DEV Community

LaTerral Williams
LaTerral Williams

Posted on

🛡️ Ethical Hacking Lab Walkthrough: Website Cloning & SMB Enumeration (Beginner-Friendly)

#cybersecurity #cloud #security #parocyber

Lab Context:

This article documents a controlled, educational cybersecurity lab completed in a VirtualBox-based Kali Linux environment.

All techniques demonstrated were performed only against intentionally vulnerable lab machines (DVWA & Metasploitable) and never against real-world systems.

📌 Table of Contents

  1. Why I Built This Lab
  2. Lab Environment Setup
  3. Part 1: Website Cloning with SEToolkit
  4. Part 2: SMB Vulnerability Scanning with Enum4Linux
  5. SMB Access & File Upload with smbclient
  6. Key Security Findings
  7. Defensive Takeaways
  8. Final Thoughts

Why I Built This Lab

This is a part of my Parocyber ethical hacking training. The instructors course design provides opportunities to gain hands-on experience that mirrors real-world penetration testing workflows.

This lab helped me practice:

  • Understanding how phishing attacks work behind the scenes
  • Enumerating SMB services and misconfigurations
  • Reading tool output and translating it into meaningful findings

Everything here is framed from a defender’s mindset: learning how attacks work so they can be prevented.

Lab Environment Setup

  • Attacker Machine: Kali Linux OVA (VirtualBox)
  • Targets:
    • DVWA (http://dvwa.vm)
    • Metasploitable (172.17.0.2)
  • Network: Isolated lab network
  • Attacker IP: 10.6.6.1

Part 1: Website Cloning with SEToolkit

Understanding Website Cloning

Website cloning is a technique used in phishing attacks where a legitimate login page is copied and hosted elsewhere to harvest credentials.

In this lab, the goal is educational to see how credential harvesting works so we can better defend against it.

SEToolkit Attack Flow

Tool: Social-Engineer Toolkit (SEToolkit)

Attack Type: Credential Harvester → Site Cloner

High-level steps:

  1. Clone a login page (http://dvwa.vm)
  2. Host it on the Kali attacker machine
  3. Capture submitted credentials
  4. Review the generated report

A custom redirect file was created:

<html>
  <head>
    <meta http-equiv="refresh" content="0; url=http://10.6.6.1/" />
  </head>
</html>
Enter fullscreen mode Exit fullscreen mode

Fake credentials submitted:

Captured Credentials & XML Report

SEToolkit logged the credentials and exported an XML report:

<harvester>
   URL=http://dvwa.vm
   <url>
      <param>username=marvelfan@demo.com</param>
      <param>password=1234</param>
      <param>Login=Login</param>
      <param>user_token=...</param>
   </url>
</harvester>
Enter fullscreen mode Exit fullscreen mode

This clearly shows how form fields are captured during phishing attacks.

Part 2: SMB Vulnerability Scanning with Enum4Linux

Network Discovery with Nmap

A null scan was used (requires root):

nmap -sN 172.17.0.0/24
Enter fullscreen mode Exit fullscreen mode

This revealed the Metasploitable host (172.17.0.2) with SMB-related ports:

  • 139/tcp
  • 445/tcp

User Enumeration 

enum4linux -U 172.17.0.2
Enter fullscreen mode Exit fullscreen mode

Result:

  • Dozens of local users discovered
  • Anonymous SMB sessions allowed

This alone is a critical misconfiguration.

NetBIOS & OS Enumeration 

enum4linux -n 172.17.0.2
enum4linux -o 172.17.0.2
Enter fullscreen mode Exit fullscreen mode

Key findings:

  • Workgroup: WORKGROUP
  • OS: Samba 3.0.20 (Debian) — known vulnerable version

Share Enumeration 

enum4linux -Sv 172.17.0.2
Enter fullscreen mode Exit fullscreen mode

Shares discovered:

  • print$
  • tmp
  • opt
  • IPC$
  • ADMIN$

The tmp share allowed anonymous read/write access.

Password Policy Enumeration 

enum4linux -P 172.17.0.2
Enter fullscreen mode Exit fullscreen mode

Findings:

  • Minimum password length: 5
  • Password complexity: Disabled
  • Account lockout: None

This configuration allows easy brute-force attacks.

Full Enumeration (-a) 

enum4linux -a 172.17.0.2
Enter fullscreen mode Exit fullscreen mode

This combined all enumeration techniques:

  • Users
  • Groups
  • Shares
  • Password policy
  • RID cycling

A full attacker profile of the system was built without authentication.

SMB Access & File Upload with smbclient

Listing shares:

smbclient -L //172.17.0.2
Enter fullscreen mode Exit fullscreen mode

Anonymous login succeeded.

Connecting to the writable share:

smbclient //172.17.0.2/tmp
Enter fullscreen mode Exit fullscreen mode

Uploading a file:

put virus.exe group_work.txt
Enter fullscreen mode Exit fullscreen mode

The uploaded file appeared in the directory listing, confirming anonymous write access.

⚠️ Note: The local file must exist in your current directory before using put, or the upload will fail.

Further Reading & Full Outputs

🔗 Full raw command outputs (Enum4Linux, smbclient, SEToolkit) are available on my github:

➡️ Website Clone & SMB Vulnerability Scan

Key Security Findings

  • Phishing pages easily capture credentials if users are unaware
  • SMB anonymous access exposes:
    • Users
    • OS details
    • Writable shares
  • Weak password policies enable brute-force attacks
  • SMB1 fallback is still enabled (dangerous)

Defensive Takeaways

To defend against these attacks:

  • Enforce MFA and phishing-resistant authentication
  • Disable anonymous SMB access
  • Remove SMB1 support
  • Enforce strong password policies
  • Restrict share permissions
  • Monitor logs for enumeration activity

Final Thoughts

This lab reinforced how small misconfigurations can lead to full system compromise.

By practicing these techniques in a safe environment, defenders can better recognize, detect, and prevent real-world attacks.

If you’re learning cybersecurity, labs like this bridge the gap between theory and practice.

🤝 Connect

If you enjoyed this article or you’re also learning DevOps, Linux, Security, or Cloud automation, I’d love to connect, share ideas, and learn.

💬 Feel free to reach out or follow my journey on 👉 LinkedIn

Top comments (0)