Lesson 12 — Intermediate

Security Tools (Nmap, Wireshark, Kali)

Security tools wo instruments hain jo analyst ke haath mein hote hain — network map karne se lekar packets samajhne tak. Is lesson mein hum Nmap, Wireshark, Kali aur baaki toolbox dekhenge, aur sabse zaroori cheez — inka LEGIT use aur uski legal boundary.

⏱ 15 min• Intermediate• Social Engineering

Security tools kya hote hain

WHAT

Security tools wo utilities hain jo network, traffic aur systems ko scan/analyze karte hain — asset inventory, audit, troubleshooting aur authorized vulnerability testing ke liye.

WHEN

Network audit, incident investigation, troubleshooting, aur certification lab (CEH/Security+) mein — yaani professional kaam ke liye.

WHERE

Security analyst ki Kali Linux VM, IT admin ka dashboard, SOC team ka SIEM — tools legit professionals ka roz kaam hain.

Pehle line clear kar lo: tools neutral hain. Knife kitchen mein chalta hai — tool ka use, intent aur PERMISSION hi white hat aur black hat ka farak banata hai.

Discovery: Nmap, DNS enumeration — network ko samajhne ke liye (apna asset map).
Analysis: Wireshark, Zeek — packets/traffic ko samajhne ke liye.
Scanning: Nessus, OpenVAS — apne systems mein known vulnerabilities dhondhne ke liye.
Monitoring: Splunk, ELK (SIEM) — logs se alert banane ke liye.

Nmap — network ka map

Nmap = Network Mapper (open source, industry standard)

Kya karta hai:
  - Network mein kaunse devices hain (host discovery)
  - Kaunse PORTS open hain (TCP/UDP)
  - Kaunsa service/version chal raha hai (service detect)
  - OS ka hint bhi de sakta hai (OS fingerprint)

Legit use (defender perspective):
  - Apne network ka asset inventory banana
  - Unauthorized device dhhoondna (shadow IT)
  - Firewall rules verify — kya sach mein band hai
  - Patch audit ke liye open services check

Output states : open (service chal raha), closed (band),
                filtered (firewall ne roka)

LEGAL : sirf apne network ya WRITTEN permission pe.
        Bina permission = IT Act offence

Interview line: Nmap ka sawaal aaye toh do line: "network discovery aur port scanning tool, use hota hai asset inventory/audit ke liye." Aur permission ka point zaroor add karo — interviewer dhyan se sunta hai.

Wireshark — packets ka microscrop

Wireshark = packet analyzer (GUI wala sniffer, open source)

Kya karta hai:
  - Network ke packets CAPTURE karke decode karta hai
  - Protocol-wise dikhata hai (HTTP, DNS, TCP kya ho raha)
  - Filters se specific flow nikal lo

Legit use:
  - "Site slow kyun hai?" — diagnose karne ke liye
  - Protocol seekhne ka BEST lab tool (TCP handshake dikhta hai)
  - Incident ke baad pcap se timeline banana
  - Apne traffic mein kaunse connection khule hain check

NOTE : kisi aur ka traffic bina permission capture karna
       illegal hai — capture hamesha authorized scope mein

Wireshark seekhne ka faayda: tum network theory ko aankhon se dekh sakte ho — SYN, SYN-ACK, ACK ka handshake, DNS query, TLS ke messages sab dikhte hain. Ye interviews mein bhi impress karta hai.

Baaki toolbox aur ethics boundary

TOOLBOX (concept — kaam samjho):
Kali Linux    : security tools ka Linux distro (labs/learning)
Burp Suite    : web app ke requests analyze karo (authorized test)
Nessus/OpenVAS: vulnerability scanner (apne systems scan)
Splunk/ELK    : logs ko SIEM mein alert banana
Metasploit    : exploit framework — SIRF authorized lab
hashcat       : hashed passwords ki strength test (apni data)

ETHICS FLOW (yaad rakho):
  Scope -> Written Permission -> Test -> Report -> Fix

  Apne lab/CTF mein practice : OK (ise hi seekhte hain)
  Company ke system pe approval se : OK (audit)
  Bina permission kisi aur pe : OFFENCE (IT Act)

Ethics line: Certification labs (CEH, Security+) isi liye hain — taaki tum authorized environment mein technique seekho. Seekhna legal hai, bina permission use karna nahi.

Exercise

Question: Nmap ka full form kya hai? (do words)

Question: Wireshark kya capture karke analyze karta hai? (packets/passwords)

Question: Bina permission ke kisi aur ka network scan karna legal hai ya illegal? (legal/illegal)

Common mistakes

Tools ko "hacker ka saman" samajhna: Tools neutral hain — IT admin, SOC analyst, auditor sab inhein roz use karta hai. Use intent + permission decide karta hai.
Kali chalana = hacker hona: Kali ek distro hai jisme tools hain. Lab mein seekhna seekhne ka hissa hai, unauthorized use crime hai — farak yahi hai.
Office network bina permission scan kar lena: Chaahe intent achha ho ya nahi — bina written approval ke scanning IT Act ke under unauthorized access hai.

Desi example: IT admin ka asset audit

TCS-jaisi company ke admin ko har mahine apna network audit karna hai — kaunse device connect hain, kaunse ports khule hain. Uske paas approval tha, scope defined tha:

Approval : manager se written sign
Scope    : sirf office subnet (10.x.x.x)
Nmap     : host list + open ports nikale
Result   : 2 purane device mile, patch karwaye
Lesson   : tools + permission = professional work

Exam mapping (CEH / Interview / Practical)

CEH: Nmap, Wireshark sawaal aksar aate hain (concept + use).
Interview: "Wireshark kis liye use karte ho?" — troubleshooting answer do.
Practical rounds: tool ke naam + kaam match karna poochha jaata hai.
Trap: "Metasploit kisi pe bhi chala sakte ho" — galat, sirf authorized scope.

Lesson complete?

Tools ke naam clear. Agla lesson — Incident Response & Forensics — mein dekhenge jab attack ho jaaye toh team kya karti hai, step by step.