Reference no: EM132932676 , Length: 2350 Words

7CS023 Ethical Hacking - University of Wolverhampton

Assessment - Ethical Hacking as a proactive and adversarial approach to secure systems.

1. Assessment Brief

The purpose of this assignment is to perform and document a penetration testing phase as part of a practical ‘offensive security' approach against a known network topology with distinguished characteristics and services. Furthermore, the report incorporates state-of-the-art research to demonstrate in-depth theoretical knowledge of a network security auditing paradigm regarding application and network layer attacks. You will learn how to defend a system and provide a better set of services in terms of security and availability and to further understand how planning and executing a set of steps and methods can seriously affect the security of a network.

2. Ethical and Legal Implications
Due to the nature of this module, you MUST ensure that ALL the attacks performed during the coursework are carefully contained within a controlled laboratory environment. The expected approach is to utilise virtual technology (e.g. VMware, Hyper-V or VirtualBox) to build your own lab.

Performing attacks on the virtual machines within the dedicated University laboratory is permitted, but it is very important to note that attacking the rest of the university network is NOT allowed. A full monitoring process will be in place and offenders could be prosecuted. Ask your lecturer to clarify any doubts shall you have further inquiries. Overall, make sure you comply with UK-legislation and all associated professional and ethical behaviour.

The purpose of this assignment is NOT to teach you how to break computer systems but rather to understand how the countermeasures are applied to protect your potentially vulnerable infrastructure.

3. Prerequisites and Preparation
Element 1: For the practical part of this assignment, you will have to build Virtual Machines (VM), an exemplar scenario is clarified below but you can choose a different setup:
1. A Server
o You could use a Linux (e.g. CentOS, Ubuntu Server), or a Windows Server
o Minimum configuration required
Two services of your own choice (e.g. DHCP, FTP, SMTP, SNMP, Web etc)
2. A Client
o Could be either Windows (Visa, 7, 8, 10 etc) or Linux (Fedora, Ubuntu etc)
o You could create multiple copies of the client's VM if you require more clients to demonstrate an attack
3. Attacker machine
o Kali Linux (the most recent version is highly recommended)
Element 2: For this element, you are required to reference peer-reviewed papers. Access to academic databases/journals such as IEEE Xplore, Scopus etc is given via the UoW Library Catalogue: https://www2.wlv.ac.uk/lib/Summon/

4. Deliverables
There are two submissions for this assignment as it is consisting of two parts as follows:

Element 1
In this first part of the assignment, you are required to plan and demonstrate a case study of offensive security:
• Provide a summary of the configuration steps (e.g. for the server and client machines). Include screenshots to show that the environment is functional (e.g. to evident functionality at the client-side). Discuss the rationale behind service selection and configuration.
• Demonstrate a minimum of 2 attacks in total against the services configured. Any further and complex attack steps will attract more marks. Log all the important and offensive events against your target including attacks detected, services' logs nature, the origin of the attack and damage caused. Support your demonstration with screenshots.
• Critically reflect on countermeasures and prevention mechanisms applied to mitigate against your attacks.

Element 2
In the second part of the report, you are required to write a short position paper to critically analyse and reflect on recent state-of-the-art attacks and hacking techniques, followed by a discussion on possible countermeasures.
Your paper should consider the following guidance and contain the following subtitles as a minimum:
• Title page and Abstract
• Introduction
o The nature of the brief/commission and the topic should be briefly outlined and defined alongside details of how the paper is organised.
o Scope: how did you select the attacks/techniques in this paper? E.g. most recent attacks, wireless attacks, IoT attacks, DNS attacks etc
• Main body
o Critical discussion, reflection and analysis
• Conclusions
o A brief summary of the key findings established from your research.
• References.
o A full list of references used within the paper should be provided. The Harvard Style of referencing should be applied throughout the assignment.

Attachment:- Ethical Hacking.rar