Hello, dear friend, you can consult us at any time if you have any questions, add WeChat: THEend8_
FIT1093/2093 Assignment
Submission Guidelines & Tasks Guidelines Details • Deadline: Assignment 2 submission is due in Week 15 on 10 June 2024 at 11:55pm Melbourne, Australia time (CL Campus) and 10 June 2024 at 11:55pm Malaysia time (MA Campus). This Task is an individual (not group) work and it must be submitted by each student individually. • Submission Platform: Electronic submission via the `Assignment 2 Submission’ link on the Moodle Assessments page (an Ed announcement will be sent once the link is added). • Required Files: Required VM files for the assignment will be available for download via the Moodle Asg 3 Moodle Submission Link. • Submission File Format: One PDF document for all 4 tasks. • Submission Page Limit: The submitted PDF document must be at most 20 pages, excluding cover page and references. Any screenshots that cannot fit in the main 20 pages can be placed in an Appendix (which does not count in the page limit). • Plagiarism: It is an academic requirement that your submitted work be original. Zero marks will be awarded for the whole submission if there is any evidence of copying, collaboration, pasting from web sites, or copying from textbooks. • Use of Generative AI tools: ChatGPT or other AI tools may be used for study purposes, to learn about your topic, and to develop your assignment. However, similar to citation requirements for other references, you must include a clear declaration of all generative AI tools used (e.g. ChatGPT, DALL-E, Grammarly, voice-to-text), how and where you have used them. Please follow the Monash guidelines on how to acknowledge the use of Generative AI. Notes ● For each question, you need to answer both the computation result question and the explanation questions about your working process such as the source code or the commands you are using to solve the tasks. ● Note that if numbers in this assignment are specified in hexadecimal format, your written answer and many software packages expect hexadecimal numbers to be input a ‘0x’ prefix (e.g. ’0xa0b1c2d3’) for indicating the hexadecimal format. For example, this prefix allows SageMath to interpret the value in hex. 1 Overview of the assignment The assignment is worth 30% of your total unit mark. Your goal in this assignment is to do security/penetration testing of a mini web application to identify web application and SQL injection vulnerabilities in it, using the techniques covered in our Web and database security lectures. Then, the goal is to demonstrate how to exploit the vulnerabilities discovered to break the app’s security. Finally, you will reflect on the invited lecture from Week 12 and on applying your unit knowledge in a daily life situation. In Task 1 of the assignment (weight: 10% of your unit mark), you will demonstrate your understanding of XSS security vulnerabilities by testing the web application such vulnerabilities and assessing whether any vulnerabilities you find can potentially be exploited by an attacker. In Task 2 of the assignment (weight: 4% of your unit mark), you will demonstrate your understanding of client-side penetration testing techniques to attempt to bypass the web application’s mechanism for enforcing access control to private documents to authorised users. Task 3 of the assignment (weight 6% of your unit mark) requires you to demonstrate your skills in testing for SQL injection vulnerabilities in a part of the web application that makes queries to an SQL database, and exploit any vulnerabilities you discover to breach gain unauthorised access to the database. Task 4 of the assignment (weight 10% of your unit mark) requires you to write your reflection of the invited lecture in Week 12 and personal experience in relation to Cyber Security 2 Assessment Details Task Rubric Task 1 10% ■ Task A (3%): list of potential XSS vulnerability points (2%) and explain the results (1%) ■ Task B (7%): for testing techniques (1%), tests results (2%) and send out document cookie to attacker’s domain (1%) Explain the vulnerability (2%) and mitigation (1%) Task 2 4% ■ Testing(s) techniques (2%) and ■ exploit/vulnerabilities’ explanation (2%) Task 3 6% ■ Task A (4%): for list of users testing (2%), results and interpretation, for table and fields testing results and interpretation) (2%) ■ Task B (2%): for modifying a non phone no. field testing(1%), results and interpretation (1%) Task 4 10% ● Reflection of Invited Lecture (5%) ● Reflection of personal cyber security experience (5%) 3 Assignment Details You can download the Asg3 VM file from the link in the Moodle Asg3 Submission Page: - for Windows or Mac devices with Intel CPUs (.ova file), or - for Mac M1/M2 devices with VMWare Fusion player (.zip file), or - for Mac M1/M2 devices with UTM player (.qcow2 file), see Ed #893. Once you run the VM, log in with the following credential: VM login name: student VM password: student Your task is to perform the following security tests on this web application. You should perform these tests using the Firefox or burpsuite built-in web browser installed in your VM, and the burpsuite tool installed in the given VM. Task 1 (10% of unit marks): Committee Member Security Test Visit the homepage for the web application at the URL (http://alicefansclub.org/index.php) using your web browser. If all is well, the browser should display a page that looks as in Fig. 1. Fig.1 Login Pag 4 This web app allows committee members of Alice Fans Club to access their personal documents. In this part, your aim is to do security testing of the committee member part of the web application, from the point of view of an attacker trying to reveal the secret committee information. To help you with this, you are given the login credentials of one of the registered committee members (however, note that an outsider attacker may or may not know credentials other than provided): Username: Alice Password: alice City: Sydney After clicking the “submit” button with the above credential, the browser should display a welcome page, as shown in Fig. 2. Fig. 2. Welcome page Then, after entering the event details e.g May 2024 and Sydney into the boxes and then clicking the “submit” button, you should see the show poster as shown in Fig. 3. 5 Fig. 3. Secret report of observation. Complete the following tasks: ● Task 1A (3 mark) Based on the application behavior for login and welcome pages above: o Based on the behaviour of the web application pages above with an honest user, list potential points on the home and greeting pages where a reflected XSS input injection vulnerability may potentially exist. (No actual XSS attack is required in this task). o Explain why the points you listed are potential XSS vulnerability points. ● Task 1B (7 mark) Experiment with the home page login and welcome and member report pages in Figs. 1-3, and examine the behavior of these pages to different inputs. In particular: o For each of the potential XSS vulnerability points listed in Task A.1, perform tests to see if XSS vulnerabilities actually exist at these points. o Assume you set up a web application server, craft a malicious script that could allow the attacker to receive the target user’s session cookie by launching an XSS attack on one of the chosen vulnerability points. o In the report, ▪ Describe and explain your testing approach ▪ Draw a table of test results and your interpretation/conclusions on why or why not such XSS vulnerability exists (note: you only need to test if script injection is possible, no social engineering considerations are required). ▪ Screenshot of script and the feasibility of receiving cookies at the attacker’s application server. (note: you only need to show the script and evidence for its execution to steal the cookie, no social engineering attack feasibility/demo is required) ▪ Explain how to mitigate the vulnerabilities. 6 Task 2 (4% of unit marks): Personal Information Security Test In this part, your aim is to do security testing of the fans’ personal information part of the web app. For this, you are given one of fans’ name and password, namely: Member Name: Grace Member ID Number: 3 Member password: Ro4mvSemq45xfepvaEr24 Use Grace’s member ID number and Member password to log in to the Personal Private Information login page shown in Fig. 4. Fig. 4. Personal Private Information login page. Complete the following tasks: Grace has two private documents stored in his account with document IDs 1 and 2. Your goal in this task is to test the application against attacks by Grace (Member ID: 3) who is curious to learn about another member Camy’s (Member ID: 4) private information. o Can Grace gain unauthorised access to Camy’s personal private data? ▪ If you think it is possible, explain the vulnerability you found and how Grace can exploit it, and show any private data of Camy you managed to expose by the attack. ▪ If you think it is not possible, explain why.