1
Running head: LAB 2 WORKSHEET
Nicholas M. Ford
Lab 2 Worksheet
Liberty University
CSCI 631
Professor Mercer
June 11, 2018
2
LAB 2 WORKSHEET
Lab Steps
1.7 In the Lab Report file, describe each of the Top 10 vulnerabilities and summarize the
recommendations for preventing each attack.
From the OWASP Top 10-2017.pdf file, the top 10 are as follows:
1. Injection-
a. User-supplied data is not validated, filtered, or sanitized by the applications error
checking. Also caused by lack context-aware escaping by dynamic queries as well
as hostile data. Examples of this are SQL injection attacks.
b. Best practices for mitigation would be a safe, trusted API with better ORM
control. The use of a trusted “whitelist” server-side input validation can aid with
injection attacks.
2. Broken Authentication-
a. The application permits automated attacks, brute force, weak or default
passwords, poor multi-factor authentication and improper Session ID handling.
An example of this type of attack is credential stuffing.
b. Implement weak password checks, stronger multi-factor authentication, limit
failed attempts and log them.
3. Sensitive Data Exposure-
a. Using HTTP, SMTP or FTP to transmit data in clear text and storing data at rest
in clear text. No encryption enforcement in place or outdated cryptography
algorithms. An example of this is a site that doesn’t use HTTPS instead of HTTP
for all traffic, leaving session cookies vulnerable.
b. Encryption of all data whether at rest or in transit. Use up to date and strong
cryptography algorithms.
4. XML External Entities (XXE)-
a. The application accepts XML from untrusted sources and uses SAML for identity
processing within SSO. XML external entities can lead to denial of service
attacks.
3
LAB 2 WORKSHEET
b. For mitigation, use JSON as opposed to complex data formats, patch and
upgrade all XML processors and libraries.
5. Broken Access Control-
a. Modifications made through bypassing access control checks, allowing the
primary key to be changed to another user’s record, elevated privileges or
metadata manipulation. Force browsing to target URLs is an example.
b. Best way to mitigate broken access control is to use trusted server-side code and
deny by default. Implement 1 set of access control mechanisms and re-use them to
stop CORs..
6. Security Misconfiguration-
a. Unnecessary features are enabled, unnecessary ports are open and missing
appropriate security hardening. A potential attack would be sensitive stored data
within cloud storage could accessed due to the CSP’s default sharing permissions
set to open.
b. Best ways to stop this would be a proven, repeatable hardening process that is
quick and easy to deploy. Only install features that are needed and close all
unused ports.
7. Cross-Site Scripting (XSS)-
a. Three forms of XSS are reflected, stored, and DOM. Reflected allows for
unvalidated and unescaped user input as part of HTML output. Stored is input
that is view by another user or admin. DOM is malicious software downloads, key
logging, and other client attacks.
b. To combat this, use frameworks that automatically escape XSS by design and also
escape from untrusted HTTP request. It is in good practice that one use a content
security policy.
8. Insecure Deserialization-
a. Applications and APIs can be vulnerable to object and data structure related
attacks as well as access control related attacks. An example of this would be
PHP object serialization to save a “super” cookie.
4
LAB 2 WORKSHEET
b. Implementing integrity checks such as digital signatures to prevent hostile object
creation. Enforcing strict type constraints, isolating and running code that
deserializes and logging deserialization exceptions and failures are best practice
steps in mitigating this threat.
9. Using Components with Known Vulnerabilities-
a. The use of outdated, unsupported and vulnerable software. Not knowing exactly
what version of all components both server and client. Simple if you use a known-
bad version of software, you are at risk for all known vulnerabilities.
b. Remove unused dependencies, unnecessary features, components, files, and
documentation.
10. Insufficient Logging & Monitoring-
a. Auditable events do not get logged, warnings and error logs give out too much
information that can be used in an attack and lack of monitoring for suspicious
activity.
b. For mitigation, ensure all login, access control failures and server-side input is
validated. Logs should be easily generated in a format that can be organized and
institute effective monitoring and alerting.
2.7 Make a screen capture showing the results of the SQL injection attempt and paste it
into the Lab Report file.
The below screenshot shows the results of the SQL injection attempt:
5
LAB 2 WORKSHEET
2.13 In the Lab Report file, document the correct username/password combination.
The correct combination used to gain entry was:
user: adrian
pass: somepassword
2.14 Make a screen capture showing the successful brute-force attack with the logged in
username and paste it into the Lab Report file.
6
LAB 2 WORKSHEET
The screenshot below shows the result of the correct combination of user: Adrian and pass:
somepassword:
2.18 Make a screen capture showing the successful command injection attempt and paste it
into the Lab Report file.
The following screenshot shows the successful command injection attempt:
7
LAB 2 WORKSHEET
2.27 Make a screen capture showing the successful CSRF blog post and paste it into the
Lab Report file.
The screenshot below shows the results of the successful CSRF attack:
8
LAB 2 WORKSHEET
Challenge Questions
1. What has changed between this year’s OWASP Top 10 list and the Top 10 list in
2010? What is the rationale for these changes? List at least five changes.
9
LAB 2 WORKSHEET
• A4:2017-XML External Entities (XXE) is a new category primarily supported by source code
analysis security testing tools (SAST) data sets.
After over 500 peer submissions, and removing issues that were already supported by data (such
as Sensitive Data Exposure and XXE), the two new issues are:
• A8:2017-Insecure Deserialization, which permits remote code execution or sensitive
object manipulation on affected platforms.
• A10:2017-Insufficient Logging and Monitoring, the lack of which can prevent or
significantly delay malicious activity and breach detection, incident response, and digital
forensics.
• A4-Insecure Direct Object References and A7-Missing Function Level Access Control merged
into A5:2017-Broken Access Control.
• A8-Cross-Site Request Forgery (CSRF), as many frameworks include CSRF defenses, it was
found in only 5% of applications.
• A10-Unvalidated Redirects and Forwards, while found in approximately 8% of applications, it
was edged out overall by XXE.
2. Research anybrute-force attack tool (for example, THC Hydra, Brutus, or Burp
Intruder). List at least three features of that tool. What method does the tool use in
its brute-force attack?
Brutus version AET2 is the current release and includes the following authentication types:
-HTTP (Basic Authentication)
10
LAB 2 WORKSHEET
-HTTP (HTML Form/CGI)
-POP3
The current brutus password release includes the following functionality :
-Multi-stage authentication engine
-60 simultaneous target connections
-No username, single username and multiple username modes
-Password list, combo (user/password) list and configurable brute force modes
-Highly customisable authentication sequences
-Load and resume position
-Import and Export custom authentication types as BAD files seamlessly
-SOCKS proxy support for all authentication types
-User and password list generation and manipulation functionality
-HTML Form interpretation for HTML Form/CGI authentication types
-Error handling and recovery capability inc. resume after crash/failure.
3. What is the purpose of a rainbow table?
Files of precomputed hashes and their matching plaintext values.
Assessment Questions
1. What are the current OWASP Top 10?
A1:2017-Injection, A2:2017-Broken Authentication, A3:2017- Sensitive Data Exposure,
11
LAB 2 WORKSHEET
A4:2017-XML External Entities (XXE), A5:2017-Broken Access Control, A6:2017-Security
Misconfiguration, A7:2017- Cross-Site Scripting (XSS), A8:2017- Insecure Deserialization,
A9:2017-Using Components with Known Vulnerabilities, A10:2017- Insufficient Logging &
Monitoring.
2. What is a brute-force attack and how can the risks of these attacks be mitigated?
It is a trial-and-error method for detecting username/password combinations, often by using
software that performs dictionary attacks. And they can be stopped by enforcing stronger
passwords and hardened all systems.
3. Explain a scenario where a hacker may use cross-site request forgery (CRFS) to
perform authorized transactions.
An example of this would be an attacker forcing you to change the password for your online
bank account that you were tricked into clicking.
4. What could be the impact of a successful SQL injection?
SQL injection attacks lead to the extraction and manipulation of sensitive data, they can also be
used to compromise the underlying Web server’s operating system.
5. How would you ensure security between a Web application and a SQL server?
Sanitize user-supplied input using a white list approach and discard unexpected data or
characters. Use prepared statements (a.k.a. parameterized queries) instead of a query string.
These types of queries first define SQL code and then define parameters. If an attacker were to
enter a userID of test' or 1=1;#, the parameterized query would not be vulnerable and would
instead look for a username that literally matched the entire string test' or 1=1;#. Build strong
12
LAB 2 WORKSHEET
exception-handling routines. Do not provide any information that might assist the attacker. Have
a generic error message for all exceptions. Use database access credentials that have minimal
database privileges.
6. What is the underlying cause of a cross-site scripting (XSS) attack?
Vulnerabilities arise when data is copied from a Web application request and echoed into the
application’s immediate response in an unsafe way.
7. What is the difference between a reflected XSS and a stored, or persistent, XSS?
The primary a reflected XSS and a stored, or persistent, XSS is that the script code is injected
into an area of an application where the data persists, like a database, and can be viewed by
multiple users and multiple sessions.
