Nmap_Encrypted_Scanning_Project.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "**Nmap Encrypted Scanning Project**\n",
    "\n",
    "**Objective**\n",
    "\n",
    "This project will analyze how encryption affects Nmap scans under different conditions by comparing open port detection, service fingerprinting, and banner information between encrypted and unencrypted communications.\n",
    "\n",
    "**Project Scenarios**\n",
    "\n",
    "We will conduct Nmap scans from the Dell OptiPlex 7070 SFF (Windows 10 Pro) against the MacBook Air (macOS) under four conditions:\n",
    "\n",
    "No Encryption (Baseline) – Unencrypted HTTP service on port 80.\n",
    "\n",
    "TLS Encryption (HTTPS Web Server) – TLS-encrypted service on port 443.\n",
    "\n",
    "Secure Shell (SSH Tunnel Forwarding) – SSH tunnel between devices on port 22.\n",
    "\n",
    "Secure File Transfer (SFTP over SSH) – Secure file transfer using SFTP (port 22).\n",
    "\n",
    "Project Setup\n",
    "\n",
    "**1. Environment Preparation**\n",
    "\n",
    "**Windows Setup (Dell OptiPlex 7070 SFF)**\n",
    "\n",
    "Install Nmap (already installed).\n",
    "\n",
    "Install VS Code, Python, Jupyter Notebook (already installed).\n",
    "\n",
    "\n",
    "**MacOS Setup (MacBook Air)**\n",
    "\n",
    "Ensure OpenSSH is installed (comes pre-installed on macOS).\n",
    "\n",
    "Install a simple web server (if needed for TLS testing):\n",
    "\n",
    "brew install openssl\n",
    "\n",
    "**2. Scenario 1: No Encryption (Baseline)**\n",
    "\n",
    "Start an HTTP server on the MacBook Air:\n",
    "\n",
    "python3 -m http.server 80 --bind 0.0.0.0\n",
    "\n",
    "Find MacBook's local IP address:\n",
    "\n",
    "ifconfig | grep \"inet \"\n",
    "\n",
    "Run Nmap from Dell (Windows) to scan the MacBook:\n",
    "\n",
    "nmap -A <MacBook-IP>\n",
    "\n",
    "Record findings in Jupyter Notebook.\n",
    "\n",
    "**3. Scenario 2: TLS Encryption (HTTPS Web Server)**\n",
    "\n",
    "Set up an HTTPS server on MacBook Air:\n",
    "\n",
    "Run Nmap from Dell (Windows) to scan the encrypted service:\n",
    "\n",
    "nmap -sV --script ssl-enum-ciphers <MacBook-IP>\n",
    "\n",
    "Compare findings with baseline scan and note differences.\n",
    "\n",
    "**4. Scenario 3: SSH Tunnel Forwarding**\n",
    "\n",
    "Start an SSH server on MacBook Air:\n",
    "\n",
    "sudo systemsetup -setremotelogin on\n",
    "\n",
    "From Dell, establish an SSH tunnel:\n",
    "\n",
    "ssh -L 8080:localhost:80 user@<MacBook-IP>\n",
    "\n",
    "Run Nmap against the tunneled service:\n",
    "\n",
    "nmap -p 8080 localhost\n",
    "\n",
    "Compare results against previous scans.\n",
    "\n",
    "**5. Scenario 4: Secure File Transfer (SFTP over SSH)**\n",
    "\n",
    "On MacBook Air, confirm SSH service is running:\n",
    "\n",
    "sudo systemsetup -getremotelogin\n",
    "\n",
    "Transfer a test file from Windows to Mac via SFTP:\n",
    "\n",
    "sftp user@<MacBook-IP>\n",
    "put testfile.txt\n",
    "\n",
    "Run an Nmap scan on port 22 from Dell:\n",
    "\n",
    "nmap -p 22 -sV <MacBook-IP>\n",
    "\n",
    "Analyze how encryption affects service detection.\n",
    "\n",
    "** 6.Conclusion**\n",
    "\n",
    "Compare all four scenarios and analyze how encryption changes Nmap’s ability to detect services.\n",
    "\n",
    "Document findings in the Jupyter Notebook and push results to GitHub.\n",
    "\n"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "**Scenario 1: Baseline Nmap Scan (No Encryption) - Report**\n",
    "\n",
    "**Objective**\n",
    "\n",
    "The purpose of this scenario was to establish a baseline for how Nmap detects open, unencrypted services. To achieve this, an HTTP server without encryption was set up on the MacBook Air, and an Nmap scan was conducted from the Dell Windows 11 system to analyze what services and ports were detected before implementing encryption in later scenarios.\n",
    "\n",
    "Steps Taken\n",
    "Set up a Python HTTP server on the MacBook Air:\n",
    "\n",
    "The following command was executed in the MacBook’s Terminal:\n",
    "\n",
    "sudo python3 -m http.server 80 --bind 0.0.0.0\n",
    "\n",
    "This command launched an unencrypted web server on port 80, making it accessible over the local network.\n",
    "\n",
    "Verified the MacBook’s IP address:\n",
    "\n",
    "The command below was used to identify the local IP address of the MacBook Air:\n",
    "\n",
    "ifconfig | grep \"inet \"\n",
    "\n",
    "The system returned an IP address of 192.168.1.148, confirming that the device was reachable on the network.\n",
    "\n",
    "Tested HTTP access from the Dell system:\n",
    "\n",
    "Using Google Chrome on the Dell Windows 11 system, the following URL was entered:\n",
    "\n",
    "http://192.168.1.148\n",
    "\n",
    "The browser successfully loaded the server’s directory listing, confirming that the HTTP server was functional and accessible.\n",
    "\n",
    "**Performed Nmap scans from the Dell system:**\n",
    "Basic port scan **(nmap 192.168.1.148)**) is executed to detect open ports.\n",
    "Service version detection scan **(nmap -sV 192.168.1.148)** was performed to identify running services.\n",
    "Aggressive scan **(nmap -A 192.168.1.148)** was conducted for more detailed fingerprinting.\n",
    "\n",
    "**Findings from the Baseline Scan**\n",
    "Key Findings:\n",
    "Port 80 (HTTP) was detected as open, confirming that the unencrypted Python HTTP server was active and accessible.\n",
    "Nmap identified the service as SimpleHTTPServer 0.6 (Python 3.12.3), which aligns with the expected output for Python's built-in web server.\n",
    "The OS fingerprinting results correctly identified the target machine as running macOS (versions 11-13).\n",
    "A directory listing was detected on the HTTP server, meaning that any files in the directory where the server was launched were openly accessible.\n",
    "\n",
    "**Additional Interesting Observations:**\n",
    "\n",
    "Port 5000/tcp & 7000/tcp were open, running AirTunes RTSP (Real Time Streaming Protocol) services (rtspd 775.3.1). These are used by Apple’s AirPlay for media streaming.\n",
    "Port 49152/tcp was open but unidentified. This is a common ephemeral port that macOS may use for internal communication or background services.\n",
    "Nmap detected a .git directory on the HTTP server, which could indicate an exposed Git repository if it were publicly accessible.\n",
    "\n",
    "**Conclusion:**\n",
    "The baseline Nmap scan was successfully completed, providing a clear view of how Nmap detects unencrypted services on a network. Port 80 was correctly identified, and additional open ports (such as AirTunes services) were also detected. This establishes a reference point for comparison in future scenarios when encryption is applied.\n",
    "\n",
    "📌 Scenario 1: Summary of the Flow (Baseline - Unencrypted HTTP)\n",
    "Step 1: The Mac starts an unencrypted HTTP server on 0.0.0.0:80, making it accessible to any device on the network.\n",
    "Step 2: The Dell scans 192.168.1.148:80 and detects an open HTTP service.\n",
    "Step 3: The Dell accesses http://192.168.1.148 in a browser, confirming the connection is unencrypted.\n",
    "Step 4: Nmap’s aggressive scan (-A) reveals a directory listing, meaning files on the server are openly accessible.\n",
    "\n",
    "🚀 Key Takeaway\n",
    "🔹 All traffic is unencrypted, meaning data can be intercepted.\n",
    "🔹 Nmap detects HTTP on port 80, confirming the service is running with no encryption.\n",
    "🔹 The server allows directory listing, which could expose sensitive files to attackers.\n",
    "\n",
    "\n",
    "\n",
    "**Next Steps: Implementing TLS Encryption**\n",
    "\n",
    "With the baseline scan complete, the next step is to encrypt the HTTP traffic using TLS (HTTPS) and analyze how Nmap’s detection results change. This will involve:\n",
    "\n",
    "Setting up an HTTPS server on the MacBook Air with a self-signed TLS certificate.\n",
    "Running the same Nmap scans from the Dell system to compare results.\n",
    "Identifying how encryption affects port visibility, service fingerprinting, and banner detection."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "**Scenario 2: Nmap Scan Results for TLS-Encrypted HTTPS Server**\n",
    "\n",
    "1️⃣ Basic Port Scan (nmap 192.168.1.148)\n",
    "\n",
    "Nmap Command:\n",
    "**nmap 192.168.1.148**\n",
    "\n",
    "Raw Output Highlights:\n",
    "Host is up with 0.012s latency.\n",
    "Port 443/tcp (HTTPS) is open, replacing HTTP from Scenario 1.\n",
    "Port 5000/tcp (UPnP) is open, likely related to Apple’s AirTunes or device functions.\n",
    "Port 7000/tcp (AFS3 file server) is open, used by macOS for file sharing.\n",
    "MAC Address: 74:A6:CD:DB:FD:32 (Apple device).\n",
    "\n",
    "**Interpretation:**\n",
    "\n",
    "The system is responsive with low latency, confirming a local network connection.\n",
    "HTTPS is running on port 443 instead of HTTP (port 80 in Scenario 1).\n",
    "Other detected services (5000, 7000) were also present in Scenario 1, meaning they are unrelated to the encryption change.\n",
    "\n",
    "**Comparison to Scenario 1:**\n",
    "\n",
    "Main difference: In Scenario 1, port 80 (HTTP) was open, now it's 443 (HTTPS).\n",
    "This confirms that TLS encryption has replaced the previous unencrypted web service.\n",
    "\n",
    "2️⃣ Service Version Detection (nmap -sV -p 443 192.168.1.148)\n",
    "\n",
    "Nmap Command:\n",
    "**nmap -sV -p 443 192.168.1.148**\n",
    "\n",
    "**Raw Output Highlights:**\n",
    "\n",
    "Port 443 is open, running ssl/http (HTTPS).\n",
    "Detected service: SimpleHTTPServer 0.6 (Python 3.12.3).\n",
    "\n",
    "**Interpretation:**\n",
    "The server is using Python’s built-in SimpleHTTPServer, which was also present in Scenario 1.\n",
    "Key difference: Now it is wrapped in SSL/TLS encryption (identified as ssl/http instead of http).\n",
    "This confirms that encryption is successfully applied, and the server is no longer transmitting data in plaintext.\n",
    "\n",
    "**Comparison to Scenario 1:**\n",
    "\n",
    "Scenario 1: The same Python server was detected but as http (unencrypted).\n",
    "Scenario 2: The server is now detected as ssl/http, verifying that the transition to HTTPS was successful.\n",
    "\n",
    "**3️⃣ Aggressive Scan (nmap -A -p 443 192.168.1.148)**\n",
    "\n",
    "Nmap Command:\n",
    "**nmap -A -p 443 192.168.1.148**\n",
    "\n",
    "**Raw Output Highlights:**\n",
    "\n",
    "Port 443 is open, running ssl/http (HTTPS).\n",
    "SSL certificate details:\n",
    "Organization: Internet Widgits Pty Ltd\n",
    "Country: AU\n",
    "Validity: March 12, 2025 – March 12, 2026\n",
    ".git directory found in web root.\n",
    "\n",
    "**Interpretation:**\n",
    "\n",
    "Nmap successfully extracted SSL certificate details, confirming that our self-signed certificate is in use.\n",
    "The certificate is not signed by a trusted Certificate Authority (CA), which is why browsers show a security warning.\n",
    "Security Concern: Nmap discovered a .git directory on the HTTPS server.\n",
    "This could expose Git repository data if misconfigured.\n",
    "If sensitive files exist in .git, attackers could clone the repository and extract code, credentials, or configuration files.\n",
    "\n",
    "**Comparison to Scenario 1:**\n",
    "New detection: .git directory was NOT reported in Scenario 1.\n",
    "Possible reason: HTTPS may allow deeper enumeration, or Git may not have been scanned over HTTP in Scenario 1.\n",
    "\n",
    "**4️⃣ SSL Cipher & Encryption Strength Analysis (nmap --script ssl-enum-ciphers -p 443 192.168.1.148)**\n",
    "\n",
    " Nmap Command:\n",
    "**nmap --script ssl-enum-ciphers -p 443 192.168.1.148**\n",
    "\n",
    "**Raw Output Highlights:**\n",
    "\n",
    "TLS 1.2 and TLS 1.3 are supported.\n",
    "Strong ciphers detected (all rated \"A\"):\n",
    "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384\n",
    "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256\n",
    "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256\n",
    "No weak ciphers detected.\n",
    "\n",
    "**Interpretation:**\n",
    "The HTTPS server is enforcing modern encryption standards, which is ideal for security.\n",
    "TLS 1.2 and 1.3 are strong and still widely used in production environments.\n",
    "No outdated or insecure ciphers (e.g., TLS 1.0, RC4, or DES) were found, meaning the server is using best practices for encryption.\n",
    "\n",
    "**Comparison to Scenario 1:**\n",
    "Scenario 1 had no encryption.\n",
    "Scenario 2 has enforced HTTPS with strong TLS encryption.\n",
    "This confirms that data transmission is now protected from man-in-the-middle attacks (MITM) and eavesdropping.\n",
    "\n",
    "**Final Summary & Key Takeaways:**\n",
    "✅ Encryption Successfully Implemented\n",
    "\n",
    "The server has transitioned from HTTP (unencrypted) to HTTPS (encrypted).\n",
    "TLS 1.2 and TLS 1.3 are properly configured, with no weak ciphers detected.\n",
    "The server is using strong, modern cryptographic ciphers (AES-GCM, ChaCha20-Poly1305), ensuring that data cannot be easily intercepted or tampered with.\n",
    "The certificate is self-signed, which means it is not trusted by default browsers, resulting in a security warning. However, the encryption itself is functional.\n",
    "\n",
    "**🚨 Security Concern: Exposed .git Directory**\n",
    "\n",
    "The .git directory could potentially leak sensitive repository information.\n",
    "This was not detected in Scenario 1 (HTTP) but was found in Scenario 2 (HTTPS).\n",
    "Possible reasons it was detected now:\n",
    "Nmap's HTTP scripts scanned more deeply over HTTPS.\n",
    "Additional web security measures on HTTP may have blocked certain requests.\n",
    "The .git folder was manually added or became exposed during the transition to HTTPS.\n",
    "\n",
    "**Potential risk:**\n",
    "If this Git repository contains sensitive credentials, API keys, or proprietary code, an attacker could clone it remotely.\n",
    "If the .git folder is publicly accessible, attackers could extract commit history and config files.\n",
    "\n",
    "**Recommendation:**\n",
    "Restrict access to the .git directory in the web server configuration.\n",
    "Ensure no sensitive credentials are stored in Git repositories accessible from the web root.\n",
    "Verify that Git is not exposing unwanted files using ls -la /path/to/webroot/.git.\n",
    "\n",
    "**🔹 Additional Insight: Understanding Cipher Suite Negotiation**  \n",
    "\n",
    "In our analysis, we determined that the HTTPS server **supports** strong encryption methods, but Nmap does not tell us which cipher suite is actually **negotiated and used** in a real connection.  \n",
    "\n",
    "**🔹 Key Clarification:**  \n",
    "- Nmap lists **all available cipher suites** that the server supports.  \n",
    "- The **actual cipher chosen depends on handshake negotiation** between the client and server.  \n",
    "- If a client does not support the strongest cipher, a weaker one may be selected.  \n",
    "- **Nmap does not simulate a full TLS handshake**, so we cannot see the final choice.  \n",
    "\n",
    "**🔹 Optimally, the server will use:**  \n",
    "- **TLS Handshake:** ECDHE for key exchange (supports Perfect Forward Secrecy).  \n",
    "- **Server Authentication:** RSA to verify the certificate.  \n",
    "- **Data Encryption:** AES-256 in GCM mode for confidentiality.  \n",
    "- **Integrity Check:** SHA-384 for message authentication.  \n",
    "\n",
    "**🔹 However, these may be downgraded based on:**  \n",
    "- The client’s supported ciphers.  \n",
    "- TLS handshake negotiation.  \n",
    "- Server preference settings.  \n",
    "\n",
    "**🔹 How to Determine the Actual Cipher Used?**  \n",
    "To confirm which cipher suite was actually chosen in a real connection, we would need to:  \n",
    "\n",
    "1️⃣ **Perform a live TLS handshake using OpenSSL:**  \n",
    "   ```sh\n",
    "   openssl s_client -connect 192.168.1.148:443\n",
    "\n",
    "   This forces a connection and reveals the negotiated cipher.\n",
    "\n",
    "2️⃣ **Capture the handshake with Wireshark:**\n",
    "\n",
    "The Server Hello message will contain the actual selected cipher in real traffic.\n",
    "This allows us to verify if the strongest cipher was used or if it was downgraded.\n",
    "\n",
    "**🚀 Summary:** \n",
    "\n",
    "Nmap shows what is available, but not what is actually used.\n",
    "OpenSSL or Wireshark is required to determine the final selected cipher.\n",
    "Understanding this distinction is crucial in security assessments to ensure that strong encryption is actually enforced.\n",
    "\n",
    "📌 Scenario 2: Summary of the Flow (TLS-Encrypted HTTPS Server)\n",
    "Step 1: The Mac starts an HTTPS server on 0.0.0.0:443 using a self-signed TLS certificate.\n",
    "Step 2: The Dell scans 192.168.1.148:443 and detects an HTTPS service instead of HTTP.\n",
    "Step 3: The Dell accesses https://192.168.1.148 in a browser, but sees a security warning due to the self-signed certificate.\n",
    "Step 4: Nmap retrieves SSL certificate details, confirming TLS 1.2 and TLS 1.3 encryption.\n",
    "Step 5: Nmap detects an exposed .git repository, which was not identified in Scenario 1.\n",
    "\n",
    "🚀 Key Takeaway\n",
    "🔹 Traffic is now encrypted, preventing interception, but the self-signed certificate triggers security warnings.\n",
    "🔹 Nmap sees HTTPS on port 443 instead of HTTP on port 80, confirming encryption is in place.\n",
    "🔹 The .git directory exposure is a security risk, showing that encryption does not protect against misconfigurations.\n",
    "\n"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "**Scenario 3: Nmap Scan Results for HTTP Over SSH Tunnel**\n",
    "\n",
    "**1️⃣ Basic Port Scan (nmap 127.0.0.1 -p 9999)**\n",
    "\n",
    "Nmap Command:\n",
    "**nmap 127.0.0.1 -p 9999**\n",
    "\n",
    "Raw Output Highlights:\n",
    "Port 9999/tcp is open, meaning the SSH tunnel is active.\n",
    "Initially identified as \"abyss\" service due to incomplete detection.\n",
    "\n",
    "**Interpretation:**\n",
    "The port is open, confirming that the SSH tunnel is properly forwarding traffic.\n",
    "Initial misidentification was due to Nmap not fully analyzing the service.\n",
    "\n",
    "**Comparison to Previous Scenarios:**\n",
    "In Scenario 1 (Unencrypted HTTP), Nmap scanned 192.168.1.148:80 directly.\n",
    "In Scenario 2 (Direct HTTPS), Nmap scanned 192.168.1.148:443.\n",
    "Here, Nmap is scanning 127.0.0.1:9999, meaning it is analyzing the SSH tunnel rather than the remote Mac itself.\n",
    "27.0.0.1:9999 appears to be a local HTTP server on the Dell, but it is actually traffic being forwarded from the Mac’s HTTP server (192.168.1.148:8080).\n",
    "The SSH tunnel makes the remote service accessible as if it were running locally on the Dell.\n",
    "Nmap detects HTTP on port 9999, but it is actually analyzing the tunneled connection, not a service physically running on the Dell.\n",
    "Without the SSH tunnel, port 9999 on the Dell would be closed and inaccessible.\n",
    "\n",
    "\n",
    "**2️⃣ Service Version Detection (nmap -sV -p 9999 127.0.0.1)**\n",
    "\n",
    "Nmap Command:\n",
    "**nmap -sV -p 9999 127.0.0.1**\n",
    "\n",
    "Raw Output Highlights:\n",
    "Port 9999/tcp is running SimpleHTTPServer 0.6 (Python 3.12.3).\n",
    "Now correctly identifies the service as HTTP instead of \"abyss\".\n",
    "\n",
    "**Interpretation:**\n",
    "This confirms that the SSH tunnel is successfully forwarding HTTP traffic.\n",
    "The initial service misidentification was resolved by using a version scan (-sV).\n",
    "Even though traffic is encrypted over SSH, Nmap still detects HTTP running inside the tunnel.\n",
    "\n",
    "**Comparison to Previous Scenarios:**\n",
    "In Scenario 1, Nmap detected SimpleHTTPServer on port 80.\n",
    "In Scenario 2, Nmap detected SimpleHTTPServer on port 443 (encrypted with TLS).\n",
    "Here, we see the same service running, but tunneled over SSH.\n",
    "Nmap detects HTTP because it is scanning port 9999 on the Dell, where the SSH tunnel has already decrypted the traffic.\n",
    "Wireshark will show unencrypted HTTP packets on 127.0.0.1:9999 (Dell), but encrypted SSH packets on 192.168.1.148:22 (Mac).\n",
    "The SSH tunnel encrypts traffic between machines but does NOT encrypt traffic once it reaches the local port forwarding endpoint.\n",
    "\n",
    "**3️⃣ Aggressive Scan (nmap -A -p 9999 127.0.0.1)**\n",
    "Nmap Command:\n",
    "nmap -A -p 9999 127.0.0.1\n",
    "Raw Output Highlights:\n",
    "Port 9999 is running SimpleHTTPServer 0.6 (Python 3.12.3).\n",
    "Directory Listing is Enabled.\n",
    "Git Repository Detected (.git directory found).\n",
    "HTTP Server Header: Reports SimpleHTTP/0.6 Python/3.12.3.\n",
    "Interpretation:\n",
    "The SSH tunnel does not block Nmap’s ability to detect the underlying service.\n",
    "The .git directory is exposed, which could pose a security risk.\n",
    "This shows that SSH tunneling encrypts traffic in transit, but does NOT hide the service details from a local scan.\n",
    "Comparison to Previous Scenarios:\n",
    "In Scenario 1, a .git directory was detected in unencrypted HTTP (port 80).\n",
    "In Scenario 2, the .git directory was also found in direct HTTPS (port 443).\n",
    "Here, despite the SSH tunnel, Nmap was still able to detect and enumerate the .git repository.\n",
    "\n",
    "**Summary of the Flow**\n",
    "\n",
    "Step 1: The Mac starts an HTTP server on 127.0.0.1:8080, but it’s only accessible from the Mac itself.\n",
    "Step 2: The Dell creates an SSH tunnel (9999 → 8080), allowing traffic sent to 127.0.0.1:9999 to be forwarded to 127.0.0.1:8080 (Mac).\n",
    "Step 3: The Dell accesses 127.0.0.1:9999, and traffic is automatically encrypted, sent to the Mac, decrypted, and processed by the HTTP server.\n",
    "Step 4: Nmap scans 127.0.0.1:9999 on the Dell, sees HTTP running, but does not know that it’s actually coming from the Mac.\n",
    "\n",
    "🚀 Key Takeaway\n",
    "🔹 The SSH tunnel tricks the Dell into thinking the Mac’s HTTP server is running locally.\n",
    "🔹 Nmap sees HTTP on 127.0.0.1:9999, but that’s just the tunnel exposing it—it doesn’t detect encryption.\n",
    "🔹 If we ran Wireshark, we would see encrypted SSH traffic between the Dell and Mac (port 22), but unencrypted HTTP on 127.0.0.1:9999.\n",
    "\n",
    "**Final Summary & Key Takeaways**\n",
    "\n",
    " SSH Tunnel Successfully Established\n",
    "\n",
    "HTTP traffic was secured via an SSH tunnel, replacing direct HTTP or HTTPS.\n",
    "Port 9999 correctly forwarded traffic from 127.0.0.1:8080.\n",
    "Nmap successfully scanned HTTP through the SSH tunnel, proving that encrypted tunneling does not inherently block service fingerprinting.\n",
    " Encrypted tunneling prevents third-party network-based packet capture, but does not block service fingerprinting at the local endpoint because decryption happens before the service is accessed. This means that while tunneling protects data in transit from external interception, it does not hide the true nature of a service from an attacker who gains access to the endpoint. In cybersecurity, this reinforces the need for strong endpoint security, access controls, and logging, as attackers who breach a local system can still enumerate services even if traffic was encrypted over the network.\n",
    "\n",
    "\n",
    "**🚨 Security Concern: Exposed .git Directory**\n",
    "\n",
    "The .git directory was detected, just as in Scenario 1 (HTTP) and Scenario 2 (HTTPS).\n",
    "This means SSH tunneling does NOT prevent data leaks—it only encrypts traffic.\n",
    "Recommendation: Restrict access to .git via .htaccess or server configuration.\n",
    "\n",
    "**🛠️ Key Differences Compared to Previous Scenarios**\n",
    "\n",
    "Scenario 1: Direct HTTP\n",
    "Connection Type: Unencrypted HTTP.\n",
    "Port Scanned: 80.\n",
    "Encryption Used: ❌ None.\n",
    "Key Findings: .git directory exposed.\n",
    "\n",
    "Scenario 2: Direct HTTPS\n",
    "Connection Type: Encrypted HTTPS.\n",
    "Port Scanned: 443.\n",
    "Encryption Used: ✅ TLS 1.2 / 1.3.\n",
    "Key Findings: .git directory still exposed.\n",
    "\n",
    "We are confident that TLS 1.2 and TLS 1.3 were the only versions available on the server because Nmap’s ssl-enum-ciphers script explicitly confirmed that only these versions were supported. While we previously discussed how individual cryptographic components—such as key exchange (ECDHE), authentication (RSA), encryption (AES-GCM), and integrity verification (SHA-384)—could be downgraded based on client-server negotiation, TLS version enforcement operates differently. A server will only allow connections using the versions it supports, meaning if an older version like TLS 1.1 were required by the client, the connection would simply fail rather than downgrade. In our case, the Mac server only advertised TLS 1.2 and 1.3, ensuring that no older, weaker versions could be used. While cipher selection was flexible within the constraints of TLS 1.2/1.3, the protocol version itself was strictly limited by the server’s configuration, meaning we can be fully confident that one of these two versions was used.\n",
    "\n",
    "Scenario 3: HTTP Over SSH Tunnel\n",
    "Connection Type: HTTP tunneled over SSH.\n",
    "Port Scanned: 9999.\n",
    "Encryption Used: ✅ SSH Tunnel.\n",
    "Key Findings: .git directory still exposed, proving tunneling does not hide services.\n"
   ]
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.13.2"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 2
}