Hello, dear friend, you can consult us at any time if you have any questions, add WeChat: THEend8_
FIT3173 Software Security Assignment 2 (S1 2023)
Total Marks 50
Due on May 12, 2023, Friday, 11:55 pm
1 Overview
The learning objective of this assignment is for you to gain a first-hand experience on how to exploit SQL
injection and cross-site scripting vulnerabilities as discussed in this module. All tasks in this assignment can
be done on “SeedVM” as used in labs. Please refer to Section 2 for submission notes.
2 Submission
You need to submit a lab report (one single PDF file) to describe what you have done and what you have
observed with screenshots whenever necessary; you also need to provide explanation or codes to the obser-
vations that are interesting or surprising. In your report, you need to answer all the questions listed in this
manual. Please answer each question using at most 200 words. Typeset your report into .pdf format (make
sure it can be opened with Adobe Reader) and name it as the format: [Your Name]-[Student ID]-FIT3173-
Assignment, e.g., HarryPotter-12345678-FIT3173-Assignment.pdf.
All source code, if required, should be embedded in your report. In addition, if a demonstration video
is required, you should record your screen demonstration with your voice explanation and upload the video
to your Monash Google Drive or any online service which allows you to share videos. The shared URL
of the video should be mentioned in your report wherever required.
Late submission penalty: 10 percent deduction per day (5 Marks). If you require a special con-
sideration, the application should be submitted and notified at least three days in advance. Special
Considerations are handled by and approved by the faculty and not by the teaching team (unless the special
consideration is for a small time period extension of one or two days).
3 SQL Injection Attack – Using SQLi Lab [25 Marks]
In this part, we modify a web application called SQLi Lab, which is designed to be vulnerable to the
SQL-Injection attack. Although the vulnerabilities are artificially created, they capture the common mis-
takes made by many web developers. Your goal in this part is to find ways to exploit the SQL-injection
vulnerabilities, demonstrate the damage that can be achieved by the attacks, and master the techniques that
can mitigate such attacks.
The database of SQLi Lab, named Users, can be traced and manipulated when we login to MySQL
Console by using following commands: