Week 5: Network Attacks, Malware, and Web Application Security
Week of Sun, Sep 20 · week closes Sat, Sep 26
This week's items
- Weekly Quiz 5points in Canvas
- Discussion Board 5points in Canvas
- Lab 5points in Canvas
Exact due times are in Canvas. Late assignments are NOT accepted. Complete all assignments before the due date.
Read this week
- TestOut Ethical Hacker Pro — Ch 13–15 — Commercial text; named here for reference.
- OWASP Web Security Testing Guide — Free — definitive open-source guide to web application security testing.
- OWASP Top 10 (2021) — Free — the ten most critical web application security risks.
Know these cold
- Packet sniffing captures network traffic for analysis — Wireshark is the standard tool; ethical use requires being on an authorized network segment.
- Session hijacking exploits the stateful nature of web sessions by stealing or predicting session tokens — countermeasures include HTTPS everywhere and post-auth token rotation.
- ARP poisoning sends forged ARP replies to associate the attacker's MAC with a legitimate IP — enabling man-in-the-middle traffic interception on local segments.
- Malware taxonomy: virus (self-replicates in files), worm (self-replicates across networks without a host file), Trojan (masquerades as legitimate software), ransomware (encrypts data for extortion), rootkit (hides malware presence).
- SQL injection inserts database commands into input fields — prevented definitively by parameterized queries (prepared statements).
- XSS (Cross-Site Scripting) injects scripts into pages served to other users — executes in the victim's browser to steal cookies or redirect sessions.
- CSRF tricks an authenticated user's browser into submitting unauthorized requests to a trusted site — prevented by CSRF tokens and SameSite cookie attribute.
- Standards: Maryland Blueprint Pillar 3 · CEH v12 Domain 8 (Sniffing) + Domain 9 (Session Hijacking) + Domain 12 (Web Apps) · PGCC Outcomes 3, 4, 5.
Meerk's quiz — open the Week 5 gate
10 questions, no time limit. 85% on your first attempt in a 24-hour window opens the gate. Retakes inside the window are practice — they help you learn, they don't count. Work alone; the point is to know it, not to have seen it.
Dinner Table Question
Ask at home: A login form reflects back exactly what you typed as an error message. What vulnerability does this suggest, and what do you test for first?
En español: Un formulario de inicio de sesión repite exactamente lo que escribiste como mensaje de error. ¿Qué vulnerabilidad sugiere esto?