preview

Assignment 2: Isin 312 Applications Of Information Security

Decent Essays

ISIN 312 Applications of Information Security
Instructor: Jerry Emerick

Christopher Smith
2/19/2016
EXECUTIVE SUMMARY
This is a report on an authorized penetration test against the site located at http://192.168.0.1/isihack/shop.aspx. The testing occurred at my testing facility in Grand Ledge, MI. The testing occurred between the dates of 2/16/2016 and 2/20/2016 after written authorization was received from Jerry Emerick. The scope of the test was discussed on 2/15/2016 with Jerry Emerick. The following areas were the focus of the assessment:
1. Testing of shopping site security
2. Testing whether price could be manipulated
3. Testing whether quantities could be manipulated

As documented in this report, many vulnerabilities were identified …show more content…

VULNERABILITY
The following is a list of the vulnerabilities found during the attack:
1. Using proxy software Burp Suite it was discovered that the shopping site contained a hidden form field that could be manipulated.
2. The hidden form field offered no security in regards to the item quantity and an attacker could select and item and enter a negative quantity which would subtract from the total dollar amount in the shopping cart.
REMEDIATION
The following are a list of recommendations that should be considered to resolve the vulnerabilities
1. Remove the hidden form fields from the shopping website and move all sensitive items to the server side.
2. Use validation to ensure the information is correct.

CONCLUSION AND RECOMMENDATIONS As mentioned earlier in the report. The vulnerabilities present on the e-commerce site allow a malicious user to intercept the web traffic and locate the hidden form fields and alter the item prices and quantities. These vulnerabilities allow the user to adversely affect the financial stability of the company. As show in the below diagram the user has the ability to user proxy software such as Burp Suite and intercept the traffic and send back manipulated data to the web server and paying reduced prices on all

Get Access