19.11 Red vs Blue, Project and Real Incidents

By Ravindra Bagale Last updated: 27 September 2026

Chala mitrano, recon ani scanning shiklo – aata Purple Team loop lavuya. Red noisy scan karto; Blue IDS, logs, tight ports ani fail2ban ne pakadto. Tumhi Sahyadri / Raja-Rani style OWN lab madhe build → hack → fix karun prove kara ki surface shrink hote. Tool shikne ardha kaam; detection ani hardening ardha. Samjla ka?

Red Team vs Blue Team – scanning and recon noise

Red team (attacker) does	Blue team (defender) detects / stops
`sudo nmap -sS -T4` / aggressive SYN sweep across many hosts	Snort/Suricata port-scan rules; firewall logs; VPC Flow Logs / GuardDuty port-probe findings
`sudo masscan 192.168.56.0/24 -p1-65535 --rate 10000` flood	Rate anomalies; SYN flood / scan alerts; rate-limit at edge; fail2ban-style blocks on noisy sources
`dig axfr @192.168.56.20 lab.local` (zone transfer attempt)	Disable AXFR to untrusted IPs; allow-transfer ACL; monitor DNS logs for AXFR
Banner grabbing (`nmap -sV`, `nc`, Nikto-style probes)	`ServerTokens Prod` / `server_tokens off;`; stop unused services; watch `/var/log/secure` and web logs
Leaves FTP/Telnet/old HTTP open "for later labs" forever	Close unused ports; `sudo service vsftpd stop`; `sudo yum remove` unused packages; tight security groups
Scans beyond host-only (bridged LAN / public IPs)	Written scope; host-only proof via `ip a`; IDS on real networks blocks stranger scanners
Saves no scan output, cannot prove before/after hardening	Always `-oA ~/labs/...`; compare pre/post port lists in the Purple report

Defender chi simple checklist: kamit kami ughde ports, banners hide, zone transfer band, IDS + logging, fail2ban / security group. Attack tools Kali var; bachav controls Blue var. Dhyan rakho – company madhe "I can Nmap" peksha "I can shrink attack surface and show detection" jast valuable aahe.

# OWN host-only only – Kali 192.168.56.10 → Metasploitable 192.168.56.20
mkdir -p ~/labs
sudo nmap -sS -T2 -p 21,22,23,25,80,443,445,3306 192.168.56.20 -oA ~/labs/pre-fix-surface
sudo nmap -sV -T2 -p 21,22,80 192.168.56.20
# Optional lab DNS (if you run BIND on a lab VM you own):
# dig axfr @192.168.56.20 lab.local
# On a Linux target you own – watch the SYN pattern while Kali scans:
# sudo tcpdump -n -i eth0 'tcp[tcpflags] & tcp-syn != 0' | head -40
# After fix – same commands again; expect fewer open ports / failed AXFR

On an Amazon Linux helper you own in host-only (optional .50):

# Example defender moves (OWN lab only)
sudo yum install fail2ban
sudo service fail2ban start
sudo service fail2ban status
# Stop something you do not need:
# sudo service vsftpd stop
# sudo yum remove vsftpd

Ravindra Bagale's Tip

Students go "wow, what speed" with Masscan and forget the logs – and then that same noise becomes an alert in the company. In the interview, say: "I can run Nmap, but I also know how Snort/Suricata and fail2ban see me." Tool + detection = Purple. Scanning comes up in the CEH exam modules – always add the defence line. Forgetting banners and AXFR is also a common mistake – nmap -sV and dig AXFR reveal leaks. Don't worry – with practice it comes.

Ravindra Bagale's Tip – मराठी

Students Masscan ने "वाह speed" करतात आणि logs विसरतात – मग company मध्ये तोच noise alert येतो. Interview मध्ये सांगा: "I can run Nmap, but I also know how Snort/Suricata and fail2ban see me." Tool + detection = Purple. CEH exam modules मध्ये scanning येतं – defence line नेहमी जोडा. Banner आणि AXFR विसरणं पण common चूक – nmap -sV आणि dig AXFR ने leak दिसतो. घाबरू नका, practice ने येतंय.

Ravindra Bagale's Tip – हिंदी

Students Masscan से "वाह speed" करते हैं और logs भूल जाते हैं – फिर company में वही noise alert बन जाता है. Interview में कहो: "I can run Nmap, but I also know how Snort/Suricata and fail2ban see me." Tool + detection = Purple. CEH exam modules में scanning आता है – defence line हमेशा जोड़ो. Banner और AXFR भूलना भी common गलती है – nmap -sV और dig AXFR से leak दिखता है. घबराओ मत, practice से आ जाता है.

Lab

Metasploitable (192.168.56.20) var tcpdump (kiwa Kali var Wireshark host-only capture) chalu theva. Mag -T2 SYN scan vs thoda faster timing compare kara – packet rate fark notes madhe liha. Mag tumchya OWN Amazon Linux helper VM asel tar: unused service sudo service <name> stop, security group / firewall madhe lab subnet only, punha scan – filtered / closed wadhayla havet. Output -oA ne save kara.

Project: Build it, hack it, fix it

Build: For fictional Sahyadri Traders (Pune) / Raja-Rani Traders warehouse lab, make Metasploitable 192.168.56.20 (or a second lab VM at .50) intentionally noisy and weak. Document each weakness before you start:

Many unused services left listening (FTP, Telnet, old HTTP – common on Metasploitable; on a helper VM use sudo yum install then leave extras on purpose)
Optional: lab-only BIND for lab.local with zone transfer allowed to any (allow-transfer { any; }; – lab only!)
Version banners visible (nmap -sV shows clear product/version)

Snapshot pre-noisy-scan-surface. Host-only adapters only – Chapter 18 ethics card apply kara.

Hack (lab only): From Kali 192.168.56.10:

sudo nmap -sS -sV -T2 -p- 192.168.56.20 -oA ~/labs/sahyadri-pre
Optional: sudo masscan 192.168.56.20 -p1-1000 --rate 500 then confirm with Nmap
If BIND is up: dig axfr @192.168.56.20 lab.local and save the leaked names

Prove a wide surface + banners + AXFR leak. Never scan institute Wi-Fi or public IPs.

Fix:

Stop/disable unused daemons (sudo service stop / remove packages; on Amazon Linux helpers sudo yum remove unused servers)
Firewall allow only needed ports from 192.168.56.10
Apache/Nginx banner hardening (ServerTokens Prod, ServerSignature Off / server_tokens off;)
BIND allow-transfer { 127.0.0.1; }; or disable AXFR entirely
fail2ban notes for sshd on a hardened helper; sudo service <name> restart after config test

Re-verify: Re-run the same Nmap/Masscan/dig commands – open port count drops, AXFR fails, banners muted, scan quieter in tcpdump. Write a 1-page Purple report for owner Raja: finding → risk → fix → evidence. Study buddy Ravina / Amir peer-review the report. No real org, no internet targets.

Real incident: Mirai botnet and the Dyn DNS disruption (2016)

In 2016, the Mirai malware scanned large parts of the internet for IoT devices that still used default or weak credentials, recruited them into a botnet, and that capacity was later used in major DDoS activity – including the widely reported Dyn DNS disruption that affected reachability of several large sites for many users. Weakness: internet-exposed devices with default passwords + widespread automated scanning. What would have reduced it: change default credentials, disable remote admin where unused, network segmentation, patch/replace insecure IoT, and monitoring for scan/brute patterns. Lab lesson: the same scan → find weak service → abuse pattern is why we close unused ports and never expose practice targets. Source: public US-CERT / industry analyses of Mirai; major reporting on the Dyn events (verify summaries).

Real incident: Open databases found by mass scanning (mid-2010s onward)

Security researchers and incident responders have repeatedly reported thousands of databases (for example MongoDB or Elasticsearch instances) left reachable on the public internet without authentication – discovered through internet-wide scanning and search engines such as Shodan-class indexes. Some exposed datasets were copied or held to ransom by opportunistic actors (reported in multiple vendor and news write-ups). Weakness: bind-to-all-interfaces + no auth + no firewall. What stops it: bind to localhost / private IP only, authentication, TLS where applicable, security groups / firewall allow-lists, and regular external attack-surface reviews. Older DNS zone-transfer misconfigurations similarly leaked internal hostnames when AXFR was open to the world – same lesson as our lab BIND fix. Source: public vendor reports on exposed MongoDB/Elasticsearch incidents; classic DNS AXFR misconfiguration advisories (verify current hardening guides).

Interview model (clean English): "I run Nmap and Masscan only against my host-only lab. I pair every scan with defender views – tcpdump, IDS rules, fail2ban, closed ports, and disabled zone transfers – and I re-scan after hardening to prove the surface shrank."

Thodkyaat: scan shika, pan surface shrink karayla shika. Aata pudhe vulnerability scanning – ethics card sobat. Chala pudhe, mitrano!

Thodkyaat sangaycha tar

Recon comes first: passive (whois, dig, theHarvester, Maltego) sends nothing to the target; active (Netdiscover, Nmap, Masscan) does.
Netdiscover finds live hosts on your LAN using ARP.
Nmap finds live hosts, open ports, service versions and OS; NSE scripts add checks. Know the six port states, especially closed vs filtered.
Save every scan with -oA and follow a step-by-step workflow.
Masscan is fast but only finds ports; confirm with Nmap.
Every scan leaves traces – defenders catch it with IDS, logs and flow logs, and reduce exposure with tight security groups and fewer services.

Samjla ka? Aata aaplyakade target chi purna yaadi aahe – ports, services, versions. Pudhchya chapter madhe aapan shodhu ki ya versions madhe kontya kamjorya (vulnerabilities) lapllya aahet. Chala pudhe, mitrano!