segments in
your trace. Most often it will be present, and when it is then its length will be a multiple
of four bytes.
The Payload is optional. It is present for the segment you viewed, but not present on an
Ack-only segment, for example.
Note, you can work out sizes yourself by clicking on a protocol block in the middle panel
(the block itself, not the “+” expander). Wireshark will highlight the corresponding bytes
in the packetin the lower panel, and display the length at the bottom of the window. You
may also use the overall packet size shown in the Length column or Frame detail block.
See below where a TCP packet
of length 66 is highlighted.
Three-Way Handshake
To see the “three-way handshake” in action, look for a TCP segment with the SYN flag
on. These are up at the beginning of your trace, and the packets that follow it (see below).
Figure 9: Selecting a TCP segment with SYN flag.
The SYN flag is noted in the Info column. You can also search for packets with the SYN
flag on using the filter expression “tcp.flags.syn==1”. (See below)
A “SYN packet” is the start of the three-way handshake. In this case it will be sent from your
computer to the remote server. The remote server should reply with a TCP segment with the
SYN and ACK flags set, or a “SYN ACK packet”. On receiving this segment, your computer
will ACK it, consider the connec-tion set up, and begin sending data, which in this case will
be the HTTP request.
Figure 11: Clearing the display filter TCP segment with SYN flag on
If you do this correctly, you should see the full trace. We are most interested in the first three
packets.
Below is a time sequence diagram of the three-way handshake in your trace, up to and
including the first data packet (the HTTP GET request) sent by ‘your computer’ when the
connection is established. As usual, time runs down the page, and lines across the page
indicate segments.
Figure 13: Time sequence diagram for the TCP three-way handshake.
The initial SYN has no ACK number, only a sequence number. All subsequent packets
have ACKnumbers.
The initial sequence numbers are shown as zero in each direction. This is because our
Wireshark is configured to show relative sequence numbers. The actual sequence
number is some large 32-bit number, and it is different for each end.
For the Data segment, the sequence number and ACK stay with the
previous values. The sequence number will advance as the sender sends more data. The
ACK number will advance as the sender receives more data from the remote server.
The three packets received and sent around 88ms happen very close together
compared to the gap between the first and second packet. This is because they are
local operations; there is no network delay involved.
Common Options include Maximum Segment Size (MSS) to tell the other side the largest
segment that can be received, and Timestamps to include information on segments for
estimating the round trip time. There are also Options such as NOP (No-operation) and End
of Option list that serve to format the Op- tions but do not advertise capabilities. You do not
need to include these formatting options in your an- swer above. Options can also be carried
on regular segments after the connection is set up when they play a role in data transfer. This
depends on the Option. For example: the MSS option is not carried on each packet because it
does not convey new information; timestamps may be included on each packet to keep a
fresh estimate of the RTT; and options such as SACK (Selective Acknowledgments) are used
only when data is received out of order.
Our TCP Options are Maximum Segment Size, Window Scale, SACK permitted, and
Timestamps. Each of these Options is used in both directions. There are also the NOP &
End of Option List formatting options.
to note:
Like the SYN, the FIN flag occupies one sequence number. Thus, when the sequence
number ofthe FIN is 192, the corresponding Ack number is 193.
Your sequence numbers will vary. Our numbers are relative (as computed by
Wireshark) but clearly depend on the resource that is fetched. You can tell that it is
around 1 MB long.
The RTT in the FIN exchange is like that in the SYN exchange, as it should be.
Your RTT will vary depending on the distance between the computer and server
as before.
Finally, the TCP connection is taken down after the download is complete. This is typically
done with FIN (Finalize) segments. Each side sends a FIN to the other and acknowledges the
FIN they receive; it is simi- lar to the three-way handshake. Alternatively, the connection
may be torn down abruptly when one end sends a RST (Reset). This packet does not need to
be acknowledged by the other side.
Below is a picture of the teardown in your trace, starting from when the first FIN or RST is
issued untilthe connection is complete. It shows the sequence and ACK numbers on each
segment.
Figure 15: Time sequence diagram for RST teardown Points
to note:
The teardown is abrupt – a single RST in this case, and then it is closed, which the
other endmust accommodate.
The sequence and Ack numbers do not really matter here. They are simply the
(relativeWireshark) values at the end of the connection.
For this part, we are going to launch an older version of Wireshark called Wireshark legacy.
You do thisby selecting the Wireshark legacy application as follows.
When it launches, you should open the trace-tcp file which is in your downloads folder from
earlier.
You should then be presented with the same trace-tcp as used previously in this exercise.
The middle portion of the TCP connection is the data transfer, or download, in our trace.
This is the mainevent. To get an overall sense of it, we will first look at the download rate
over time.
Under the Statistics menu select an “IO Graph” (as shown below).
Under the Statistics menu select an “IO Graph” (as shown below).
You should end up with a graph like below. By default, this graph shows the rate of
packets over time. You might be tempted to use the “TCP Stream Graph” tools under the
Statistics menu instead. However,these tools are not useful for our case because they
assume the trace is taken near the computer send- ing the data; our trace is taken near the
computer receiving the data.
Figure 17: The IO graph
Now we will tweak it to show the download rate with the changes given below
On the x-axis, adjust the tick interval and pixels per tick. The tick interval should be
small enoughto see into the behavior over the trace, and not so small that there is no
averaging. 0.1 seconds is a good choice for a several second trace. The pixels per tick
can be adjusted to make the graph wider or narrower to fill the window. Make this 10.
See below
Add a filter expression to see only the download packets. So far we are looking at all of
the pack-ets. Assuming the download is from the usual web server port of 80, you can
filter for it with a filter of “tcp.srcport==80”.
Don’t forget to press Enter, and you may need to click the “Graph” button to
cause it to redisplay.
To see the corresponding graph for the upload traffic, enter a second filter in the next
box. Againassuming the usual web server port, the filter is
“tcp.dstport==80”. After you press Enter and click the Graph button, you should have two
lines on the graph.
Our graph for this procedure is shown in the figure on next page. From it we can see the
sample down- load rate quickly increase from zero to a steady rate, with a bit of an
exponential curve. This is slow- start. The download rate when the connection is running is
approximately 2.5 Mbps. The upload rate is asteady, small trickle of ACK traffic. Our
download also proceeds fairly steadily until it is done. This is the ideal, but many downloads
may display more variable behavior if, for example, the available bandwidth varies due to
competing downloads, the download rate is set by the server rather than the network, or
enough packets are lost to disrupt the transfer.
Note, you can click on the graph to be taken to the nearest point in the trace if there is a
feature youwould like to investigate.
Try clicking on parts of the graph and watch where you are taken in the Wireshark
trace window.
Inspect the packets in the download in the middle of your trace for these features:
You should see a pattern of TCP segments received carrying data and ACKs sent
back to the server. Typically, there will be one ACK every couple of packets.
These ACKs are called DelayedACKs. By delaying for a short while, the number
of ACKs is halved.
Since this is a download, the sequence number of transmitted segments will not
increase (afterthe initial get). Thus the ACK number on received segments will not
increase either.
Each segment carries Window information to tell the other end how much space
remains in the buffer. The Window must be greater than zero, or the connection will
be stalled by flow control.
Note the data rate in the download direction in packets/second and bits/second once the
TCP connec-tion is running well is 250 packet/sec and 2.5 Mbps.
Our download packets are 1434 bytes long, of which 1368 bytes are the TCP payload
carrying contents.Thus 95% of the download is content.
The data rate in the upload direction in packets/second and bits/second due to the ACK
packets is 120 packets/sec and 60,000 bits/sec. We expect the ACK packet rate to be around
half of the data packet rate for the typical pattern of one delayed ACK per two data packets
received. The ACK bit rate will be at least an order of magnitude below the data bit rate as
the packets are much smaller, around 60 bytes.
The Ack number tells the next expected sequence number therefore it will be X plus the
number of TCPpayload bytes in the data segment.
RESULT:
Thus the above Installation of Wire shark, tcp dump and observe data transferred
in client-server communication using UDP/TCP and identify the UDP/TCP datagram is
installed and verified Successfully.
Ex. No: 5
Date: Check message integrity and confidentiality using SSL
AIM:
ALGORITHM:
1. **Setting up SSL/TLS:**
Use Java's `SSLSocket` and `SSLServerSocket` classes to establish a secure connection
between client and server.
2. **Ensuring Confidentiality:**
- Use SSL/TLS to encrypt the communication between client and server. This encryption
ensures that the message content is secure from eavesdropping.
3. **Ensuring Integrity:**
- SSL/TLS provides integrity by using cryptographic hashing algorithms (like HMAC) to
verify that the transmitted data has not been altered during transmission.
PROGRAM:
import javax.net.ssl.*;
import java.io.*;
import java.security.*;
public class Server {
public static void main(String[] args) {
try {
SSLServerSocketFactory serverSocketFactory = (SSLServerSocketFactory)
SSLServerSocketFactory.getDefault();
SSLServerSocket serverSocket = (SSLServerSocket)
serverSocketFactory.createServerSocket(9999);
SSLSocket sslSocket = (SSLSocket)
serverSocket.accept();
// Read data from client
BufferedReader input = new BufferedReader(new
InputStreamReader(sslSocket.getInputStream()));
String clientMessage = input.readLine();
System.out.println("Received from client: " + clientMessage);
Result:
Thus the message integrity and confidentiality using SSL is executed
Successfully.
Ex. No: 6
Date: Experiment Eavesdropping, Dictionary attacks, MITM attacks
Aim:
Procedure:
You can think of this type of attack as similar to the game of telephone where one person's
words are carried along from participant to participant until it has changed by the time it
reaches the final person. In a man-in-the-middle attack, the middle participant manipulates
the conversation unknown to either of the two legitimate participants, acting to retrieve
confidential information and otherwise cause damage.
Man-in-the-middle attacks:
Although the central concept of intercepting an ongoing transfer remains the same,
there are several different ways attackers can implement a man-in-the-middle attack.
Scenario 1: Intercepting Data
1. The attacker installs a packet sniffer to analyze network traffic for insecure
communications.
2. When a user logs in to a site, the attacker retrieves their user information and redirects
them to a fake site that mimics the real one.
3. The attacker's fake site gathers data from the user, which the attacker can then use on
the real site to access the target's information.
In this scenario, an attacker intercepts a data transfer between a client and server. By
tricking the client into believing it is still communicating with the server and the server into
believing it is still receiving information from the client, the attacker is able to intercept data
from both as well as inject their own false information into any future transfers.
1. The attacker sets up a fake chat service that mimics that of a well-known bank.
2. Using knowledge gained from the data intercepted in the first scenario, the attacker
pretends to be the bank and starts a chat with the target.
3. The attacker then starts a chat on the real bank site, pretending to be the target and
passing along the needed information to gain access to the target's account.
In this scenario, the attacker intercepts a conversation, passing along parts of the
discussion to both legitimate participants.
44
Dept. of CSE Jeppiaar Ins 琀椀 tute of Technology
Real-World MITM Attacks
In 2011, Dutch registrar site DigiNotar was breached, which enabled a threat actor to gain
access to 500 certificates for websites like Google, Skype, and others. Access to these
certificates allowed the attacker to pose as legitimate websites in a MITM attack, stealing
users' data after tricking them into entering passwords on malicious mirror sites. DigiNotar
ultimately filed for bankruptcy as a result of the breach.
In 2017, credit score company Equifax removed its apps from Google and Apple after a
breach resulted in the leak of personal data. A researcher found that the app did not
consistently use HTTPS, allowing attackers to intercept data as users accessed their accounts.
Any improperly secured interaction between two parties, whether it's a data transfer
between a client and server or a communication between two individuals over an internet
messaging system, can be targeted by man-in-the- middle attacks. Logins and
authentication at financial sites, connections that should be secured by public or private
keys, and any other situation where an ongoing transaction could grant an attacker access
to confidential information are all susceptible.
Man-in-the-middle attacks are only one form of session hijacking. Others include:
Sniffing - An attacker uses software to intercept (or "sniff") data being sent to
or from your device.
Sidejacking - An attacker sniffs data packets to steal session cookies from your
device, allowing them to hijack a user session if they find unencrypted login
information.
Result:
Thus the study of Eavesdropping, Dictionary attacks, MITM attacks is
successfully completed.
45
Dept. of CSE Jeppiaar Ins 琀椀 tute of Technology
Ex. No: 7
Date: Experiment with Sniff Traffic using ARP Poisoning
AIM:
Static ARP entries: these can be defined in the local ARP cache and the switch configured
to ignore all auto ARP reply packets. The disadvantage of this method is, it’s difficult to
maintain on large networks. IP/MAC address mapping has to be distributed to all the
computers on the network.
ARP poisoning detection software: these systems can be used to cross check the IP/MAC
address resolution and certify them if they are authenticated.
Uncertified IP/MAC address resolutions can then be blocked.
Operating System Security: this measure is dependent on the operating system been used.
The following are the basic techniques used by various operating systems.
Microsoft Windows: the ARP cache behavior can be configured via the
registry. The following list includes some of the software that can be used to protect
networks against sniffing;
46
Dept. of CSE Jeppiaar Ins 琀椀 tute of Technology
XArp– provides protection against both passive and active sniffing
We are using Windows 7 for this exercise, but the commands should be able to work on
other versions of windows as well.
Open the command prompt and enter the following command arp –a
HERE,
Note: dynamic entries are added and deleted automatically when using TCP/IP sessions
with remote computers.
Static entries are added manually and are deleted when the computer is restarted, and the
network interface card restarted or other activities that affect it.
47
Dept. of CSE Jeppiaar Ins 琀椀 tute of Technology
Adding static entries
Open the command prompt then use the ipconfig /all command to get the IP and MAC
address.
The MAC address is represented using the Physical Address and the IP address is
IPv4Address.
Note: The IP and MAC address will be different from the ones used here. This is because
they are unique.
48
Dept. of CSE Jeppiaar Ins 琀椀 tute of Technology
You will get the following results
Note the IP address has been resolved to the MAC address we provided and it is of a static
type.
P.S. ARP poisoning works by sending fake MAC addresses to the switch.
RESULT:
Thus the Sniff Traffic using ARP Poisoning is demonstrated
successfully.
49
Dept. of CSE Jeppiaar Ins 琀椀 tute of Technology
Ex. No: 8
Date: Demonstration of Intrusion Detection System (IDS)
AIM:
3. Double click on the .exe to install snort. This will install snort in the “C:\
Snort” folder.It is important to have WinPcap (https://www.winpcap.org/install/)
installed
4. Extract the Rules file. You will need WinRAR for the .gz file.
5. Copy all files from the “rules” folder of the extracted folder. Now paste the
rules into “C:\Snort\rules” folder.
6. Copy “snort.conf” file from the “etc” folder of the extracted folder. You must paste it into
“C:\Snort\etc” folder. Overwrite any
existing file. Remember if you modify your snort.conf file and download a new file, you
must modify it for Snort to work.
8. To start (execute) snort in sniffer mode use following command: snort -dev
-i 3
-i indicates the interface number. You must pick the correct interface number. In my case, it
is 3.
50
Dept. of CSE Jeppiaar Ins 琀椀 tute of Technology
snort -W
Finding an interface
You can tell which interface to use by looking at the Index number and finding Microsoft.
As you can see in the above example, the other interfaces are for VMWare. My interface is
3.
9. To run snort in IDS mode, you will need to configure the file “snort.conf”
according to your network environment.
10. To specify the network address that you want to protect in snort.conf file, look for the
following line. var HOME_NET 192.168.1.0/24 (You will normally see any here)
11. You may also want to set the addresses of DNS_SERVERS, if you have some on
your network.
Example:
example snort
12. Change the RULE_PATH variable to the path of rules folder. var
RULE_PATH c:\snort\rules
path to rules
13. Change the path of all library files with the name and path on your system. and you
must change the path of snort_dynamicpreprocessorvariable.
C:\Snort\lib\snort_dynamiccpreprocessor
51
Dept. of CSE Jeppiaar Ins 琀椀 tute of Technology
You need to do this to all library files in the “C:\Snort\lib” folder. The old path might be:
“/usr/local/lib/…”. you will need to replace that path with your system path. Using C:\
Snort\lib
14. Change the path of the “dynamicengine” variable value in the “snort.conf”
file.
Example:
dynamicengine C:\Snort\lib\snort_dynamicengine\sf_engine.dll
include c:\snort\etc\classification.config
include c:\snort\etc\reference.config
16. Remove the comment (#) on the line to allow ICMP rules, if it is
commented
with a #.
include $RULE_PATH/icmp.rules
17. You can also remove the comment of ICMP-info rules comment, if it is
commented.
include $RULE_PATH/icmp-info.rules
18. To add log files to store alerts generated by snort, search for the “output log” test in
snort.conf and add the following line: output alert_fast: snort- alerts.ids
52
Dept. of CSE Jeppiaar Ins 琀椀 tute of Technology
21. Save the “snort.conf” file
22. To start snort in IDS mode, run the following command: snort -c
c:\snort\etc\snort.conf -l c:\snort\log -i 3
If a log is created, select the appropriate program to open it. You can use WordPard
or NotePad++ to read the file.
To generate Log files in ASCII mode, you can use following command while running
snort in IDS mode:
After scanning or during the scan you can check the snort-alerts.ids file in the log folder to
insure it is logging properly. You will see IP address folders appear.
53
Dept. of CSE Jeppiaar Ins 琀椀 tute of Technology
RESULT:
Thus the Intrusion Detection System (IDS) has been demonstrated by using the
Open Source Snort Intrusion Detection Tool.
54
Dept. of CSE Jeppiaar Ins 琀椀 tute of Technology
Ex. No: 9
Date: Explore network monitoring tools
AIM:
To download the N-Stalker Vulnerability Assessment Tool and exploring the features.
EXPLORING N-STALKER:
It incorporates with a well-known N-Stealth HTTP Security Scanner and 35,000
Web attack signature database.
Before scanning the target, go to “License Manager” tab, perform the update.
4. After the scan completes, the N−Stalker Report Manager will prompt
5. you to select a format for the resulting report as choose Generate HTML.
55
Dept. of CSE Jeppiaar Ins 琀椀 tute of Technology
Now goto “Scan Session”, enter the target URL.
Manual test which will crawl the website and will be waiting for manual attacks.
owasp policy
Once, the option has been selected, next step is “Optimize settings” which will
crawl the whole website for further analysis.
In review option, you can get all the information like host information,
technologies used, policy name, etc.
56
Dept. of CSE Jeppiaar Ins 琀椀 tute of Technology
Once done, start the session and start the scan.
The scanner will crawl the whole website and will show the scripts, broken pages, hidden
fields, information leakage, web forms related information which helps to analyze further.
57
Dept. of CSE Jeppiaar Ins 琀椀 tute of Technology
Once the scan is completed, the NStalker scanner will show details like severity level,
vulnerability class, why is it an issue, the fix for the issue and the URL which is vulnerable
to the particular vulnerability?
RESULT:
Thus the N-Stalker Vulnerability Assessment tool has been downloaded, installed
and the features has been explored by using a vulnerable website.
58
Ex. No: 10
Date: Study to configure Firewall, VPN
Aim:
When you configure Cloud VPN tunnels to connect to your peer network, review and
modify firewall rules in your Google Cloud and peer networks to make sure that they meet
your needs. If your peer network is another Virtual Private Cloud (VPC) network, then
configure Google Cloud firewall rules for both sides of the network connection.
Google Cloud firewall rules apply to packets sent to and from virtual machine (VM)
instances within your VPC network and through Cloud VPN tunnels.
The implied allow egress rules allow VM instances and other resources in your Google
Cloud network to make outgoing requests and receive established responses. However, the
implied deny ingress rule blocks all incoming traffic to your Google Cloud resources.
At a minimum, create firewall rules to allow ingress traffic from your peer network to
Google Cloud. If you created egress rules to deny certain types of traffic, you might also
need to create other egress rules.
Traffic containing the protocols UDP 500, UDP 4500, and ESP (IPsec, IP protocol 50) is
always allowed to and from one or more external IP addresses on a Cloud VPN gateway.
However, Google Cloud firewall rules do not apply to the post- encapsulated IPsec packets
that are sent from a Cloud VPN gateway to a peer VPN gateway.
Example configurations
59
Dept. of CSE Jeppiaar Ins 琀椀 tute of Technology
Permissions required for this task
6. Click Create.
If you need to allow access to IPv6 addresses on your VPC network from your peer
network, add an allow-ipv6-tcp-udp-icmpv6 firewall rule.
1. Click Add firewall rule. Add a rule for TCP, UDP, and ICMPv6:
Name: Enter allow-ipv6-tcp-udp-icmpv6.
Source filter: Select IPv6 ranges.
Source IP ranges: Enter a Remote network IP range value from when you
created the tunnel. If you have more than one peer network range, enter each one.
Press the Tab key between entries. To allow traffic from all source IPv6 addresses
in your peer network, specify::/0.
Specified protocols or ports: Select tcp and udp.
Other protocols: Enter 58. 58 is the protocol number for ICMPv6.
Target tags: Add any valid tag or tags.
2. Click Create.
Alternatively, you can create rules from the Google Cloud console Firewall
page.
60
Dept. of CSE Jeppiaar Ins 琀椀 tute of Technology
Peer firewall rules
Configure rules to allow egress and ingress traffic to and from the IP ranges
used by the subnets in your VPC network.
You can choose to permit all protocols and ports, or you can restrict traffic to only
the necessary set of protocols and ports to meet your needs.
Allow ICMP traffic if you need to use ping to be able to communicate among peer
systems and instances or resources in Google Cloud.
If you need to access IPv6 addresses on your peer network with ping, allow
ICMPv6 (IP protocol 58) in your peer firewall.
RESULT:
Thus the study of Firewall and VPN is demonstrated successfully.
61
Dept. of CSE Jeppiaar Ins 琀椀 tute of Technology