Hello, dear friend, you can consult us at any time if you have any questions, add WeChat: THEend8_
FIT1093/2093 Assignment
Submission Guidelines & Tasks
Guidelines Details
• Deadline: Assignment 2 submission is due in Week 15 on 10 June 2024 at
11:55pm Melbourne, Australia time (CL Campus) and 10 June 2024 at 11:55pm
Malaysia time (MA Campus). This Task is an individual (not group) work and it
must be submitted by each student individually.
• Submission Platform: Electronic submission via the `Assignment 2 Submission’
link on the Moodle Assessments page (an Ed announcement will be sent once the
link is added).
• Required Files: Required VM files for the assignment will be available for
download via the Moodle Asg 3 Moodle Submission Link.
• Submission File Format: One PDF document for all 4 tasks.
• Submission Page Limit: The submitted PDF document must be at most 20
pages, excluding cover page and references. Any screenshots that cannot fit in
the main 20 pages can be placed in an Appendix (which does not count in the page
limit).
• Plagiarism: It is an academic requirement that your submitted work be original.
Zero marks will be awarded for the whole submission if there is any evidence of
copying, collaboration, pasting from web sites, or copying from textbooks.
• Use of Generative AI tools: ChatGPT or other AI tools may be used for study
purposes, to learn about your topic, and to develop your assignment. However,
similar to citation requirements for other references, you must include a clear
declaration of all generative AI tools used (e.g. ChatGPT, DALL-E, Grammarly,
voice-to-text), how and where you have used them. Please follow the Monash
guidelines on how to acknowledge the use of Generative AI.
Notes
● For each question, you need to answer both the computation result question
and the explanation questions about your working process such as the source
code or the commands you are using to solve the tasks.
● Note that if numbers in this assignment are specified in hexadecimal format,
your written answer and many software packages expect hexadecimal
numbers to be input a ‘0x’ prefix (e.g. ’0xa0b1c2d3’) for indicating the
hexadecimal format. For example, this prefix allows SageMath to interpret the
value in hex.
1
Overview of the assignment
The assignment is worth 30% of your total unit mark.
Your goal in this assignment is to do security/penetration testing of a mini web application to identify
web application and SQL injection vulnerabilities in it, using the techniques covered in our Web and
database security lectures. Then, the goal is to demonstrate how to exploit the vulnerabilities
discovered to break the app’s security. Finally, you will reflect on the invited lecture from Week 12 and
on applying your unit knowledge in a daily life situation.
In Task 1 of the assignment (weight: 10% of your unit mark), you will demonstrate your understanding
of XSS security vulnerabilities by testing the web application such vulnerabilities and assessing
whether any vulnerabilities you find can potentially be exploited by an attacker.
In Task 2 of the assignment (weight: 4% of your unit mark), you will demonstrate your understanding
of client-side penetration testing techniques to attempt to bypass the web application’s mechanism for
enforcing access control to private documents to authorised users.
Task 3 of the assignment (weight 6% of your unit mark) requires you to demonstrate your skills in
testing for SQL injection vulnerabilities in a part of the web application that makes queries to an SQL
database, and exploit any vulnerabilities you discover to breach gain unauthorised access to the
database.
Task 4 of the assignment (weight 10% of your unit mark) requires you to write your reflection of the
invited lecture in Week 12 and personal experience in relation to Cyber Security
2
Assessment Details
Task Rubric
Task 1 10%
■ Task A (3%): list of potential XSS vulnerability points (2%) and
explain the results (1%)
■ Task B (7%): for testing techniques (1%), tests results (2%) and
send out document cookie to attacker’s domain (1%)
Explain the vulnerability (2%) and mitigation (1%)
Task 2 4%
■ Testing(s) techniques (2%) and
■ exploit/vulnerabilities’ explanation (2%)
Task 3 6%
■ Task A (4%): for list of users testing (2%), results and
interpretation, for table and fields testing results and
interpretation) (2%)
■ Task B (2%): for modifying a non phone no. field testing(1%),
results and interpretation (1%)
Task 4 10%
● Reflection of Invited Lecture (5%)
● Reflection of personal cyber security experience (5%)
3
Assignment Details
You can download the Asg3 VM file from the link in the Moodle Asg3 Submission Page:
- for Windows or Mac devices with Intel CPUs (.ova file), or
- for Mac M1/M2 devices with VMWare Fusion player (.zip file), or
- for Mac M1/M2 devices with UTM player (.qcow2 file), see Ed #893.
Once you run the VM, log in with the following credential:
VM login name: student
VM password: student
Your task is to perform the following security tests on this web application. You should perform these
tests using the Firefox or burpsuite built-in web browser installed in your VM, and the burpsuite tool
installed in the given VM.
Task 1 (10% of unit marks): Committee Member Security Test
Visit the homepage for the web application at the URL (http://alicefansclub.org/index.php) using your
web browser. If all is well, the browser should display a page that looks as in Fig. 1.
Fig.1 Login Pag
4
This web app allows committee members of Alice Fans Club to access their personal documents.
In this part, your aim is to do security testing of the committee member part of the web application,
from the point of view of an attacker trying to reveal the secret committee information. To help you with
this, you are given the login credentials of one of the registered committee members (however, note
that an outsider attacker may or may not know credentials other than provided):
Username: Alice
Password: alice
City: Sydney
After clicking the “submit” button with the above credential, the browser should display a welcome
page, as shown in Fig. 2.
Fig. 2. Welcome page
Then, after entering the event details e.g May 2024 and Sydney into the boxes and then clicking the
“submit” button, you should see the show poster as shown in Fig. 3.
5
Fig. 3. Secret report of observation.
Complete the following tasks:
● Task 1A (3 mark) Based on the application behavior for login and welcome pages above:
o Based on the behaviour of the web application pages above with an honest user, list
potential points on the home and greeting pages where a reflected XSS input
injection vulnerability may potentially exist. (No actual XSS attack is required in this
task).
o Explain why the points you listed are potential XSS vulnerability points.
● Task 1B (7 mark) Experiment with the home page login and welcome and member report
pages in Figs. 1-3, and examine the behavior of these pages to different inputs. In particular:
o For each of the potential XSS vulnerability points listed in Task A.1, perform tests to
see if XSS vulnerabilities actually exist at these points.
o Assume you set up a web application server, craft a malicious script that could allow the
attacker to receive the target user’s session cookie by launching an XSS attack on one
of the chosen vulnerability points.
o In the report,
▪ Describe and explain your testing approach
▪ Draw a table of test results and your interpretation/conclusions on why or why
not such XSS vulnerability exists (note: you only need to test if script injection is
possible, no social engineering considerations are required).
▪ Screenshot of script and the feasibility of receiving cookies at the attacker’s
application server. (note: you only need to show the script and evidence for its
execution to steal the cookie, no social engineering attack feasibility/demo is
required)
▪ Explain how to mitigate the vulnerabilities.
6
Task 2 (4% of unit marks): Personal Information Security Test
In this part, your aim is to do security testing of the fans’ personal information part of the web app. For
this, you are given one of fans’ name and password, namely:
Member Name: Grace
Member ID Number: 3
Member password: Ro4mvSemq45xfepvaEr24
Use Grace’s member ID number and Member password to log in to the Personal Private Information
login page shown in Fig. 4.
Fig. 4. Personal Private Information login page.
Complete the following tasks:
Grace has two private documents stored in his account with document IDs 1 and 2. Your goal in this
task is to test the application against attacks by Grace (Member ID: 3) who is curious to learn about
another member Camy’s (Member ID: 4) private information.
o Can Grace gain unauthorised access to Camy’s personal private data?
▪ If you think it is possible, explain the vulnerability you found and how Grace can
exploit it, and show any private data of Camy you managed to expose by the
attack.
▪ If you think it is not possible, explain why.