Skip to content

CW 2: Penetration Test Report

Assessment brief

View as Coursework Brief

Submission Informtion

Handout Date 20/9/2021
Due Date 3/12/2021
Estimated Effort 20 Hours
Percentage of Module Mark 100%

ILO's Assessed

  • 1. Use appropriate tools to discover the structure of a network, the services running on it, and identify and classify potential security flaws
  • 2. Demonstrate understanding of the core theoretical concepts that lead to insecurity in computer systems, and how there can be used to exploit and mitigate threats identified in a computer system or network
  • 3. Discuss common penetration testing methodologies, vulnerability risk rating systems and how they relate to the security audit process

Task and Mark Distribution

In this assignment you will need to write a comprehensive pen-test report on ONE of the challenge systems provided in the labs.

Unlike in CW1 where you are expected to give an overview of the portfolio tasks. The report should be aimed at a non technical audience, and provide a detailed description of the process used to identify any vulnerabilities, methods used to exploit, and relevant suggestions for mitigation.

You should refer back to the generic pentest process discussed in the class, and discuss how the information gathered at each stage informed the decisions made.

You will also need to provide some discussion around the issues discovered. Providing an explanation of the cause of the problems, links to other similar real world examples, discussion of the risk involved.

Example Pen Test Process

A Generic Penetration test process discussed in class was:

  • Scope
  • Reconnaissance
  • Exploitation
  • Post-Exploitation

Your report should address each of these stages:

SCOPE

As there is no formal contract defined, your scope stage should discuss any assumptions you make around the process. What methods of testing are you going to use, are there elements that are out of scope etc.

Reconnaissance

Discussion of recon methodology, and any tools used. Results, and analysis of the reconnaissance phase. This may stage should also include any reconnaissance from post initial foothold on the system.

Exploitation

Description of any tools, techniques and strategies for the exploitation phase. Discussion of the vulnerabilities found, and how you were able to exploit them.

As with reconnaissance, this should include details of any further exploitation after the initial foothold.

Post Exploitation

Suggestions for mitigation, and any other post-exploit tasks carried out.

Marking Scheme

Element Marks Available
Introduction / Conclusions 10
Pen Test Report 60
*Discussion of issues Raised / Suggestions for mitigation 20
Report Structure 10

Suggested Report Structure

The recommended structure for the report is

  1. Introduction
  2. Results of the Security Audit
  3. Discussion and Suggestions for Mitigation
  4. Summary
  5. References

Marking Matrix

Grade Mark Description
No submission 0 No work submitted
Fail 0-25 Clear failure demonstrating little understanding of relevant theories, concepts and issues. Minimal evidence of research and use of established methodologies and incomplete knowledge of the area. Serious and fundamental errors and aspects missing. No evidence of research.
Near Fail 25-39 Very limited understanding of relevant theories, concepts and. Little evidence of research and use of established methodologies. Some relevant material will be present. Deficiencies evident in analysis. Fundamental errors and some misunderstanding likely to be present.
Pass 40-49 Meets the learning outcomes with a basic understanding of relevant theories, concepts and issues.. Demonstrates an understanding of knowledge and subject-specific theories sufficient to deal with concepts. Assessment may be incomplete and with some errors. Research scope sufficient to evidence use of some established methodologies. Some irrelevant material likely to be present
2:2 50-59 Good understanding of relevant theories, concepts and issues with some critical analysis. Research undertaken accurately using established methodologies, enquiry beyond that recommended may be present. Some errors may be present and some inclusion of irrelevant material. Good understanding, with evidence of breadth and depth, of knowledge and subject-specific theories with indications of originality and autonomy
2:1 60-69 Very good work demonstrating strong understanding of theories, concepts and issues with clear critical analysis. Thorough research, using established methodologies accurately, beyond the recommended minimum with little, if any, irrelevant material present. Very good understanding, evidencing breadth and depth, of knowledge and subject-specific theories with some originality and autonomy.
First 70-79 Excellent work with clear evidence of understanding, creativity and critical/analytical skills. Thorough research well beyond the minimum recommended using methodologies beyond the usual range. Excellent understanding of knowledge and subject-specific theories with evidence of considerable originality and autonomy.
Outstanding 80-90 Outstanding work with high degree of understanding, creativity and critical/analytical skills. Outstanding understanding of knowledge and subject-specific theories. Evidence of outstanding research well beyond minimum recommended using a range of methodologies. Demonstrates creative flair, originality and autonomy.
Exceptional 90-100 Exceptional work with very high degree of understanding, creativity and critical/analytic skills. Evidence of exceptional research well beyond minimum recommended using a range of methodologies. . Exceptional understanding of knowledge and subject-specific theories. Demonstrates creative flair, a high degree of originality and autonomy.