## https://sploitus.com/exploit?id=AD3753A6-4B86-5E3B-9D75-BDF6E00E4DF4
# Vulnerability Assessment & Detection Lab
End-to-end vulnerability assessment and detection lab: Nmap/Nikto enumeration, manual + SQLMap SQLi validation, Hydra credential testing, OWASP ZAP web scanning, Snort 3 detection, log triage, and Linux/Windows host firewall hardening — built in an isolated Kali Linux / Metasploitable2 lab.
**Methodology:** Discover → Enumerate → Validate → Detect → Investigate → Harden → Re-test
## Highlights
| | |
|---|---|
|  |  |
| **20+ services enumerated** with full service/OS fingerprinting | **SQL injection validated** across 4 techniques with sqlmap |
|  |  |
| **High-risk RCE (CVE-2012-1823)** confirmed via OWASP ZAP active scan | **Custom Snort 3 rule** validated against live traffic |
## Findings Summary
| ID | Finding | Severity | Status |
|---|---|---|---|
| [F-01](docs/findings/01-exposed-legacy-services.md) | Exposed Legacy Services & Outdated Web Stack | High | Confirmed in lab |
| [F-02](docs/findings/02-sql-injection-dvwa.md) | SQL Injection in DVWA `id` Parameter | High | Confirmed in lab |
| [F-03](docs/findings/03-php-cgi-rce-cve-2012-1823.md) | Remote Code Execution — PHP-CGI (CVE-2012-1823) | High | Confirmed via scanner |
| [F-04](docs/findings/04-web-security-misconfigurations.md) | Missing HTTP Security Headers | Low–Medium | Confirmed in lab |
| [F-05](docs/findings/05-weak-credentials-ftp-bruteforce.md) | Weak/Default Credentials on FTP (vsftpd) | High | Confirmed in lab |
| [F-06](docs/findings/06-reflected-xss-dvwa.md) | Reflected XSS in DVWA `name` Parameter | Medium | Confirmed in lab |
Full write-ups (executive summary, evidence, validation workflow, impact, root cause, remediation, re-test criteria) live in [`docs/findings/`](docs/findings/).
## Defensive / Detection Work
Assessment findings show *what was wrong*. This work shows what was detected, investigated, and hardened:
| ID | Work | Status |
|---|---|---|
| [D-01](docs/defensive/01-snort-custom-detection.md) | Custom Snort 3 detection rule (ICMP) | Implemented and validated |
| [D-02](docs/defensive/02-authentication-log-triage.md) | SSH authentication log triage | Completed in lab |
| [D-03](docs/defensive/03-host-firewall-hardening.md) | Linux UFW & Windows Defender Firewall hardening review | Completed in lab |
Additional evidence (recon detail, manual validation steps, supporting screenshots)
- [01b — Nmap subnet-targeted scan](evidence/01b-nmap-subnet-targeted-scan.png)
- [01c — Nmap service version scan](evidence/01c-nmap-service-version-scan.png)
- [03 — DVWA SQLi manual proof of concept](evidence/03-dvwa-sqli-manual.png)
- [04b — sqlmap backend fingerprint](evidence/04b-sqlmap-backend-fingerprint.png)
- [04c — Burp Repeater SQLi dump](evidence/04c-burp-sqli-dump.png)
- [05 / 05b — ZAP passive header alerts](evidence/05-zap-passive-scan.png)
- [07b — Snort passive-mode packet statistics](evidence/07b-snort-packet-stats.png)
- [08b — Auth log triage, grouped by username](evidence/08b-ssh-auth-log-by-user.png)
- [13 — DVWA reflected XSS executing](evidence/13-dvwa-reflected-xss.png)
- [14 — Burp capture of the XSS payload request](evidence/14-burp-xss-payload-capture.png)
## Scope & Environment
Isolated lab: Kali Linux (attacker) against a Metasploitable2 target and its DVWA (Damn Vulnerable Web Application) instance. All testing was performed against systems owned and controlled within this lab — no external or production targets were tested.
## Tools Used
Nmap · Nikto · sqlmap · Burp Suite · OWASP ZAP · Hydra · Snort 3 · UFW · Windows PowerShell (`NetSecurity`)
## What's Next
A before/after Nmap comparison demonstrating measurable attack-surface reduction following the remediation steps documented in each finding is planned as a follow-up case file.
## Author
**Jaden Mascarenhas**
MSc Information & Network Security, Kingston University London
[Portfolio](https://jaden-mas1010.github.io) · [LinkedIn](https://linkedin.com/in/jaden-mascarenhas-989b6a254) · [GitHub](https://github.com/jaden-mas1010)