36.6 Defence Checklist for These Tools
Aata tools shikle – pan tumhi trainer/defender pan aahaat. Raja ani Rani chya Pune chya fictional shop chya website sathi short checklist:
| Threat from this chapter | Defence |
|---|---|
| FFUF / directory fuzz | Rate-limit, WAF, no backup files public, auth on admin paths |
| Amass / subdomain enum | CT monitoring, kill dead subdomains, inventory |
| WhatWeb fingerprint | Strip version headers, harden banners, patch stack |
| Netcat shells | Egress filter, host firewall, watch ss/netstat, EDR |
| Bettercap MITM | HTTPS+HSTS, segmentation, static ARP/DAI, user awareness |
Rozcha habit: lab madhe attack try kara, mag tyachya against control implement kara – techi real learning. Aata pudhe jaauya.
Ravindra Bagale's Tip
Tools cha naav memorise karne exam sathi thode madat karte, pan job madhe vichartat: "FFUF detect kasa karshil?" Checklist table swatahchya shabdat liha – interview madhe techt bolta yeil. Attack ani defence jodun shika, alag alag nahi.
Practice task
Varcha table copy karun aaplya notes madhe expand kara: pratyek row sathi ek concrete command kiwa config step liha (example: fail2ban / nginx limit_req for fuzzing; ss -tulnp cron for shells). Shraddha Bagale la (fictional junior) samjavnyasarkha ek paragraph liha: "Why HTTPS alone is not enough against lab MITM."