HACKING PROJECT · network · Intermediate
Vulnerability Scanner + DNS Spoofer
Demonstrate attack-surface discovery and LAN traffic-redirection techniques within a controlled, authorized lab.
Organizations frequently lack continuous visibility into exposed services and misconfigurations, while attackers exploit LAN trust to intercept traffic via DNS/ARP manipulation. Understanding both discovery (scanning) and man-in-the-middle abuse is essential for both offensive assessment and building defenses. Treating these as a black box leaves defenders unable to detect or mitigate them.
**What you'll build**
Build a modular scanner that performs host discovery, port and service enumeration, and version/CVE correlation, paired with a lab-only DNS spoofing module demonstrating LAN interception via ARP poisoning and forged DNS responses. All spoofing is confined to an isolated lab and instrumented to also show blue-team detection signatures. Output feeds a prioritized, evidence-backed findings report.
**Objective** — Demonstrate attack-surface discovery and LAN traffic-redirection techniques within a controlled, authorized lab.
**Expected outcome** — A working scanner with CVE-correlated reports plus a documented, detection-annotated DNS/ARP spoofing lab demo.
**Difficulty** — Intermediate — combines networking fundamentals with packet-level scripting, but relies on well-known techniques and libraries.
**Primary category** — Penetration Testing; Secondary = Network Security, Vulnerability Management
**Security domains** — Primary = Red Team; Secondary = Purple Team, Blue Team, Security Research, Penetration Testing
**Technical focus** — Host discovery, Port/service enumeration, Banner grabbing, CVE correlation, ARP poisoning, DNS spoofing, MITM, Packet crafting, Network reconnaissance
**Core technologies** — Languages: Python; Frameworks/Libraries: Scapy, python-nmap, socket, requests; Security Tools: Nmap, Ettercap/Bettercap (reference), Wireshark, dnsmasq; Cloud/Infra: isolated virtual LAN (GNS3/VirtualBox); AI/Data: CVE feeds (NVD API); Databases: SQLite for scan results, local CVE cache
**Where it's valued** — Penetration-testing firms, MSSPs, enterprise security teams, network operations, red teams
**Careers it builds toward** — Penetration Tester, Network Security Engineer, Red Team Operator, Vulnerability Analyst
**Framework alignment**
• MITRE ATT&CK: Reconnaissance — Active Scanning (T1595); Discovery — Network Service Discovery (T1046); Credential Access/Collection — Adversary-in-the-Middle (T1557), specifically ARP Cache Poisoning (T1557.002) and DNS spoofing behavior
• NIST CSF 2.0: Identify (ID.RA, ID.AM), Protect (PR.IR), Detect (DE.CM)
• OWASP: N/A (network-layer focus); API-level checks map loosely to OWASP API Top 10 where web services are scanned
• CIS Controls v8: 1 (Inventory of Enterprise Assets), 7 (Continuous Vulnerability Management), 12 (Network Infrastructure Management), 13 (Network Monitoring and Defense)
**Innovation** — Improved Existing Solution — pairing discovery with an interception module and explicit blue-team detection framing is a useful training synthesis rather than a novel product. Scores: Innovation 5/10, Startup 4/10, Enterprise-Readiness 5/10, Patent = No.