+1-415-670-9189
info@expertsmind.com
Complete a penetration testing engagement
Course:- PL-SQL Programming
Reference No.:- EM132320517




Assignment Help
Expertsmind Rated 4.9 / 5 based on 47215 reviews.
Review Site
Assignment Help >> PL-SQL Programming

Final Project - Penetration Test Planning and Reporting

Lab Objectives - Upon completion of this activity, you will be able to:

  • Utilize and recognize basic programming and scripting technologies to assist in cyber attacks and defense.
  • Differentiate encryption and decryption as they apply to cryptography.

For this assignment, we will research and become familiar with different approaches to complete a penetration testing engagement, using the instructor as your client. You are hired to complete a penetration test of the "target" VM. Some specifics about the assessment:

Purpose/business objective:

  • To assess the security posture of the Metasploitable VM.
  • Proactively identify, prioritize, and report existing vulnerabilities and successful exploits.
  • Gain root access to the system using any of the discovered vulnerabilities.
  • Crack the passwords of any existing system, app, database user.
  • Provide synthesized action plan for the IT operations team to address the findings.
  • Provide a comprehensive findings report.
  • Include a table with results that need to line up.

IP Address

FQDN

OS

Port

Protocol

Service

Name

Version

Additional Nmap Script Information (To be Added Manually)

Vulnerability

CVE

CVSS

Exploit Success? If yes, which exploit?

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

The scope of the assessment is:

  • Only the Linux Target, Metasploitable, VM, no other IPs should be included.
  • All Metasploitable ports, services/applications, and databases that are open or running need to be evaluated.
  • The assessment is system, application, database level.
  • Manual and automated scans are acceptable.
  • Post-exploitation activities like privilege escalation and password cracking of additional system/database accounts are in scope.

Rules of engagement

  • No social engineering and DDoS attacks
  • No physical attacks. Since this is a VM, you cannot use the msfadmin:msfadmin credentials to sign in to the VM using the console interface and claim you successfully exploited a vulnerability like weak/easy to guess credentials.
  • You can only scan/attack from the Kali VM
  • You are find all existing vulnerabilities
  • Validate all of the discovered vulnerabilities through active exploitation (at least those specified by the instructor during week 7)
  • No time restrictions for the testing; you can test any time of the day
  • For the vulnerability identification, you have 1 week (week 6)
  • For the exploitation/validation, you have 1 week (week 7).

Lab Instructions -

We will focus on preparing a pen test execution plan and a report template. They will help you for the final project. Think of it as a preparation for the final.

Review the provided video and additional references above

Review approaches like the Pen Testing Execution Standard or NIST SP800-115 before starting to figure out the before, during, and after of a pen test

For the plan, you need to outline what activities, you need to include before, during, and after a pen test execution:

- Before - Planning and preparation

  • Example, scope, rules of engagement, methodology, permissions. You need to go in details.
  • I provided a foundation for your scope, rules of engagement, and the video and presentation should help you come up with a methodology=approach for complete the pen test.

- During the assessment - Execution

  • This is where you provide more details about the phases outlined in your methodology
  • Highlight what you will do during each phase

What are the objectives of each phase?

What are the deliverables? For example, for the information gathering phase:

- You will collect information like:

  • System IP
  • Hostname
  • Open ports
  • OS type
  • Running services/Applications and their versions
  • Record any information discovered via Nmap Script Engine

- You will record the results in a table with results so each port, service/app, version can be mapped appropriately

- You will provide evidence of the discovery in the form of a screenshot and brief explanation of the command and findings/result.

After- Reporting and result presentation

- You will organize the results and put them in a comprehensive report

- The report will cover areas like:

Table of contents

Executive summary

  • Background
  • Scope
  • risk classification/categorization
  • major findings chart/graph
  • overall risk profile

Technical report

Methodology

Examined assets

Tools used

Attack Narrative/Details

  • typically focus on the most critical findings,
  • what you assessed (IP, app, database)
  • what you found (CVE, CVSS, exploit and screenshots),
  • how you found it (command, scan and screenshot),
  • why is the finding significant (risk impact, likelihood, ease of use, etc)

Conclusion - overall recommendation for direction and prioritization

Appendix

Table with synthesized results that will help with client result verification and remediation lifecycle efforts

IP Address

FQDN

OS

Port

Protocol

Service

Name

Version

Additional Nmap Script Information (To be Added Manually)

Vulnerability

CVE

CVSS

Exploit Success? If yes, which exploit?

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Manual and automated scan results

Additional exploit information and reference link to figures, graphs in the body of the report

Additional guidance and recommendation to address the findings like guide on how to align the findings prioritization against CIS CSC top 20 or another control standard

Once you finish the write up of the plan, create a report template cover

Submit assignment including the plan and report template in the same assignment.

Lab Deliverables -

Plan that provides a roadmap for completing a pen test engagement and addresses before, during, and after of a pen test as shown in the lab instructions section

Report template appended to the plan that addresses all sections specified in the lab instructions "after" the pen test (section 5.c)

  • You may include additional sections as needed
  • Create a document/template that you can use for the final project

Make sure each screenshot is accompanied by a brief explanation of what you did in the screenshot.

Attachment:- Assignment File.rar




Put your comment
 
View Conversion
Minimize
  1. user image
    inf2320517

    this zip file will also help tremendously because is it from the instructor and has example reports of what he is looking for 33693772_1M5.zip awesome thank you so much Every problem when I asked they have the solution for the same. As in monetary terms they have justified pricing for every assignments. They can also give discount for regular students if being requested to them.

  2. user image
    len2320517

    Compose your work in a .doc or .docx file type using a word processor (such as Microsoft Word, etc.) and save it frequently to your computer. For those assignments that are not written essays and require uploading images or PowerPoint slides, please follow uploading guidelines provided by your instructor. Check your work and correct any spelling or grammatical errors. When you are ready to submit your work, click "Upload Submission." Enter the submission title and then click on "Select a file to upload." Browse your computer, and select your file. Click "Open" and verify the correct file name has appeared next to Submission File. Click on "Continue." Confirm submission is correct and then click on "Accept Submission & Save."



Ask Question & Get Answers from Experts
Browse some more (PL-SQL Programming) Materials
ICT320 - Database Programming Identification of major implementation flaws and/or areas for improvement, including and identification of & proposal to remove repeated data.
For the lab, you will need to create a script file containing the PL/SQL code that will address the lab steps below. Run the script file in your SQL*Plus session using the S
Look at your Book how they have done. Mention, Fully Functional Dependency and No Transitive Dependency - Tables implemented and the Create SQL statement Copied in the report
Write a script that creates and calls a function named fnDiscountPrice that calculates the discount price of an item in the OrderItems table (discount amount subtracted from
For this assignment, imagine that you have been hired by ABC, Inc., a global company, to propose a cloud-based storage service appropriate for a globalized company to use to
Discuss some possible solutions and strategies for improving the performance of SQL queries and their ability to provide data to users and identify the performance or usabili
At this point, you will add data to your database and validate that they loaded properly. In tabular format, include 3 rows for each table, making sure that the primary-key
List the Rider's Name, RaceLevel as Race_Level and the total number of all points based on their placement. Make sure that you don't list any riders who have not raced in an