**this is done in a virtual machine, we would have to do a zoom meeting.** Scenario: The CyberApolis Water Company has been taken over by the Carbon Spector terrorist organization. The employees ar

**this is done in a virtual machine, we would have to do a zoom meeting.** 

Scenario:

The CyberApolis Water Company has been taken over by the Carbon Spector terrorist organization. The employees are being held hostage and Carbon Spector has opened the dam’s flood gates and is trying to flood the city of CyberApolis. 

You are a DHS security specialist and you have been tasked to hack into the CyberApolis water company (water.cyberapolis.gov), gain access to the HMI Controls, and shut the dam’s flood gates. 

Executive Summary:Write a 3-5 sentence summary outlining how you were able to complete assigned tasks. Your target audience includes the CEO of a company, the FBI Assistant Director in Charge of the CyberApolis Field Office, and the Mayor of CyberApolis -- all of which have no technical knowledge or expertise. Do not provide in-depth details; discuss concepts and trends that led to your success.  

Technical Report:

CyberApolis security technicians have formally requested that DHS provides answers for several important questions that can assist with their own internal investigation. Your supervisor has instructed you to provide detailed answers to their questions. As part of your technical report, you will provide screenshots and step-by-step procedures. 

Specifically discuss Reconnaissance (25 pts), Scanning (25 pts), Exploitation (25 pts), and Strong Mitigations (25 pts). 

Separately at the end of the document answer the following questions. (10 points/question)

1. What Username(s) did you find that could access the dam controls?
2. What password hash(es) did you find that could access the dam controls?
3. What password(s) were associated with the dam operator’s account?
4. Was there any metadata required to complete your task? If so, what was it and where did you find it?
5. What vulnerabilities did you identify in the CyberApolis Water Company’s website?
6. Which set of credentials granted you access to the admin website?
7. Which set of credentials granted you access to the HMI controls?

5 Points: Provide a screenshot that verifies you closed the flood gates.