SOFTWARE DEVELOPMENT

1 Homework 2 Demonstrating Insecure Interaction between Components Over view In this homework you use Netbeans to create two different unique and complete demonstrations of insecure interaction between components such as SQL Injection, Command Line Injection, Cross -Site Scripting , Unrestricted Upload of File with Dangerous Type, Cross -Site Request Forgery (CSRF), and URL Redire ction to Untrusted Site ('Open Redirect') . You will demonstrate and describe how to fix each of the problems. Therefore , a total of four code samples will be created. T wo will have insecure interaction between components and two will have the issues fixed. Assignment Details Be sure you have carefully read and understand the materials in week 1 and 2 as well as successfully configured your environment. 1. Select 2 CWE/SANS Top 25 vulnerabilities under the category of Insecure Interaction between Components. Review and try the existing examples in links in the classroom . Use Netbeans to experiment. Work in multiple languages where possible. 2. Using Netbeans, create your own unique , full example for each of the 2 vulnerabilities in th is category. Note: by uniqu e and full I mean, this should not just be a code snippet. It should be part of a small application. In other words, you need to adapt the examples provided in the documentation to something more meaningful and substantive. It doesn’t have to be a large, overly comple x application, but it needs to be complete, and runnable and demonstrate how this vulnerability may appear in the real world. 3. Demonstrate for each of the two applications they are vulnerable to this attack. You need to show explicitly the attack you use and demonstrate the impact of the vulnerability. The demonstration should occur through screen shots and detailed walkthrough of the steps you performed. 4. Finally, using the information in the CWE/SANS Top 25 vulnerabilities, fix the issues i n each of the two examples you created in step 2. 5. Document the vulnerabilities and describe specifically how the issues were corrected. Note: You may need to conduct additional research to better understand the vulnerability or the features associated wit h a specific language. Deliverables Provide all of your source files for this assignment . T wo source code files will have software vulnerabilities. The remaining t wo will have the issues fixed. Provide any supplemental or utility files supporting your ma in source files. Prepare a word or PDF file describing and demonstrating the vulnerabilities in each of your source files and specifically how you fixed the issue. You should demonstrate with properly labeled screen captures and code within the document to report your find ings. Note: Be sure to provide all screen 2 shots in one word of PDF document. You can compress the files using a zip application for easier upload. Grading Rubric: Attribute Meets Does not meet Vulnerabilities 50 points Selec ts 2 CWE/SANS Top 25 vulnerabilities under the category of Insecure Interaction between Components . (10 points) Create s unique , full example for each of the 2 vulnerabilities in this category . (20 points) Demonstrate s for each application , they are vulnerable to an attack . (20 points) 0 points Does not s elect 2 CWE/SANS Top 25 vulnerabilities under the category of Insecure Interaction between Components . Does not c reate unique , full example for each of the 2 vulnerabilities in th is category . Does not d emonstrate for each application , they are vulnerable to an attack . Mitigation 25 points Fixes the issues i n each of the two examples you created. (25 points) 0 points Does not f ix the issues i n each of the two examples you created. Documentation and submissions 25 points Provide s all source files (those with vulnerabilities, those fixed and any supplemental files needed to run the application . (5 points) Within a word or PDF file, documents vulnerabilities and describe specifically how the issues were corrected . (10 points) Demonstrate s with properly labeled screen captures and code within the document to report your find ings. (10 points) 0 points Does not p rovide all source files (those with vulnerabilities, those fixed and any supplemental files needed to run the application . Within a word or PDF file, does not document vulnerabilities and describe specifically how the issues were corrected . Does not d emonstrate with properly labeled screen captures and code within the document to report your find ings.