Reference no: EM132845447 , Length: word count:3800
CO7607 Penetration Testing and Active Defence - University of Chester
Learning Objective 1: Critically analyse and evaluate networked systems for vulnerabilities and weaknesses LO2: Learning Objective 2: Demonstrate an understanding of access, attack and defence methods
Learning Objective 3: Demonstrate the use of some complex penetration testing and active defence tools LO4: Carry out a complete and detailed penetration test
Learning Objective 4: Demonstrate the ability to report on and advise on networked system security
Assignment Brief
The case study for this assignment is a virtual machine (VM) which belongs to a company. The VM plays a significant role in the company's business and has a number of services running on it. The company would like to know the security status of the VM and what they need to do to keep it safe. You are expected to carry out full penetration testing on this particular VM and provide a report of your findings to the company.
The case study VM can be downloaded from Moodle/Aula under Session 3. This case study will be the focus of the six lecture sessions. Every lecture will start with introducing a pentesting stage and the relevant tools followed by the exercise of performing the activities of that pentesting stage on the case study. This will involve building on those activities (further individual study and discretion will be required), applying them to the case study, and documenting the processes and findings. You are expected to start each exercise in class with tutor's support and then go on to complete tasks individually. You are encouraged to complete each exercise before the start of the next lecture.
You are required to produce a Pentest Report using the reporting template presented in pages 5- 6 of Weidman (2014). You are expected, as a pentesting consultant in this case, to be creative in writing/presenting your penetration test report. Note that, apart from the exploitation skills of the pentester, his/her penetration test report should provide useful suggestions and techniques the client can use to resolve their security issues.
The report, as explained in the pentest report template of Weidman (2014), should contain detailed explanations of the activities and findings in each of the Engagement & Information Gathering, Footprinting & Scanning, Vulnerability Assessment, and Exploitation stages.
The report should address techniques used, vulnerabilities identified, exploits used, impact and remediation tipsetc.
The report is the actual deliverable of the pentester's professional engagement. It summarises the findings for both executives and technical practioners. So it is important to bear in mind the level of technical knowledge of both the non-technical and technical executives. The provided report template is a very good guide.
Attachment:- Pentration Testing.rar