CSE5PEN - Penetration Testing Principles

Background

Australian universities have been frequent targets of cyberattacks due to their valuable research data and intellectual property.

Tasks

• Select three cybersecurity incidents involving Australian universities.

• For each incident, analyze:

  • Date & context of the attack

  • Attack vector used (e.g., phishing, malware, insider threats)

  • Tactics, Techniques, and Procedures (TTPs) using MITRE ATT&CK framework

  • Step-by-step attack execution

  • Damages caused (data breaches, financial loss, reputational impact)

  • Prevention measures (best security practices)

Deliverables

1. Lessons learned from each case

2. Recommendations for La Trobe University's IT security team

3. Strengthen cybersecurity

4. Improve incident response

5. Reduce risks

2. Vulnerability Assessment

Background

You will conduct a vulnerability assessment on the MetaSploitable machine using Nessus.

Tasks & Deliverables

1. Service Identification

   • Identify open ports & running services with version details

2. Vulnerability Discovery

   • List known vulnerabilities (include CVE IDs, CVSS scores)

   • Check if vulnerabilities are exploitable (provide Exploit-DB/GitHub links)

3. Vulnerability Prioritization

   • Rank vulnerabilities by CVSS score

   • Summarize top 6 critical vulnerabilities

4. Risk Assessment & Preventive Measures

   • Explain potential exploitation risks

   • Recommend patching, configuration hardening, firewall rules

Evidence Collection

• Include Nessus scan screenshots showing:

  • Ports, services, CVE IDs

  • CVSS scores, exploit verification evidence

 3. Exploitation Using Metasploit

Background

Using Metasploit Framework, exploit six vulnerabilities on MetaSploitable.

Tasks & Deliverables

1. Selection of Exploits

   • Choose six different exploits targeting MetaSploitable

   • Provide CVE ID, exploit name, attack method

2. Execution & Documentation

   • Demonstrate each exploit with screenshots

   • Show successful access (shell access, privilege escalation, etc.)

   • If exploit fails, explain why and try alternatives

3. Summary Table

   • Include details like CVE ID, service name, port number, exploit method, success/failure

4. Analysis & Findings

   • Explain why exploit worked or failed

   • Describe potential impact of attack

5. Mitigation Recommendations

   • Suggest patching, service hardening, firewall rules

6. Evidence Collection

   • Screenshots showing successful exploits & student ID in terminal

4. Cracking Passwords with OphCrack

Background

Crack Windows XP SAM file password hashes using OphCrack.

Deliverables

1. Document steps taken to crack passwords

2. Submit recovered passwords

3. Include screenshots for each step 

5. Research Paper Review

Background

Analyze PTVis from the research paper: S. Zheng et al., "PTVis: Visual Narrative and Auxiliary Decision to Assist in Comprehending the Penetration Testing Process," IEEE Access, 2020.

Tasks & Deliverables

1. PTVis and Penetration Testing

   • Explain how PTVis supports penetration testing

   • Why visualization is crucial in penetration testing

2. Proposed Enhancements

   • Suggest one enhancement for PTVis

   • Justify how it improves customized exploration

3. Critical Evaluation

   • Evaluate challenges PTVis solves

   • Discuss how its absence would impact penetration testers

Submission Details

• Submit 1 PDF file containing all answers.

• Follow academic integrity policies (use citations, avoid plagiarism).

• Upload via LMS before May 18, 2025.