Namjerno ranjive računalne okoline za poučavanje i vježbu penetracijskog testiranja

professional thesis

• Title (english): Deliberately vulnerable computer environments for penetration testing education and training
• Author: Goran Pogačić
• Mentor: Miljenko Mikuc (mentor)
• Committee member: Marin Vuković (predsjednik povjerenstva)
• Committee member: Miljenko Mikuc (član povjerenstva)
• Committee member: Željko Hutinski (član povjerenstva)
• Granter: University of Zagreb; Faculty of Electrical Engineering and Computing; (Department of Telecommunications); Zagreb
• Defense date and country: 2016-03-08, Croatia
• Scientific / art field, discipline and subdiscipline: TECHNICAL SCIENCES; Computing

Abstract

Cilj specijalističkog rada je istražiti namjerno ranjive računalne okoline u svrhu poučavanja i vježbanja penetracijskog testiranja. Rad se sastoji od teoretskog i praktičnog dijela. U teoretskom dijelu rada objašnjeni su osnovni pojmovi vezani uz penetracijsko testiranje, pregled korištenih alata za penetracijsko testiranje te pregled nekoliko postojećih namjerno ranjivih računalnih okolina. Praktični dio rada se sastoji od demonstracije pojedinih ranjivosti unutar namjerno ranjivih računalnih okolina kroz njihovo iskorištavanje. Obrađeno je pet namjerno ranjivih računalnih okolina Metasploitable, Damn Vulnerable Linux (DVL), LAMPSecurity CTF8, De-ICE S2.100 i OWASP Broken Web Application (BWA) i tri namjerno ranjive web aplikacije Mutillidae, Damn Vulnerable Web Application i WebGoat. Sve obrađene namjerno ranjive računalne okoline sadrže mnoge različite ranjivosti te su pogodne za poučavanje i vježbu penetracijskog testiranja. Unatoč tome postoje razlike između okolina. Razvijanje vještine penetracijskog testiranja zahtijeva mnogo vremena i truda. Podrazumijeva duboko razumijevanje tehnologije, od poznavanja detalja mrežnih protokola i asemblerskog koda do dizajna arhitekture mreža i aplikacija. Na kraju rada donesen je zaključak o primjeni namjerno ranjivih računalnih okolina u poučavanju i vježbanju penetracijskog testiranja.

Abstract (english)

This specialist's thesis goal is to explore deliberately vulnerable computer environments for penetration testing education and training purposes. The thesis consists of theoretical and practical parts. Theoretical part has explanation of basic penetration testing terms, overview of used penetration testing tools and reviews of several existing deliberately vulnerable computer environments. Practical part is demonstration of individual vulnerabilities in deliberately vulnerable computer environments through their exploitation. Five deliberately vulnerable computer environments have been examined Metasploitable, Damn Vulnerable Linux (DVL), LAMPSecurity CTF8, De-ICE S2.100 i OWASP Broken Web Application (BWA) and three deliberately vulnerable web applications Mutillidae, Damn Vulnerable Web Application i WebGoat. All examined deliberately vulnerable computer environments incorporate many different vulnerabilities and are suitable for education and training purposes. Nevertheless, some differences between environments exist. Development of penetration testing skills requires a lot of time and effort. It implies deep understanding of technology, from knowing network protocol details and assembler code to proficiency in network and application architecture. The end of thesis contains conclusion about deliberately vulnerable computer environment usage in penetration testing education and training.

• Keywords: namjerno ranjive računalne okoline; namjerno ranjive web aplikacije; penetracijsko testiranje; iskorištavanje ranjivost
• Keywords (english): deliberately vulnerable computer environments; deliberately vulnerable computer web applications; penetration testing; exploiting vulnerabilities
• Language: croatian
• URN:NBN: urn:nbn:hr:168:921663
• Study programme: Title: Specialist study programme in information security; Study programme type: university; Study level: postgraduate specialist; Academic / professional title: Specijalist informacijske sigurnosti (Specijalist informacijske sigurnosti)
• Type of resource: Text
• File origin: Born digital
• Access conditions: Closed access
• Created on: 2022-07-20 10:14:34