Scribd Logo
Upload

Welcome to Scribd!

  • 15 views

    Penetration Testing-Hritika Rawat Law

    Uploaded by

    Hritika Rawat

    Copyright:

    © All Rights Reserved

    Penetration Testing-Hritika Rawat Law

    Uploaded by

    Hritika Rawat
    15 views7 pages

    Copyright

    © © All Rights Reserved

    Did you find this document useful?

    Is this content inappropriate?

    Copyright:

    © All Rights Reserved
    15 views7 pages

    Penetration Testing-Hritika Rawat Law

    Uploaded by

    Hritika Rawat

    Copyright:

    © All Rights Reserved
    of 7

    Executive Summary:

    This report is the final coursework of Basic Cyber Security Course given by the NCC
    Education for the purpose of testing the students’ knowledge and skills.

    This report outlines the findings of a penetration testing exercise conducted on the target
    network to identify vulnerabilities and recommend remediation steps. The scope of the
    testing included web application security assessment of BWAPP and DVWA environments.

    Several vulnerabilities were identified in both BWAPP and DVWA environments. These
    included SQL injection, cross-site scripting (XSS), and insecure file uploads. Additionally,
    other vulnerabilities such as missing patches, weak passwords, and misconfigured servers
    were also identified.

    Based on the results of the penetration testing, the following recommendations are made to
    improve the overall security of the target network:

    1. We should use parameterized queries, input validation and sanitization.


    2. We should limit user privileges.
    3. Regular update of software shall be done.
    4. We should use secure and HttpOnly cookies, and also adopt other different methods.

    Overall, the results of the penetration testing demonstrate that the target network is vulnerable
    to attacks and that urgent action is required to address these vulnerabilities. The
    recommendations outlined in this report should be implemented immediately to mitigate the
    risk of a successful attack.
    Introduction
    The aim of this penetration testing project was to dig deep into the web applications BWAPP
    and DVWA to uncover any weaknesses or vulnerabilities that a hacker could take advantage
    of. Our ultimate objective was to pinpoint any potential security threats and vulnerabilities
    that could pose a risk to the application's security.

    This report is designed to share our findings from the penetration testing project, including
    our methodology, results, and recommendations for remediation.

    The system has the IP address of 192.168.101.7.


    Findings:-

    1. SQL Injection Attacks


    Risk: High

    Vulnerability:- SQL injections are possible in the online application. As a result, an attacker
    might possibly access or manipulate all database data. This may result in the disclosure of
    private data, including credit card details, business information, and table structure.

    Proof of Concept:
    The entered parameter and its result is listed bellow. The screenshot depicts how the web
    server may be exploited simply and get unauthorized or foreign access or modified by an
    attacker. Here, we put inputs such as 1, 1=1, 1=1 –,

    Mitigating Measures:
    Mitigating measures of SQL injection include using parameterized queries, input validation
    and sanitization, limiting user privileges, and regularly updating software and security
    patches.
    2. Command Injection Attacks
    Risk: High

    Vulnerability:
    The input field specifies a target for a ping command, e.g., an IP address. In the weak
    application, it injects and executes commands that the attacker specifies. A malignant hacker
    could mislead a program into executing operating system commands by using command
    injection.

    Proof of Concept:

    Mitigating Measures:
    For mitigation, there should be correct input data validation and input filtering in the web
    system server. Additionally, the use of parameterized queries and prepared statements in
    database queries can prevent command injection attacks.
    3. XSS Attacks
    Attackers can take control of a target website by using XSS attacks to insert malicious scripts
    into the website.

    Risk: High

    Vulnerability:- The DVWA web server is vulnerable to XSS attacks because it enables
    attackers to insert malicious scripts into web pages that are being viewed by other users. This
    can result in the theft of user data or allow the victim user to perform unauthorized actions.

    Proof of Concept:

    Mitigating Measures:
    Your application must validate all input data, ensure that only allowlisted data is permitted,
    and ensure that all variable output in a page is encoded before it is returned to the user if you
    want to prevent XSS attacks.
    4. Cookie manipulation attacks
    A cookie manipulation attack is the act of manipulating or forging a cookie for the purpose of
    getting around security measures or sending false information to a server.

    Risk:- medium

    Vulnerabilities:- The vulnerabilities arise when a script writes attacker-controllable data into
    the value of a cookie. An attacker may be able to utilize this vulnerability to generate a URL
    that, if accessed by another user, will set an arbitrary value in the user's cookie.

    Proof of concept:-
    Mitigation measures:-

    To mitigate this attacks, we should use secure and HttpOnly cookies, and also adopt other
    different methods.

    You might also like