Lab Report For COM6015- 2022
Instructions
With your other group member, create a report and answer each of the questions. For
each question/sub question, make sure to include descriptions and screenshot
evidence of the completed tasks. You will receive marks based on correct answers
and also your level of understanding in your explanations. You only need to submit
one report per group.
Due Dates:
● You need to submit the report by 19th May 5 pm.
Question #1:Clickjacking
You want to help your friend Jane Doe to gain more followers in his TilTol account. URL:
https://tiltol.github.io/JaneDoe/index.html. With the help of the clickjacking techniques that
you have learnt, create a malicious web-page that will trick victims into clicking the “follow”
button without realising it. Remember to be creative. [20%]
(Attack Crafting 10%, Attack Implementation 10%)
Question #2: Wireshark
You receive a phone call from a pizza shop, reporting an unauthorised withdrawal of $5000
from their bank account. The store manager informs you that they always use a particular
computer with the IP address (10.8.21.163) to order ingredients from retailers. You collect
the network pcap file for further investigations. [20%]
Analyse the pcap file and answer the following questions with evidence (screenshots).
● What is the victim MAC address? [1%]
● What is the victim Host Name? [1%]
● Find the executable file the victim computer has downloaded using ‘HTTP’ protocol
(hint: filter HTTP packets to discover the malicious HTTP packet containing an
executable file). What is the client operating system, and what day and time the
malware was executed? [2%]
● Where was the intruder file location? (hint: http://****1.cab) [2%]
● What is the intruder IP address? Show the geographical location of the intruder using
the Wireshark endpoint feature. [5%]
● Extract the malicious file (in your VM) and extract its hash key using Linux terminal/
windows cmd (SHA 256). [5%]
● Use the extracted SHA 256 code, search on the Internet and provide the malware
description. [1%]
● Which user is accountable for downloading the malicious malware from the Internet?
provide Account Name by searching inside Kerberos packets (hint: find the answer
in the KRBS packet (#237) ‘CNameString’ section) [3%]
You can find the pcap file in BB.
Question #3 : SQL Injection
Write an SQL Injection query for each of the following:
● Extract the column names of the table that contains the user data
● Attempt the previous injection in medium security, update your query to bypass the
new security measures
● Locate the location of the database on the remote system (File path the database is
stored)
● Read a file (e.g. passwords) from the discovered path
● Discover the users with the highest and lowest salaries
● Who has the insurance number: 53779132
Be sure to write the query you used for each injection and screenshot your results, alongside
a brief explanation for how the query undermines the security measures of the web
application. [20%]
Question #4 : XSS
Set your DVWA to HIGH security. Analyse the PHP source code and perform an attack that
works on Reflected, Stored and DOM XSS pages. Provide a description for each relating to
the source code as to why your given attack works. [10%]
Question #5 : Defence
In a language of your choice, write a short function which handles input from a user which
would prevent an SQL injection attack and a Stored XSS attack. Provide a short description
of where/why your function is safe against these vulnerabilities. (NOTE: Assessment is on
secure development methodology and explanation provided, exact correctness of syntax will
not be assessed). [10%]
Question #6: Buffer Overflow
A. Choose one of the known buffer overflow vulnerabilities and write a half-page description
of it. Aspects that you should cover are:
● Which systems were affected by the vulnerability?
● When was it discovered, reported and fixed?
● What were the known attacks exploiting it, and what were their consequences?
(You are free, but not required to choose one of the vulnerabilities mentioned in the lecture.)
[10%]
B. Propose a modification of the C programming language that would mitigate buffer
overflow vulnerabilities, and discuss the implications of this modification. (Please keep the
discussion within one page of text.) [10%]