+1-415-670-9189
info@expertsmind.com
Complete a penetration testing engagement
Course:- PL-SQL Programming
Reference No.:- EM132320517




Assignment Help
Expertsmind Rated 4.9 / 5 based on 47215 reviews.
Review Site
Assignment Help >> PL-SQL Programming

Final Project - Penetration Test Planning and Reporting

Lab Objectives - Upon completion of this activity, you will be able to:

  • Utilize and recognize basic programming and scripting technologies to assist in cyber attacks and defense.
  • Differentiate encryption and decryption as they apply to cryptography.

For this assignment, we will research and become familiar with different approaches to complete a penetration testing engagement, using the instructor as your client. You are hired to complete a penetration test of the "target" VM. Some specifics about the assessment:

Purpose/business objective:

  • To assess the security posture of the Metasploitable VM.
  • Proactively identify, prioritize, and report existing vulnerabilities and successful exploits.
  • Gain root access to the system using any of the discovered vulnerabilities.
  • Crack the passwords of any existing system, app, database user.
  • Provide synthesized action plan for the IT operations team to address the findings.
  • Provide a comprehensive findings report.
  • Include a table with results that need to line up.

IP Address

FQDN

OS

Port

Protocol

Service

Name

Version

Additional Nmap Script Information (To be Added Manually)

Vulnerability

CVE

CVSS

Exploit Success? If yes, which exploit?

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

The scope of the assessment is:

  • Only the Linux Target, Metasploitable, VM, no other IPs should be included.
  • All Metasploitable ports, services/applications, and databases that are open or running need to be evaluated.
  • The assessment is system, application, database level.
  • Manual and automated scans are acceptable.
  • Post-exploitation activities like privilege escalation and password cracking of additional system/database accounts are in scope.

Rules of engagement

  • No social engineering and DDoS attacks
  • No physical attacks. Since this is a VM, you cannot use the msfadmin:msfadmin credentials to sign in to the VM using the console interface and claim you successfully exploited a vulnerability like weak/easy to guess credentials.
  • You can only scan/attack from the Kali VM
  • You are find all existing vulnerabilities
  • Validate all of the discovered vulnerabilities through active exploitation (at least those specified by the instructor during week 7)
  • No time restrictions for the testing; you can test any time of the day
  • For the vulnerability identification, you have 1 week (week 6)
  • For the exploitation/validation, you have 1 week (week 7).

Lab Instructions -

We will focus on preparing a pen test execution plan and a report template. They will help you for the final project. Think of it as a preparation for the final.

Review the provided video and additional references above

Review approaches like the Pen Testing Execution Standard or NIST SP800-115 before starting to figure out the before, during, and after of a pen test

For the plan, you need to outline what activities, you need to include before, during, and after a pen test execution:

- Before - Planning and preparation

  • Example, scope, rules of engagement, methodology, permissions. You need to go in details.
  • I provided a foundation for your scope, rules of engagement, and the video and presentation should help you come up with a methodology=approach for complete the pen test.

- During the assessment - Execution

  • This is where you provide more details about the phases outlined in your methodology
  • Highlight what you will do during each phase

What are the objectives of each phase?

What are the deliverables? For example, for the information gathering phase:

- You will collect information like:

  • System IP
  • Hostname
  • Open ports
  • OS type
  • Running services/Applications and their versions
  • Record any information discovered via Nmap Script Engine

- You will record the results in a table with results so each port, service/app, version can be mapped appropriately

- You will provide evidence of the discovery in the form of a screenshot and brief explanation of the command and findings/result.

After- Reporting and result presentation

- You will organize the results and put them in a comprehensive report

- The report will cover areas like:

Table of contents

Executive summary

  • Background
  • Scope
  • risk classification/categorization
  • major findings chart/graph
  • overall risk profile

Technical report

Methodology

Examined assets

Tools used

Attack Narrative/Details

  • typically focus on the most critical findings,
  • what you assessed (IP, app, database)
  • what you found (CVE, CVSS, exploit and screenshots),
  • how you found it (command, scan and screenshot),
  • why is the finding significant (risk impact, likelihood, ease of use, etc)

Conclusion - overall recommendation for direction and prioritization

Appendix

Table with synthesized results that will help with client result verification and remediation lifecycle efforts

IP Address

FQDN

OS

Port

Protocol

Service

Name

Version

Additional Nmap Script Information (To be Added Manually)

Vulnerability

CVE

CVSS

Exploit Success? If yes, which exploit?

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Manual and automated scan results

Additional exploit information and reference link to figures, graphs in the body of the report

Additional guidance and recommendation to address the findings like guide on how to align the findings prioritization against CIS CSC top 20 or another control standard

Once you finish the write up of the plan, create a report template cover

Submit assignment including the plan and report template in the same assignment.

Lab Deliverables -

Plan that provides a roadmap for completing a pen test engagement and addresses before, during, and after of a pen test as shown in the lab instructions section

Report template appended to the plan that addresses all sections specified in the lab instructions "after" the pen test (section 5.c)

  • You may include additional sections as needed
  • Create a document/template that you can use for the final project

Make sure each screenshot is accompanied by a brief explanation of what you did in the screenshot.

Attachment:- Assignment File.rar




Put your comment
 
View Conversion
Minimize
  1. user image
    len2320517

    Compose your work in a .doc or .docx file type using a word processor (such as Microsoft Word, etc.) and save it frequently to your computer. For those assignments that are not written essays and require uploading images or PowerPoint slides, please follow uploading guidelines provided by your instructor. Check your work and correct any spelling or grammatical errors. When you are ready to submit your work, click "Upload Submission." Enter the submission title and then click on "Select a file to upload." Browse your computer, and select your file. Click "Open" and verify the correct file name has appeared next to Submission File. Click on "Continue." Confirm submission is correct and then click on "Accept Submission & Save."



Ask Question & Get Answers from Experts
Browse some more (PL-SQL Programming) Materials
Write SQL statement which creates stored procedure with one int input parameter. Stored procedure selects supplierId field and total of all Count field values for each group
Given an alphabetically sorted list of 500,000 people's names and telephone numbers, describe an algorithm that you could implement that would allow you to find a given pers
Perform the following from the SQLZoo site. In the labs at school, you can generate a .pdf by printing the page to the pseudo printer CutePDF Writer. If you use the Chrome b
Write SQL statement which creates the stored procedure which adds new record to the Part table, and returns value of newly created PartID PK value in out parameter.
Write a perl subroutine for temperature conversion named 'convert_temp'. It should be able to handle both Fahrenheit to Celsius conversions as well as Celsius to Fahrenheit co
Question 1: Explain the security mechanisms available for a database and how the data will be protected. Question 2: Explain how to defeat SQL injection attacks since the data
How to select the primary key from the candidate keys? How do foreign keys relate to candidate keys? provide examples from either your workplace or class assignments
1. Write a SQL statement to display Student's First and Last Name.  2. Write a SQL statement to display the Major of the STUDENT with no duplications. Do not display student n