I need help with network security -- 3
Budget: $30 – $250 USD
I am working on a group project whose goal is to gain access to another server. I need help figuring out what attacks to make and the logic behind it. Please see project information below
Suggested strategies
You may want to limit the ability of attackers to scan your network.
Make sure to handle SQL injection attacks and to set up folder access conservatively.
Some legitimate users may create weak passwords. You should accept every password. You should ensure however that your teammates and you have strong passwords.
You can set up HTTPS if you like and let me know and I will adjust my legitimate client script to use it.
Red Team Tasks
The goal of the red team is to gain access to blue team's network and interfere with its operation. This can be done by: (1) performing SQL injection, (2) making the banking application behave in a way that is not expected (e.g., being able to withdraw money from a legitimate user's account), (3) finding and exploiting a backdoor, (4) cracking/stealing passwords of the opposing team.
Assumptions and Requirements
You can borrow code from online sources but you need to understand what it does and how. Attacks that overwhelm the blue team's network are out of scope (e.g., DDoS) but anything that targets the blue server is in scope. Also, doing "sudo su sunshine" on your experimental machine and then logging into Blue team's machines is out of scope.
Attacking IPs do not have to attack all the time. Mixing up some legitimate traffic with attack would be good to hide the nature of the IPs.
User passwords/cookies could be sniffed from the net
It may be possible to leverage an existing vulnerability in OS or applications if you find it.
Look for backdoors. If they are not closed, you will be able to open a reverse shell into the blue server.
You can do some hacker training at http://www.overthewire.org
Suggested strategies
You may want to limit the ability of attackers to scan your network.
Make sure to handle SQL injection attacks and to set up folder access conservatively.
Some legitimate users may create weak passwords. You should accept every password. You should ensure however that your teammates and you have strong passwords.
You can set up HTTPS if you like and let me know and I will adjust my legitimate client script to use it.
Red Team Tasks
The goal of the red team is to gain access to blue team's network and interfere with its operation. This can be done by: (1) performing SQL injection, (2) making the banking application behave in a way that is not expected (e.g., being able to withdraw money from a legitimate user's account), (3) finding and exploiting a backdoor, (4) cracking/stealing passwords of the opposing team.
Assumptions and Requirements
You can borrow code from online sources but you need to understand what it does and how. Attacks that overwhelm the blue team's network are out of scope (e.g., DDoS) but anything that targets the blue server is in scope. Also, doing "sudo su sunshine" on your experimental machine and then logging into Blue team's machines is out of scope.
Attacking IPs do not have to attack all the time. Mixing up some legitimate traffic with attack would be good to hide the nature of the IPs.
User passwords/cookies could be sniffed from the net
It may be possible to leverage an existing vulnerability in OS or applications if you find it.
Look for backdoors. If they are not closed, you will be able to open a reverse shell into the blue server.
You can do some hacker training at http://www.overthewire.org