CSEC5003 Penetration Test Incident Response Summative Coursework Brief 2024-25 | DMU

Tasks to be Undertaken:

Please read all sections of this specification carefully. This specification comprises two clearly separated parts. This coursework is to be an individual piece of work. You may NOT work with a colleague.

Part A – Penetration Test

The business manager of a local SME has requested a penetration test to be carried out against their newly developed web application, The Bodgelt Store.

Requirements

This assessment focuses on your ability to report your findings after completing a penetration test:

• You need to complete a scan of the target web application to identify all existing vulnerabilities and misconfigurations. For each one, present a summary, including the risk level, risk matrix, and recommendation to mitigate the vulnerability.
• You need to conduct a comprehensive exploit attempt of the vulnerabilities and misconfigurations. The authoritative exploitation and post-exploitation processes need to be replicable. You are to use any TTP allowed by scope, including existing exploits and your bespoke scripts.
• Produce a Final Penetration Test Report based on the TTPs you used and the results of your exploitations. Provide evidence (i.e., screenshots, test outputs) of all the steps you carry out, and document the commands you use during the test.

Scope

The scope of the penetration test is limited to the website using only ports 80 and 443. The Rules of Engagement allow to use any TTP, including existing exploits, and your own bespoke scripts. However, the use of the tool SQLmap is out of scope. Similarly, the implementation of cross-site scripting or Cross-Site Request Forgery is out of scope. Any offline attacks on the victim's Virtual Hard Disk are out of scope. Interacting with the GRUB loader on the coursework VM is out of scope. You should not look at files directly on the coursework VM, and interaction with the target should always occur through the network. Your client has also requested no cross referencing between the Executive Summary, Technical Summary, and Assessment Summary. Each of these documents should address the relevant audience, and be written using the adequate narrative. The technical summary must include a table summarising the vulnerabilities uncovered.

During the pre-engagement meetings, your client has requested using the ATT&CK matrix and risk matrices to describe each vulnerability exploited (attack.mitre.org), supporting the technical summary with an attack flow diagram, and only including recommendations from the MITRE ATT&CK framework.

You will need to download a compressed file (victim_web_app.zip) from the link provided on the Learning Zone shell. You will need VMWare Player to run both VMs, the one containing the web application and the other running Kali Linux.

You need to ascertain the IP address of the victim machine, and then access it with a browser. Point the browser from the test environment at the home page of the website in the VM. This VM contains multiple websites – you need to select The Bodgelt Store from the list.

Part B – Incident Response

Scope

Based on the findings of your penetration test, your client is now well aware of the cyber security risk posed to their operation and are thinking about setting up its own Security Operations Centre, but is unsure whether or to commit the resources required. You have been asked to provide advice on the matter and to present a business case to support your advice. You are required to provide:

• A recommended SOC solution (internal or external) and a justification of this choice
• Draft NIST processes AND the policies that should be implemented to support your recommended solution
• An outline of the resources required to support your solution
• If the architecture of The Bodgelt Store is as shown below, identify any improperly implemented features and propose improvements

When completed you are required to submit your coursework via:

• Report: Electronic submission on Blackboard/Turnitin

If you need any support or advice on completing this coursework please visit the Student Matters tab on the CEM Blackboard shell.

The learning outcomes that are assessed by this coursework are:

• LO1 Produce penetration testing plans
• LO2 Apply penetration testing techniques to identify vulnerabilities
• LO3 Propose an appropriate response to a computer security incident