Home work

TLS Handshake Trace

Captured with Wireshark

TLS 1.3 observed

Cipher suite identified

Certificate issuer identified

ECDHE key exchange observed

Encrypted application data confirmed

Port Scan & Firewall

Nmap revealed open services

SSH was intentionally kept open

UFW configured with default deny incoming

Unnecessary ports became filtered

Attack surface was reduced

conclusion

By tracing the TLS handshake, we verified that HTTPS establishes a secure session using a negotiated cipher suite and ephemeral key exchange. Packet capture showed that metadata such as IP addresses, certificates, and cipher suites are visible, while the actual web content remains encrypted. Through Nmap scanning and UFW firewall configuration, we identified exposed services and reduced the VM’s externally reachable attack surface.