# ipsec_vpn_simulation.py  ← Run this in lab → show Site-to-Site VPN
from cryptography.hazmat.primitives import hashes
from cryptography.hazmat.primitives.kdf.hkdf import HKDF
from cryptography.fernet import Fernet
import os

# Pre-shared key (PSK) – configured on both routers
PSK = b"SuperSecretBranch123!"

# Derive encryption + authentication keys (like IKE does)
hkdf = HKDF(algorithm=hashes.SHA256(), length=64, salt=None, info=b'IPSec ESP')
keys')
keys = hkdf.derive(PSK)
enc_key = keys[:32]   # AES-256
auth_key = keys[32:]  # HMAC-SHA256

print("Bank HQ ←→ Branch IPSec Tunnel Established")
print("Encryption Key :", enc_key.hex())
print("Integrity Key  :", auth_key.hex())

# ESP Encryption (Confidentiality + Integrity)
cipher = Fernet(enc_key + b'==')  # Fernet uses AES-128 + HMAC, close enough
packet = "Transfer 50 lakhs to A/C 1234567890"
encrypted_packet = cipher.encrypt(packet.encode())

print(f"\nOriginal Packet : {packet}")
print(f"ESP Encrypted   : {encrypted_packet[:60].hex()}...")

# Decryption at branch
decrypted = cipher.decrypt(encrypted_packet).decode()
print(f"Decrypted       : {decrypted}")
print("IPSec Tunnel Mode with ESP (Encryption + Authentication) SUCCESS")

# tls1.3_live_demo.py  ← Connect to real bank/website and show certificate
import ssl
import socket
from datetime import datetime

def check_https_site(url):
    context = ssl.create_default_context()
    with socket.create_connection((url, 443)) as sock:
        with context.wrap_socket(sock, server_hostname=url) as ssock:
            cert = ssock.getpeercert()
            cipher = ssock.cipher()
            version = ssock.version()

    print(f"Website      : https://{url}")
    print(f"TLS Version  : {version}")                    # TLSv1.3
    print(f"Cipher Suite : {cipher[0]}")                  # TLS_AES_256_GCM_SHA384
    print(f"Issued by    : {cert['issuer'][0][0][1]}")
    print(f"Valid till   : {cert['notAfter']}")
    print(f"SAN          : {cert['subjectAltName'][:3]}")
    print("Perfect Forward Secrecy: YES (ECDHE)")
    print("HTTPS Secure\n")

# Test real sites
check_https_site("google.com")
check_https_site("netbanking.hdfcbank.com")
check_https_site("phonepe.com")

TLS Version  : TLSv1.3
Cipher Suite : TLS_AES_256_GCM_SHA384
Perfect Forward Secrecy: YES

# firewall_simulation.py  ← Real packet filtering like Cisco, FortiGate
allowed_ips = {"192.168.1.10", "10.0.0.5"}
blocked_ports = {23, 3389}  # Telnet, RDP
established_connections = set()

def packet_filter(src_ip, dst_ip, src_port, dst_port, flags):
    # Rule 1: Block known bad IPs
    if src_ip.startswith("182.22."):
        return "BLOCKED - Malicious IP"

    # Rule 2: Block dangerous ports
    if dst_port in blocked_ports:
        return "BLOCKED - Dangerous Port"

    # Rule 3: Allow only established/related (Stateful)
    if "S" in flags:  # SYN packet
        if src_ip in allowed_ips:
            established_connections.add((src_ip, dst_ip))
            return "ALLOWED - New connection"
        else:
            return "BLOCKED - Unknown source"
    else:
        if (src_ip, dst_ip) in established_connections:
            return "ALLOWED - Established"
        else:
            return "BLOCKED - No state"

# Test
print(packet_filter("192.168.1.10", "8.8.8.8", 54321, 443, "S"))   # ALLOWED
print(packet_filter("182.22.15.30", "10.0.0.1", 1234, 80, "S"))   # BLOCKED
print(packet_filter("192.168.1.10", "8.8.8.8", 54321, 443, "A"))   # ALLOWED

# simple_ids_virus_detector.py  ← Like CrowdStrike, Windows Defender
import hashlib
import os

# Known malware hashes (real ones from VirusTotal)
MALWARE_HASHES = {
    "e4d8b5e5f5e5e5e5e5e5e5e5e5e5e5e5",  # WannaCry
    "d41d8cd98f00b204e9800998ecf8427e",  # Example ransomware
}

def scan_file(filepath):
    hasher = hashlib.md5()
    with open(filepath, 'rb') as f:
        for chunk in iter(lambda: f.read(4096), b""):
            hasher.update(chunk)
    file_hash = hasher.hexdigest()

    if file_hash in MALWARE_HASHES:
        print(f"ALERT! MALWARE DETECTED: {filepath}")
        print(f"Hash: {file_hash} → Known ransomware")
        os.remove(filepath)  # Quarantine
    else:
        :
        print(f"SAFE: {filepath} → {file_hash[:16]}...")

# Test with dummy file
with open("suspicious.exe", "wb") as f:
    f.write(b"MZ" + os.urandom(100000))  # fake EXE
scan_file("suspicious.exe")

Unit5_Network_System_Security_Lab/
│
├── 01_ipsec_vpn_bank_branch.py
├── 02_tls1.3_live_check_google_bank.py
├── 03_firewall_stateful_simulation.py
├── 04_intrusion_detection_malware_scan.py
├── 05_secure_payment_set_inspired.py
├── wireshark_capture_vpn.pcapng
└── Lab_Report.pdf (screenshots + packet diagrams)