Assignment 1
Assessment Type: Group assignment. Maximum of 2 people are allowed in a group. Submit online via
1. Overview
The objective of Assignment 1 is to evaluate your knowledge of the topics covered in Lectures 1-3. Topics include an overview of the E-Commerce system, common security attacks on E-Commerce websites, protecting E-commerce sites using well-known approaches, and some fundamentals of crypto protocols that are used for securing electronic commerce. Assignment 1 will focus on developing your abilities in identifying security flaws in an e-commerce website and securing the e-commerce application using some of the well-known approaches. Assignment 1 contains several problems related to the topics mentioned above. You are required to prepare the solutions with the description of the step-by-step processes as a single PDF or MS Word file and the necessary codes.
There are 4 (four) questions in Assignment-1. Q1 is related to different security attacks that can be performed on an e-commerce website. On the other hand, Q2 to Q4 are related to some of the popular protection methods that are used in e-commerce applications. Protection methods include Google’s ReCaptcha V2 and V3, email, multifactor authentication, and Google’s two-factor authentication (2FA) framework.
If there are questions, you must ask via the relevant Canvas discussion forums in a general manner.
Overall, you must follow the following special instructions:
● You must fulfill the requirements in the questions.
● Create a group of a maximum of 2 people and perform the tasks as a group.
● For the questions that require implementation, you must implement the functionalities stated in the questions. Any change in a user interface is acceptable if the functionality is there.
● You must submit the solutions as a report on CANVAS. In your solution, you must show all the steps with necessary code segments and screenshots for each question.
● Upload your solution as a single PDF or Word document in CANVAS. Also, upload codes as a single ZIP file in the CANVAS.
● Do not put the PDF within the ZIP file.
2.Assessment Criteria
This assessment will determine your ability to:
● Follow requirements provided in this document and in the lessons.
● Independently solve a problem by using concepts taught over the first four weeks of the course.
● Meeting deadlines.
3.Learning Outcomes
This assessment is relevant to the following Learning Outcomes:
● CLO 1: Explain the security requirements of an e-commerce application.
● CLO 2: Identify and analyze key threats by launching attacks on e-commerce applications.
4.Assessment details
Please ensure that you have read Sections 1 to 3 of this document before going further. Assessment details (i.e., questions Q1 to Q4) are provided on the next page.
In this assignment, you will perform an XSS and SQL Injection attack. You will learn to exploit these common web application vulnerabilities by injecting malicious scripts and manipulating database queries. By executing these attacks, you will gain insights into the potential risks and understand the importance of implementing effective preventive measures.
In Tutorial 1, you already taught how to run bWAPP from Docker Container. (Please refer to Tutorial 1 if you have not installed Docker and bWAPP)
In the login tab it will show you the login interface to the lab (see Figure-1.3:). Login with User: bee and Password: bug and change the difficulty to MEDIUM.
Figure-1.3: Login Page for the Lab
Figure-1.4 shows the main page of the bWAPP. On the right side, click on the dropdown menu under “Choose your bug”
Figure-1.4: bWAPP Lab interface
Figure-1.5 show you the list of attacks that you can do for this assignment. Each category of the attack will start with “/A – AttackLabName/”.
Figure-1.5: List of Possible Attack Lab
For this assignment, you need to perform 2 Attacks in SQL Injections and 2 Attacks in Cross-Site Scripting (XSS) from the list shown in Figure-1.6 and Figure-1.7:
SQL Injections Lab List (Under /A1 – Injection/) XSS Lab List (Under /A3 – Cross-Site Scripting (XSS)/)
Figure-1.6: List of SQL Attack Lab Figure-1.7: List of XSS Attack Lab
Once you have selected the attack, click the “hack” button next to the list of the attack (see Fig. 1.8).
Figure-1.8: Hack Button
To complete the requirements of this task, your group are required to perform the attacks on the given lab categories using the knowledge you have learned from Tutorial 2. For each of the attacks, write down all the necessary steps to launch each attack with screenshots.
What is considered a successful attack?
● XSS: Successfully displaying any pop-up or alert on the webpage.
● SQL Injection: Successfully gaining access by logging in, displaying credentials, or revealing the database version.
Create an E-Commerce application shown in Figure-2.1. Only registered users should be authorized to log in to the Ecommerce application and trade. A registered user can be either a seller or a buyer who needs to create a user account. It is possible that several fake users are created by human attackers or software bots to hamper the operation of the ECommerce application. To protect the E-Commerce application from spam and abuse, Alice requests you to integrate CAPTCHA into her E-Commerce application.
Considering the security strength of Google’s reCAPTCHA service, you have decided to integrate it in Alice’s application. a) From the knowledge you have learned in the Tutorial, implement Google’s reCAPTCHA version 2:
i. Design a form similar to the one given in Figure-2.1 to create a user account with Google’s reCAPTCHA version 2. ii. Show step-by-step processes, with appropriate code segments and screenshots, how Google’s reCAPTCHA version 2 can be applied in the E-Commerce application to prevent creating fake user accounts.
Figure-2.1: Expected User Registration Page enabled with Google’s reCAPTCHA version 2
b) You have found that Google has a new version of its reCAPTCHA, which is reCAPTCHA version 3. When you informed Alice about the reCAPTCHA version 3, she was convinced that reCAPTCHA version 3 is better.
To make Alice happy:
i. Design a form similar to the one shown in Figure-2.2 to create user accounts with Google’s reCAPTCHA version 3.
ii. Show step-by-step processes, with appropriate code segments and screenshots, how Google’s reCAPTCHA version 3 can be applied in the E-Commerce application to prevent creating fake user accounts. iii. What are the advantages of using reCAPTCHA version 3?
Figure-2.2: User Registration Page enabled with Google’s reCAPTCHA version 3
Once user accounts have been created, only valid users should be allowed to log in and trade using Alice’s E-Commerce application. However, attackers can still compromise the login system with the aid of some sophisticated software. So, you have decided to integrate the multi-factor authentication in Alice’s E-Commerce application.
Develop an Email-based multi-factor authentication for Alice’s E-Commerce application that has the following requirements.
Requirements:
i. Create a simple login form, as shown in Figure-3.1. The “Email” field should only accept text in email format, and the “Password” field should be in password format. When a user provides a valid email (your RMIT student email) and password (e.g., 1234), the user should receive a 6-digit random number in his/her email address as shown in Figure-3.2 and the page to be shown as presented in Figure-3.3.
ii. Once the verification code is provided in the form shown in Figure-3.3, the code should be verified, and the Success Page is shown (see Figure-3.4). Otherwise, the Failure Page is shown (see Figure-3.5).
Figure-3.1: Login Form for Email-based Two Factor Authentication
Figure-3.2: Email containing the 6-digit Two Factor Authentication code
Figure-3.3: Form to Enter the Verification Code
Figure-3.4: Success Page shown if a valid code is entered.
Figure-3.5: Failure Page shown if an invalid code is entered.
Once user accounts have been created, only valid users should be allowed to log in and trade using Alice’s E-Commerce application. However, attackers can still compromise the login system by performing a password-guessing attack. To prevent an attacker from getting access to the application by simply knowing the password, you have decided to integrate the multi-factor authentication in Alice’s E-Commerce application.
Apply Google’s 2-step verification (e.g.2FA, also called 2 Factor Authentication or 2FA) to user accounts of the E-Commerce application. You need to perform the followings:
A. Create a login form (as shown in Figure-4.1) that would allow you to enter your Email and password. The “Email” field should only accept text in email format, and the “Password” field should be in password format. Next, provide steps with the necessary code segment and screenshots of how you have integrated Goggle’s 2FA in Alice’s ECommerce application.
Figure-4.1: Login Form with Google’s 2-Factor Authentication
B. Once a user enters the correct email and password, a screen (like Figure-4.2 or 4.3) should prompt the user to enter a 2-step verification code as follows:
Figure-4.2: Google’s Form to enter verification code in Google’s 2 Factor Authentication
Figure-4.3: Another Google’s Form to enter verification code in Google’s 2 Factor Authentication
Extra Question for Learning purpose only (This question will not be assessed
Design an SMS-based two-factor authentication (2FA) framework and show step-by-step process to implement it in Alice’s E-Commerce application. In your designed 2FA framework, the E-commerce website should send an SMS to the verified user’s mobile phone number each time a user provides a valid username and password. The verification code should be a unique short-lived code. Figure-4.4 shows an overview of the system. Show steps with necessary code segments and screenshots.
Figure-4.4: Overview of SMS-based 2 Factor Authentication system
● Acknowledged words, data, diagrams, models, frameworks and/or ideas of others you have quoted (i.e. directly copied), summarized, paraphrased, discussed or mentioned in your assessment through the appropriate referencing methods,
● Provided a reference list of the publication details so your reader can locate the source if necessary. This includes material taken from Internet sites.
● Failure to properly document a source
6. Assessment declaration
When you submit work electronically, you agree to the
10 of 12
7. Rubric/assessment criteria for marking
All of the computations must be correct and only provided values must be used. Instructions must be followed.
Criteria
The characteristic or outcome that is being judged. Total
5pts
Question 1
Security Attacks on
E-Commerce Websites 0pts
Not answered.
Question 2
Securing E-Commerce
Website from Spam and
Abuse 6pts
Not answered. 6 pts
4pts
Answered correctly with detail step-by-step process.
Answer is correct, and detail stepby-step process is shown.
Answer is partially correct, and detail step-by-step process is NOT shown. Explanations are not satisfactory and, the student
cannot answer the question
Question 3
Simple Multi-Factor
Authentication 0pts
Not answered. 4 pts
10pts
Both Q4(a) and Q4(b) are answered correctly with 8pts
Any 1 of the followings is satisfied: 1) Only Q4(a) is 4pts
Any 1 of the followings is satisfied: 1) Both Q4(a) and 2pts
Both Q4(a) and Q4(b) are attempted. But, answered are
Question 4 0pts
Not answered. 10 pts
Advanced Multi-Factor Authentication required
Total Point
25 pts
Page 13 of 13
