COMP3320 Vulnerability Assessment and Penetration Testing

Assignment (Weighting 15%)

Vulnerability Assessment and Penetration Test

The final report for this assignment is due before 4:00 pm, Tuesday 15th April 2025 (before the Week 8 lecture. Late penalties apply from 4:00 pm onwards. See the ECP for details.

[UPDATED 25/2/2025] This assignment simulates a practical VAPT engagement, including the ethical vagaries that occasionally occur, so there are some marks for your solution to two ethical issues that will arise during your engagement. These will require you to research not only the legal ramifications of the issues in question, but also how you will handle the issues, including how you report the issues and the timing for reporting those issues. The details will come with the penetration test stage of the engagement. Your solution to each issue is to be included as separate appendix (each) as part of, and submitted with, to your final report.

Your client is the Davros Industries1 . Davros Industries mines rare earth elements and is enjoying a healthy return from its lithium mining operations due to the surge in domestic battery production as Australia scrambles to meet its 2030 emissions targets.

Davros Industries has engaged your company (you can think up your own company name) to perform a black-box vulnerability assessment penetration test of their systems. You have just completed the kick-off meeting at 4:00pm today and agreed on the Terms of Engagement, including “regular updates” and the final report due no later than 7 weeks’ time (i.e. before 4:00 pm on Tuesday 15th April 2025).

As it is to be a black-box test, you have no technical details at this stage, but in the kick-off meeting you saw one of the participants with a Windows login screen on their laptop. There was a video-conferencing screen in the room with clearly a Windows 10 desktop showing and it remained logged-in and idle for the entire 1-hour meeting and never timed-out. They clearly use Microsoft systems on their corporate network. Their emails come from Microsoft servers, but not M365 (Azure) servers, so they are using in-house mail servers, and you therefore suspect all corporate systems are based on in-house Microsoft servers.

During the meeting you discussed their corporate objectives and difficulties, and you now know they have a working open-cut mine in western Queensland, which is producing above-expected yields for processing into lithium and has attracted both national and international interest. ASD representatives have met with the Davros Industries CISO to advise them that they have detected attempts at clearly malicious traffic to Davros Industries’ Web servers originating from the country of Kamaria2 . In addition, you have discovered, that they made an (ill-advised) attempt to get a lease to mine part of Kakadu (in the national park, Bininj/Mungguy Country) in the Northern Territory, which although rejected, has angered numerous environmental groups.

You have dispatched one of your team to do reconnaissance, find their external facing addresses, and perform a vulnerability scan on them, but as with a real VAPT, you won’t get the results for some days (in our case, next week, when we do the next lecture that will give you a better understanding of the process). In the meantime, you should use this first week to start to gather information for your Threat Analysis (it is black-box, so you will have to consider generic threats, plus the little bit of information you have from your first meeting) and also start considering what you will need to lay out your final report to Davros Industries.

This is a level 3 course; you will not be given a fixed format for your VAPT report. You should review available reports on the Internet and decide how best to get your points across. Your report MUST include a Threat Analysis (and thus the Threat Environment as you see it for Davros Industries), a section on the Vulnerability Assessment, and a section on the Penetration Test.

Research

Your search should involve a variety of types of sources OSInt sites (Open Source Intelligence), Journals, and Internet sources. ALL sources MUST be correctly referenced in your report.

From the ECP, you must “compile a report that demonstrates the ability to locate high quality sources of relevant information, to understand complex concepts, to analyse and organise information and ideas and to convey those ideas clearly, concise and fluently; and the ability synthesize a clear and paper of the appropriate level and style.”

This task has been designed to be challenging, authentic and complex. Whilst students may use AI and/or MT technologies, successful completion of assessment in this course will require students to critically engage in specific contexts and tasks for which artificial intelligence will provide only limited support and guidance.

A failure to reference generative AI or MT use may constitute student misconduct under the Student Code of Conduct.

Final Report

Target Audience

Technical details should be put in appendices.

Report Length (NOT including images, test outputs, appendices, or references)

Report Structure

Referencing Style

Assessment – Marking Scheme (15 marks 15% of course – 1% per mark)