Reference no: EM132910771
COMP3781 Cybersecurity - Flinders University
Assignment - Penetration Test & Evaluation Report
Learning Outcome 1: Understand, Evaluate & Identify Network Security Threats
Learning Outcome 2: Secure Ethernet, Wireless and Mobile Networks
Learning Outcome 3: Security Design at Different Levels of the OSI model
Learning Outcome 4: Apply Authentication, Authorization and Accounting Tools & Techniques
Learning Outcome 5: Ongoing Management of a Secure Network
ASSIGNMENT BRIEF
You are a Cybersecurity consulting company, offering penetration testing services. You have been contracted with performing a full penetration test of an IT environment as a security professional. This simulated penetration test will involve the discovery of specific ‘flags' that are present within the simulated environment. You will be required to perform all aspects of a penetration test, including reporting of findings and possible solutions to each problem.
The vulnerable VM can be downloaded from the link provided below. Your goal is to remotely attack the VM and find all four flags, eventually leading you to full root access. You have to provide all the possible mitigation techniques and should enumerate all the things.
Required Resources
• Kali Linux
• Vulnerable VM (download it here)
The network setting is either host-only or bridge-mode. The vulnerable VM has a static IP 192.168.1.67. You need to configure your Kali IP to the same subnet using ifconfig eth0 192.168.1.xx. Once you configure, your IP then ping the vulnerable VM and make sure that vulnerable VM is reachable.
TASKS
As a security consultant company, generic.com has asked you to provide a report on any vulnerabilities in their online environment, as well as mitigations. Your report should also cover your enumeration of the entire environment in the vulnerable VM.
Students are expected to provide a detailed report on identified security vulnerabilities. The report should also explain the mitigation techniques.
This is an internal security audit as provisioned by a client; thus, the report is to be written in the context of a client. The intended audience for this report is both technical and non-technical.
Ensure to document all the stages of your investigation, and failing to do so would result in fail (partial) marks.
Attachment:- Cybersecurity.rar