Penetration testing planning stage

Assignment Help Other Subject

Reference no: EM132535928

CECT5804 Penetration Testing and Incident Response - De Montfort University

Assignment - Report on Web Application Penetration Testing and Incident Response

Learning outcome 1: Demonstrate the ability to produce Penetration Testing plans.
Learning outcome 2: Apply Penetration Testing techniques to identify vulnerabilities.
Learning outcome 3: Propose an appropriate incident/intrusion response to a computer security incident.
Learning outcome 4: Critically evaluate a range of computer security solutions.

Task

Analyse the given web application (via URL/port 80/port 443) for vulnerabilities, and produce a report summarising your findings.

Objective

Web developers working for a commercial client have implemented a new web application. The company has requested that a penetration testing is carried out against the web-site, and that a report is prepared of the findings, to be returned to the client.

The VM is a samurai machine with the password of samurai. The website that you need to pen test is located at 127.0.0.1/cwk. The scope of your pen test is limited to the website as seen to the outside world, this means that you should not look at the files directly in a terminal.

You will need VM Player (or VM Workstation) to run the Virtual Machine containing the web-application.

You are to plan and execute a penetration testing of this web-application. You will describe the tools and techniques that you used to carry out the test. Your findings will be prepared as a report (Executive Summary) for the web-site owner, followed by a fuller discussion of the tools and techniques that you used.

Please note that the coursework is to assess your abilities in finding vulnerabilities using only port 80 and or port 443, ie via web-page forms or the address box.

Perform the pentest yourself - do not discuss your findings with anyone else. All sections of the report MUST be an individual piece of work.

Section 1 - Penetration Testing Planning Stage

To plan for the penetration testing, you will need to research techniques and tools to carry out the test. You should consider the use of a web application pen testing methodology and discuss this in your plan. When discussing the tools and techniques, you should also consider the likely outcomes and methods of analysis from each.

Section 2 - Penetration Testing Implementation Stage

Your investigation may or may not discover any problems with the web-site. You must ensure that you have thoroughly documented all tools and processes used in your investigations. You are also expected to critically analyse your penetration test in relation to your test plan, highlighting areas of strength and areas where work deviated from the original design.

The executive summary (a maximum of 600 words) should address the OWASP Top 10 vulnerabilities for 2013. The severity of each uncovered vulnerability should be assessed. The writing style of the summary should be suitable for a busy MD or CEO who is non-technical.

Section 3 - Preventative Recommendation Stage

Finally, you need to provide preventative recommendations to react appropriately. You need to discuss different security solutions to address the identified vulnerabilities and critically evaluate these security solutions.

Section 4 - Incident/Intrusion Response Plan
In this stage, you also need to propose the essential preparations before the incidents occur. For example, what processes and procedures you will put in place, how you plan to detect and analyse incidents, how you plan to collect data and evidence, how to build an incident response team, how to perform an initial response, incident handling and analysis, incident reporting, etc.

Attachment:- Penetration Testing and Incident Response.rar

Reference no: EM132535928

Questions Cloud

Find how much company flexible budget operating income : In July, the company operated 53 buses and served a total of 3,200 passengers. How much is the company's flexible budget operating income for July?

Discussion on your favorite consumer product : Research your favorite consumer product (iPhone, Lexus IS, Disney, Sony PlayStation, Gucci, Lego, Frito Lay Cheetos, etc.) for changes in trend (trend analysis)

First transatlantic television broadcast transmitted : Knowing that radio waves project in all directions how deep into the universe has the signal gone?

Magnitude and angle of the acceleration of the object : If the object is initially at rest, what will be the magnitude and angle of the acceleration of the object due to F1 and F2?

Penetration testing planning stage : Discuss different security solutions to address the identified vulnerabilities and critically evaluate these security solutions

What appropriate transfer price for electronic division : If Electronic Division decided to sell some containers to outside customers, would your answer to requirement 3 change? Defend your response

What was the motivation to develop performance indicators : What was the motivation to develop performance indicators? How did the organisation develop the indicators?

Describe the company and their primary product service : Think of a company with which you are familiar. Describe the company and their primary product(s)/service(s).

How much do you expect the force to change : If you reduce the distance between them to 1/3 of what it was originally, how much do you expect the force to change?

User Account

All Pages