Showcasing Projects and Papers
Description: The lab report discusses the vulnerabilities of the MD5 hashing algorithm, specifically its susceptibility to collision attacks. The lab involves generating MD5 hash collisions and explores how malicious code could use the same hash as benign code to bypass verification mechanisms.
Uses: MD5 hashing algorithm, md5collgen function for generating collisions, Python, C, Unix commands
DownloadDescription: The document outlines a security testing plan for the Hackazon application, emphasizing the importance of a structured approach to software security testing. It provides methodologies for testing, including both static and dynamic tests, and highlights the OWASP Application Security Verification Standard (ASVS).
Uses: OWASP ASVS, Automated and manual source code review, Dynamic system testing (automated and manual), Tools like Nmap and Python
DownloadDescription: This report evaluates SQL injection vulnerabilities in the Hackazon application, focusing on various input fields. Multiple security flaws were identified, which could enable attackers to access or modify data, with suggestions for mitigation strategies.
Uses: Burp Suite (Intruder tool), Fuzz testing, HTTP proxying
DownloadDescription: Discusses identifying and mitigating SQL injection vulnerabilities in the Hackazon web application, emphasizing the importance of using prepared statements and input filtering to enhance security.
Uses: SQL/Databases, Prepared Statements, PHP, Fuzz Testing
DownloadDescription: The document focuses on identifying and mitigating cross-site scripting (XSS) vulnerabilities in the Hackazon application. It details how XSS attacks, such as reflected and stored XSS, can be exploited, and it outlines mitigation strategies like input/output encoding, context-aware sanitization, and secure coding practices.
Uses: PHP, HTML/JavaScript, RIPS Scanner, DOMPurify, Content Security Policy (CSP)
DownloadDescription: Provides an analysis and exploration of length extension attacks on cryptographic hash functions like SHA256. It explains how attackers can append data to a hashed message without knowing the original contents and explores mitigating these risks through HMAC implementations.
Uses: SHA256, HMAC, Python, MACs (Message Authentication Codes)
DownloadDescription: Designed and implemented a secure file transfer system using asymmetric encryption and digital signatures to ensure data integrity.
Technologies Used: Python, OpenSSL, RSA Encryption
DownloadDescription: Details the process of using Burp Suite to conduct a dynamic vulnerability scan on the Hackazon application. It discusses the limitations of the free version, examines Burp Suite’s ability to detect a variety of web vulnerabilities, and outlines best practices for ethically reporting vulnerabilities to stakeholders.
Uses: Burp Suite, HTTP/Proxy, OWASP
DownloadDescription: Explores the fundamentals of Public Key Infrastructure (PKI) and its role in securing network communications. The lab covers certificate creation, validation, the use of secure communication protocols (like HTTPS), and simulates attack scenarios like man-in-the-middle attacks to demonstrate the importance of secure PKI practices.
Uses: OpenSSL, RSA Encryption, X.509 Certificates, HTTPS
DownloadDescription: Outlines the process of generating security test cases for the Hackazon application based on system requirements. It includes a STRIDE threat model to identify key security threats and proposes test cases to mitigate these risks across various layers of the software development lifecycle (SDLC), focusing on authentication, data integrity, access control, and other security features.
Uses: STRIDE Threat Model, Penetration Testing, Source Code Reviews, OWASP Guidelines
DownloadDescription: Explores different encryption modes and their implications on data security, with a focus on the AES algorithm. The lab demonstrates how various encryption modes, such as ECB, CBC, CFB, and OFB, impact data confidentiality, padding, and data corruption resilience. It also emphasizes the importance of initialization vectors (IVs) and their role in adding randomness to secure encryption processes.
Uses: AES (Advanced Encryption Standard), Python, OpenSSL, Initialization Vectors (IVs)
DownloadDescription: Outlines the guidelines and expectations for the proper use of H.E. Games’ technological resources. It emphasizes promoting responsible usage, ensuring data security, and mitigating risks associated with social engineering and human error. The policy includes sections on internet usage, employee monitoring, password policies, data handling, and awareness training, all aimed at protecting the company’s resources and data.
Uses: ISO/IEC 27002
DownloadDescription: This document outlines a Clean Desk Policy, which establishes guidelines for maintaining an organized and clutter-free workspace.
Uses: ISO/IEC 27002
Download