36.7 Red vs Blue, Project and Real Incidents

By Ravindra Bagale Last updated: 27 September 2026

Chala mitrano, FFUF, Amass, WhatWeb, Netcat/Socat, Bettercap – aata Purple Team loop. Red side madhe directory fuzz, subdomain enum, banner fingerprint, reverse shell, ARP MITM dakhavto; Blue – WAF/rate-limit, inventory/CT monitor, strip banners, egress filter/ss/EDR, HTTPS+HSTS/segmentation/DAI. Tumhi Sahyadri Traders style OWN host-only lab madhe build → hack → fix karun Purple report liha. Real Wi-Fi / office – kadhi nahi. Samjla ka?

Red Team vs Blue Team – fuzz, recon, shells and MITM

Red team (attacker) does	Blue team (defender) detects / stops
FFUF / Gobuster directory fuzz on webroot (`ffuf -u http://…/FUZZ`)	WAF + rate-limit (`limit_req`); no `.bak`/`.old` in webroot; auth on admin paths; 404/403 noise alerts
Amass / subdomain enum (passive + active brute on target domain)	Asset inventory; Certificate Transparency (CT) monitor; kill dead subdomains; alert on unexpected hosts
WhatWeb / Wappalyzer fingerprint (`whatweb http://…`)	Strip `Server` / `X-Powered-By` version banners; patch stack; harden headers
`nc` / `socat` reverse or bind shell (lab)	Egress filter (odd outbound ports); `ss -tulnp` / process ancestry; EDR on shell spawn; host firewall
Bettercap ARP spoof + sniff (host-only lab concept)	HTTPS everywhere + HSTS; VLAN segmentation; Dynamic ARP Inspection (DAI) / static ARP where available; never ignore cert warnings

Defender chi simple checklist: rate-limit + no backup files → inventory/CT → strip banners → egress/ss/EDR → HTTPS+HSTS+segmentation. Red = fuzz/enum/shell/MITM; Blue = controls + logs. Interview madhe "I ran FFUF on random .in sites" peksha "I built a weak PHP page on Sahyadri OWN lab, fuzzed it, removed .bak, added rate-limit and HSTS notes" jast strong.

# OWN lab only – Sahyadri Traders (Pune) – host-only 192.168.56.x
# Target: YOUR tiny PHP/static site OR DVWA on 192.168.56.20 – never third-party
mkdir -p ~/labs/sahyadri-web-recon
# 1) BUILD – deliberately weak (lab):
#    - put index.php.bak in webroot (backup leak)
#    - leave Server / X-Powered-By version headers visible
#    - optional cleartext HTTP page (no HSTS) for MITM concept notes
# 2) HACK – OWN lab only:
# whatweb http://192.168.56.20
# ffuf -u http://192.168.56.20/FUZZ -w /usr/share/wordlists/dirb/common.txt -mc 200,301,403 -rate 20
# Note Bettercap concepts (net.probe / arp.spoof) – practice ONLY on host-only lab VMs; never real Wi-Fi
# 3) FIX – remove .bak; nginx/Apache rate-limit; strip banners; document HSTS + DAI notes
# ss -tulnp | head   # baseline listeners before/after shell lab

Ravindra Bagale's Tip

Students scan a live shop site with an FFUF wordlist at full speed – that breaks the IT Act and gets them banned by the WAF. The second mistake: Bettercap on office Wi-Fi as "just practice". Rule: OWN 192.168.56.x only → ffuf/whatweb on YOUR DVWA/PHP → note MITM concepts without attacking real networks → fix backups + rate-limit + HSTS. Tool = lab; production without permission = crime. Don't worry, your OWN lab gets you there.

Lab

Host-only lab madhe whatweb ani ffuf (rate-limited) OWN DVWA / tiny PHP (192.168.56.20) var chalaa. Finding: .bak kiwa version banner. Mag backup file remove + banner strip note + one HSTS line. Bettercap – fakt net.probe / net.show on host-only iface; ARP spoof optional only against YOUR .20 HTTP page, then off. Real Wi-Fi – nahi.

Project: Build it, hack it, fix it

Build: For fictional Sahyadri Traders (Pune shop learning lab) on YOUR host-only network:

Tiny PHP or static site (or DVWA) on 192.168.56.XX with a deliberate index.php.bak (or config.php.bak) in the webroot
Leave Server / X-Powered-By version headers visible; optional HTTP-only page (no HSTS) for concept notes
Ethics card: IT Act – only OWN VMs; Bettercap never on office/college/neighbour Wi-Fi

Hack (OWN lab only):

Fingerprint with whatweb http://192.168.56.XX
Directory fuzz with ffuf (use -rate / filters) – find the .bak and note interesting paths
Optional: Bettercap net.probe / net.show on host-only; if you try ARP spoof, target only YOUR lab HTTP VM, then turn spoof off
Shell concept: note how a reverse nc would look in ss -tulnp – do not leave listeners running

Do not fuzz third-party sites, do not MITM real Wi-Fi, do not leave .bak or shells on anything you do not own.

Fix:

Delete backup files from webroot; move secrets out of document root
Add nginx/Apache rate-limit (or WAF note); strip version banners
Document HTTPS + HSTS and DAI / segmentation for the MITM row
Egress note: odd outbound ports blocked; baseline ss after cleanup

Re-verify: Peer-review with Amir / Zoya – .bak gone? rate-limit on? banners quiet? Purple 1-page for owner Ravindra Bagale (trainer) / shop story: fuzz finding → fix → re-ffuf (backup 404). IT Act: OWN / authorised only.

Real incident: Mossack Fonseca / Panama Papers (2016)

In 2016, a huge document leak from the Panamanian law firm Mossack Fonseca (widely called the Panama Papers) reached journalists. Public security research afterward reported that the firm's public web stack looked badly outdated – WordPress and a client portal on old Drupal, plus a well-known vulnerable Revolution Slider WordPress plugin path discussed by researchers as a plausible entry (exact root cause was not proven in a single official forensic public report). Weakness: poor web hygiene – unpatched CMS/plugins, version exposure, weak patching culture that recon tools (fingerprint + vuln discovery) can find. What would have reduced risk: timely CMS/plugin updates, no public backup/config leaks, WAF/hardening, inventory of internet-facing apps. Lesson for this chapter: WhatWeb/FFUF-style recon is how attackers map soft targets – Blue must patch and hide nothing sensitive in webroot. Source: contemporary reporting (e.g. Wordfence/Forbes/InfoWorld analyses of Mossack Fonseca's outdated WordPress/Drupal/plugin exposure); verify current summaries.

Real incident: British Airways Magecart (2018)

In 2018, British Airways reported that attackers stole payment and customer data from bookings. Researchers (widely reported, e.g. RiskIQ) described a Magecart-style skimmer: malicious JavaScript (reported as roughly 22 lines injected into a site script such as Modernizr) that grabbed payment-form data and sent it to an attacker domain made to look BA-like. Reported impact was on the order of hundreds of thousands of transactions (treat published figures as reported). Weakness: attackers could alter first-party JS on payment pages; insufficient web integrity / monitoring of script changes. What would have helped: strict Content-Security-Policy (CSP), Subresource Integrity (SRI) where applicable, change-monitoring on payment JS, least privilege on who can deploy web assets. Lesson: fingerprinting and web recon find soft spots; Blue must protect page integrity, not only HTTPS. Source: BA public statements and major coverage of the 2018 Magecart analysis (RiskIQ and others); verify current summaries.

Interview model (clean English): "I only fuzz and fingerprint systems I own. In our Sahyadri lab I found a backup file with FFUF, removed it, added rate-limiting and HSTS notes, and I treat Bettercap MITM as a host-only concept never used on real Wi-Fi."

Thodkyaat: fuzz/enum/shell/MITM olakha, pan WAF/inventory/banner-strip/egress/HSTS+DAI shika. Aata pudhe enumeration tools. Chala pudhe, mitrano!

Thodkyaat sangaycha tar

FFUF: fast fuzzing with FUZZ; filter by status/size; rate-limit; lab only on DVWA (192.168.56.20).
Amass: passive subdomain discovery first; active brute only on domains you own.
WhatWeb / Wappalyzer: fingerprint the stack; defenders strip version headers and patch.
Netcat / Socat: listen, transfer, relay; reverse/bind shells are concepts to detect (ss, egress firewall).
Bettercap: ARP MITM only on host-only lab; HTTPS + HSTS + segmentation defend.
Every tool in this chapter pairs with a defence – checklist lakshat theva.

Samjla ka? Aata FFUF, Amass, WhatWeb, Netcat/Socat ani Bettercap tumchya toolkit madhe aahet. Pudhchya chapter madhe enumeration ani Active Directory (Impacket, BloodHound) – CEH modules pudhe. Chala pudhe, mitrano!