ETHICAL HACKING & PEN TESTING Project.
student55546
course_projects_deliverable.docx
1- Locating Known Buffer Overflows
In this exercise, you examine code to search for known buffer overflows and security holes. Security professionals need to have a good understanding of the issues that can lead to buffer flows.
Estimated time: 10 minutes.
1. You have been given the following program and have been ask to examine it for potential problems:
/* my_program.c */ int main(int argc, char *argv[]) { char buffer[500]; if(argc>=2) strcpy(buffer, argv[1]); return 0; }
2. Do you see anything in the program that might be a problem? If so, what?
3. The issue is with one of the standard libraries being used. A standard library for a programming language is the library that is made available in every implementation of that language. The standard C++ library can be divided into the following categories:
A standard template library
Inputs and outputs
Standard C headers
4. The problem is that some C standard library functions can be used inappropriately or in ways that may cause security problems. C functions that can be exploited, because they do not check for proper buffer size, include strcat(), strcpy(), sprintf(), vsprintf(), bcopy(), scanf(), and gets().
5. Although you might not be a programmer, as a CEH candidate you should be able to identify these issues when you see them on the exam.
2-Review CVEs and Buffer Overflows
As you have seen, buffer overflows are a real danger. To learn more about buffer overflows and how they are tracked, this exercise requires you to visit and explore the Common Vulnerabilities and Exposures (CVE) website. The CVE is a list of standardized names for vulnerabilities and other information security exposures. Its purpose is to standardize the names for all publicly known vulnerabilities and security exposures and provide a centralized location for information sharing among security professionals.
1. Go to http://cve.mitre.org/cve to begin this exercise.
2. After you are at http://cve.mitre.org/cve, enter buffer overflow as the keyword search.
3. Your search results should return more than 2,000 entries. Search for CVE-2003-0533. The entries are listed in order, so paging down several pages should bring you to the appropriate entry. CVEs are listed by year, month, and the number of vulnerabilities reported. Therefore, CVE-2003-0533 was reported in May 2003 and was the 33rd vulnerability reported that month.
4. After you have found CVE-2003-0533, explore the details. Which well-known worm exploited this stack-based buffer overflow? ______________
5. You should have discovered that the Sasser worm exploited this vulnerability.
12.1 Examining an SSL Certificate
To get a better understanding of how SSL works, this exercise will have you examine an SSL certificate.
Estimated Time: 10 minutes.
1. Open your browser and navigate to: http://mail2web.com. When there, choose the secure login option. To view a secured page, a warning will appear indicating that you are about to view pages over a secure connection.
2. Click OK.
3. Double-click the SSL icon. (The padlock icon in the status bar.)
4. Review the certificate information.
5. Click the Details tab.
6. Click each field. To view the contents of each field, the following information is provided:
Version: The version of X.509 used to create the certificate
Serial number: The unique serial number for the certificate
Signature algorithm: The encryption algorithm used to create the certificate’s signature
Issuer: The issuer of the certificate
Valid from: The date from which the certificate is valid
Valid to: The date after which the certificate expires
Subject: Used to establish the certificate holder, which typically includes the identification and geographic information
Public key: The certificate’s encrypted public key
Thumbprint algorithm: The encryption algorithm used to create the certificate’s thumbprint
Thumbprint: The encrypted thumbprint of the signature (for instance, message digest)
Friendly Name: The descriptive name assigned to the certificate
7. Click the Certification Path tab.
8. Click View Certificate to view the certificate of the CA.
9. Return to https://www.mail2web.com certificate. When does the certificate expire? Is it valid? Hopefully so; otherwise, you should have seen an error message displayed.
10. What algorithm was used to create the message digest? Was it MD5 or SHA-1?
11. What is the algorithm used to sign the certificate?
12. How does the browser indicate whether an HTTPS page was displayed? It should show HTTPS in the URL window and display a small lock in the lower-right corner of the browser.
12.2 Using PGP
In this exercise, you install PGP.
Estimated Time: 10 minutes.
1. Install the trial version of PGP desktop from http://www.pgp.com/downloads/freeware/.
2. Notice that after PGP is installed and you have created a passphrase, the program creates two files: pubring.pkr and secring.skr. These are your public and private keys.
3. Use PGP tools to encrypt a file on your hard drive. You can create a file such as test.txt if you do not want to use an existing file.
4. Now that you have encrypted a file, how secure is it? It should be secure given that you used a strong passphrase.
5. What is the most vulnerable part of PGP? What is the easiest way an attacker could gain access to your encrypted file? If an attacker can steal the secring.skr file, he has the passphrase, and so there is no need for him to attempt to crack the file.
