6G7V0032 Penetration Testing and IoT Security Assessment Brief | MMU

6G7V0032 Assessment Brief 

6G7V0032 Learning Outcomes Being Assessed:

LO1 Discover a variety of security vulnerabilities using a broad range of penetration testing tools.
LO2 Apply appropriate network security techniques to mitigate vulnerabilities and minimise attacks.
LO3 Use appropriate network development tools in the deployment of secure computer networks
LO4 Apprise the emerging challenge mobile and IoT devices pose to an organisation's network and propose strategies against them
LO5 Apply a wide range of transferable skills and attributes applicable to modern industry and research.

Note: it is your responsibility to make sure that your work is complete and available for marking by the deadline. Make sure that you have followed the submission instructions carefully, and your work is submitted in the correct format, using the correct hand-in mechanism (e.g., Moodle upload). If submitting via Moodle, you are advised to check your work after upload to make sure it has uploaded properly. If submitting via OneDrive, ensure that your tutors have access to the work. Do not alter your work after the deadline. You should make at least one full backup copy of your work.

Penalties for late Submission

The timeliness of submissions is strictly monitored and enforced.
All coursework has a late submission window of 7 calendar days, but any work submitted within the late window will be capped at 50% unless you have an agreed extension. Work submitted after the 7-day late window will be capped at zero unless you have an agreed extension. See ‘Assessment Mitigation’ below for further information on extensions.

Please note that individual tutors are unable to grant any extensions to assessments.

Assessment Mitigation

If there is a valid reason why you are unable to submit your assessment by the deadline, you may apply for Assessment Mitigation. There are two types of mitigation you can apply for via the module area on
Moodle (in the ‘Assessments’ block on the right-hand side of the page):

Non-evidenced extension: does not require you to submit evidence. It allows you to add a short extension to a deadline. This is not available for event-based assessments, such as in-class tests, presentations, interviews, etc. You can apply for this extension during the assessment weeks, and the request must be made before the submission deadline. For this assessment, the self-certification extension is 2 days.

Evidenced extension requires you to provide independent evidence of a situation that has impacted you. Allows you to apply for a longer extension and is available for event-based assessments, such as in-class tests, presentations, interviews, etc. For event-based assessments, the normal outcome is that the assessment will be deferred to the summer reassessment period.
Further information about Assessment Mitigation is available on the Postgraduate Assessment  Regulations on the Assessments and Results information pages

Personal Learning Plans

If you have a Personal Learning Plan (PLP) which states you can negotiate an extended deadline, make an appointment to see the Department’s Disability Coordinator to discuss your needs, and, where appropriate agree on a revised submission deadline.

Plagiarism

Plagiarism is the unacknowledged representation of another person’s work, or use of their ideas, as one’s own. Manchester Metropolitan University takes care to detect plagiarism, employs plagiarism detection software, and imposes severe penalties, as outlined in the Student Code of Conduct and Academic Misconduct Policy. Poor referencing or submitting the wrong assignment may still be treated as plagiarism. If in doubt, seek advice from your tutor.

As part of a plagiarism check, you may be asked to attend a meeting with the Module Leader or another member of the module delivery team, where you will be asked to explain your work (e.g. explain the code in a programming assignment). If you are called to one of these meetings, you must attend.

Use of generative AI

The use of generative AI is permitted in this assessment, so long as it is used under the instructions provided in the ‘Are you allowed to use AI in assessments?’ section of the AI Literacy Rise  Study Pack. All submitted work must be your original content.

We recommend working with the two main principles:

1. Your work should always authentically represent your capabilities.

2. You should never trust the outputs of Generative AI uncritically.

3. Generative AI should not be used to write any part of your assessment.

Assessment Regulations

For further information, see the Undergraduate Assessment Regulations on the Assessments and Results information pages

Scenario

You are employed as an ethical hacker, and your company has asked you to represent them at a leading tradeshow. At this event, you will demonstrate your knowledge and practical skills in penetration testing using a small number of virtual machines and produce a detailed technical penetration testing report.

Penetration Testing

Your objective for this task is to exploit three target machines and provide proof of enumeration/vulnerability assessment, scanning, exploit development, and exploitation, as well as a brief discussion on vulnerability fixes or detailed security recommendations with appropriate references where required. You will be provided with three Virtual Machines, each ranked by its difficulty, with instructions on accessing these VMs. You will be given a Kali Linux Virtual Machine to attack the targets.

Each target machine contains at least one proof file, which you must retrieve and include with your documentation.

1. Proof Filenames:

proof.txt /root.txt - This file is only accessible to the root or Administrator user and can be found under the /root directory (Linux) or the Administrator “Desktop” or “My Documents and Settings” (Windows). This file is available on every target machine.

a. Proofs: Windows

On all Windows targets, you must have a shell of one of the following to receive full or partial marks:

Full marks will be given if you obtain: SYSTEM user/Administrator user or User with Administrator privileges. Partial marks will be awarded for obtaining a low privilege user (see the marks breakdown section).

You must provide the contents of the proof files IN A SHELL (web, bind, reverse, or RDP) with the "type" or "cat" command from their original location. Obtaining the contents of the proof files in any other way will result in a loss of marks.

b. Proofs: Linux

On all Linux targets, you must have a root shell to receive full marks. Partial marks will be awarded for obtaining a low-privilege user. You must provide the contents of the proof files IN A SHELL (web, bind, reverse, or SSH) with the "cat" command from their original location. Obtaining the contents of the proof files in any other way will result in a loss of marks.

Submission

Technical Report 

You are required to write a professional report describing your exploitation process for each target. You must document all your attacks, including all steps and commands issued. For each target machine you exploit, you must provide the target’s operating system name and IP address and detailed documentation to accompany the ethical hacking process. Your documentation should be thorough enough that your attacks can be replicated step-by-step by a technically competent reader.

The report should comprise no more than 2500 words excluding references. Your submission file should use the following naming convention. The ability to write concisely will be considered in determining the quality of the writing.

Screenshot Requirements

You are required to provide screenshots for each target machine, describing the action taken in the screenshot. These screenshots MUST be yours and SHOULD NOT be copied from others or online sources. You will lose marks for not including any screenshots or not adhering to the screenshot guideline (See assessment criteria).

Each section of your report should be labelled as follows:

a. Enumeration/Vulnerability Scanning: Screenshot showing port scanning using Nmap and vulnerability scan using GVM or OpenVAS or any other suitable vulnerability scanner used on the target. This should also include a detailed explanation/discussion of the enumeration/scanning results or observations you made from the results of the scans.
 
Example:

b. Exploit Development: This should show and discuss detailed steps you took when developing, creating and sending your exploit as well as detailed steps before arriving at the screenshot. If you have used any public exploits, you should include modifications you made to the exploit script in this section and explain the changes that you made.

Example:

c. Successful Exploitation + Privilege Escalation: Show the output of the successful initial shell and privilege escalation shell from the exploit development, the output of "ifconfig/ipconfig", “date/time”, and the contents of the proof.txt or root.txt files.

Example:

d. Vulnerability Fix + Recommendations: This section should provide a detailed technical discussion on the vulnerability or vulnerabilities that were successfully exploited on a given target. You MUST provide details of the vulnerability fix, root causes and security recommendations to ensure the security of the target is enhanced. Adequate and proper references should be included for any citations or information you have provided from credible sources.

Marking Scheme/Assessment Criteria

Marks will be awarded for partial and complete administrative control of the target machine. Each target machine has a maximum of 30 marks. If you are unable to successfully exploit a target, marks will be awarded for the initial enumeration and vulnerability scanning phases you have included in your report. Provided you have included screenshots and a detailed description of the attempts you have made. 10 marks will be awarded for the overall report structure.

Note: Methodical documentation of hacking steps, exploitation methods used to exploit, as well as vulnerability fixes, is important and not just obtaining a shell on the target. The assessment criteria rubric should be used as a guide on the level of detail required in your technical report.

The total number of marks for the technical report is 100 marks.