COMP 4108 Assignment 4

This section explains the setup steps for this assignment. You do not have to submit anything for this section.

If you have completed the setup steps for Assignment 1, you will already have created a Linux virtual machine for this course on the SCS OpenStack platform. You will re-purpose that VM instance for this assignment.

Follow the instructions from Assignment 2 to rebuild your VM instance against the comp4108-w26-assignment-04 image. Once you have, connect to it and change your password.

This assignment will require the use of a custom hostname mapping, from comp4108.ca to 127.0.0.1 (localhost). This mapping will be necessary for a CSRF exploit performed in Part B. You will need to set this in the location specific to your OS.

• MacOS / Linux – Add the following line to /etc/hosts as a superuser, at the very bottom of the file: 127.0.0.1 comp4108.ca

• Windows – Open C:\Windows\System32\drivers\etc\hosts as an administrator, then add the following line at the very bottom of the file: 127.0.0.1 comp4108.ca

Relevant textbook sections: 10.3 (read ahead to Figure 10.6 on page 295)

Your remote VM should be running two web services for this assignment: one is bound to port 80, the other to port 3000. (We will explain what these services do in later parts.) These services are insecure and should not be exposed to the outside network—your VM only exposes port 22, for you to use the SSH protocol. To reach the two web services from your local machine, you will use what is called SSH port forwarding. Traffic sent over ports 80 and 3000 of the remote machine VM will then travel through an SSH tunnel that connects, respectively, to local ports 9999 and 3333 on your machine.

Note that an ssh client process must remain alive for port forwarding to continue working. The process will run silently in the background, but restarting your local machine, or getting a Connection reset by peer error after a period of inactivity, means you will need to set up port forwarding again.

• MacOS / Linux – Initialise a local (-L) port forwarding SSH tunnel in the background (-f) by executing the following command.

  ssh -N -L 9999:localhost:80 -L 3333:localhost:3000 -f [your-VM-external-IP-address]

  (Aside: In this command, localhost:80 and localhost:3000 will be interpreted by the remote machine's SSH daemon, relative to itself.)

• Windows – Specific instructions for local port forwarding on Windows depends on the SSH client you use.
  • For PuTTY, the configuration options are under Connection ➤ SSH ➤ Tunnel (documentation here).
  • For MobaXterm, click the Tunneling button (documentation here).
  In either case, set up one rule to forward your port 9999 to localhost:80, and another rule to forward your port 3333 to localhost:3000.

Verify that your port forwarding is working correctly by navigating to http://comp4108.ca:9999 and http://localhost:3333/ui/panel. Both links should resolve to a webpage.

Note: Instructions are current as of Sept 2025.

Some of the questions in this assignment rely on specific browser protections being disabled. We recommend that you use the Firefox browser by Mozilla. (If you already use Firefox as your main web browser, consider creating a new profile for this assignment before changing your settings. The profile manager can be accessed at about:profiles, and you can consult Mozilla's documentation for the feature here.) Once the browser is installed, enter the Settings screen by clicking the menu button, then clicking Settings:

• In the sidebar menu on the left, navigate to Privacy & Security.
• Under the Browser Privacy section, select the Custom option under Enhanced Tracking Protection. Uncheck all checkboxes.

Relevant textbook sections: 9.1, 9.7

This assignment explores several classes of web-based attacks, and how these harm both browser users and service providers, with the use of vulnerable web applications. We begin with common web vulnerabilities that specifically enable a malicious client to read or modify privileged information on the hosting web server. Potential impacts range from revealing implementation details about the host process, to leaking user application data, to performing arbitrary code execution. (The OWASP Top 10 provides a regularly updated overview of the most common categories of web security threats, if you want to learn more.)

We illustrate these attacks by using the Damn Vulnerable Web Application (DVWA), a sandbox application for educating about web security threats, and their various mitigations. Each tab of the application's interface focuses on a different vulnerability, and has a configurable "Security Level" to change which mitigations are used to secure itself. DVWA is already an available service on your VM, and your port forwarding has made it accessible on port 9999, at http://comp4108.ca:9999/DVWA. To login, use the user name comp4108 and the password found in the Brightspace announcement for this assignment. (If you get a CSRF token error, try again.)

1. 4 Marks (total) Navigate to the File Inclusion tab of DVWA for the following questions. (A file inclusion vulnerability allows an attacker to direct the web server into executing a file of their choosing.) This page allows the user to choose one of three PHP files to execute.
   1. 2 Marks Exploit the file inclusion vulnerability on this page, with Security Level set to low, to output the contents of the server's /etc/passwd onto the page. Explain the vulnerability on this page, and how you were able to exploit it successfully.
   2. 2 Marks Set Security Level to impossible and try your exploit again. What extra mitigations have been added? Refer to the new DVWA source code in your description. Explain why these are effective at preventing the original exploit.

2. 7 Marks (total) Navigate to the Command Injection tab of DVWA for the following questions. (A command injection vulnerability allows an attacker to trick the web server into executing arbitrary OS commands, as part of normal operation of the application.) This page allows the user to ping an IP address of their choosing.
   1. 4 Marks Exploit the injection vulnerability on this page, with Security Level set to medium, to create a new page in the current web directory called phpinfo.php. (The PHP manual has a "Hello World" example, if you have never written a PHP file.) This new page only needs to call the phpinfo() function. Explain the vulnerability on the DVWA page, and how you were able to exploit it successfully, including the exact string you submitted. Refer to relevant parts of the DVWA source code, and any mitigations you noticed, in your explanation.
      • Note – The page you landed on is the index.php file for the directory, which has a special file name that does not need to be explicitly referenced in the URL. You can navigate to index.php explicitly if that helps to situate yourself. Your phpinfo.php file should be created in the same directory where index.php sits.
      • Hint – If you are having difficulty executing your command, try to echo a string to the page on Security Level low first. Then, change Security Level back to medium.
   2. 1 Mark Comment on the contents of phpinfo.php: how might this information be useful to a malicious user of the web application?
   3. 2 Marks Set Security Level to impossible and try your exploit again. What extra mitigations have been added? Refer to the new DVWA source code in your description. Explain why these are effective at preventing the original exploit.

3. 5 Marks (total) Navigate to the SQL Injection tab of DVWA for the following questions. This page allows the user to query the first and last name for a chosen user identifier, e.g. 5.
   1. 3 Marks Exploit the injection vulnerability on this page, with Security Level set to low, to output all user and password column values in the users table. The database (MariaDB) uses MySQL-flavoured SQL syntax. Explain the vulnerability on this page, and how you were able to exploit it successfully. Refer to specific parts of the DVWA source code in your explanation.
      • Note – You are given the names of the target columns here, but in practice, an attacker would likely need to use other means to determine the target columns.
      • Hint – Despite being Security Level low, this exercise is tricky if you are not familiar with SQL syntax. You may refer to an online guide on SQL injection strategies, but you must cite it if you do. Pay close attention to strategies that involve the UNION keyword.
   2. 2 Marks Set Security Level to impossible. Explain why use of the prepare and bindParam functions is effective at preventing the original exploit.

4. 2 Marks Which security principle discussed in Chapter 1.7 of the course textbook best helps to mitigate the explored attacks above? Explain.

Relevant textbook sections: 9.1, 9.3, 9.5, 9.6

This part involves two additional classes of web-based attacks, cross-site request forgeries (CSRF) and cross-site scripting (XSS) attacks. In contrast to Part A, these classes primarily involve exploiting the actions of regular users of a vulnerable web application.

A web browser will typically render a web page and execute its scripts exactly as specified by the page's host, rather than ask the browsing user before doing so. Therefore, a user implicitly trusts that a page link or action will not result in the execution of malicious code. Although modern browser security measures insulate users from many threats, various attack vectors continue to exist due to both old and new vulnerabilities in web applications.

We will again use DVWA to demonstrate a common style of CSRF attack, and effective mitigation techniques. XSS attacks are more varied in their execution, however, so we will use a different vulnerable application called XSSmh. This application is also already available on your VM, and can be accessed at http://comp4108.ca:9999/MCIR/xssmh.

1. 11 Marks (total) For the following questions, you will run a basic web server on your local machine to serve HTML content. Create a directory to hold your HTML files called csrf-4108. Then, choose from the following two options to start a web server for files in your new directory:

   • MacOS / Linux – Use Python's http.server module to open a web server on port 5000 in your terminal: python3 -m http.server -d ./csrf-4108 5000
   • Any OS – Download and unzip the HFS web server by Massimo Melina. Run the hfs executable contained within. Once the admin panel opens:
     • Click Options in the navigation pane on the left. Under the Networking section, change the HTTP Port setting to Choose, and then the Number setting to 5000. Click the Save button at the bottom of the screen.
     • Click Shared Files in the navigation pane on the left. At the bottom of the page, click the Add button, and choose From Disk. Navigate the file browser to your csrf-4108 directory, and then click the Select This Folder button at the bottom of the dialog.
     • Once you have completed Question 1, you can delete the .hfs folder created in your home directory, as well as the hfs executable itself.

   Once you have set up your web server, confirm that it is working by navigating to http://localhost:5000—you should see a file browser.

   In a separate tab, navigate to the CSRF tab of DVWA. This page simulates a password change form where the user must enter (and then confirm) their new password. The "Change" button then submits the form to the web server.

   1. 4 Marks Create a minimal HTML file in csrf-4108 that, once opened with DVWA Security Level set to low, exploits the CSRF vulnerability on DVWA to overwrite the password of the logged-in user to a password of your choice. The exploit should occur automatically after opening the HTML file from your web server, without any further interaction from you. To confirm that your exploit worked, click the Test Credentials button on the DVWA page, and try the new password. Explain how your CSRF works, and why it was possible on this DVWA page. Submit your HTML file with your code package as b-1-csrf-low.html.
      • Note – To avoid file caching issues in Firefox when opening your HTML file, click the menu button, and then More tools ➤ Web Developer Tools. In the pane that appears, click the Network tab, and then check the Disable Cache option at the top-right. Keep this pane open while you are testing.
   2. 3 Marks Attempt the exploit again with Security Level set to medium. Refer to relevant parts of the DVWA source code to explain what mitigations were added. Create a new HTML file in csrf-4108 that exploits the CSRF vulnerability as per the previous question, but circumventing these new mitigations. Explain how you worked around these new measures. Submit your HTML file with your code package as b-1-csrf-medium.html.
   3. 2 Marks [Secret validation tokens] Set Security Level to hard and try your exploit again. What extra mitigations have been added? Explain why these are effective at preventing the original exploit.
   4. 2 Marks Now set Security Level to impossible. Compare the mitigations here to the ones in Security Level hard, and explain why the developers of DVWA believe them to be superior for this specific instance.



2. 9 Marks (total) Use the XSSmh web application to solve 5 of its 8 challenges relating to XSS attacks. To reach these from the application's main page, click the Challenges link below the page's title. Each challenge features an input box for you to provide text, and when you click the "Inject" button, your text will appear somewhere within the HTML of the next page. For most of these, your goal is to force a Javascript dialog, populated with a message, to display on page load using the alert() function. You may refer to an online guide on Javascript XSS strategies, but you must cite it if you do.

   For each challenge, briefly describe the scenario, then provide the exact input you used in text form, and then explain how your exploit works.

   1. 1 Mark Challenge 0 - alert("Hello, world!");
   2. 2 Marks Challenge 1 - The Failure of Quote Filters
   3. 2 Marks Challenge 3 - AttriBeautiful
   4. 2 Marks Challenge 6 - Up the Chain
   5. 2 Marks Challenge 7 - Crouching JS, Hidden Field

Relevant textbook sections: 7.7, 7.8, 9.3, 9.5, 9.6

This part leverages a persistent XSS vulnerability in DVWA to inject a browser control script into the page. The goal is to demonstrate the extent of the control that malicious scripts can have over what a browser displays, and what actions it can be forced into taking.

We illustrate this with the use of the Browser Exploitation Framework Project (BeEF). The main purpose of BeEF is to enable penetration testers to easily test browser attack vectors. BeEF has two main components: the hook script, which is Javascript code to be executed by the victim browser, and a control panel, which acts as a command and control (C2) server. As long as the hook script is loaded on the browser, the C2 server is able to inspect the browser and deliver payloads for it to execute.

The BeEF control panel is running on your VM, and available locally on your local machine on port 3333, at http://localhost:3333/ui/panel. To login, use the same credentials that were provided for DVWA.

1. 2 Marks Navigate to the XSS (Stored) tab of DVWA. This page features a guestbook, with a form enabling users to submit their name and a comment. This is then stored to be displayed to other visitors on the page. Exploit the injection vulnerability on this page, with Security Level set to low, such that any visitor that loads the page afterwards will automatically execute the BeEF hook script located at http://localhost:3333/hook.js. Explain how you were able to exploit this vulnerability, and include the exact string you used.

2. 1 Mark Open a second browser instance as a private window. Load the BeEF control panel in this new browser. Submit a screenshot of the control panel showing that the first browser was hooked successfully.

3. 1 Mark Under the Current Browser ➤ Commands tab, locate and run the Get Geolocation (Third-Party) module. Use any one of ip-api.com, geoplugin.net, or ipinfo.io as the API provider. Comment on the results: how precise was the information returned?

4. 3 Marks (total) [Background requests] Under the Current Browser ➤ Proxy ➤ Forge Request tab, force the hooked browser to make a request to /DVWA/messaging/chats/1036.php on host comp4108.ca:9999. When the request completes, the response will appear as an entry under the History tab. Double-click the entry and expand the Response Body field.
   1. 1 Mark Comment on the impact of this exploit on the hooked user. Do they have any indication that the request was made?
   2. 2 Marks Assume that you know that the hooked browser is logged into Facebook Messenger. Force the browser to make another request, with the Host changed to www.messenger.com and the path changed to /t/123456789. Comment on the response received: what are the limits of this feature, and why?
5. 4 Marks (total) [Cookie theft]
   1. 1 Mark Use the BeEF control panel to retrieve the hooked browser's session cookie. Explain how you did so. Submit a screenshot of the BeEF control panel displaying the cookie.
   2. 2 Marks With your retrieved cookie, use the curl command-line tool to make an authenticated HTTP request to DVWA. cURL is a lightweight tool for transferring data over a protocol such as HTTP. (For its man page, run man curl.) Depending on your OS, this can be accomplished in one of two ways.
      • MacOS / Linux – Run curl on your local machine to make a request to http://comp4108.ca:9999/DVWA.
      • Windows – Run curl on your VM to make a request to http://localhost:80/DVWA.
      The response HTML will indicate if you are successful: if DVWA responds with a login page, you have failed to authenticate; if it responds with its home page, you have successfully used a stolen cookie to impersonate a logged-in user. Provide the exact curl command you used.
      • Note – The BeEF control panel does not easily allow you to copy its contents. In Firefox, right-click on the element you wish to copy and select Inspect. In the displayed HTML inspector tool, right-click the highlighted HTML element, then Copy ➤ Inner HTML.
      • Hint – cURL options -L and -s will provide you with a slightly cleaner output. You can also pipe the result into grep -E "<title>.+</title>", which will return just the HTML <title> content so you can quickly identify which page you received.
   3. 1 Mark Give one example defensive measure, by an application such as this one, that could reduce the impact of cookie theft on its users.
6. 3 Marks (total) [Phishing] Use the BeEF control panel to run the Pretty Theft social engineering module, under Current Browser ➤ Commands. Change only the Dialog Type option to Generic.
   1. 1 Mark Provide a screenshot of the hooked browser as it is undergoing the social engineering attack. On the hooked browser, simulate a victim user going along with the attack by filling in the prompts, and then return to the BeEF control panel to view the results. Describe how this social engineering attack works.
   2. 2 Marks Compare the impact of a stolen authentication cookie to the impact of this social engineering attack.