CYB 660: Penetration Testing Group Bonus Point Exercise Due Date: 11/30, 11:59 P.M. (Late Submission Not Accepted) Description: In this bonus point exercise, you are required to find the password for root user in MySQL server. This bonus point exercise is worth 1% of your total score. Instructions: 1. Start your Kali VM and your Metasploitable3 in AWS. 2. In your Kali VM, type vncserver to connect to your Kali’s desktop. 3. Next, on your Kali’s desktop, launch Firefox. 4. Enter the private IP of your Metasploitable 3 for URL. 5. You will then see the following. Click on DVWA. Please see below Figure 1: DVWA Webpage 1 6. Enter admin for username and password for password. 7. Next, click DVWA Security. See below. Figure 2: DVWA Security 8. Next, set the security level to low. See below. 2 Figure 3: Security Level 9. Next, click Command Injection. See below. Figure 4: Command Line Injection 10. In this step, you are going to do some testing. Please see below. 3 Enter this command for testing purpose. Notice that ; is used to separate one command from the next. Figure 5: Entering Command You should be able to see the following output: Figure 6: Output for Command Injection 11. Now, you are on your own. Please take note that DVWA web application connects to MySQL database server. Run some Linux commands (that you have learned in Week 2 and Week 3) to enumerate the password of the root user in MySQL database server. (Some hints: look for the default Web directory for Apache Web server). Submission: Please make only ONE submission per group if your group choose to take up the challenge! You can select a group member to submit the work. You must perform command line injection on the DVWA website. 4 You are required to submit: a. A screenshot to clearly show the command you entered. The background of the screenshot must clearly show a terminal with whoami command with RED_TEAM_xxx as the output. b. A screenshot to clearly show the username root and his/her password of MySQL database server. The background of the screenshot must clearly show a terminal with whoami command with RED_TEAM_xxx as the output. 5
