Investigating python vulnerabilities

Investigating vulnerabilities in a python web server and writing a script using nmap

Project Report

The contents of your assignment should be the statement of the task, followed by your response to the task. Each task should be numbered. You may also include an appendix, listing information that is relevant to your response(s). The report should be a maximum of 2,500 words (not including front page, contents page or appendices).

Task 1
The network 192.168.3.0/24 has an IDS that is set to trigger after connections are made to 3 or more IP addresses consecutively from a single IP within 500ms or if 3 or more ports are scanned consecutively on a machine from a single IP within 500ms.
Write a script using nmap to look at TCP ports 21, 22, 23, 53, 79, 80 and 123 across the entire network to identify which IP addresses are running any of those services. Ensure that you don’t trigger the IDS of the system. It is OK to use a port scanner other than nmap. You should design the script so that it operates in the most efficient way (i.e. it executes in the shortest amount of time).

Task 2
Apython web serverthat allows a user to access files in their home directory.
You are to investigate the program to identify all of the possible vulnerabilities that could be associated with it. State exactly what investigations you do and what you find. You should also state what you consider to be the most significant vulnerability. There is no bonus to analysing both files or for demonstrating a reliable exploit. If you do analyse both files, both attempts will be marked and your highest mark recorded.

Scheme

80-100% Exemplary work that provides novel analysis for each task which is expressed with flair and precision. The work is intellectually rigorous and original.
70-79% Original thinking in the critical examination of key issues. The task responses are well thought out and proven through practical demonstration.
60-69% A clear, balanced and coherent analysis for each task. They present a detailed understanding of knowledge and the theory is expressed with clarity and interest.
50-59% Demonstration of a thorough knowledge of relevant theory and methods and use these to produce coherent responses to the tasks. However, little effort has been made to expand upon well known examples.
40-49% Demonstration of a grasp of key concepts and technology, a familiarity with security and an understanding of the relevant theoretical and methodological issues. The responses to the tasks is coherent, but would typically be considered trivial. No effort has been made to expand upon well known examples that can be easily found.

3.2 Fail Grades

30-39% There is some knowledge of relevant concepts and technology but with significant gaps. This will be evidenced in the response to the tasks, where there is only a trivial attempt.
0-29% Failure to grasp basic knowledge and concepts and they demonstrate a misunderstanding of key ideas. There is no thought-out process and there is a lack of any real attempt at the tasks.

3.3 Grammar Assessment
The following demonstrates the marks that may be deducted for grammatical or typographical errors.
-10 A word is spelt incorrectly that should have been found with a spell checker or the lack of the use of paragraphs and sentences, any use of ‘i’ rather than I.
-9 to -7 Common misspelling of words such as “whether” and “weather” and “there” and
“their”, inaccurate capitalization of the first letter of nouns rather than proper nouns, inaccurate use of units (mb rather than MB).
-6 to -5 Consistent lack of the correct use of the apostrophe indicating possessive rather than plural, common use of the wrong words, “there is a different in the use of” rather than “there is a difference in the use of”.
-4 to -3 Not referring to any tables, figures or appendices in the report.
-2 Consistent inaccurate use of the comma.
-1 Very few mistakes and all written in the first person.
-0 Very few mistakes and written in the third person with no use of colloquial English.