# 🛡️ Cybersecurity Labs 

![University](https://img.shields.io/badge/Università_di_Siena-CyberSecurity_Lab_2026-4b2e83?style=flat-square&logo=academia)
![Python](https://img.shields.io/badge/Python-3.10%2B-blue?style=flat-square&logo=python)
![Jupyter](https://img.shields.io/badge/Jupyter-Notebooks-orange?style=flat-square&logo=jupyter)
![OWASP](https://img.shields.io/badge/OWASP-Top_10_2021-red?style=flat-square&logo=owasp)
![License](https://img.shields.io/badge/Use-Educational_Only-critical?style=flat-square)

A hands-on laboratory for the **CyberSecurity course @ Unisi 2025/2026**. Each module translates a theoretical attack or vulnerability class into working, inspectable Python code and interactive Jupyter notebooks — so the concepts stick beyond the lecture.

---

> [!CAUTION]
> ## ⚖️ Academic Disclaimer — Read Before Proceeding
>
> The tools, techniques, and code examples in this repository are provided **strictly for academic and educational purposes** within the context of the University of Siena Cybersecurity Laboratory.
>
> This material covers topics that have real-world offensive potential, including but not limited to:
> - **Password cracking** (offline hash attacks, online brute-force, credential profiling)
> - **Cryptographic attack patterns** (weak hashing, insecure randomness, Google Dorking for exposed secrets)
> - **Malware behaviour simulation** (viruses, worms, trojans, infostealers, ransomware-adjacent techniques)
> - **Penetration testing** (active reconnaissance, vulnerability exploitation, privilege escalation)
>
> **You are responsible for how you use this knowledge.**
>
> - ✅ Authorized use: studying, understanding, defending, and testing systems you own or have explicit written permission to test.
> - ❌ Unauthorized use: running these tools or techniques against any system, account, or network without explicit permission — regardless of intent — **is illegal** under the Computer Fraud and Abuse Act (US), the Computer Misuse Act (UK), the Directive on Attacks Against Information Systems (EU), and equivalent national laws.
>
> Misuse of anything in this repository may result in criminal prosecution, civil liability, and permanent reputational damage. The authors and the university accept no responsibility for misuse.
>
> *To defend a system, you must understand how it is attacked. Understanding is not endorsement.*

---

## 🗺️ Modules

---

### 🔑 1 — Cryptographic Failures

> *OWASP A02:2021 — Cryptographic Failures*

📂 [`1_Cryptographic_Failures/`](1_Cryptographic_Failures/README_Failures.md)

Examines what happens when cryptography is absent, misapplied, or simply too weak. The module is split into four sub-sections that escalate from foundations to live exploitation.

#### `1_1-Basics/` — Cryptographic Foundations

Introductory notebooks covering the core building blocks:

| Notebook | Topic |
|----------|-------|
| `1-Example_cryptography.ipynb` | Symmetric (AES) vs asymmetric (RSA) encryption |
| `2-Example_digital_signature.ipynb` | Digital signature creation and verification |
| `3-Example_digital_signature_pdf.ipynb` | Signing PDF files |
| `4-Example_digital_signature_embedded_pdf.ipynb` | Embedding signatures inside PDFs |
| `5-Example_hashing.ipynb` | Hash functions: properties, use cases, collision resistance |

#### `1_2-Failures/` — Attack Notebooks

Thirteen notebooks covering real failure modes, each building on the previous:

| # | Notebook | Attack / Concept |
|---|----------|-----------------|
| 01 | `CryptoFailure_encoding_is_not_encryption` | Encoding (Base64, hex) vs encryption — why the distinction matters |
| 02 | `CryptoFailure_malicious_usage_base64` | Obfuscating payloads with Base64 and EBCDIC |
| 03 | `CryptoFailure_cracking_caesar_cipher` | Frequency analysis to break the Caesar cipher |
| 04 | `Cryptofailure_cracking_vigenere_cipher` | Kasiski / index-of-coincidence attack on Vigenère |
| 05 | `CryptoFailure_cracking_DES` | DES brute-force — why 56-bit keys are dead |
| 06 | `CryptoFailure_md5_bruteforce_attack` | Brute-forcing MD5 hashes |
| 07 | `CryptoFailure_md5_dictionary_attack` | Dictionary attack against MD5 |
| 08 | `CryptoFailure_insecure_randomness` | `random` vs `secrets` — predictable token generation |
| 09 | `CryptoFailure_google_dorking` | Google Dorks to surface exposed credentials and secrets |
| 10 | `Cryptofailure_waybackmachine` | Recovering deleted sensitive data via the Wayback Machine |
| 11 | `Cryptofailure_randomness_phpmtseed` *(md)* | PHP `mt_rand` seed cracking with `php_mt_seed` |
| 12 | `Cryptofailure_breaking_nemucod` | Breaking NemucodAES ransomware via Mersenne Twister seed recovery |
| 13 | `Cryptofailure_JWT_json_web_tokens` | JWT vulnerabilities — `alg:none`, weak secrets, header injection |

#### `1_3-WeakAppRandomness/` — Live Flask App

A deliberately vulnerable Flask web application that uses Python's `random` module (instead of `secrets`) to generate session tokens and OTPs. Demonstrates how an attacker can predict "random" values after observing a few outputs.

#### `1_4-RainbowTables/` — Rainbow Table Implementation

A from-scratch Python implementation of the rainbow table attack chain:

| File | Role |
|------|------|
| `rainbowgen.py` | Build rainbow tables from a wordlist |
| `rainbowtable.py` | Table data structure (chains, reduction functions) |
| `rainbowcrack.py` | Crack a hash using a pre-built table |
| `algorithm.py` | Core chain-traversal algorithm |

---

### 🔐 2 — Authentication

> *OWASP A07:2021 — Identification and Authentication Failures*

📂 [`2_Authentication/`](2_Authentication/2_1-Password%20cracking/README_Authentication.md)

Explores both sides of the authentication coin: **how passwords are broken** and **how they should be built, stored, and evaluated**.

#### `2_1-Password cracking/A_offline/` — Offline Hash Cracking

Attack hash files without any network access, using two industry-standard tools:

| Notebook / File | Content |
|-----------------|---------|
| `1-Using_John_basics.ipynb` | John the Ripper — wordlist, incremental, rules modes |
| `2-Using_John_advanced.ipynb` | Custom rules, mangling, `--loopback` |
| `3-Using_John_applications_unix.ipynb` | Cracking `/etc/shadow` |
| `3-Using_John_applications_zip.ipynb` | Cracking password-protected ZIP archives |
| `4-Using_Hashcat_basics.ipynb` | Hashcat — GPU-accelerated attack modes |
| `JOHN_VS_HASHCAT.md` | Side-by-side comparison: when to use which |
| `HASHCAT.md` | Full Hashcat reference (modes, rules, masks) |
| `cupp/cupp.py` | CUPP — credential profiler from personal info |
| `username generator/` | Enumerate plausible usernames from a full name |

#### `2_1-Password cracking/B_online/` — Online Attacks

| Notebook / Folder | Content |
|-------------------|---------|
| `Cracking_Login_Using_Hydra.ipynb` | THC Hydra against HTTP login forms |
| `mini_catch_the_flag/` | Full 7-phase CTF lab: passive recon → enumeration → username generation → credential profiling → Hydra brute-force → SQLi bypass → flag capture. Includes a target `CybercorpWebsite` Flask app and `sqlmap` integration |

#### `2_2-Password generation/` — Secure Password & Passphrase Design

| File | Content |
|------|---------|
| `1-Password_Generator.ipynb` | CSPRNG-based password generator with configurable character sets |
| `2-Password_Strength_Evaluator.ipynb` | Entropy-based strength evaluation from first principles |
| `2b-Password_Strength_Evaluator_zxcvbn/` | **Flask web app** — real-time strength bar powered by `zxcvbn`; 4-segment colour-coded meter (red → amber → light green → dark green) with crack-time estimate and feedback |
| `3-Passphrase_generator.ipynb` | Dictionary-based passphrase generator + Markov-chain pseudoword generator with optional random mixed-case |
| `4-Password_Entropy.ipynb` | Entropy calculations for passwords and passphrases; comparing brute-force costs |
| `5-Password_Storage_Evolution.ipynb` | From plaintext → MD5 → bcrypt/Argon2; why slow hashing and salting matter |

#### `2_3-Phishing/` — Social Engineering

| Notebook | Content |
|----------|---------|
| `01_Using_Setoolkit.ipynb` | Social-Engineer Toolkit (SET) — credential harvesting pages |
| `02_Using_Zphisher.ipynb` | Zphisher — templated phishing pages for 30+ platforms |

> See [`DISCLAIMER.md`](2_Authentication/2_3-Phishing/DISCLAIMER.md) before opening any file in this sub-section.

---

### 🦠 3 — Malware

> *Cross-cutting threat category — underpins multiple OWASP risks*

📂 [`3_Malware/`](3_Malware/README_Malware.md) — see also [`DISCLAIMER.md`](3_Malware/DISCLAIMER.md)

A taxonomy of **nine malware families**, each implemented at a conceptual, non-destructive level. The goal is pattern recognition and defensive awareness, not weaponisation. All code must be run inside an isolated VM.

| # | Family | Folder | Key files |
|---|--------|--------|-----------|
| 1 | 🔴 **Virus** | `3_1-Virus/` | `Coding_Python_Virus.ipynb` — injection lifecycle; `VIRUS_LIFECYCLE.md` |
| 2 | 🟠 **Worm** | `3_2-Worm/` | `abraworm.py` — autonomous network propagation; `abraworm_analysis.md` |
| 3 | 🟡 **Trojan** | `3_3-Trojan/` | `Example_trojan_horse.ipynb`; `snake/snake_trojan.py` — benign game with embedded backdoor; `Using_msfvenom.md` |
| 4 | 🔵 **Adware** | `3_4-Adware/` | `adware.py` — pop-up injection loop; `create_windows_exe.md` — packaging as an EXE |
| 5 | 🟣 **Persistence** | `3_5-Persistence/` | `persistence.py` — cron/registry/startup techniques; `ImpairDefenses.py`; `Persistence.md` |
| 6 | 🔴 **Infostealer** | `3_6-Infostealer/` | `UserDiscovery.py`; `WebSessionCookieHijack.py`; `Malware_Analysis_Zebo.ipynb` — analysis of the real Zebo stealer |
| 7 | 🟠 **Exfiltration** | `3_7-Exfiltration/` | `Exfiltration_methods.ipynb` — DNS tunnelling, HTTP covert channels, steganography |
| 8 | 🟡 **Scareware** | `3_8-Scareware/` | `fake_error.py` — social-engineering via fabricated system alerts |
| 9 | ⚫ **Autorun / USB drop** | `3_10-AutorunScripts/` | `USB.py` — simulates autorun on USB insertion; `malicious.py` — payload |

---

### 🎯 4 — Penetration Testing

> *Covers the full attack lifecycle against a deliberately vulnerable target (Metasploitable)*

📂 [`4_PenTesting/`](4_PenTesting/)

A structured walkthrough of a professional penetration test, from pre-engagement theory through post-exploitation, paired with the defensive countermeasures that would stop each step. Labs run against **Metasploitable** — Rapid7's deliberately vulnerable Linux VM.

#### Theory & Methodology

| File | Content |
|------|---------|
| `Red_Teaming.md` | Full pentest methodology: pre-engagement → recon → scanning → exploitation → post-exploitation → reporting. PTES & OWASP Testing Guide aligned |
| `Blue_Teaming.md` | Defensive counterpart: SOC structure, SIEM, detection engineering, incident response, purple teaming |

#### Hands-On Lab Sequence (Metasploitable)

| # | File | Phase |
|---|------|-------|
| 1 | `1_Metasploitable_active_recon_smb_ssh.md` | Passive recon (OSINT) → active recon with Nmap → SMB and SSH enumeration |
| 2 | `2_Metasploitable_post_exploit_enum.md` | Post-exploitation enumeration: users, services, sudo, SUID, cron jobs |
| 4 | `4_Metasploitable_exploiting_vulnerabilities.md` | Exploiting specific CVEs with Metasploit modules |
| 5 | `5_Metasploitable_privilege_escalation.md` | Privilege escalation: SUID abuse, kernel exploits, weak sudo rules |
| 6 | `6_Disclaimer.md` | Scope, ethics, and legal boundaries for this lab |
| 7 | `7_Defensive_Measures.md` | Defensive mirror of the full lab — every attack mapped to the control that stops it |

#### Web Exploitation

| File | Content |
|------|---------|
| `SQLi_Injection.ipynb` | SQL injection from first principles: UNION-based, blind, time-based; `sqlmap` integration; prepared statements as the fix |

---

## ⚙️ Setup

```bash
# Clone and enter the repository
git clone <repo-url>
cd CybersecurityLab

# Unix / macOS
bash create_venv_unix.sh

# Windows
create_venv_win.bat

# Or manually
python -m venv .venv
source .venv/bin/activate        # Windows: .venv\Scripts\activate
pip install -r requirements.txt

# Launch Jupyter
jupyter notebook
```

> [!NOTE]
> All notebooks are self-contained. You can run each section independently — no shared state between modules.

---

> [!WARNING]
> Run every notebook in an **isolated environment** (VM, container, or dedicated lab machine). Some exercises simulate behaviours that may trigger antivirus or EDR alerts on a production system.

---

## 🎓 A Note on the Ethical Hacker's Mindset

Security professionals operate under a simple principle: **know the attack to build the defence**. Every technique in this lab has a defensive mirror image — understanding how password crackers work makes you design better authentication; understanding how malware persists makes you build better detection rules; understanding cryptographic failures makes you choose better primitives; understanding how a pentest unfolds makes you build networks that are harder to traverse.

Carry that mindset into every notebook.
