Hello, dear friend, you can consult us at any time if you have any questions, add WeChat: THEend8_
FIT3173 Software Security Assignment
1 Overview
The learning objective of this assignment is for you to perform penetration testing and thread modelling,
and write a formal report. The lab setup employed in Lab10 (Penetration Testing) can be utilized for this
assignment.
2 Submission
You need to submit a report (one single PDF file) to describe what you have done and what you have
observed with screen shots whenever necessary. Please follow the template of report wherever provided.
Typeset your report into .pdf format (make sure it can be opened with Adobe Reader) and name it as the
format: [Your Name]-[Student ID]-FIT3173-Assignment.pdf. Please do not submit any extra files, all
screenshots or code (if applicable) should be embedded in the report.
Late submission penalty: 10% deduction (of original marks) per day. If you require extension or
special consideration, refer to special consideration form. Kindly note that no member of the teaching team
is authorized to grant extensions or special considerations. Therefore, refrain from seeking assistance on this
matter from any teaching team member. Please adhere to the guidelines provided in the link mentioned.
policies/academic-integrity
3 Penetration Testing [50 Marks]
The learning objective of this part is to learn the process of conducting a standard penetration test and sub-
sequently compose a formal report detailing the identified vulnerabilities. The examination will be executed
on virtual machines deliberately designed to be vulnerable, publicly accessible for educational purposes.
You may leverage walkthroughs created by other testers as reference material; however, direct replication of
text or screenshots from these walkthroughs is strictly prohibited. While utilizing a walkthrough for guid-
ance is permitted, the report should be an original composition. External resources, beyond the provided
walkthrough, can be consulted and referenced appropriately. It is important to note that the penetration test
report will be checked for plagiarism through Turnitin.
Download one of the below Virtual Machines (VMs) and perform penetration test on it. The goal of the
test is to make an attempt to compromise the VM.
Q1 (50 marks): Identify at-least 3 vulnerabilities in the selected Virtual Machine and write a report.
The report should be in the following format:
Executive Summary (Max 300 words) - (10 Marks)
{Briefly explain the penetration testing results, e.g. was the goal achieved? if yes, how? you can
also provide high-level recommendations here. }
Vulnerability List (Max 200 Words) - (4 Marks)
{Create a table with columns: Vulnerability Name, Severity and Page No.} (Utilize CVSS3.0
calculator for calculating the severity of the issue)
Details of Vulnerabilities
Chosen three vulnerabilities should be written in the following format - (36 Marks)
{Severity} (e.g. High) {Vulnerability Name e.g. SQL Injection}
Vulnerability
{Describe the vulnerability, exploit it and write step by step guide
on how to re-produce the exploitation with screenshots} (Max
400 Words)
References {add references here, for further reading, e.g. Heap Overflow}
Risk {Explain risk here} (Max 200 Workds)
Recommendation {Make theoratical recommendations here} (Max 200 Words)