Cyber Security and Analytics

This report provides a plan of action for conducting a full cyber security penetration testing for Mr. Daniel Gromer's e-commerce stores. It discusses potential threats, penetration tools, expected outcomes, and business benefits.

Running head: Cyber Security and Analytics 1
Cyber Security and Analytics
[Author Name(s), First M. Last, Omit Titles and Degrees]
[Institutional Affiliation(s)]
Author Note
[Include any grant/funding information and a complete correspondence address.]

Running head: Cyber Security and Analytics 2
1 TABLE OF CONTENTS
Executive Summary.....................................................................................................................................2
2 Introduction.........................................................................................................................................3
3 Report layout.......................................................................................................................................3
4 Potential threats and risks...................................................................................................................4
5 Penetration tools and technologies.....................................................................................................4
5.1 Acunetix.......................................................................................................................................5
5.2 Aircrack-ng...................................................................................................................................5
5.3 Cain & Abel..................................................................................................................................5
5.4 Ettercap.......................................................................................................................................5
5.5 Metasploit...................................................................................................................................6
6 Expected outcomes.............................................................................................................................6
Acunetix...................................................................................................................................................7
Aircrack-ng...............................................................................................................................................7
Cain & Abel..............................................................................................................................................7
Ettercap...................................................................................................................................................7
Metasploit...............................................................................................................................................7
7 Practical demonstration......................................................................................................................7
7.1 Acunetix.......................................................................................................................................7
7.2 Cain and Abel.............................................................................................................................10
7.3 Ettercap.....................................................................................................................................11
7.4 Metasploit.................................................................................................................................12
8 Business benefits...............................................................................................................................12
9 Conclusion and remarks....................................................................................................................13

Running head: Cyber Security and Analytics 3
EXECUTIVE SUMMARY
This security plan was intended for Mr. Daniel Gromer web service which hosts the e-commerce
application that isutilized to process transactions of the business. From the preliminary case study,
the following key vulnerabilities are associated with the business.
There are high vulnerabilities associated with SQL injections due to improper database setting. We
recommended a complete overhaul of the application layer of the e-commerce site
Some user validation is not done hence some cabbage finds their way into the database. It is,
therefore, recommended the site developer s have input validation at both presentation and
application layers.
Cross-site scripting is another serious vulnerability caused by weaknesses in the Apache web server
vulnerabilities. We recommended updating the web server core libraries.

Running head: Cyber Security and Analytics 4
2 INTRODUCTION
This report provides the plan of action that will be used to conduct a full cyber security penetration
testing for Mr. Daniel Gromer who runs a series of e-commerce stores that expands the cities of Sydney
and Melbourne [1]. This business has a lot of competition hence requires a unique approach to ensure
the customer finds the site not only convenient but also secure to shop in. The plan is organized in a
different section with each section focusing on a given area. The following section discusses the layout
of the report [2].
3 REPORT LAYOUT
The report is divided into sections with each section focusing on a given subset of the penetration
testing subset. First sections discuss the potential risks that the e-commerce faces in relation to the
cybersecurity threats and vulnerabilities within the e-commerce realm. This will give the pentest
activities more focus on trying to find the risks identified [3]. The second section discusses the various
points tools and procedure that will be used methodologically to conduct the cybersecurity pentest to
ensure the risks and vulnerabilities are identified. The third section enumerates the expected outcomes
from the pentest conducted on the e-commerce site. This will aid in gauging the success of the pentest.
The resources required to conduct the pentest will also be enumerated in this section to list all the tools
and methodologies that will be used to conduct the pentest [4]. The next section will provide a practical
demonstration of the various pentest tools to ensure the effectiveness of the results obtained. This will
enable the store owner to appreciate the pentest procedure. Lastly, the business benefits and
conclusion will be given to provide a summary of the various vulnerabilities identified. The writing style
for the report shall be IEEE.
4 POTENTIAL THREATS AND RISKS
Conducting penetration testing comes with its inherent risks that must be identified and mitigated. The
following section identifies some of the risks and potential remedies. First, denial of service poses a

Running head: Cyber Security and Analytics 5
serious threat to the success of the pentest as such attacks would deny even the pentest tools ability to
scan the system and applications to identify some of the vulnerabilities [5]. It is therefore vital for the
servers to be configured with redundancies to ensure the system won’t be affected by a potential denial
of service threats [6].
Second, the business risk having a general degradation of service during the pentest and most of the
penetration testing and vulnerabilities scanners are system intensive in terms of resource utilization. The
amount of bandwidth estimated to be used is quite high hence will affect the performance of other
business operations [7]. The remedy for this is to perform testing on business-critical applications during
the offpeak hours to ensure no degradation of service to customers. Testing can again be conducted in
phases by first doing the UAT and then focusing on the production environment [8].
The following table list the vulnerabilities the business currently face.
Risk Severity
Insufficient Authentication High
Improper Input Filtration High
Cross-site scripting High
SSL weak ciphers Medium
Deprecated protocols Medium
Weak password High
SQL injections High
5 PENETRATION TOOLS AND TECHNOLOGIES
This section describes the various tools that will be used to conduct the pentest procedures The
rationale for choosing the tool is also explained in these sections.
5.1 ACUNETIX
This is a web security tool that will allow the pentest procedures to find various attack vectors that are
associated with the web applications including the XSS and SQL injections. The tools are chosen due to
its versatility and ability to run only on demand and can be scheduled to run on many web applications

Running head: Cyber Security and Analytics 6
efficiently at a reasonable cost. The reporting engine of the tool is also intuitive hence will be key in
providing the feedback requires [9]
5.2 AIRCRACK-NG
This tool is critical for scanning the vulnerabilities within the wifi networks that the company uses to
enable access to the internet by the employees and other guests. It will be used to test the crackability
of the various wifi passwords, checking the wifi network interface vulnerabilities against know
vulnerabilities. In particular, Aircrack-ng is just a suite for an array of software used for vulnerabilities
testing. Key among them includes the Airodump-ng, Airplay-ng, Aircrack-ng, Airedecap-ng [10].
5.3 CAIN & ABEL
This tool has a set of pentest tools that will aid the penetration to be conducted. It will be used to
attempt to test the security of the transport layer security, password guessing, and the MAC address
spoofing. This will be a key tool for the team [11].
5.4 ETTERCAP
Ettercap is a tool used to simulate Man in the middle attacks as it will be used to catch live packets and
attempts to get the data on transit [12]. This is particularly important because most of the adversaries of
an e-commerce site are mainly Man in the middle attacks who sniff packets to gain access to critical
information such as credit card details of the customers [13].
5.5 METASPLOIT
The Metasploit framework which comes inbuilt into the Kali Linux security OS shall be key in conducting
a vulnerability assessment of the web server hosting the e-commerce application, conduct the
vulnerabilities of intrusion detection systems [14].

Running head: Cyber Security and Analytics 7
6 EXPECTED OUTCOMES
The goals for conducting this pentest includes
I. To secure the client’s data
II. To identify and document security vulnerabilities in the client’s e-commerce applications
III. To identify loopholes in the current system
IV. To guide the client in implementing an effective cybersecurity strategy for the company.
The expected outcomes for the test include;
I. Identification of Key system and application risks
II. Security vulnerabilities in the current e-commerce site
III. Identify the potential threats the company faces due to its current systems
Resources required
The following are key resources that shall be used by the team.
I. Laptop with 8GB RAM
II. Kali Linux 64bit ISO image
III. VLAN for pentest
IV. Word processor for report
For each of the tool, the following vulnerabilities shall be tested
Insufficient
Authentication
Improper
Input
Filtration
Cross-site
scripting
SSL weak
ciphers
SQL
injection
Deprecated
protocols

Running head: Cyber Security and Analytics 8
ACUNETI
X
 
AIRCRAC
K-
NG

CAIN &
AB
EL

ETTERCA
P
  
METASP
LOI
T
  
7 PRACTICAL DEMONSTRATION
The following section describes a practical usage of the tools described in the section above,
7.1 ACUNETIX

Running head: Cyber Security and Analytics 9
Aircrack-ng

Running head: Cyber Security and Analytics 10

Running head: Cyber Security and Analytics 11
7.2 CAIN AND ABEL

Running head: Cyber Security and Analytics 12
7.3 ETTERCAP

Running head: Cyber Security and Analytics 13
7.4 METASPLOIT
8 BUSINESS BENEFITS
Numerous benefits accrue to a business when they conduct a thorough pentest. This section outlines
some of these benefits from a business perspective,
To meet regulatory requirements. Various jurisdictions have set up laws and regulations governing how
consumer data is to be handled [15]. It is, therefore, the work of the company to identify any key
loopholes where consumer data will be at risks and make corrective controls if necessary. The only way
to identify such weaknesses is through a structures pentest.
Enhance customer loyalty and protection of the company's image. Cybersecurity breaches have a ripple
effect on consumer trust on the affected business. The image of the company will also be at risk if such
security loopholes are not identified earlier and handled accordingly. Pentest will help the company
have a competitive advantage when it survives such attacks [14].
Reduce the cost of total downtime. E-commerce sites need to be running 24/7 as the buyers are
distributed and conduct the most transaction online. It is therefore important to reduce any threats that
affect system and application downtime through cyber attacks and misconfigure applications. Such
vulnerabilities can only be detected by conducting a structured pentest [16].

Running head: Cyber Security and Analytics 14
9 CONCLUSION AND REMARKS
Penetration testing for the e-commerce site yielded some finding which is summarized below,
Insufficient authentication in the user login page. We recommended proper authentication schemes
using up to 3 factors to enhance effective security
Invalid input filtering. The data being sent into the database is not sanitized as an attacker can trick the
database and still important information through SQL injection, The recommended action is to ensure all
the inputs are well validated before entering the database. In addition to this, the company should use
more stored procedures to reduce SQL injections
If the above are well addressed, the company will reap from the benefits of reduced cyber threats that
can make the business endure loses.

Running head: Cyber Security and Analytics 15
REFERENCES
[1] Penetration testing of law enforcement credential used to bypass screening [electronic resource] :
(unclassified summary). Washington, DC : U.S. Dept. of Homeland Security, Office of Inspector
General, 2009, 2009.
[2] A. M. Kadan and A. K. Doronin, “The Study of Methods for Penetration Testing in Training of
Information Security Specialists,” Цифровая трансформация, no. 2, p. 3, 2016.
[3] Артём Григорьевич Тецкий, “Applying of Neural Networks for Selecting the Tools for Penetration
Testing of Web Applications,” Радіоелектронні і комп’ютерні системи, no. 4, p. 86, 2018.
[4] Tomáš Klíma, “PETA: Methodology of Information Systems Security Penetration Testing,” Acta
Informatica Pragensia, no. 2, p. 98, 2016.
[5] “Static Analysis and Penetration Testing from the Perspective of Maintenance Teams,”
International Symposium on Empirical Software Engineering and Measurement (ESEM), 2016.
[6] S. Chockalingam and H. S. Lallie, “The Conceptual Idea of Online Social Media Site (SMS) User
Account Penetration Testing System,” 2014.
[7] P. Čisar and S. M. Čisar, “Ethical Hacking of Wireless Networks in Kali Linux Environment,” Annals
of the Faculty of Engineering Hunedoara - International Journal of Engineering, vol. 16, no. 3, pp.
181–186, Aug. 2018.
[8] Dragan D. Mladenović, “Vulnerability assessment and penetration testing in the military and IHL
context / Оценка уязвимости и тестирование на взлом в военном и международном
гуманитарном праве / Procena ranjivosti i testiranje otpornosti na upade u sistem u vojnom i
kontekstu međunarodnog humanitarnog prava,” Vojnotehnički Glasnik, no. 2, p. 464, 2017.
[9] Y. Erzin and D. Turkoz, “Use of neural networks for the prediction of the CBR value of some Aegean
sands,” Neural Computing & Applications, vol. 27, no. 5, pp. 1415–1426, Jul. 2016.
[10] R. LaBarge and T. McGuire, “Cloud Penetration Testing,” 2013.
[11] M. Li, J. L. Furlong, P. L. Yorio, and L. Portnoff, “A new approach to measure the resistance of fabric
to liquid and viral penetration,” PLoS ONE, vol. 14, no. 2, p. 1, Feb. 2019.
[12] M. Tomanek and T. Klima, “Penetration Testing in Agile Software Development Projects,” 2015.
[13] N. A. Naik, G. D. Kurundkar, S. D. Khamitkar, and N. V. Kalyankar, “Penetration Testing: A Roadmap
to Network Security,” 2009.
[14] I. b. Ryzhkov and O. n. Isaev, “Current status and trends in cone penetration testing of soil:
(proceedings of the 3rd International Symposium on Cone Penetration Testing),” Soil Mechanics
and Foundation Engineering, no. 3, p. 171, 2015.
[15] C. Sarraute, O. Buffet, and J. Hoffmann, “Penetration Testing == POMDP Solving?,” 2013.
[16] S. Stephan, N. Kaul, and H. Villinger, “Validation of impact penetrometer data by cone penetration
testing and shallow seismic data within the regional geology of the Southern North Sea,” Geo-
Marine Letters, no. 3, p. 203, 2015.