Course Name :

PENETRATION TESTING & VULNERABILITY ASSESSMENT

Code(Credit) :CUTM1631(4-0-2)

Course Objectives

Explain the basic principles and techniques of how attackers can enter computer systems.
Put acquired knowledge into practice by performing ethical penetration tests and hiding the intrusion.
Perform analyses of data breaches and audits of information technology security.
Evaluate the strengths and weaknesses of various information technology solutions regarding data security.
Independently present and perform demonstrations of pen tests for educational purposes.
evaluate the societal role of hacking from a social, ethical and economic standpoint

Course Outcomes

SNO	DESCRIPTION	PO MAPPING
CO1	Understand the penetration testings	PO1, PO2, PO5, PO6, PO11, PO12
CO2	Understand to vulnerability assessment	PO1, PO2, PO4, PO5, PO11
CO3	Can evaluates if the system is susceptible to any known vulnerabilities, assigns severity levels to those vulnerabilities, and recommends remediation or mitigation, if and whenever needed	PO1,PO2, PO5, PO6, PO7

Course Syllabus

MSCS2104-PENETRATION TESTING & VULNERABILITY ASSESSMENT

MODULE (I):

OWASP: Introduction to web applications security, threats and OWASP principles, introduction to secure design, web server: introduction a secure setup of apache, firewalling a server Browser: general concepts, functionalities, browsers war, configuration (HTTP-cookies, contents, scripting etc. attack to browsers, and users tracking/profiling (third party cookies, super cookies, XSS, CSFR, Command Injection), browser security (add-ons, plugins, same-origin policy etc.) & secure browsing.

OWASP Privacy preserving: attacks to privacy, (spyware & backdoors, browser, email etc.) Tracking techniques: (HTTP cookies, third party cookies, browser fingerprinting, CSP) Advanced browser configuration, anonymity and onion routing (Tor). Internet E-mail: Architecture and infrastructure, functions, agents and standards, MIME & PGP, phishing, spamming & spoofing, DKIM, SPF, introduction to email forensics.

MODULE (III):

Introduction to EthicalHacking Terminology-Fivestages ofhacking-VulnerabilityResearch-Legalimplication of hackingImpact of hacking. Foot printing & Social engineering.

Information gathering methodologies- Competitive Intelligence- DNS Enumerations- Social Engineering attacks. Scanning & Enumeration Port Scanning-Network Scanning- Vulnerability Scanning- NMAP scanning tool- OS Finger printing Enumeration. System Hacking Password.

MODULE (IV):

Sniffers & SQL Injection Active and passive sniffing- ARP Poisoning- Session Hijacking- DNS Spoofing- Conduct SQL Injection attack – Counter measures. Cracking techniques- Key loggers- Escalating privileges- Hiding Files-Steganography technologies- Countermeasures.

TEXT BOOK: