NWC4123: WebGoat is a deliberately insecure web application maintained by OWASP designed: Ethical Hacking Assignment, UPTM, Malaysia

QUESTION 1

WebGoat is a deliberately insecure web application maintained by OWASP designed to teach web application security lessons. You can install and practice with WebGoat. There are other ‘goats’ such as WebGoat for .Net. In each lesson, users must demonstrate their understanding of a security issue by exploiting a real vulnerability in the WebGoat applications.

WebGoat for J2EE is written in Java and therefore installs on any platform with a Java virtual machine. There are installation programs for Linux, OS X Tiger and Windows. Once deployed, the user can go through the lessons and track their progress with the scorecard.

1.0 Instruction for Task 1. : Learning the techniques, network and servers
1. Student are to demonstrate the following task:
a. Injection
b. Broken Authentication
c. Sensitive data Exposure
d. XML External Entities
e. Cross Site Scripting
By using the WebGoat.

2. As for description of each task, student need to rephrase any information, guide or result from the tasks. DO NOT COPY AND PASTE the guideline or instruction given by Web Goat.

3. Summarize your observation and result from each task that you have achieved.

2.0 Instruction for Task 2: Apply the techniques on selected site.
1. Based on the knowledge you have acquired from web goat, student are to pick a web system and apply the knowledge of the attack on the selected web system.

2. Student will select any webpage, or any system deemed insecure. (In order to determine which site is secure, the students will conduct background check on the webpage/system. If the system is suitable, than the student may conduct the suitable tasks for the system/ or webpage.)

3. Upon launching attack, you are required to launch the attack using virtual machine (kali). Do not launch your attack directly from your real machine. Take the necessary action to obscure your IP address. You may apply any technique to mask you IP address (using proxy or changing the IP address range in VM )

4. It is to proposed that some of the attack launch will not be successful due to the technical capabilities of the programmers and fortified layer of security installed on the targeted system. However, the methodologies and problem solving on the task will be heavily mark on. The result will act as the bonus point for the student.

5. The main quality that is being looked upon are the problem solving and the technical knowledge presented throughout the attacking process.

3.0 Requirement
At the end of the assignment, the student is required to write a report for both tasks. The marks will be weighted on the analytical explanation on the problem, solution and the countermeasure proposed. Documented on each problem that you have solved and explain on how the problems are being overcome. Any justification must be backed with relevant references.

Answer

Request Answer of this Assignment