[SOLVED] INTE1070/1071 Assignment 1 Solution

         1.    Overview

The objective of Assignment 1 is to evaluate your knowledge of the topics covered in Lectures 1-3. Topics include an overview of the E-Commerce system, common security attacks on E-Commerce websites, protecting E-commerce sites using well-known approaches, and some fundamentals of crypto protocols that are used for securing electronic commerce. Assignment 1 will focus on developing your abilities in identifying security flaws in an e-commerce website and securing the e-commerce application using some of the well-known approaches. Assignment 1 contains several problems related to the topics mentioned above. You are required to prepare the solutions with the description of the step-by-step processes as a single PDF or MS Word file and the necessary codes.

There are 4 (four) questions in Assignment-1. Q1 is related to different security attacks that can be performed on an e-commerce website. On the other hand, Q2 to Q4 are related to some of the popular protection methods that are used in e-commerce applications. Protection methods include Google’s ReCaptcha V2 and V3, email, multifactor authentication, and Google’s two-factor authentication (2FA) framework.

Develop the solution of this assignment in an iterative fashion (as opposed to completing it in one sitting). You should be able to start preparing your answers immediately after Lecture-1 (in Week-1). At the end of each week starting from Week-1 to Week-3, you should be able to solve at least one question.

If there are questions, you must ask via the relevant Canvas discussion forums in a general manner.

Overall, you must follow the following special instructions:

• You must fulfill the requirements in the questions.
• Create a group of a maximum of 2 people and perform the tasks as a group.
• For the questions that require implementation, you must implement the functionalities stated in the questions. Any change in a user interface is acceptable if the functionality is there.
• Your works must be demonstrated to your tutor. Date and time will be announced separately. No demo, no marks.
• You must submit the solutions as a report on CANVAS. In your solution, you must show all the steps with necessary code segments and screenshots for each question.
• Upload your solution as a single PDF or Word document in CANVAS. Also, upload codes as a single ZIP file in the CANVAS.
• Do not put the PDF within the ZIP file.

         2.    Assessment Criteria

This assessment will determine your ability to:

• Follow requirements provided in this document and in the lessons.
• Independently solve a problem by using concepts taught over the first four weeks of the course.
• Meeting deadlines.

         3.    Learning Outcomes

This assessment is relevant to the following Learning Outcomes:

• CLO 1: Explain the security requirements of an e-commerce application.
• CLO 2: Identify and analyze key threats by launching attacks on e-commerce applications.

         4.    Assessment details

Please ensure that you have read Sections 1 to 3 of this document before going further. Assessment details (i.e., questions Q1 to Q4) are provided on the next page.

Q1. Security Attacks on E-Commerce Websites (5 Marks)

In this assignment, you will perform an XSS and SQL Injection attack. You will learn to exploit these common web application vulnerabilities by injecting malicious scripts and manipulating database queries. By executing these attacks, you will gain insights into the potential risks and understand the importance of implementing effective preventive measures.

In Tutorial 1, you already taught how to run bWAPP from Docker Container. (Please refer to Tutorial 1 if you have not installed Docker and bWAPP)

In the login tab it will show you the login interface to the lab (see Figure-1.3:). Login with User: bee and Password: bug and change the difficulty to MEDIUM.

Figure-1.3: Login Page for the Lab

Figure-1.4 shows the main page of the bWAPP. On the right side, click on the dropdown menu under “Choose your bug”

Figure-1.4: bWAPP Lab interface

Figure-1.5 show you the list of attacks that you can do for this assignment. Each category of the attack will start with “/A – AttackLabName/”.

Figure-1.5: List of Possible Attack Lab

For this assignment, you need to perform 2 Attacks in SQL Injections and 2 Attacks in Cross-Site Scripting (XSS) from the list shown in Figure-1.6 and Figure-1.7:

            SQL Injections Lab List (Under /A1 – Injection/)                 XSS Lab List (Under /A3 – Cross-Site Scripting (XSS)/)

                                 Figure-1.6: List of SQL Attack Lab                                          Figure-1.7: List of XSS Attack Lab

Once you have selected the attack, click the “hack” button next to the list of the attack (see Fig. 1.8).

Figure-1.8: Hack Button

To complete the requirements of this task, your group are required to perform the attacks on the given lab categories using the knowledge you have learned from Tutorial 2. For each of the attacks, write down all the necessary steps to launch each attack with screenshots.

What is considered a successful attack?

• XSS: Successfully displaying any pop-up or alert on the webpage.
• SQL Injection: Successfully gaining access by logging in, displaying credentials, or revealing the database version.

Q2. Securing E-Commerce Website from Spam and Abuse (2+4 = 6 Marks)

Create an E-Commerce application shown in Figure-2.1. Only registered users should be authorized to log in to the E-commerce application and trade. A registered user can be either a seller or a buyer who needs to create a user account. It is possible that several fake users are created by human attackers or software bots to hamper the operation of the E-Commerce application. To protect the E-Commerce application from spam and abuse, Alice requests you to integrate CAPTCHA into her E-Commerce application.

Considering the security strength of Google’s reCAPTCHA service, you have decided to integrate it in Alice’s application.

1. a) From the knowledge you have learned in the Tutorial, implement Google’s reCAPTCHA version 2:
2. Design a form similar to the one given in Figure-2.1 to create a user account with Google’s reCAPTCHA version 2. ii. Show step-by-step processes, with appropriate code segments and screenshots, how Google’s reCAPTCHA version 2 can be applied in the E-Commerce application to prevent creating fake user accounts.

Figure-2.1: Expected User Registration Page enabled with Google’s reCAPTCHA version 2

3. b) You have found that Google has a new version of its reCAPTCHA, which is reCAPTCHA version 3. When you informed Alice about the reCAPTCHA version 3, she was convinced that reCAPTCHA version 3 is better.

To make Alice happy:

2. Design a form similar to the one shown in Figure-2.2 to create user accounts with Google’s reCAPTCHA version 3.
3. Show step-by-step processes, with appropriate code segments and screenshots, how Google’s reCAPTCHA version 3 can be applied in the E-Commerce application to prevent creating fake user accounts. iii. What are the advantages of using reCAPTCHA version 3?

Figure-2.2: User Registration Page enabled with Google’s reCAPTCHA version 3

Q3. Simple Multi-Factor Authentication (4 Marks)

Once user accounts have been created, only valid users should be allowed to log in and trade using Alice’s E-Commerce application. However, attackers can still compromise the login system with the aid of some sophisticated software. So, you have decided to integrate the multi-factor authentication in Alice’s E-Commerce application.

Develop an Email-based multi-factor authentication for Alice’s E-Commerce application that has the following requirements.

Requirements:

3. Create a simple login form, as shown in Figure-3.1. The “Email” field should only accept text in email format, and the “Password” field should be in password format. When a user provides a valid email (your RMIT student email) and password (e.g., 1234), the user should receive a 6-digit random number in his/her email address as shown in Figure-3.2 and the page to be shown as presented in Figure-3.3.
4. Once the verification code is provided in the form shown in Figure-3.3, the code should be verified, and the Success Page is shown (see Figure-3.4). Otherwise, the Failure Page is shown (see Figure-3.5).

Figure-3.1: Login Form for Email-based Two Factor Authentication

Figure-3.2: Email containing the 6-digit Two Factor Authentication code

Figure-3.3: Form to Enter the Verification Code

Figure-3.4: Success Page shown if a valid code is entered.

Figure-3.5: Failure Page shown if an invalid code is entered.

Q4. Advanced Multi-Factor Authentication (10 Marks)

Once user accounts have been created, only valid users should be allowed to log in and trade using Alice’s E-Commerce application. However, attackers can still compromise the login system by performing a password-guessing attack. To prevent an attacker from getting access to the application by simply knowing the password, you have decided to integrate the multi-factor authentication in Alice’s E-Commerce application.

Apply Google’s 2-step verification (e.g.2FA, also called 2 Factor Authentication or 2FA) to user accounts of the E-Commerce application. You need to perform the followings:

4. Create a login form (as shown in Figure-4.1) that would allow you to enter your Email and password. The “Email” field should only accept text in email format, and the “Password” field should be in password format. Next, provide steps with the necessary code segment and screenshots of how you have integrated Goggle’s 2FA in Alice’s E-Commerce application.

Figure-4.1: Login Form with Google’s 2-Factor Authentication

4. Once a user enters the correct email and password, a screen (like Figure-4.2 or 4.3) should prompt the user to enter a 2-step verification code as follows:

Figure-4.2: Google’s Form to enter verification code in Google’s 2 Factor Authentication

Figure-4.3: Another Google’s Form to enter verification code in Google’s 2 Factor Authentication

Extra Question for Learning purpose only (This question will not be assessed

Design an SMS-based two-factor authentication (2FA) framework and show step-by-step process to implement it in Alice’s E-Commerce application. In your designed 2FA framework, the E-commerce website should send an SMS to the verified user’s mobile phone number each time a user provides a valid username and password. The verification code should be a unique short-lived code. Figure-4.4 shows an overview of the system. Show steps with necessary code segments and screenshots.

Figure-4.4: Overview of SMS-based 2 Factor Authentication system

5.    Academic integrity and plagiarism (standard warning)

Academic integrity is about honest presentation of your academic work. It means acknowledging the work of others while developing your own insights, knowledge and ideas. You should take extreme care that you have:

• Acknowledged words, data, diagrams, models, frameworks and/or ideas of others you have quoted (i.e. directly copied), summarized, paraphrased, discussed or mentioned in your assessment through the appropriate referencing methods,
• Provided a reference list of the publication details so your reader can locate the source if necessary. This includes material taken from Internet sites.

If you do not acknowledge the sources of your material, you may be accused of plagiarism because you have passed off the work and ideas of another person without appropriate reference, as if they were your own.

RMIT University treats plagiarism as a very serious offence constituting misconduct. Plagiarism covers a variety of inappropriate behaviors, including:

• Failure to properly document a source
• Copyright material from the internet or databases Collusion between students

For further information on our policies and procedures, please refer to the University website.

6.    Assessment declaration

When you submit work electronically, you agree to the assessment declaration.

10 of 12

7.                        Rubric/assessment criteria for marking

All of the computations must be correct and only provided values must be used. Instructions must be followed.

Page 13 of 13