WEEK 1  Penetration testing: Penetration testing is part of - Pcap_open_live = opens a device and returns a

 Security: CIA = Confidentiality Integrity Availability. the (larger) security auditing/analysis process. handle
 Software Insecurity: A software bug or software Pentest/fix as a cycle is NOT a good way to ensure - pcap_open_offline and pcap_dump_open = read
fault may be a security bug or vulnerability. the security of a system. from and save packets to files
When the bug is triggered or exploited, it A comprehensive security analysis process takes - pcap_compile and pcap_setfilter = set a tcpdump-
compromises the security of the software system into account many other aspects (e.g., source code like filte
 Software Security: analysis, policy analysis, social engineering) - Pcap_loop = register a callback to be invoked for
Software each received packet
User WEEK 2  Switched Environments:
Configuration Switched Ethernet does not allow direct sniffing.
OS  MAC flooding:
Firmware  LAN Attacks:
Impersonation of a host
- Switches maintain a table with MAC address/port
Hypervisor
Hardware Denial of service mappings.
 Adversarial mindset: Access to information - In some cases, flooding the switch with bogus
What happens if I…? Tampering with delivery mechanisms MAC addresses will overflow the table’s memory
Where does this data go?  Sniffing and revert the behavior from “switch” to “hub.”
Who processes this data?  Spoofing  MAC duplicating/cloning:
What assumptions is the system making?  Hijacking - Attacker reconfigures his/her host to have the
 Which step can be taken to mitigate  Hubs vs. Switches: same MAC address as the target machine.
vulnerabilities? Hub: All traffic is broadcasted to all ports. - The switch will record this in its table and send the
Identify the weak points of a software system. Switches: Modern network switches keep track of traffic to the attacker machine (or possibly both).
 History of the Internet which interface is connected to each port - ARP spoofing with forwarding can be used to
The Defense Advanced Research Project Agency - All broadcast traffic is sent to all connected hosts. bypass this protection.
(DARPA) developed ARPANET - All directed traffic is sent to the ports associated  ARP Spoofing:
Based on the Network Control Protocol (NCP) with the referenced hardware address To sniff all traffic between two hosts in a switched
1970  Network Sniffing: environment.
First 4 nodes: The attacker sets his/her network interface in - The attack leverages the stateless nature of the
University of California, Los Angeles promiscuous mode. ARP protocol. (Replies without a request will be
University of California, Santa Barbara If switched Ethernet is used, then the switch must accepted)
Stanford Research Institute be “convinced” that a copy of the traffic needs to be - The attacker host sends spoofed ARP messages to
University of Utah sent to the port of the sniffing host. the two victim hosts, poisoning their cache.
TCP/IP = ARPANET moves to TCP/IP (Jan 1st, 1983) Many protocols (FTP, POP, HTTP, IMAP) transfer - The victim host sends their IP packets to the
ARPANET = APRANET becomes a subset of the authentication information in the clear attacker host.
Internet (and MILNET detaches) By sniffing the traffic, it is possible to collect - The attacker host acts has a router
1980 usernames, passwords, files, mail, etc - Legitimate ARP replies might restore the ARP
UNIX: DARPA funds the development of Berkeley  Sniffing Tools: cache to the correct value
UNIX (TCP/IP implementation that introduces the Command-line tools: - Most ARP-spoofing tool repeatedly send spoofed
socket programming abstraction) - tcpdump: collects traffic ARP replies to keep the ARP cache in the desired
Defense Advanced Research Project Agency - tcpflow: reassembles TCP flows State
(DARPA) play an integral role in creating or - tcpreplay: re-sends recorded traffic - Device in the network houses the ARP cache table?
improving in Berkeley UNIX Graphical tools: The Victim’s Network Device (i.e., ethernet or
NFSET: The National Science Foundation (NSF) - WireShark: wireless interface)
creates a supercomputer network, NFSNET, Supports TCP reassembling  ARP Spoofing Tools:
supported by a "backbone" (56Kbps link in 1986) Provides parsers for several protocols Dsniff(dsniff, filesnarf,mailsnarf, msgsnarf,urlsnarf,
1990’s & 2000’s  TCPDUMP: and webspy) : passively monitor a network for
1991: Tim BernersLee at CERN creates the World Based on libpcap, which provides a platform- interesting data (e.g., passwords, e-mail, files, etc.)
Wide Web independent library and API to perform traffic arpspoof, dnsspoof, and macof: Facilitate the
 Which limiting factor resulted in the switch from sniffing interception of network traffic normally unavailable
NCP to TCP/IP in the 1980s? Requires root privileges to be able to set the to an attacker.
Congestion and packet loss interface to promiscuous mode (privileges not sshmitm and webmitm: implement active manin-
 Ethics: needed when reading from file) the-middle attacks against redirected SSH and
Never hack into a system that you do not own or  TCPDUMP (OPTIONS): HTTPS
-e print link-level addresses
have permission  Ettercap:
Never attempt to find vulnerabilities in a system -n do not translate IP addresses to FQDN - Tool for performing man-in-middle attacks in LANs.
that you do not own or have permission names - Provides support for ARP spoofing attacks.
1) Download Source Code: Download source code -x print each packet in hex - Provides support for the interception of SSH1 and
onto a server/system that you control (assuming it -i use a particular network interface SSL connections.
is open-source) -r read packets from a file - Support the collection of passwords for a number
2) Participate in a bug bounty program: Only try to -w write packets to a file of protocols
find vulnerabilities in a system that has a bug -s  ARP Defenses:
specify the amount of data to be sniffed
bounty program Static ARP entries:
for each packet
They will give you money or fame in exchange for - The ARP cache can be configured to ignore
-f specify a file containing the filter
reporting security vulnerabilities to them dynamic updates
3) Become an academic: We can sometimes do expression
- Difficult to manage in large installation
vulnerability analysis, however we are very careful  TCPDUMP (Filter Express): - Could be used for a subset of critical addresses
to consider the ethical considerations before A filter expression consist of one or more primitives. (e.g., DNS servers, gateways)
performing any analysis. Cache poisoning resistance:
 Disclosure: Primitives are composed of a qualifier and an ID. - Ignore unsolicited ARP replies (still vulnerable to
No Disclosure, Responsible Disclosure, Full Operators can be used to create complex filter hijacking)
Disclosure expression. - Update on timeout (limited usefulness)
 Legal Hacking: Penetration Testing: Relational = <, >, >=, <=, =, != Monitor changes (e.g., arpwatch):
Vulnerability analysis followed by exploitation Binary = +, -, *, /, &, | - Listen for ARP packets on a local Ethernet
Assumptions and hypothesis derived from the Logical = and, or, not (e.g. “not host errol and dst interface.
analysis are verified on the field host [Link]”) - Keep track for Ethernet/IP address pairs.
It is usually "black-box"  Libpcap: C library for Sniffing
- Pcap_lookupdev = looks up a device
 - Report suspicious activity and changes in mapping. discarded after a timeout.  Destination Unreachable Attacks:
Forged destination unreachable messages can cut
 Detecting Sniffers on Your Network:  Fragmentation Attacks: Ping of Death out nodes from the network (denial of service).
- Sniffers are typically passive programs. - The offset of the last segment is such that the total  ICMP Time Exceeded:
- They put the network interface in promiscuous size of the reassembled datagram is bigger than the TTL becomes zero (code = 0)
mode and listen for traffic. maximum allowed size of the receiving kernel. - The reassembling of a fragmented datagram times
- They can be detected by programs that provide - A kernel static buffer is overflowed, causing a out (code =1)
information on the status of a network interface kernel panic.
(e.g., ifconfig)  Evasion and Denial-Of-Service:
- A kernel-level rootkit can easily hide the presence - Firewalls and intrusion detection systems analyze
of a sniffer incoming datagrams using the information  Traceroute:
- Sniffing and hijacking attacks (e.g., ARP attacks) contained in both the datagram header and the - ICMP Time Exceeded messages are used by the
require physical access. datagram payload (TCP ports, UDP ports, SYN and traceroute program to determine the path used to
- It is important to control who can access your ACK flags in the TCP header). deliver a datagram.
network. - An attacker may use fragmentation to avoid - A series of IP datagrams are sent to the destination
 Suspicious ARP activity filtering. node.
- ARP cache poisoning attacks are noisy - An attacker may use fragmentation to avoid - Each datagram has an increasing TTL field (starting
- Tools like arpwatch and XArp detect a variety of detection. at 1).
ARP attacks - An attacker may use fragmentation to build a DOS - From the ICMP Time exceeded messages returned
 Suspicious DNS lookups attack. by the intermediate gateways, it is possible to
- Sniffer attempts to resolve names associated with  ICMP: reconstruct the route from the source to the
IP addresses (may be part of normal operation) - ICMP is used to exchange control/error messages destination.
- Trap: generate connection from fake IP address about the delivery of IP datagrams. - Note: traceroute allows one to specify loose
not in local network and detect attempt to resolve - ICMP messages are encapsulated inside IP source routing (-g option).
name datagrams. - Useful for network analysis, topology mapping.
 Latency - ICMP messages can be:  IP Spoofing:
- Assumption: Since the NIC is in promiscuous mode, - Requests In an IP spoofing attack, a host impersonates
every packet is processed. - Responses another host by sending a datagram with the
- Use ping to analyze response time of host A. - Error messages address of the impersonated host as the source
- Generate huge amount of traffic to other hosts An ICMP error message includes the header and a address.
and analyze response time of host A. portion of the payload (usually the first 8 bytes) of - IP spoofing is used to impersonate sources of
 Kernel behavior - Linux the offending IP datagram. security-critical information (e.g., a DNS server or an
- When in promiscuous mode, some kernels will  ICMP Message Format: NFS server).
accept a packet that has the wrong Ethernet - IP spoofing is used to exploit address-based
address but the right destination IP address. authentication in higher-level protocols.
- If sending an ICMP request to a host using the  IP Spoofing (Tools):
wrong Ethernet address but the correct IP address  ICMP Messages: - Protocol-specific spoofers (e.g., DNS spoofers, NFS
causes an ICMP reply, the host is sniffing the Address mask request/reply: used by diskless spoofers, etc.)
network. systems to obtain the network mask at boot time. - Generic IP spoofing tools (e.g., hping)
 AntiSniff tool (written in 2000!) Timestamp request/reply: used to synchronize  Libnet:
clocks. - Provides a platform-independent library of
- Covers some of the techniques above. functions to build (and inject) arbitrary packets.
Source quench: used to inform about traffic
- Uses TCP SYN and TCP handshake forged traffic to - Allows to write Ethernet spoofed frames.
overloads.
overload sniffer when testing latency.  Libnet (Steps in building a packet):
Parameter problem: used to inform about errors in
the IP datagram fields. 1. Memory Initialization (allocates memory for
WEEK 3 Echo request/reply: used to test connectivity (ping). packets)
Time exceeded: used to report expired datagrams 2. Network Initialization (initializes the network
 IP Fragmentation:
(TTL = 0). interface)
- When the datagram size is bigger than the data
Redirect: used to inform hosts about better routes 3. Packet Construction (fill in the different protocol
link layer MTU (Maximum Transmission Unit)
(gateways). headers/payloads)
- Fragmentation can be performed at the source
Destination unreachable: used to inform a host of 4. Packet Checksums (compute the necessary
host or at an intermediate step in datagram delivery
the impossibility to deliver traffic to a specific checksums - some of them could be automatically
 IP Datagram:
destination. computed by the kernel)
 ICMP Echo Request/Reply (Used by Ping Program) 5. Packet Injection (send the packet on the wire)
 Scapy (Python library for manipulation of packet):
Provides support for sniffing and spoofing
eg “send(IP(src="[Link]",
dst="[Link]")/ICMP())”
 Hijacking:
 ICMP Echo Attacks: - The attacker sniffs the network, waiting for a client
ICMP Echo Request messages can be used to map request.
 If the datagram can be fragmented: the hosts of a network (pingscan or ipsweep). - Races against legitimate host when producing a
- The header is copied in each fragment. ICMP echo request reply is also known as ping reply.
- In particular, the “datagram id” is copied in each - ICMP echo datagrams are sent to all the hosts in a - We will see ARP-, UDP-, and TCP-based variations
fragment. subnetwork. of this attack.
- The “more fragments” flag is set with the - The attacker collects the replies and determines  Blind IP Spoofing:
exception of the last fragment. which hosts are actually alive. - A host ([Link]) sends an IP datagram with
- The “fragmentation offset” field contains the  Smurf: the address of some other host as the source
position of the fragment with respect to the original ICMP Echo Request can be used to perform a denial address ([Link])
datagram expressed in 8 byte units. of service attack (smurf). Too many echo request to - The attacked host replies to the impersonated host
- The “total length field” is changed to match the the server
size of the fragment. Leverage - Important security concept is found in - Usually the attacker does not have access to the
- Each fragment is then delivered as a separate the smurf attack and many other security attacks reply traffic
datagram Man-in-the-middle Attacks:
 ICMP Destination Unreachable:

- An attacker that has control of a gateway used in
- If one fragment is lost, the entire datagram is
ICMP message used by gateways to state that the
the delivery process can (Sniff the traffic,
datagram cannot be delivered.
 Intercept/block traffic, Modify traffic). the port is open or (usually) with a RST packet if the - The receiver considers this as out-of-sync and
- Perform a full man-in-the-middle attack. port is closed sends an acknowledgement with the “expected”
 UDP Spoofing = IP Spoofing - The attacker sends a RST packet instead of the final sequence number.
ACK - ACK messages with no data are not retransmitted
 UDP Hijacking: - The connection is never open and the event is not in case of loss.
Variation of the UDP spoofing attack. logged by the operating system/application - The “ACK storm” continues until one message is
 TCP FIN Scanning: lost.
- The attacker sends a FIN-marked packet. - Any subsequent attempt to communicate will
- In most TCP/IP implementations: generate an ACK storm.
- If the port is closed, a RST packet is sent back. - ACK storms can be blocked by the attacker using
- If the port is open, the FIN packet is ignored ACK packets with the right numbers.
(timeout).  OS Fingerprinting (p0f tool):
- In Windows a RST is sent back in any case, so that allows one to determine the operating system of a
all ports appear to be closed. host by examining the reaction to carefully crafted
- Variation of this type of scanning technique: packets
 UDP Portscan: - Xmas: FIN, PSH, URG set - Wrong answers to FIN TCP packets
- Used to determine which UDP services are - Null: no flags set - Undefined" flags in the TCP header of a request
available.  Idle Scanning: are copied verbatim in the reply
- A zero-length UDP packet is sent to each port. - Uses a victim host to "relay" the scan. - Weird combinations of flags in the TCP header
- If an ICMP error message "port unreachable" is - The attacker sends spoofed TCP SYN packets to the - Selection of TCP initial sequence numbers
received, the service is assumed to be unavailable. target. - Selection of initial TCP window size
- Many TCP/IP stack implementations implement a - The packets appear to come from the victim - Analysis of the use of ICMP messages
limit on the error message rate, therefore this type - The target replies to the victim. - Error rate
of scan can be slow (e.g., Linux limit is 80 messages - If the target replies with a SYN+ACK packet (open - Amount of offending datagram included
every 4 seconds). port), then the victim will send out a RST. - TCP options
- nmap - If the target replies with a RST (closed port), then  DOS Attack :
 Which UDP service is used in a UDP spoofing the victim will not send out any packet.  SYN-flooding Attack:
attack? Answer: (DNS) - The attacker checks the IP datagram ID of the - Very common denial-of-service attack, aka
 TCP: Three-Way Handshake: victim before and after each port probe. Neptune.
1) SYN:1 Ack:0 - If it has increased: port on target was open - Attacker starts handshake with SYN-marked
2) SYN:1 Ack:1 - If it has not increased: port on target was closed segment.
3) SYN:0 Ack:1  Idle Scanning Steps: - Victim replies with SYN-ACK segment.
Step 1: Determine the relay’s initial IP sequence no. - Attacker… stays silent
Step 2: Send a spoofed connection request - A host can keep a limited number of TCP
Step 2b: Send a spoofed connection request to a connections in half-open state.
closed port.  SYN-flooding Attack (Current Solutions):
Step 3: Determine the relay’s final IP sequence no. -Filtering
Step 3b: Determine the relay’s final IP sequence no. - Increase the length of the half-open connection
 Which value or field is used in an IP or TCP header queue
to determine whether a RST was sent out? - Reduce the SYN-received timeout
Answer(Identifier header in IP packet) - Drop half-open connections when the limit has
 TCP: Data Exchange:
 TCP Spoofing: been reached and new requests for connection
- Attack aimed at impersonating another host when arrive
establishing a TCP connection. - Limit the number of half-open connections from a
- First discussed by R.T. Morris in "A Weakness in specific source
the 4.2BSD Unix TCP/IP Software" in 1985. - Use SYN cookies
- Used by Mitnick in his attack against SDSC.  SYN Cookies:
 TCP Spoofing Steps: Special algorithm used for determining the initial
- Node A trusts node B (e.g., login with no password sequence number of the server.
if the TCP connection comes from a specific IP).  SYN Cookies (Calculation):
 TCP: Shutdown - Node C wants to impersonate B with respect to A - Top 5 bits: t mod 32, where t is a 32-bit time
in opening a TCP connection. counter that increases every 64 seconds
- C kills B (flooding, crashing, redirecting) so that B - Following 3 bits: the encoding of the Maximum
does not send annoying RST segments. Segment Size (MSS) chosen by the server in
- C sends A a TCP SYN segment in a spoofed IP response to the client's MSS
packet with B’s address as the source IP and Sc as - A keyed hash of:
the sequence number. • Counter t
- A replies with a TCP SYN/ACK segment to B with Ss • Source/Destination IP addresses and ports
as the sequence number. B ignores the segment:  SYN Cookies (Drawbacks):
dead or too busy. - The server sequence no grows faster than normal.
- C does not receive this segment but to finish the - The MSS value is limited by the encoding
 TCP Portscan: handshake it has to send an ACK segment with Ss + procedure (only 8 possible values).
- Used to determine the TCP services available on a 1 as the acknowledgment number. - No data can be included in the initial SYN.
victim host. - C eavesdrops the SYN/ACK segment  State Attacks:
- Most services are statically associated with port - C guesses the correct sequence number - Memory for the socket descriptor
numbers (see/etc/ services in UNIX systems).  TCP Hijacking: - Process or thread to manage the connection
- In its simplest form (connect() scanning), the The attacker uses spoofed TCP segments to - Memory associated with the data in the TCP stream that
attacker tries to open a TCP connection to all 65535 - Insert data in the streams has not yet been acknowledged
ports of the victim host. - Reset an existing connection (denial of service)
- If the handshake is successful, then the service is The correct sequence/acknowledgment numbers WEEK 4
available. must be used.
The attacker injects the data in the stream  Application Security:
Advantage: no need to be root
- The receiver of the injected data sends an The behavior of an application is determined by:
Disadvantage: very noisy
acknowledgment to the apparent sender. - The code being executed
 TCP SYN Scanning (half-open scanning):
- The apparent sender replies with an - The data being processed
- The attacker sends a SYN packet
acknowledgement with the “expected” sequence #. - The environment in which the application is run
- If the server answers with a SYN/ACK packet then
 Application Vulnerability Analysis: GNU/Linux = assembler = as entries that are used at loading time to “fix” the
Identifying vulnerabilities in applications, as A binary object contains the binary code and addresses (this procedure is called rebasing).
deployed in a specific operational environment additional metadata  Program Loading and Execution:
- Design - Relocation information about things that need to When a program is invoked, the operating system
- Implementation be fixed once the code and data are loaded into creates a process to execute the program:
- Deployment memory - The ELF file is parsed and parts are copied into
 Design Vulnerabilities: - Info about symbols defined by object file and memory.
Flaws in the overall logic of the application: different imported objects - In Linux /proc/<pid>/maps shows the memory
-Lack of authentication and/or authorization checks - Debugging information layout of a process.
- Erroneous trust assumptions  Linker: - Relocation of objects and reference resolution is
- Require clear understanding of the application Combines the binary object with libraries, resolving performed.
 Confused Deputy problem: references that the code has to external objects - The instruction pointer is set to the location
Trusted entity called when it is tricked into acting on (e.g., functions) and creates the final executable specified as the start address.
behalf of an attacker GNU/Linux = linker = ld - Execution begins.
 Implementation Vulnerabilities:  Static linking: performed at compile-time  Process Structure:
Application is not able to correctly handle  Dynamic linking: performed at run-time Environment/Argument section:
unexpected events:  ELF file Format: - Used for environment data
- Unexpected input - Most widely-used binary object formats - Used for the command line data
- Unexpected errors/exceptions - Architecture-Independent Stack section:
- Unexpected interleaving of events  ELF files are of four-types: - Used for local parameters
- Unfiltered output - Relocatable: need to be fixed by the linker before - Used for saving the processor status
 Deployment Vulnerabilities: being executed Memory-mapping segment:
Incorrect/faulty deployment/configuration of the - Used for shared libraries
application - Executable: ready for execution (all symbols have Heap section:
- An application is installed with more privileges been resolved with the exception of those related to - Used for dynamically allocated data
than the ones it should have shared libs) Data section (static/global vars):
- An application is installed on a system that has a - Shared: shared libraries with the appropriate - Initialized variables (.data)
faulty security policy and/or mechanism (e.g., a file linking information - Uninitialized variables (.bss)
that should be read-only is actually writeable) Code/Text section (.text):
- Core: core dumps created when a program
- An application is configured with easy-to-guess - Marked read-only
terminated with a fault
default credentials - Modifications causes segfaults
Tools: readelf, file
If correctly deployed, the application would be  UNIX Processes:
 ELF file Format (Header):
(more) secure Real UID/GID: started/owns the process
 Local Attack: Effective UID/GID: process is "allowed to do things"
- Allow one to manipulate the behavior of an Saved ID: used to drop and re-gain privileges
application through local interaction. If a program file has the SUID bit set, when a
- Allow one to execute operations with privileges process executes the program, the process’
that are different (usually superior) from the ones effective UID/GID are changed to the ones of the
that the attacker would otherwise have. program file owner
- In general, these attacks are easier to perform,  SUID Behavior:
because the attacker has a better knowledge of the - int setuid(uid_t uid) sets the ruid, euid, and suid to
environment uid.
 Remote Attack: - It is allowed only if euid is 0 or euid is not 0, but
Each section contains a header that specifies the
- Allow one to manipulate the behavior of an uid = euid
type of section and the permissions.
application through network-based interaction - int seteuid(uid_t uid) sets the euid to uid.
PROGBITS: Parts of the program, such as code and
- Allow one to execute operations with the - If euid is not 0, uid must be either the ruid or the
data
privileges of the vulnerable application suid
NOBITS: Parts of the program that do not need
- In general, these attacks are more difficult to - int setresuid(uid_t ruid, uid_t euid, uid_t suid)
space in the file, such as uninitialized data
perform but they do not require prior access to the - Allows one to set the three IDs
SYMTAB and DYNSYM: Symbol tables for static and
system - Unprivileged processes can only switch among
dynamic linking
 Life of an Application: existing values
STRTAB: The string table used to match identifiers
- By using the saved UID, a SUID process can
with symbols
securely switch between the ID of the user
REL and RELA: Sections that contain relocation
invoking the program and the ID of the user
information
owning the executable
 ELF File Format (Flag bits)
 Disassembling (Reverse Engineering):
- ALLOC: the section is allocated in memory
Extracting the assembly representation of a
- WRITE: the section is writable
program by analyzing its binary representation
- EXECINSTR: the section is executable
 Linear Disassemblers: linearly parse the instructions
 ELF Sections:
 Recursive: follow the flow of the program
 Objdump:
- A standard GNU development tool
C -> cpp (processed code) -> gcc -S (assembly) -> as - Linear disassembler
(binary object) -> ld (ELF/PE) - Can be used as an easy-to-use and basic
 Interpretation: disassembler on command line:
The program might be translated into an objdump -D <bin>
intermediate representation. E.g Byte code  Debugging: No source code is required
In most interpreted languages, it is possible to  PE File Format:  Disassembling bs debugging: Disassembling is
generate and execute code dynamically - The PE file was introduced to allow MS-DOS looking at the static code to understand, and
 Compilation: programs to be larger than 64K (limit of .COM debugging is analyzing the runtime behavior to
The compiler turns the code into architecture- format). understand
specific assembly. (Assembly file) - Also known as the “EXE” format.  By default gdb shows current instruction pointer
GNU/Linux = complier = gcc - Programs are written as if they were always loaded value
- gcc -S prog.c will generate the assembly at address 0.  Correct order for the reverse engineering process
- gcc’s -m32 option to generate 32-bit assembly - The program is actually loaded in different points binary, assembly, implementation, design
 Assembler: in memory.
Assembler turns the assembly into a binary object - The header contains a number of relocation
Practice-Mid Term:
Question 1

What are two key aspects of ethical hacking that you must adhere to in order to avoid breaking laws and increasing
your chances of going to jail?

1 / 1 point

(1) You may hack a server if you are within a related cybersecurity law.

(2) Never even attempt to find vulnerabilities in a system that you do not own or have permission.

(1) Never hack into a system that you do not own or have permission.

(2) Never even attempt to find vulnerabilities in a system that you do not own or have permission.

(1) You may hack a server if there is an existing threat or a known black hat hacker presence.

(2) You may attempt to find vulnerabilities in a system that you do not own or have permission if you follow bug
bounty rules.

(1) Permission can be obtained retroactively, so as long as you have it at some point you may hack into a system.

(2) You may attempt to find vulnerabilities in a system that you do not own or have permission if you follow bug
bounty rules.

Correct
Correct! It is never OK to hack into a system that you do not own or have permissions. It is even better to never
even attempt to find vulnerabilities in a system that you do not own or have permission. Continue to stay ethical and
stay out of jail!

Question 1
When is it implied that you may hack into a server?

1 / 1 point

It is implied that you may hack into a server if there is a bug bounty program.

It is never implied that you may hack into any server.

It is implied that you may hack into any server that has a vulnerability.

It is implied that you may hack into a server if there is not an existing cybersecurity law.

Question 2

How can you ethically find vulnerabilities?

1 point

You cannot ethically find vulnerabilities.

You can ethically find vulnerabilities by identifying vulnerabilities in a production system and then downloading the
source code to your system, participating in bug bounty programs, or by becoming an academic.

You can ethically find vulnerabilities by hacking into systems that you do not control.

You can ethically find vulnerabilities by downloading the source code to your system, participating in bug
bounty programs, or by becoming an academic.

Correct
Correct! A key aspect is to not hack into systems that you do not control, and all of these options are ways to
ethically identify vulnerabilities.

Question 3

Within the concept of ethics related to hacking, “The real key to ethically proceeding is to think about and make sure
you understand that they (e.g., company, organization) give you permission, and to make sure you understand what
is in the scope.” In the context of the sentence, what does scope mean?

1 / 1 point

Within the context of the sentence related to ethical hacking, scope best means understanding what they (e.g.,
company, organization) are willing to allow for the amount of time for your test.

Within the context of the sentence related to ethical hacking, scope best means understanding what they (e.g.,
company, organization) are going to pay you.
Within the context of the sentence related to ethical hacking, scope best means understanding what they (e.g.,
company, organization) are letting you hack and their cybersecurity policies.

Within the context of the sentence related to ethical hacking, scope best means understanding what they
(e.g., company, organization) are letting you hack and test against.

Correct
Correct! Scope is defined as what the organization is specifically allowing you to test. If something is “out-of-scope”,
then it is unethical to attempt to identify vulnerabilities in it.

Question 4

What are considered the three aspects of security of a system?

1 / 1 point

Correspondence, Intent, and Alpine

Correctness, Integrity, and Architecture

Conglomeration, Integrity, and Availability

Confidentiality, Integrity, and Availability

Correct
Correct! Confidentiality, Integrity, and Availability are the three key components to consider when thinking about the
security of a system.

Question 5

Assume that the operating system of a system is free from all bugs and vulnerabilities. Is the whole system secure?
Why or why not?

1 / 1 point

The whole system is secure because the software runs on the operating system.

The whole system is secure, because the hardware and software are secure.
 The whole system is not secure because there can be bugs in other aspects of the system, such as the
software or the hardware.

The whole system is not secure because a secure operating system causes other aspects of the system to be
insecure.

Correct
Correct! Even if one aspect of a system is assumed to be secure, there can be bugs or vulnerabilities in other
aspects of the system that can render the entire system insecure.

Question 6

What is a trusted entity called when it is tricked into acting on behalf of an attacker?

1 / 1 point

A network-based denial of service

A Confused Deputy

A TCP hijacking attack

An implementation vulnerability

Correct
Correct! A Confused Deputy is when an attacker can trick a trusted entity into acting on the attacker’s behalf.
Therefore, the "deputy" is confused about whether the attacker or the trusted entity is causing the action.

Question 7
What is a similarity between design and deployment vulnerabilities?

1 / 1 point

They are both classes of vulnerabilities that only occur in the operating system.

They are both classes of vulnerabilities that are introduced by incorrect deployment or configuration of the
application.

They are both classes of vulnerabilities that occur in the design of the application.
They are both classes of vulnerabilities that can compromise the security of an application.

Correct
Correct! While they occur at different stages of the software development lifecycle, both classes of vulnerabilities
can compromise the security of an application.

Question 8
What is one reason why a host may use IP fragmentation?

1 / 1 point

The host may be sending an ARP packet.

The host may be transmitting an IP packet that is too large for the physical medium.

The host may be transmitting a Smurf attack packet.

The host may be increasing the redundancy of the packet.

Correct
Correct! IP fragmentation may be used by an end host when it needs to transmit an IP packet that is larger than the
physical medium can support. For instance, the maximum size of an Ethernet frame is 1,522 bytes, while the
maximum size of an IP payload is 65,535 bytes. Therefore, the IP packet will be fragmented to support its
transmission across Ethernet.

Question 9
What is a technique for identifying open TCP ports?

1 / 1 point

MAC flooding

TCP sequence numbers

TCP SYN scanning

Ping of death

Correct
Correct! TCP SYN scanning is a technique for identifying open TCP ports via sending half-open TCP connections
(sending the SYN packet but never sending the final ACK back).

Question 10
A vulnerability in the code of the application is an example of what class of vulnerability?

1 / 1 point

Implementation vulnerability

An insecure default vulnerability

An over-privileged application vulnerability

A Confused Deputy vulnerability

Correct
Correct! Implementation vulnerabilities exist when there is a bug in the code of the application that allows an
attacker to compromise the security of the application.

Question 11
What can be done to achieve the security of an entire system?

1 / 1 point

Assume that everything is secure.

Attempt to secure all aspects of the system, which can be difficult to achieve in a real-world system.

Focus on securing the all aspects of the system except hardware and software, which are already secure.

Verify the security of the operating system, which ensures the security of the whole system.

Correct
Correct! To completely secure a system, one must ensure that all aspects of the system are secure. This is
incredibly difficult to achieve in practice because a vulnerability in any layer can become a vulnerability for the entire
system.

Question 11
Of the options provided, which is the most effective way to achieve security of an entire system?

1 / 1 point

Although complete security is ambitious in a real-world system, verify the security of the operating system and then
the whole system will be secure.

Although complete security is ambitious in a real-world system, if all hardware and software have been secured,
then the system as a whole is secure.

Although complete security is ambitious in a real-world system, attempt to secure all aspects of the system
from all vulnerabilities.

Although complete security is ambitious in a real-world system, assume that everything is secure based on your role
and responsibilities or within your organization.

Correct
Correct! To completely secure a system, one must ensure that all aspects of the system are secure. This is
incredibly difficult to achieve in practice, as a vulnerability in any layer can become a vulnerability for the entire
system.

Question 12
What comprises the Internet?

1 / 1 point

The World Wide Web

Connected autonomous vehicles

Autonomous and connected networks

Supercomputers

Correct
Correct! The Internet is made of autonomous networks that operate independently, and these networks are
connected.

Question 13
What are aspects of a successful security analysis process?

1 / 1 point

Source code analysis, policy analysis, and penetration testing

Encrypting all data, disallowing mobile devices, and risk assessment

Employee investigations, fingerprinting, and continuous integration

Source code version control, denial of service, and buffer overflows

Correct
Correct! A successful security analysis process can include source code analysis to identify bugs in the source
code, policy analysis to identify issues with security policies, a

Question 14
What are some capabilities of a local area network attacker?

1 / 1 point

HTTP encryption and hijacking computers

Hubs and ethernet

Spoofing and hijacking traffic

Sniffing traffic and TCPDump filters

Correct
Correct! A local area network attacker can spoof connections and hijack traffic on the local area network, using
techniques such as ARP hijacking.
Question 15
Consider a local area network with three hosts: Host A, with IP address IP_A and ethernet address HW_A, Host B,
with IP address IP_B and ethernet address HW_B, and Host C with IP_C and ethernet address HW_C.

Host C has sent the following ARP request:

16.
Question 16
What is the primary reason that makes ARP spoofing possible?

1 / 1 point

The ability to broadcast in the local area network

Using IPv4 addresses instead of IPv6 addresses

The lack of authenticity in the ARP protocol

An ARP packet does not contain the sender's hardware address

Correct
Correct! The ARP protocol has no way to verify the authenticity of the sender. Anyone can send an ARP request or
reply.

17.
Question 17
The Smurf attack is an example of what kind of attack?

1 / 1 point

Cross-Site Scripting (XSS)

Man-in-the-middle (MitM)

Denial-of-Service (DoS)

SQL Injection

Correct
Correct! By sending ICMP echo requests to a large number of computers with a spoofed source address of the
victim, an attacker can distribute the work and overwhelm the victim's machine, resulting in a denial of service.

18.
Question 18
IP, UDP, and TCP are types of packets. Which types of packets can be spoofed?

1 / 1 point

UDP and TCP are packets that can be spoofed, but IP packets cannot be spoofed.

IP and UDP are packets that can be spoofed, but TCP are packets that cannot be spoofed.

IP, UDP, and TCP are packets that can be spoofed.

IP is a packet that can be spoofed, but UDP and TCP are packets that cannot be spoofed.

Correct
Correct! All three types of packets can be spoofed, though TCP spoofing is generally harder than IP or UDP, as the
attacker must know the sequence number.

19.
Question 19
What is the value (in hex) in the ebx register at the end of the following x86_64 code?

19.
Question 19
What is the value (in hex) in the ebx register at the end of the following x86_64 code?
20.
Question 20
What is the value (in hex) in the ecx register at the end of the following x86_64 code?
21.
Question 21
What is the difference between a linear and recursive disassembler?

1 / 1 point

Linear disassemblers are resource consuming, while recursive disassemblers are not.

Linear disassemblers support scripting, while recursive disassemblers do not.

Linear disassemblers can be used in a debugger, while recursive disassemblers cannot.

Linear disassemblers parse one instruction after another, while recursive disassemblers attempt to follow
the flow of the program.

Correct
Correct! Linear disassemblers only parse one instruction after another, which generally makes them less resource
consuming. Recursive disassemblers, on the other hand, attempt to follow the flow of the program, which can
increase the accuracy.

22.
Question 22
Under what condition can UNIX program run with the effective ID of the file owner?

1 / 1 point

If the SGID bit is set

If the SUID bit is set

If the sticky bit is set

If the owner read bit is set

Correct
Correct! If the SUID bit is set on a UNIX program, this means that it will run with the effective ID of the file owner, not
the ID of the user running the program.
23.
Question 23
Consider the following packet in a TCP stream:
24.
Question 24
Consider the first packet of a TCP connection with the following headers
25.
Question 25
Consider three hosts: Host D, with IP address IP_D, Host E, with IP address IP_E, and Host F with IP_F.

Host D has sent the following UDP request:

Week 5

Application Vulnerability Analysis

What causes most local vulnerabilities in UNIX applications?

1 / 1 point

Privilege escalation via a kernel vulnerability

Plain text passwords being used in the /etc/passwd file

The application relying on setuid with root

The files being owned by root

File Access and Command Injection Vulnerabilities

When adding commands to a string that is passed into the system, which character (or sequence of characters) can be used to add
an additional command specifically when the prior command has failed?

1 / 1 point

\|\|

`` or $()

\&\&

Consider this program:

-rwsr-xr-x 1 root root 26696 Oct 15 2018 filedo

The program reads and writes to the file ~/users_file, which has these permissions:
-rw-r--r-- 1 root root 2304 Aug 15 2019 users_file

Which type of vulnerability is demonstrated by the program?

1 / 1 point

PATH Vulnerability

Link Vulnerability

HOME Vulnerability

TOCTTOU Vulnerability

Consider this program:

char cmd[1024];
printf("STARTING!!!\n");
const char* home = getenv("HOME");

printf("home=%s\n",home);

snprintf(cmd, 1024, "/bin/cat %s/localfile",home);

cmd[1023] = '\x00';

return system(cmd);

Which type of vulnerability is demonstrated by the program?

1 / 1 point

Command Injection Vulnerability

PATH Vulnerability

Link Vulnerability

TOCTTOU Vulnerability
Buffer Overflow Vulnerabilities

Where are local values stored?

1 / 1 point

On the BSS

On the TEXT

On the stack

On the heap

Correct
Correct! Unlike globals and variables allocated with malloc, local variables are stored on the stack at an offset from
rbp.

System V Calling Convention

Review Figure 0, which provides assembly code for two functions main() and foo(). Which answer contains all the
addresses of the prologue for both main() and foo()?

1 / 1 point

0x5...616, 0x5...617, 0x5...61a, 0x5...5fa, 0x5...5fb

0x5...62f, foo does not have a prologue

0x5...616, 0x5...5fa

0x5...639, 0x5...63a, 0x5...614, 0x5...615

Correct
Correct! The start to both main() and foo() begin with two instructions that makeup the prologue.
Smashing the Stack

Suppose that Eve wants to overflow a buffer that is using the vulnerable function strcpy() to copy a string into a
statically sized buffer. When creating her payload, what value must Even avoid because it will cause the strcpy() to
stop copying the buffer?

1 / 1 point

\xFF

\x00

\n

EOF

Correct
Correct. The strcpy() function will copy the buffer until it reaches a null byte (i.e., \x00).

Which problem is at the core of stack or buffer overflow vulnerabilities in C and C++ applications?

1 / 1 point

Data can be copied without checking boundaries.

If an attacker can control the code the program executes, it can borrow the program’s privileges.

Statically declared buffers have size limitations.

It is possible to overwrite the return address with a user-defined value.

Correct
Correct! This makes it possible for data to overflow a pre-allocated buffer and overwrite the return address or other
parts of the frame.
Review Figure 0, which provides an assembly. Which string will overflow the buffer and overwrite the saved ebp with
0x4242424242424242 and the saved instruction pointer (i.e., saved return address) with 0x4343434343434343?

1 / 1 point

"A" * 0x90 + "C"*8 + "B"*8

"A" * 0x90 + "B"*8 + "C"*8

"A" * 0x88 + "B"*8 + "C"*8

"A" * 0x50 + "B"*8 + "C"*8

Correct
Correct! As we can see on instruction foo+4, the stack is extended by 0x90. However, the local variable is at rbp-
0x50. Because the saved ebp and saved instruction pointer are just before the ebp value on the stack, the string
uses the 0x50 to fill up the buffer, 8 B's to overwrite the saved ebp, and 8 C's to overwrite the saved instruction
pointer with 0x4343434343434343

Memory Corruption Exploitation

Question 1
Suppose that Eve is trying to determine whether her input is overwriting the saved instruction pointer. Which method
is best for Eve to make that determination?

1 / 1 point
Run the binary with input that causes it to stop with a segmentation fault

Run the binary with ltrace with enough input to overflow the buffer

Use objdump to analyze the binary

Run the binary in gdb and check the IP at the point the binary stops executing

Correct
Correct! If Eve’s input overflows the buffer, gdb will stop at the segmentation fault. At that point, Eve can type info
register rip to see the value of instruction pointer and determine whether her input exists in that register.

Suppose you are trying to overwrite the saved instruction pointer with the starting address of your shellcode. Which
factor might cause that location to change between executions?

1 / 1 point

Changing the amount of data entered via standard input that is stored directly to a variable located on the heap

Changing the length of arguments to the binary or environmental variables

Setting the /proc/sys/kernel/randomize_va_space to 0

Having the NX bit of the binary set

Correct
Correct! The arguments and environment variables are placed high up on the stack. As a result, when the length of
the arguments changes, the lower addresses on the stack (which includes the starting location of the shellcode) end
up moving.

Generalized Memory Corruption

Which condition may allow an attacker to directly alter the binary’s control flow?

1 / 1 point
The existence of a buffer overflow

Using a buffer overflow to overwrite the arguments to the current function

A buffer overflow of a variable that is directly below the base pointer

The use of strcpy() or sprintf() in a binary

Correct
Correct! Even when an attacker is only able to control a single byte of the base pointer, it is sometimes possible to
manipulate the stack in a way that results in a change to the control flow of the binary.

The strcpy() in a “carefully” developed program can receive input that exceeds 512 bytes, even though the input is
initially filtered by strncpy(). Why is an attacker able to exceed the buffer in checkpwd()?

1 / 1 point

The strncpy() ignores the max bytes argument if it does not find a \x00 within the limit.

The strncpy() uses argv[2] for the password, which is controlled by an attacker.

The array sizes of the password in main is twice the size of the array in checkpwd().

The strncpy() does not add a \x00 to the end of the copied string.

Correct
Correct! This means that if the attacker enters a password of 512 bytes, the strcpy() will keep copying past 512
bytes and take in the username local variable as well until it reaches a \x00. This will result in the attacker gaining
control of the saved instruction or base pointers.

Format String Vulnerabilities

Consider this statement:

python -c 'print "%127x%16$hhn%128x%17$hhn%18$hhn%19$hhn%222x%20$hhn" + "%p" * 3 + "\x85\x0b\x60\x00\x00\x00\x00\

x00\x84\x0b\x60\x00\x00\x00\x00\x00\x83\x0b\x60\x00\x00\x00\x00\x00\x82\x0b\x60\x00\x00\x00\x00\x00\x81\x0b\x60\x00\
x00\x00\x00\x00\x80\x0b\x60\x00\x00\x00\x00\x00GGGGGGGGHHHHHHHH"'
Using the program analyzed in the lecture and the string generated by the provided statement, what value are we
writing using the 20th argument?

1 / 1 point

221

255

127

222

Correct
Correct! (127 + 128 + 222) % 256 => 221

Which function demonstrates a format string vulnerability?

1 / 1 point

sprintf(str, argv[1]);

strcpy(str, argv[1]);

snprintf(str, argv[1], "%p %p %p");

printf("%s", argv[1]);

Correct
Correct! The argv[1] is controlled by the attacker and it is in the format string position.

Defending Against Memory Corruption

How does the method used in the lecture bypass the restriction of non-executable stack?

1 / 1 point
It uses the GOT to bypass the restriction.

It copies the attacker's code over the valid code stored in the text section of the binary.

It still uses the stack to execute code, but the method changes the permissions to permit execution of code from the
stack.

It links together code that already exists in the binary and in libc instead of running custom attacker created
code from the stack.

Correct
Correct! This never executes code that is sitting on the stack, but it still hijacks command flow using the stack
because the stack is used to glue the disparate areas of the program together.

Which method is used for preventing memory corruption exploitation?

1 / 1 point

System call analysis (sequence checking)

Dynamic analysis boundary checks

The NX bit

Shadow stacks

Correct
Correct! The NX bit marks areas of memory, like the stack, as non-executable. This prevents an attacker from
loading shellcode into the stack and then executing it by overwriting the saved instruction pointer.

ASLR and ROP

Suppose that Eve wants to use Return Oriented Programming (ROP) to load three parameters for a function call
(A,B,C). Note that *(pop XXX; ret) means the address of that ROP gadget. As usual, higher addresses are at the top
of the stack, lower addresses are at the bottom, and new items are added to the bottom as the stack gets larger.
Which arrangement of these stacks will accomplish this?

1 / 1 point

*(pop rdx; ret)

*(pop rsi; ret)

*(pop rdi; jmp )

*(syscall)

*(pop rdi; ret)

*(pop rsi; ret)

*(pop rdx; ret)

*(pop rdx; pop rsi; pop r15; pop rdi; ret)

Correct
Correct! In this version of the stack, the bottom-most gadget pops the rdx value from the stack location just above it.
This process continues for the other parameters.

What are two ways to disable ASLR in Linux?

1 / 1 point

Place a 0 in /proc/sys/ASLR, or execute a program with setarch uname -m -R

Set the flag -R for the binary, or place a 0 in /proc/sys/kernel/randomize_va_space

Place a 0 in /proc/sys/kernel/randomize_va_space, or set the environment variable ASLR=True

Place a 0 in /proc/sys/kernel/randomize_va_space, or execute a program with setarch uname -m -R

Correct
Correct! Setting the randomize_va_space file to 0 is a more permanent way of disabling ASLR. The setarch method
can be done on a command-by-command basis.

Stack Canaries and Control-Flow Integrity

Which description best represents control-flow integrity (CFI)?

1 / 1 point

The binary prevents buffer overflows by always checking ensure that the bounds are not exceeded by the user's
input.

The binary does not allow the execution of paths that do not exist in the programs control flow graph.

The binary throws an error when the user causes a change in the control flow.

The binary control flow is learned by an external program that detects the use of a new control flow, which notifies
system administrators of the unexpected flow.

Correct
Correct! At run-time, the binary checks to ensure that the indirect jumps follow paths that exist in the Control Flow
Guard.

Which description provides the best definition of a modern stack canary?

1 / 1 point

A random value that is assigned at the at the top of the heap at the start of a function and checked prior to returning
from that function

A termination character (e.g., NULL 0x00, CR 0x0d, LF 0x0a, or EOF 0xff) that is placed at the top of a function
frame's stack at the start of a function and checked prior to returning from that function

A random value that is assigned at the top of a function frame's stack at the start of a function and checked
prior to returning from that function
A replica of the stack kept in a different region, which is copied at the start of a function and checked prior to
returning from the function

Correct
Correct! Modern stack canaries use a random value, which is difficult for an attacker to guess.

Introduction to Heaps

Review the heap given in Figure 1, and recall the structure for heaps that was described in the lecture. What
happens when we free Bob?

In C, when does the libc heap change?

1 / 1 point

It changes automatically as the program executes.

It changes when additional memory is required for the stack.

It changes when a programmer makes a brk or sbrk syscall.

It changes when a programmer includes a call to malloc() or free().

Correct
Correct! The libc function malloc() adds memory to the libc heap, and free() decontrols a region of memory
dedicated to libc.

Heap Overflows

What is the proper definition of a variable named m_ptr that points to a function with the definition of "void funcname
(int* ip){}"?

1 / 1 point

void (*char)(m_ptr*);

void (*m_ptr)(char*);

void (*m_ptr);

void (*m_ptr)(int*);

Correct
Correct! This follows the pattern for the definition of a function pointer that points to a function with a signature of
"void funcname (int* ip){}".

Which characteristic is a key difference between heap exploitation and stack exploitation?

1 / 1 point

Different bytes must be used to overflow a heap variable.

Freeing a chunk with corrupted metadata will cause a segmentation fault.

The heap's allocation in memory during execution is listed in /proc/<process id>/maps.

The object to overwrite must be after the controlled buffer

Correct
Correct! The metadata used by the heap, which is required by the dynamic nature of the heap, is validated by libc
when a chunk is freed. If the metadata in the freed chunk does not pass the validation checks libc will cause a
segmentation fault.

Use-After-Free

A pointer variable 'first' is allocated on the heap and later freed. However, a 'first' still contains the address to the
heap. What happens next to enable a use-after-free vulnerability?

1 / 1 point

The program performs another free on the first pointer.

The program allocates space for a pointer 'second', which is of a different type but the same size as first's
type, and malloc reuses the space that was previously allocated for first.

The program allocates space for a pointer 'second', which is of the same type as first.

The program sets the pointer 'first' equal to NULL.

Correct
Correct! After the malloc, the program then uses the first pointer again, which assumes the structure of first's type.
This type confusion leads to unexpected behavior that may result in a security vulnerability.

Which pointer error results in a use-after-free vulnerability?

1 / 1 point

Aliased pointer
Wild pointer

Dangling pointer

Null pointer

Correct
Correct! A dangling pointer is still pointing toward an area of memory that was previously freed.

What type of mistake leads to use-after-free vulnerabilities?

1 / 1 point

Double free

Pointer mismanagement

Memory reuse

Memory leaks

Correct
Correct! Pointer mismanagement is an abstract concept, which is often difficult to detect, especially when it occurs
in multi-threaded environments.

Metadata Corruption

Question 1
A large number of heap implementations exist. Which implementation mentioned in the lecture is included in glibc?

1 / 1 point

nedmalloc
fastmalloc

tcmalloc

ptmalloc

Correct
Correct! This is the heap method used in glibc, and it uses the metadata techniques we have discussed.

Metasploit

What is Metasploit used for?

1 / 1 point

Metasploit is an operating system that contains a wide range of utilities aimed at penetration testers and reverse
engineers.

Metasploit is used for the creation and delivery of exploits into remote binary applications.

Metasploit is used for fuzzing binary applications to discover previously unknown vulnerabilities.

Metasploit is used for automatically reverse engineering and exploiting a binary application.

Correct
Correct! Metasploit is a flexible framework that helps security engineers and pentesters by reducing the friction
associated with delivering a working exploit into a remote binary application.
Week 6

History of the Web

Who created the World Wide Web?

1 / 1 point

Charles Babbage

Steve Jobs

Vint Cerf

Tim Berners-Lee

Correct
Correct! While at CERN, he created the first website in 1990.

Which technology is used to name and identify a resource?

1 / 1 point

URI/URL

Schema

HTML

HTTP

Correct
Correct! A Uniform Resource Identifier or Location is used to identify documents on the web.

URI

Consider this URI:

[Link]
%68%65%72%65?%66%6f%6f=%62%61%72&%62%61%7a=%62%61%72#%74%65%73%74

Now consider this isolated section of the URI:

%74%6f%6f%6c%73%5f%73%65%61%72%63%68%5f%68%65%72%65

What part of the URI is given by the isolated section?

1 / 1 point

The fragment

The scheme

The query

The path

Correct
Correct! This URI translates to

[Link]

and "tools_search_here" is the path.

Consider this URI:

[Link]

In the URI spec, what is “[Link]” called?

1 / 1 point

Fragment

Query

Authority
Scheme

Correct
Correct! The authority is the entity that controls the interpretation of the remaining portions of the URI.

HTTP

Question 1
Suppose that Eve wants to analyze a web application. She must be able to view and modify her HTTP requests,
view the server's HTTP responses, and crawl the webserver to find all of the available pages. She does not have
access to the server other than through the webserver's port. Which method is best for her to use in order to
achieve her goals?

1 / 1 point

Server logs

curl

Sniffer

Client-side proxy (e.g., Burp)

Correct
Correct! Burp offers a wide range of tools for vulnerability analysis including the ability to view and alter the HTTP
requests and to crawl the webserver automatically. Another option that's similar to using a client-side proxy are
browser analysis extensions, which will also provide the capabilities sought; however, the client-proxy is a more
robust and integrated solution for vulnerability analysis.

Question 2
What port is used by default with HTTP?

1 / 1 point

53
80

110

443

Correct
Correct! Port 80 is used by default for HTTP. However, HTTP is able to use any port (e.g., port 8080).

Which part of an HTTP request are GET, POST, PUT, and HEAD used for?

1 / 1 point

The State

The Method

The Action

The Response Type

Correct
Correct! GET, POST, PUT, and HEAD are all actions that the client wants the server to apply to the provided
resource.

Suppose that you receive a status response code that has the format 4XX. What type of message is this status
response?

1 / 1 point

Informational

Successful

Client Error
Server Error

Correct
Correct! This group of status messages includes the famous 404 error message (i.e., “Not Found”).

HTML

Which of these languages is the latest Hypertext Markup Language specification?

1 / 1 point

HTML6

SGML

HTML5

XHTML 1.0

Correct
Correct! The HTML 5.0 specification is the current HTML standard published by the W3C. In addition, it is a living
document, which means there will be no additional versions of the specification. The W3C will change and grow the
specification as necessary. The current web standard is HTML 5.2, which was recommended on December 14th,
2017.

What is used to add metadata to tags?

1 / 1 point

Attributes

Elements

Properties

Values
Correct
Correct! Tags can have attributes that provide metadata about the tags.

Consider this HTML string:

&#x0054;&#x0068;&#x0069;&#x0073;&#x0020;&#x0069;&#x0073;&#x0020;&#x0074;&#x0068;&#x00
65;&#x0020;&#x0062;&#x0065;&#x0073;&#x0074;&#x0020;&#x0066;&#x006f;&#x006f;&#x0020;&#
x0061;&#x0020;&#x0074;&#x0068;&#x0065;&#x0020;&#x0062;&#x0061;&#x0072;&#x002e;

What is the HTML text saying?

1 / 1 point

When will we foo at the bar?

This is the best foo a the bar.

Try my foo I got it at the bar.

When foo goes to the bar I get baz.

Correct
Correct! Encoded HTML strings like this can cause all sorts of problems in browsers.

Consider this HTML code:

<PRE>
<form action="/go/[Link]" method="POST">
<input type="hidden" name="hideme" value="1000">
<input type="text" name="username" value="">
<input type="password" name="password" value="">
<input type="submit" name="submit" name="login">
</form>
</PRE>

Given this code, which answer could be an HTTP request resulting from the submission of the form?
Dynamic Websites

Suppose that Alice built [Link] which generates a unique experience for each user based on the data
stored in the database. By which term is [Link] best defined?

1 / 1 point

Web application
Database application

React application

Web site

Correct
Correct! A web application is an interactive experience where the results returned to the user depend on the current
state of the underlying database.

What can be used to track a user's session?

1 / 1 point

IP address and port

Browser identifier

Cookies

IP address

Correct
Correct! Cookies often track session information by keeping a session identifier stored in a cookie, which can then
be used by the web server to look up the associated session information. Session tracking can also be implemented
using URL embedding and hidden form fields.

Suppose that a server responds with:

HTTP/2.0 200 OK

Content-type: text/html

Set-Cookie: usertoken=12345678900987654321;expires=Sun, 15-Jan-2017 16:11:12 GMT;path=/go/; domain=[Link]

Question 1
What does the acronym PHP stand for?

1 / 1 point

Python Hypertext Parser

Personal Home Program

Parallel Hybrid Player

PHP Hypertext Processor

Correct
Correct! PHP is a recursive definition. PHP is a scripting language that can be embedded into HTML to generate
dynamic content.

Assume that this request is used:

POST /go/[Link]?action=login HTTP/1.1

Host: [Link]

content-Type: application/x-www-form-urlencoded

Content-Length: 27

hideme=1000&username=zardus&password=wherearemyshoes&submit=login

Now consider this PHP code:

<?php

if ($_GET['action'] == "login") {

echo "checking login..."

if ($_REQUEST['username'] == "zardus") {

if ($_GET['password'] == "wherearemyshoes"){

echo "Login via GET successful!"

if ($_POST['password'] == "wherearemyshoes"){

echo "Login via POST successful!"

?>

What does the PHP code printout?

1 / 1 point

checking login...Login via GET successful!

checking login...Login via POST successful!

Login via POST successful!

no output from script

Correct
Correct! The $_REQUEST checks both GET and POST parameters whereas the $_GET only checks GET
parameters and $_POST only checks POST parameters.

Databases

Where do most modern web applications store state information?

1 / 1 point

Memory

Flat files

XML files

Databases

Correct
Correct! Cookies can only store small amounts of information, so most modern web applications use databases to
store state information.

Question 2
Assume that this request is used:
What does the PHP code printout?

1 / 1 point

The PHP script does not print any results.

adamd

iamio

iamio
adamd

zardus

Correct
Correct! The %25 decodes to %, which will select any rows where "am" appears anywhere in the friends field. table.

Introduction to JavaScript

Question 1
JavaScript was originally created for which web browser?

1 / 1 point

Mosaic

Firefox

Internet Explorer

Netscape Navigator

Correct
Correct! Brendan Eich at Netscape Navigator created JavaScript in 1995.

Which tag is used to add JavaScript to a webpage?

1 / 1 point

Source tag

JavaScript tag

Script tag
Java tag

Correct
Correct! Script tags either enclose or link to JavaScript source code. This was originally used instead of JavaScript
with the expectation that web browsers would support multiple languages.

What is the DOM?

1 / 1 point

The DOM is a programmatic interface in JavaScript, which is used to manipulate client-side content.

The DOM is the final format that a web browser renders after parsing an HTML page.

The DOM is an HTML tag used to notify the browser that specialized binary document objects are being included.

The DOM is an alternative scripting language to JavaScript.

Correct
Correct! The DOM exposes a globally accessible JavaScript document object.

Question 4
In JavaScript, what is variable scope based on?

1 / 1 point

Global with no scope reduction

Objects

Functions

Brackets

Correct
Correct! This is a very important difference between C and JavaScript. JavaScript uses functions to define the scope
of variables.

Asynchronous JavaScript

Question 1
Suppose that Alice developed a web application that validates the information entered into the form via JavaScript.
After passing the checks, the JavaScript submits the form using a POST request to a PHP page that saves the data
into a database. Which explanation offers the best reason why this method of validation is insufficient?

1 / 1 point

JavaScript does not have as much expressiveness as PHP and cannot check as many values.

JavaScript cannot submit the form automatically after completing the checks.

PHP can perform the validation more quickly.

The JavaScript checks can be ignored or bypassed completely.

Correct
Correct! JavaScript runs on the client's machine, and using a browser is not necessary before submitting a form.
Eve could use Burp (free version) to send manipulated POST requests. For instance, Eve would use Burp as her
proxy, load the web page, enter valid data, and click submit. Next, she could go into Burp and modify the body of
the HTTP with different values. Eve could also use wget, which even has the capability to send multiple requests as
a single session. For example:

wget --save-cookies [Link] --keep-session-cookies --post-data 'p1=unvalidated1&p2=unvalidated2'

[Link]

Which entity originally introduced the XMLHttpRequest object?

1 / 1 point

Google

Microsoft
Opera

Netscape

Correct
Correct! It was originally included as an ActiveX control in Internet Explorer 5 in March of 1999.

What tool abstracts all of the browser specific functionality?

1 / 1 point

jQuery

PHP

JavaScript

XMLHttpRequest

Correct
Correct! jQuery is a powerful tool that makes it significantly easier to maintain equivalent functionality across many
different browsers.
Week 7

Modern Web Applications

Which HTML tag enables the developer to embed multiple webpages into a single page?

1 / 1 point

<paragraph>

<include>

<iframe>

<embed>

Correct
Correct! The <iframe> or inline-frame tag allows multiple webpages to be embedded into a single webpage.

Which URL conforms to the same origin policy of [Link] ?

1 / 1 point

[Link]

[Link]

[Link]

[Link]

Correct
Correct! In this example, only the path differs.

Tampering with Client-Side Information

A web application has several mechanisms that it can use to store information on the client (i.e., the web browser).
Which list of those mechanisms is the most accurate?

1 / 1 point

Cookies, URLs, Forms, Plugins, Sessions, and Local Storage

Cookies, URLs, Forms, Plugins, POST variables, and Local Storage

Cookies, URLs, and Local Storage

Cookies, URLs, Forms, Plugins, and Local Storage

Correct
Correct! Each of these mechanisms is able to store information. For example, forms can have hidden fields that do
not show up to the user and can be used to store information. Plugins include things like Flash and Java Applets.

What does the curl command-line tool do?

1 / 1 point

It translates natural language into HTTP requests.

It parses HTTP requests and displays them in a concise manner.

It creates valid HTTP requests from the command line.

It initiates a development web server that processes PHP requests.

Correct
Correct! Curl is a useful tool when exploring a website because you can create all types of requests and easily
modify many kinds of client controlled data.

Suppose that Alice is developing a web application. What would be reasonable for Alice to use for validation if she
wants to be a security-conscious developer?

1 / 1 point
A login session cookie that is a 64-bit randomly generated value, which is given to the user after the user
logs into the web application. If the application validates that it is a valid number and compares it with a
value from the database, then it can trust that this is a validly logged in user.

The referer header value as proof that the user came from the expected page.

A login session cookie that is a 64-bit randomly generated value, which is given to the user after the user logs into
the web application. The application uses it to compare to login sessions stored in the database.

The user's password, which is sent in a POST via HTTPS and used to authenticate the user. No validation is
required since the request is sent via HTTPS.

Correct
Correct! With validation to ensure that it does not contain any unexpected characters, it seems reasonable for the
web application to trust the user is logged into the system.

Authentication and Authorization Attacks

Suppose that Eve wants to find a weakness in the authorization of a web application. Which bug found by Eve
demonstrates only an authorization vulnerability?

1 / 1 point

Eve discovers that automatic directory listing is enabled. She then finds a restricted web page that loads for
her even though she is not logged in.

Eve finds a hidden parameter in the [Link] 'bypass'. When the bypass field is passed into [Link], the
password is not checked for the supplied username.

Eve is able to sniff the local area network traffic at her favorite coffee house, and she captures Alice's username and
password because the web application does not require HTTPS. She is then able to login as the user on the
website.

Eve guesses a user's password after 5,000 tries. She is then able to login as the user and post comments under the
victim's username.

Correct
Correct! This is an authorization vulnerability because the web page should be restricted to authorized users, but
Eve could view it without being logged in.

Which function does authentication attempt to perform?

1 / 1 point

Identify whom the user can see

Identify who the user is

Identify what a user is allowed to do

Identify the user's location

Correct
Correct! Authorization is used by a system to identify the person accessing it. Systems commonly do this by
requesting a username and password.

Command Injection

In web applications, PHP, JavaScript, and SQL are often vulnerable to attack. Which statement provides the best
description of the underlying cause or reason for the vulnerabilities?

1 / 1 point

The languages are in clear text and are not compiled into a static binary program.

The technologies listed are prone to memory corruption vulnerabilities.

The resulting applications are directly accessible by anyone with access to the server, and much of the code is
available to the user.

The implementations using the listed technologies often make it possible to create data that is interpreted
as code.

Correct
Correct! Anywhere that strings are concatenated to produce input into another program or parser, it becomes much
easier to confuse the program as to whether something is data or code.

Assuming that $exp is controlled by the attacker, which command is the most secure against command injection?

1 / 1 point

$exp = preg_replace("#[^A-Za-z0-9 /_]#","",$exp); system("sort", "-n", $exp);

system("sort -n "$exp"");

system("sort -n $exp");

$exp = preg_replace("#[^A-Za-z0-9 /]#","",$exp); system("sort -n "$exp"");

Correct
Correct! This limits the user's string to letters, numbers, spaces, forward slash, and underscores. In addition, it uses
the individual argument format instead of a single concatenated string.

SQL Injection

Suppose that Alice is running a web application with the following code:
<%

...

user_id = "eve"

sql = "SELECT order_num, order_date, amount FROM order WHERE amount >= " + [Link]("amount_filter") +

" AND user_id = '" + user_id + "'"

[Link](sql, connection)

...

%>

What input should Eve use to view Bob's orders?

1 / 1 point

' OR user_id = 'bob'--

0 OR user_id = 'bob'

OR user_id = 'bob'--

0 OR user_id = 'bob'--

Correct
Correct! This will list Bob's orders and ignore the "AND user_id = 'eve'"

What is the table in MySQL that contains the metadata on the tables of a database?

1 / 1 point

[Link]

user_objects table

information_schema.tables

sysobjects

Correct
Correct! By querying the informat_schema.tables, the attacker can list all of the tables within a database.

Suppose that Eve has discovered a vulnerable SELECT statement, and suppose that the following payload works " '
UNION SELECT NULL,'foo',NULL,'bar' FROM users -- ". Assuming the database is MySQL, what is a SELECT that
will return all of the tables?

1 / 1 point

' UNION show tables WHERE table_in_database like '%' --

' SELECT NULL, TABLE_SCHEMA, NULL, TABLE_NAME FROM information_schema.tables --

' UNION SELECT NULL, TABLE_SCHEMA, NULL, TABLE_NAME FROM information_schema.tables --

' UNION SELECT NULL, TABLE_SCHEMA, TABLE_NAME, NULL from information_schema.tables --

Correct
Correct! This will return the schema and tables for all of the tables used in the MySQL database.

What is required to add UNION to a SELECT?

1 / 1 point

The injected query must return the same number of rows and the same number of columns.

The injected query must return the same number of columns.

The injected query must return the same number of columns, and each of those columns needs to be the
same data type.

The injected query must have the same filtering criteria.

Correct
Correct! With these requirements satisfied, the query will return to unioned results. NULL is useful when the data
type of a column is not known.

Advanced SQL Injection

Suppose that Eve found a SQL injection vulnerability on the query

SELECT '' from users_groups WHERE user_id='$user' and group = 'visitor'

where she controls the value of $user.

If the query returns a row, then the user is permitted to access the current page. If the query does not return a row,
however, then “access denied” is shown. Eve wants to uncover the account number of the user_id alice, which is in
the accounts table. Which of these options will move her toward her goal?

1 / 1 point

eve` AND exists (SELECT '' from accounts where user_id ='alice' AND account like '1%') --
eve` OR exists (SELECT '' from accounts where user_id ='alice' AND account like '1%') --

eve` AND exists (SELECT '' from accounts where user_id ='alice' AND account > 5) --

eve` AND user_id ='alice' AND account like '1%' --

Correct
Correct! This will tell Eve whether the first digit of the account number is a 1. As she gets a success for one position,
she can move on to the next position. An even faster method would to use SUBSTRING and a binary search to find
the expected value.

What is the best way to prevent SQL injection in your application?

1 / 1 point

Stored procedures

Automate SQL correction

Prepared statements

Sanitize inputs

Correct
Correct! Prepared statements are pre-compiled SQL statements that bind the user data to the query.

XSS

Which statement best describes a reflected cross-site scripting (XSS) vulnerability?

1 / 1 point

A URL crafted by an attacker exploits a buffer overflow in the URL parser of the web browser.

Malicious JavaScript exists as data in the URL, which are then directly inserted into the HTML of the page.
A web server is compromised, and the user is presented with malicious JavaScript after it was changed by the
attacker.

Malicious JavaScript is stored on the web server and then directly inserted into the HTML of the page.

Correct
Correct! The data in the URL are sent to the server and get reflected back to the user.

Question 2
Suppose that Eve wants to gather user credentials from [Link]. What is the drawback of using a stored
cross-site scripting (XSS) vulnerability?

1 / 1 point

The web browser might filter the malicious JavaScript before it is executed.

The vulnerability is persistent across multiple sessions.

The user must click on a link that contains the malicious payload within the URL.

The website operator might notice the stored JavaScript and resolve the XSS vulnerability, as well as
remove the malicious JavaScript from its database.

Correct
Correct! Stored XSS vulnerabilities are stored on the server side, whereas reflected XSS vulnerabilities are initiated
from the client, usually from a URL containing malicious JavaScript code.

XSS Consequences

The "sammy is my hero" stored cross-site scripting (XSS) vulnerability infected at least how many accounts?

1 / 1 point

900,000

9,000
90,000

9,000,000

Correct
Correct! According to the author's writeup, the malicious JavaScript would send the author a friend request. All told,
the author received over 900,000 requests.

XSS Prevention

Which reason best explains why the prevention of cross-site scripting (XSS) is difficult?

1 / 1 point

The protections required vary depending on the context in which the data are used.

The protections can easily be disabled by the user because protections work on client-side code.

The protections must catch every possible type of encoding.

The protections required change depending on the user's browser.

Correct
Correct! Depending on whether the data are included within an attribute or within the body of the HTML page, a
different prevention scheme is necessary.

Cross Site Request Forgery

Which example gives the most accurate illustration of Cross-Site Request Forgery (CSRF)?

1 / 1 point

Alice receives an email containing a link that, if she clicks the link, will send values to a webpage without requiring a
form to verify her email address.
Alice receives an email containing a link that, if she clicks the link, will result in her unknowingly changing
her password for [Link] to 123456.

Eve’s browser loads a script from a different website, from which the underlying page is loaded.

Eve's webpage at [Link] includes <img src="[Link] which sends a full HTTP
request to [Link].

Correct
Correct! This example causes a forceful browsing to the password reset page, which would be the result of the
email sender’s malicious intent.

Clickjacking

Question 1
Which set gives three valid X-Frame-Options that can be put in the HTTP response header?

1 / 1 point

DENY / SAMEORIGIN / ALLOW-FROM

DENY / ALLOW / SAME-DOMAIN

DENY / SAMEORIGIN / ALLOW

DENY-TO / SAMEORIGIN / ALLOW-FROM

Correct
Correct! DENY prevents framing of the resource, SAMEORIGIN allows pages from the same origin to frame the
page, and ALLOW-FROM allows a specific URI to frame the page.

Logic Flaws

Which scenario gives an example of a logic flaw?

1 / 1 point
A developer enables the PHP register_global setting and uses it throughout the system. On one page, however, the
developer fails to initialize the admin variable, which makes it possible to bypass the authentication and
authorization of the web application.

Alice has an account on a banking site and a gaming site. Eve correctly guesses Alice’s password on the gaming
site, and when she tries using this password to log into Alice’s bank account, the password works and Eve
accordingly steals Alice’s money.

With unexpected and unfiltered input, a program works in a way that its developer did not intend, such as when a
web application does not filter input before sending it to the database.

There is a disconnect between the expected behavior of a web development platform and its actual
behavior, such as when a developer expects that a redirect function will halt the execution of a program, but
the code execution does not stop and actually continues until the end of the function.

Correct
Correct! Logic flaws stem from the developer’s misunderstanding about how the code works. The issue is not that
there is a problem in the code itself but that the developer did not intend for this behavior.
Final