Week 3 Lab Part 1: Web and Database Attacks & Malware and Malicious Software

Learning Objectives and Outcomes
Upon completing this lab, students will be able to: * Identify web application and web server backend database vulnerabilities as viable attack vectors * Develop an attack plan to compromise and exploit a web site using cross-site scripting (XSS) against sample vulnerable web applications * Conduct a manual Cross-site Scripting (XSS) attack against sample vulnerable web applications * Perform SQL injection attacks against sample vulnerable web applications with e-commerce data entry fields * Mitigate known web application and web server vulnerabilities with security countermeasures to eliminate risk from compromise and exploitation

Overview This Lab will demonstrate a Cross-site Scripting (XSS) exploit and an SQL Injection attack on the test bed web application and web server using the Damn Vulnerable Web App (DVWA) loaded on an Apache Web Server on “TargetUbuntu01” Linux VM server. They will first identify the IP target host, identify known vulnerabilities and exploits, and then attack the web application and web server using XSS and an SQL Injection to exploit the web application using a web browser and some simple command strings. Assignment Requirements

Watch the Demo Lab in Learning Space Unit 5 and then answer questions 1-10 below.

Lab Assessment Questions & Answers 1. Why is it critical to perform a penetration test on a web application prior to production implementation?

2. What is a cross-site scripting attack? Explain in your own words. 3. What is a reflective cross-site scripting attack? 4. What common method of obfuscation is used in most real world SQL attacks? 5. Which web application attack is more prone to extract privacy data