Analysis of Protocols with Wireshark – Explain what the website developer could do to prevent this SQL injection In your explanation, give exact code or steps the developer should use

Question 1. Analysis of Protocols with Wireshark [10 marks]

For this question you must use virtnet (as used in the workshops) to study Internet applications with Wireshark. This assumes you have already setup and are familiar with virtnet. See Moodle and workshop instructions for information on setting up and using virtnet, deploying the website, and performing the attack.

Your task is to:

  • Create topology 5 in virtnet where:
    • node1 will be referred to as the client
    • node2 will be the router
    • node3 will be the server
  • Start capturing packets using tcpdump on the router (node2)
  • While capturing, perform the following operations in order:
  1. Start netcat TCP server using assigned port on the server (node3)
  2. Start netcat TCP client on the client (node1)
  3. On the client (node1) type:

COIT20262 Assignment 1<press ENTER>

My ID is <type in your actual student ID><press ENTER>

  1. On the server (node3) type:

Hello <type in your actual student ID>. I am the server.<press ENTER>

  1. On the client (node1) type:

Goodbye server.<press ENTER>

<Ctrl-D>

You need to perform steps 3-5 in the correct sequence, switching from client to server to client.

  • Stop the capture and save the file as pcap

Server port numbers must be assigned based on the last three (3) digits of your student ID, xyz, as defined below. Examples are given for a student ID of 12345678.

  • For netcat TCP server use port 6xyz. Example port: 6678

After performing and understanding the above steps, answer the following sub-questions

 

  • Submit your capture file as pcap on Moodle. The single file must contain all packets of the TCP exchange using your assigned port and using your ID and name. [3 marks]

 

  • Draw a message sequence diagram that illustrates all the TCP packets generated by using netcat (do not draw any packets generated by other applications or protocols, such

 

as ARP, DNS or SSH). A message sequence diagram uses vertical lines to represent events that happen at a computer over time (time is increasing as the line goes down). Addresses of the computers/software are given at the top of the vertical lines. Horizontal or sloped arrows are used to show messages (packets) being sent between computers. Each arrow should be labelled with the protocol, packet type and important information of the message. Examples of message sequence diagrams are given in workshops. Note that you do not need to show the packet times, and the diagram does not have to be to scale. [3 marks]

 

 

  • Based on your capture only, identify the following information, and give the packet that the information is found If the information is found in multiple packets, give the first packet from the capture. For example, if the information is found in packet numbers 3, 5 and 7, you would give the packet as 3. [4 marks]

 

 

 

Information Value Packet
MAC address of the client    
IP address of the server    
Flags for 1st TCP segment containing data    
Length of data for 2nd TCP segment containing

data

   
Absolute sequence number of 1st TCP segment

sent by server that contains data

   

 

Question 2. Web Application Attacks [12 marks]

 

Use virtnet, perform an SQL injection attack on the demo grading website www.myuni.edu. The general steps for performing an SQL injection attack with virtnet are described at:

https://sandilands.info/sgordon/sql-injection-csrf-cookie-stealing-in-a-virtual-network However you must follow these specific steps when performing the attack:

  1. Before performing the attack, add two new student users to the database with the following details:
    1. New student 1: username is your ID, password is your ID
    2. New student 2: username is 12037777, password is hacker
  2. For both of the new students add the following courses and grades:
    1. New student 1: coit20262, D
    2. New student 1: coit20263, C
    3. New student 2: coit20262, HD
    4. New student 2: coit20263, F
  3. Perform the SQL injection attack as new student 2, e. logged in as 12037777
  4. Take a screenshot of the attacker web browser showing the form the attacker uses to perform the Make sure the screenshot clearly shows the fields/data entered by the attacker. Save the screenshot as screenshot-attack.png.
  5. Take a screenshot of the attacker web browser showing a successful attack, e. the

grades of other students. Save the screenshot as screenshot-success.png.

Answer the following questions.

  • Give a general explanation of an SQL injection (This explanation should NOT reference the attack you performed in virtnet; it should be for any SQL injection attack). [1 marks]

 

  • Explain two general approaches that can be used to avoid or minimise SQL injection (This explanation should NOT reference the attack you performed in virtnet; it should be for any SQL injection attack). [2 marks]

 

For this specific attack on www.myuni.edu:

  • Explain the limitation/weakness in the MyUni website that allowed the SQL injection attack to be In your explanation refer to the file(s) and line(s) of code, and give samples of the code in your answer. [2 marks]

 

  • Explain what the attacker, 12037777, had to do in their web browser to perform the In your explanation include the screenshot screenshot-attack.png and refer to the information shown in that screenshot. [2 marks]

 

  • Submit your screenshot screenshot-attack.png as a separate That is, you must both embed the screenshot in the report AND submit the file separately. The reason for this is that it makes it easier for the marker in reading the report to have an embedded image, but sometimes the quality is hard to read (hence the additional file submission). [1 mark]

 

  • Explain what the attacker, 12037777, could learn or gain from performing the SQL injection In your explanation include the screenshot screenshot-success.png and refer to the information shown in that screenshot. [1 mark]

 

  • Submit your screenshot screenshot-success.png as a separate [1 mark]

 

  • Explain what the website developer could do to prevent this SQL injection In your explanation, give exact code or steps the developer should use. [2 marks]

Question 3. Cryptography Concepts [7 marks]

 A simple symmetric encryption algorithm can be written as follows:

1: Input message M and 64 bit key K

2: Divide M into 64 bit size blocks B1…Bn

3: Get first block B1 and perform bit-wise XOR with K

to produce encrypted block E1

4: Repeat

Get next block Bi and perform bit-wise XOR with

Ei-1 to produce encrypted block Ei

5: Until End of message

 

 

Based on the above algorithm, answer the following questions:

 

  • Explain the weaknesses of the above algorithm if the first input block is identical to the key. [3.5 marks]

 

  • Give a modified algorithm that corrects the problem(s) identified in part (a). [3.5 marks]

Question 4. Network Attacks Research [6 marks]

  Recent progress in artificial intelligence (AI) technologies have prompted massive growth in innovation and automation and their potentialities have expanded from smart buildings, smart transportation, smart grids, smart governances to smart anything. These technologies are already being used to defend network attacks; however, they can be used maliciously. For example, DeepLocker has shown the intentional use of AI for a harmful purpose. Threat actors are constantly changing and enhancing their attack approach with a unique emphasis on the application of AI-driven techniques inside the attack process which can be used in conjunction with traditional attack techniques to cause greater damage. Your task is to study how AI technologies can be used maliciously to perform network attacks and what measures should be taken to mitigate these attacks.

You must write a short report that answers the following questions:

  • As a network security analyst, why is it important that you have knowledge of AI- based network attacks? [1]

 

  • Select three examples of AI-based network attacks and describe [3]

 

  • What are the defensive strategies you can take to prevent any two of the these attacks? [2]

 

You should structure your report into a section for each of the above parts.

There is no minimum/maximum length of the report. Support you finding by quoting reputable sources of information. You may draw diagrams if needed. Including pictures from other sources, or including pictures that do not help with the explanation will not gain marks and may lead to reduced marks.

You may assume the audience of the report has a similar background on network security as you. You should give sufficient technical detail to demonstrate you understand the issues.

find the cost of your paper

The post Analysis of Protocols with Wireshark – Explain what the website developer could do to prevent this SQL injection In your explanation, give exact code or steps the developer should use appeared first on Best Custom Essay Writing Services | EssayBureau.com.

Acemyhomework
Calculate your paper price
Pages (550 words)
Approximate price: -
Acemyhomework

Quality Research Papers

We always make sure that our academic writers follow all your instructions precisely. You can choose your academic level and we will assign a writer who has a respective degree.

Acemyhomework

Best Academic Writers

We have a team of professional writers with experience in academic and business writing. Many are native speakers and able to perform any task for which you need help.

Acemyhomework

Unlimited Revisions

If you think we missed something, send your order for a free revision. You have 10 days to submit the order for review after you have received the final document.

Acemyhomework

On time Delivery

All papers are always delivered on time. In case we need more time to master your paper, we may contact you regarding the deadline extension. Otherwise a 100% refund is guaranteed.

Acemyhomework

Original & Confidential

We use several writing tools checks to ensure that all documents you receive are free from plagiarism. We also promise maximum confidentiality in all of our services.

Acemyhomework

24/7 Customer Support

Our support agents are available 24 hours a day 7 days a week and committed to providing you with the best customer experience. Get in touch whenever you need any assistance.

Try it now!

Calculate the price of your order

Total price:
$0.00

How it works?

Follow these simple steps to get your paper done

Homework Market

Place your order

Fill in the order form and provide all details of your assignment.

Homework Market

Proceed with the payment

Choose the payment system that suits you most.

Homework Market

Receive the final file

Once your paper is ready, we will email it to you.

Academic Writing Services

Whether you have an urgent deadline or those that have time. You can take some time and relax after trusting us with your paper. We make sure that we conduct the academic writing services diligently.

Acemyhomework Acemyhomework

Essays

Essay Writing Service

Among the wide variety of academic work, essay writing is one of the simplest a student can ever come across. Usually, it is a task which students encounter and learn how to write whilst in high school. However, the case is quite different when it comes to university and college.

Acemyhomework Acemyhomework

Term Papers

Term Paper Writing

Are you looking for an online writing firm that can offer you reliable custom term paper writing help? Is your wish and desire to get someone who can guide you throughout the process of writing term papers? If yes, then you have come to the right place.

Acemyhomework Acemyhomework

Coursework

Coursework Writing Help

Coursework is essential for every student in order to graduate from college. However, most of it is deadline-centric, and that becomes a challenge to most learners. With the amount of work, learners are receiving every day, finding time to work on every task is not easy.

Acemyhomework Acemyhomework

Homework

Online Homework Help

Online homework help services are an answer to every challenge that students go through. Despite the difference in the needs and levels of learning, all students can benefit from these services. Acemyhomework is one of the best online homework help service companies you can find on the internet.