INSE 6980 Security Project 2022

INSE 6980 SECURITY
PROJECT
NAME OF THE STUDENT
NAME OF THE UNIVERSITY

RECOMMENDATION FOR PENETRATION
TESTS ON FOOD DISTRIBUTION NETWORK
STRUCTURE
• A PENETRATION TESTING IS NEEDED TO BE CONDUCTED ON THE NETWORK OF THE FOOD DISTRIBUTION
COMPANY FOR MITIGATING THE CURRENT PROBLEM OF DATA MISMATCH, DATA BACKUP, DATA DELETION
UNAUTHROISED ACCESS, ETC.
• IT IS RECOMMENDED THAT BOTH EXTERNAL AND INTERNAL PENETRATION TEST IS NEEDED TO BE
PERFORMED ON THE ORGANIZATIONAL NETWORK.
• THE EXTERNAL PENTEST HELPS IN VIEWING THE ENVIRONMENT SECURITY POSTURE FROM THE OUTSIDE
SECURITY PERIMETER FROM THE INTERNET FOR REVIEWING THE VULNERABILITY THAT IS EXPLOITED BY
EXTERNAL HACKER.
• THE INTERNAL PENTEST HELPS IN IDENTIFYING A TRUSTED INSIDER INSIDE THE PERIMETER DEFENSE. IT CAN
HELP IN IDENTIFYING THE POTENTIAL DAMAGE CAUSED BY AN INSIDER.
• THE PENTEST IS NEEDED TO BE CONDUCTED IN THREE PHASE I.E. RECONNAISSANCE, SCANNING AND
EXPLOITATION AND ACCESS MAINTAINED, BACKDOORS AND ROOTKITS ARE ALSO NEEDED TO BE IDENTIFIED.

SOFTWARE USED FOR THE PENETRATION
TEST
Software INPUT Command Possible OUTPUT
Nmap Nmap 192.100.34.0/24 Output the available host IP address
Nikto nikto -host 192.100.34.5 Apache, OpenSSL and PHP version of the targeted
webserver
John the Ripper john /etc/shadow john --show /root/johns_passwd
john:password:1000:1001::/home/john:/bin/bash
1 password hash cracked, 1 left
MySQL, Oracle, SQL Server $query = "UPDATE usertable SET pwd='$pwd' W
HERE uid='$uid';";
gain excess privileges and access database without
authentication.
WEB BROWSER (MOZLLLA
FIREFOX,GOOGLE CHROME)
GTranslate plugin
WORDPRESS
hreflang tags Reflected XSS
Query database values via web browsers .
WEB BROWSER (MOZLLLA
FIREFOX,GOOGLE CHROME)
GTranslate plugin
WORDPRESS
Coping "Referrer" header values to the html
element know as "redirectUrl"
Error in validating value

SQL INJECTION PENETRATION TESTING
THE PENETRATIVE TEST OF RESETTING A PASSWORD TO GAINING
MORE PRIVILEGES AND ACCESS THE DATABASE
• <?PHP
$QUERY = "UPDATE USERTABLE SET PWD='$PWD' WHERE UID='$UID';";
?>
• BUT A MALICIOUS USER SSUBMITS THE VALUE
' OR UID LIKE'%ADMIN%
TO
$UID TO CHANGE THE ADMIN'S PASSWORD, OR SIMPLY SETS
$PWD
TO
F!U@N!Y&UL@A', TRUSTED=100, ADMIN='YES TO GAIN MORE
PRIVILEGES. THEN, THE QUERY WILL BE TWISTED: