1. MIS 5212.001 Week 5 Site: http://community.mis.temple.edu/mis5212sec001s15/ http://community.mis.temple.edu/mis5212sec001s15/

2.  Test 1  In the news  Introduction to WebGoat  Next Week  Presentation 1 2MIS 5212.001

3. 3

4.  Submitted  http://www.dailydot.com/news/chipotle-twitter-hack/ http://www.dailydot.com/news/chipotle-twitter-hack/  http://www.csoonline.com/article/2882195/data- breach/researcher-releases-10-million-usernames- passwords-from-data-breaches.html#tk.rss_news http://www.csoonline.com/article/2882195/data- breach/researcher-releases-10-million-usernames- passwords-from-data-breaches.html#tk.rss_news  http://www.isightpartners.com/2015/02/codoso/ http://www.isightpartners.com/2015/02/codoso/  http://www.biztekmojo.com/00273/isis-social-media- accounts-disabled-claims-hacking-group-anonymous http://www.biztekmojo.com/00273/isis-social-media- accounts-disabled-claims-hacking-group-anonymous  http://mobile.nytimes.com/blogs/bits/2015/02/08/in- ways-legal-and-illegal-vpn-technology-is-erasing- international-borders/?_r=0&referrer= http://mobile.nytimes.com/blogs/bits/2015/02/08/in- ways-legal-and-illegal-vpn-technology-is-erasing- international-borders/?_r=0&referrer MIS 5212.0014

5.  Submitted  http://www.itnews.com/health-care/89260/hackers- target-health-care-industry-goes- digital?phint=newt%3Ditnews_daily&phint=idg_eid%3D e843610503cd3a85441585feddd9dac7#tk.ITNEWSNLE_nlt _itndaily_2015-02-09 http://www.itnews.com/health-care/89260/hackers- target-health-care-industry-goes- digital?phint=newt%3Ditnews_daily&phint=idg_eid%3D e843610503cd3a85441585feddd9dac7#tk.ITNEWSNLE_nlt _itndaily_2015-02-09  http://security- today.com/articles/2015/02/10/samsung-smarttvs-may- record-conversations.aspx http://security- today.com/articles/2015/02/10/samsung-smarttvs-may- record-conversations.aspx  http://www.darkreading.com/attacks- breaches/chinese-hacking-group-codoso-team-uses- forbescom-as-watering-hole-/d/d-id/1319059 http://www.darkreading.com/attacks- breaches/chinese-hacking-group-codoso-team-uses- forbescom-as-watering-hole-/d/d-id/1319059  http://www.infosecurity-magazine.com/news/20-of- security-operations http://www.infosecurity-magazine.com/news/20-of- security-operations MIS 5212.0015

6.  What I noted  http://arstechnica.com/tech-policy/2015/02/fbi-really- doesnt-want-anyone-to-know-about-stingray-use-by- local-cops/ http://arstechnica.com/tech-policy/2015/02/fbi-really- doesnt-want-anyone-to-know-about-stingray-use-by- local-cops/  http://venturebeat.com/2015/02/10/its-too-early-to-let- samsung-off-the-hook-for-smart-tv- eavesdropping/?utm_content=buffer828a2&utm_mediu m=social&utm_source=twitter.com&utm_campaign=buff er http://venturebeat.com/2015/02/10/its-too-early-to-let- samsung-off-the-hook-for-smart-tv- eavesdropping/?utm_content=buffer828a2&utm_mediu m=social&utm_source=twitter.com&utm_campaign=buff er  http://thehackernews.com/2015/02/memex-deep-web- search-engine.html http://thehackernews.com/2015/02/memex-deep-web- search-engine.html  https://www.kali.org/news/kali-linux-1-1-0-released/ MIS 5212.0016

7.  WebGoat is a deliberately insecure web application maintained by OWASP designed to teach web application security lessons  The current version is 6.0, this is still a work in progress.  WebGoat for J2EE is written in Java and therefore installs on any platform with a Java virtual machine. MIS 5212.0017

8.  You can download WebGoat at:  https://webgoat.atlassian.net/builds/browse/WEB -WGM/latestSuccessful/artifact/shared/WebGoat- Embedded-Tomcat/WebGoat-6.0.1-war-exec.jar https://webgoat.atlassian.net/builds/browse/WEB -WGM/latestSuccessful/artifact/shared/WebGoat- Embedded-Tomcat/WebGoat-6.0.1-war-exec.jar  You will also need Java >= 1.6 (JDK 1.7 Recommended)  http://www.oracle.com/technetwork/java/javase/ downloads/index.html http://www.oracle.com/technetwork/java/javase/ downloads/index.html MIS 5212.0018

9. 9

10.  Entering URL for WebGoat gives:  Use the down arrow and select “Save As” to save file to the location of your choice. MIS 5212.00110

11.  Follow URL to: MIS 5212.00111

12.  Selecting “JRE” gives: MIS 5212.00112

13.  Click “Accept” and select the OS  Same as WebGoat, use save as option to put the file where you want it  Once downloaded, run the file and follow the prompts  To launch in Windows, open the command line and type:  Java –jar WebGoat-6.0.1-war-exec.jar  Command line will say busy and will look like it hangs at Initializing Spring …. MIS 5212.00113

14.  Open a browser and type the following in the URL bar:  http://localhost:8080/WebGoat/ http://localhost:8080/WebGoat/ MIS 5212.00114

15.  Download the “jar” file as described on slide 10  Java JRE is already installed in Kali  Open a terminal and execute the same command  Java –jar WebGoat-6.0.1-war-exec.jar  Verify same as slide 14 MIS 5212.00115

16.  If you downloaded the jar file to Kali, you are ready to launch the Intercepting Proxy, point the browser the proxy and start  If you want to work in Windows, you will need to get an intercepting proxy on to your windows machine  Go to:  http://portswigger.net/burp/ http://portswigger.net/burp/  Select “Download” tab and then “Free”  This will bring down another jar file for BurpSuite MIS 5212.00116

17.  Once WebGoat is running, you are one of the most vulnerable systems on the internet!  Once you have downloaded the files consider disconnecting from the network MIS 5212.00117

18.  In the news  Presentation 1 – What did you learn about Metasploit?  Working through WebGoat MIS 5212.00118

19. ? MIS 5212.00119