Question 2 (a) Draw an attack tree showing some of the ways in which a mail server might be attacked. Your attack tree s

[answerhappygod]

Question 2 A Draw An Attack Tree Showing Some Of The Ways In Which A Mail Server Might Be Attacked Your Attack Tree S 1 (143.55 KiB) Viewed 12 times

Question 2 A Draw An Attack Tree Showing Some Of The Ways In Which A Mail Server Might Be Attacked Your Attack Tree S 2 (76.91 KiB) Viewed 12 times

Question 2 (a) Draw an attack tree showing some of the ways in which a mail server might be attacked. Your attack tree should have two levels below the root and should have at least three attack paths representing different types of attack. [4 marks] (b) Many e-Commerce web sites allow their customers to post feedback about products purchased from the site. What are the precise conditions required for a cross-site scripting attack involving such a web site to succeed? [5 marks] (c) A system adminstrator is managing a web application for her employer. The application is database-driven and runs on a Unix system. She runs intrusion detection software to scan the web server logs for suspicious activity. This software highlights the following pair of URLS: http://foo.com/2e%2e%2f%2e%2e%2fetc%2fpasswd http://foo.com/login?username=aaa%27+OR+1%3d1+--+ You may wish to use information from Figure 1 on page 4 to help you interpret these URLS when answering the questions below. (i) Consider the first of these URLs. What type of attack does this indicate? What is the attacker attempting to achieve? [3 marks] (ii) Describe a technique that the web server could use to defend itself against the attack indicated by the first URL. [2 marks] (iii) Consider the second URL. What type of attack does this indicate? What is the attacker attempting to achieve? [3 marks] (iv) The attack indicated by the second URL is unsuccessful. What does this suggest about how the web application has been implemented? [3 marks] [Question 2 total: 20 marks]

Hex Char Dec Bin Hex Char 32 0010 0000 20 space 64 0100 0000 40 33 0010 0001 21 ! 65 0100 0001 41 34 11 0010 0010 22 66 0100 0010 42 35 0010 0011 23 # 67 0100 0011 43 36 0010 0100 24 $ 68 0100 0100 44 37 0010 0101 25 8 69 0100 0101 45 38 0010 0110 26 & 70 0100 0110 46 F 39 27 F 0010 0111 71 0100 0111 47 G 40 0010 1000 28 ( 72 0100 1000 48 H 41 0010 1001 29 ) 73 0100 1001 49 42 0010 1010 2A * 74 0100 1010 4A 43 0010 1011 2B + 75 0100 1011 4B 0010 1100 2C 76 0100 1100 45 0010 1101 2D 77 0100 1101 46 0010 1110 2E 78 0100 1110 4E 47 0010 1111 2F 79 0100 1111 48 0011 0000 30 80 0101 0000 50 49 0011 0001 31 81 0101 0001 51 50 0011 0010 32 82 0101 0010 52 51 0011 0011 33 83 0101 0011 53 52 0011 0100 34 84 0101 0100 54 53 0011 0101 35 85 0101 0101 55 54 0011 0110 36 86 0101 0110 56 55 0011 0111 37 87 0101 0111 57 56 0011 1000 38 8 88 0101 1000 58 57 0011 1001 39 9 89 0101 1001 59 58 0011 1010 3A 90 0101 1010 5A 59 0011 1011 3B 91 0101 1011 5B [ 60 0011 1100 3C < 92 0101 1100 5C 1 61 0011 1101 3D 93 0101 1101 5D ] 62 0011 1110 3E 94 0101 1110 5E 95 0101 1111 5F 63 0011 1111 3F ? Figure 1: Selected ASCII characters and their numeric representations. 1 0 1 L55 AWNI 2 3 4 6 7 VII JV Dec Bin SWNTO60 4C 4D 4F ADUAN А B с E HANNOPORSERS EX N I J K L M T U W Y