SDEV 460 – Homework 2
Testing Framework and Basic Security Controls
Overview:
This homework will demonstrate your knowledge of creating a testing framework and using that
framework to conduct some basic server and web application security controls.
Assignment: Total 100 points
Using

the readings from weeks 3 and 4 as a baseline, first develop a testing

framework with these phases as guidelines for your organization or an

organization you would like to work for in the future.
• Before development begins
• During definition and design
• During development
• During deployment
• Maintenance and operations
You

will need to fill in the details for each phase by 1) describing what

each phase encompasses and 2) 3 or more activities you will engage in

for each phase. In addition, you will apply part of this framework in

the phase “During development” by engaging in three tests/security

controls outlined below to the existing SDEV virtual machine in the

default root website.
Security Controls to Test
1. Fingerprint Web Server (OTG-INFO-002)
ï‚· Use netcat, httprint or other tool to discover the web server software vendor and release. Show output of the tool output.
ï‚·

Perform online research about the discovered software vendor and

release. Report upon documented vulnerabilities with the release.
ï‚· Report upon how you would mitigate any documented vulnerabilities.
2.

Review webpage comments and metadata for information leakage

(OTG-INFO-005). Manually review the sample HTML applications in the

Apache Web Server directories
ï‚· Based upon online research, what are

three or more categories of information that would be considered

information leakage that is not acceptable?
ï‚· Review the web site to

see if there is information leakage in the SDEV information. Report upon

what you have discovered and your method of discovery.
3. Test HTTP Methods (OTG-CONFIG-006) – See which HTTP methods are available on the virtual
machine. Use Netcat or other tool against this SDEV site.
ï‚· What HTTP methods are enabled and disabled on this site? Show the output of your tool indicating the HTTP methods.
ï‚· Which methods (and why) have potentially pose a security risk for a web application. Describe
how these pose a risk.
Site Configuration:
Note: The SDEV Virtual Machine you downloaded and used for SDEV 300. The URL is here if you need to download it again: https://citeapps.umuc.edu/SDEV/
The

VM runs on the latest version of Oracle Virtual Box. Also review the

instructions for installing and configuring the VM and application under

the “Course Materials” section of the course portal. It also contains

the necessary password(s) to login as well.
Deliverables:
You should submit your source testing framework document along with the results testing the three
security

controls listed above. Screen captures should be clearly labeled

indicating exactly what the screen capture represents. Your document

should be well-organized, include page numbers, include all references

used and contain minimal spelling and grammatical errors.
Grading Rubric:
Attribute
Meets
Does not meet
Testing Framework
50 points
Develops and fills in details for the “before development begins” phase testing framework.
(10 points)
Develops and fills in details for the “during definition and design” phase testing framework.
(10 points)
Develops and fills in details for the “during development” phase testing framework.
(10 points)
Develops and fills in details for the “during deployment” phase testing framework
(10 points)
Develops and fills in details for the “maintenance and operations” phase testing framework.
(10 points)
Does not develop or fill in details for the “before development begins” phase testing framework.
Does not develop or fill in details for the “during definition and design” phase testing framework.
Does not develop or fill in details for the “during development” phase testing framework.
Does not develop and fill in details for the “during deployment” phase testing framework.
Does not develop or fill in details for the “maintenance and operations” phase testing framework.
Security Controls
30 points
Fingerprints Web Server (OTG-INFO-002) in the Apache Web Server main site. Identifies and researches Apache software version.
(10 points)
Reviews webpage comments and metadata for information leakage (OTG-INFO-005).
(10 points)
Tests

HTTP Methods (OTG-CONFIG-006) and documents which HTTP methods are

available on the virtual machine main web site. Describes risks in HTTP

methods.
(10 points)
Does not fingerprint Web Server

(OTG-INFO-002) in the Apache Web Server main site. Does not identify and

research Apache software version.
Does not review webpage comments and metadata for information leakage (OTG-INFO-005).
Does

not test HTTP Methods (OTG-CONFIG-006) and document which HTTP methods

are available on the virtual machine main web site. Does not describe

risks in HTTP methods.
Documentation and Submission
20 points
Submits source testing framework document.
(5 points)
Document includes the results from testing the three security controls listed in the instructions.
(5 points)
Screen captures are clearly labeled indicating exactly what the screen capture represents.
(5 points)
Document

is well-organized, includes page numbers, includes all references used,

and contains minimal spelling and grammatical errors.
(5 points)
Does not submits source testing framework document.
Does not include the results from testing the three security controls listed in the instructions.
Screen captures are not clearly labeled indicating exactly what the screen capture represents.
Document

is not well-organized, or include page numbers, or include all

references used, and contains multiple spelling and grammatical errors.

Do you need a similar assignment done for you from scratch? We have qualified writers to help you. We assure you an A+ quality paper that is free from plagiarism. Order now for an Amazing Discount!
Use Discount Code "Newclient" for a 15% Discount!

NB: We do not resell papers. Upon ordering, we do an original paper exclusively for you.