JAWAHARLAL NEHRU TECHNOLOGICAL UNIVERSITY HYDERABAD

Prerequisites

• 1. A Course on “Computer Networks and a course on Mathematics

Course Objectives

• 1. To understand the fundamentals of Cryptography
• 2. To understand various key distribution and management schemes
• 3. To understand how to deploy encryption techniques to secure data in transit across data networks
• 4. To apply algorithms used for secure transactions in real world applications

Course Outcomes

• 1. Demonstrate the knowledge of cryptography, network security concepts and applications.
• 2. Ability to apply security principles in system design.
• 3. Ability to identify and investigate vulnerabilities and security threats and mechanisms to counter them.

UNIT - I

Security Attacks (Interruption, Interception, Modification and Fabrication), Security Services (Confidentiality, Authentication, Integrity, Non-repudiation, access Control and Availability) and Mechanisms, A model for Internetwork security. Classical Encryption Techniques, DES, Strength of DES, Differential and Linear Cryptanalysis, Block Cipher Design Principles and Modes of operation, Blowfish, Placement of Encryption Function, Traffic Confidentiality, key Distribution, Random Number Generation.

UNIT - II

Public key Cryptography Principles, RSA algorithm, Key Management, Diffie-Hellman Key Exchange, Elliptic Curve Cryptography. Message authentication and Hash Functions, Authentication Requirements and Functions, Message Authentication, Hash Functions and MACs Hash and MAC Algorithms SHA-512, HMAC.

UNIT - III

Digital Signatures, Authentication Protocols, Digital signature Standard, Authentication Applications, Kerberos, X.509 Directory Authentication Service. Email Security: Pretty Good Privacy (PGP) and S/MIME.

UNIT - IV

IP Security: Overview, IP Security Architecture, Authentication Header, Encapsulating Security Payload, Combining Security Associations and Key Management. Web Security: Web Security Requirements, Secure Socket Layer (SSL) and Transport Layer Security (TLS), Secure Electronic Transaction (SET).

UNIT - V

Intruders, Viruses and Worms Intruders, Viruses and related threats Firewalls: Firewall Design Principles, Trusted Systems, Intrusion Detection Systems.

TEXT BOOK:

• 1. Cryptography and Network Security (principles and approaches) by William Stallings Pearson Education, 4th Edition.

REFERENCE BOOKS:

• 1. Network Security Essentials (Applications and Standards) by William Stallings Pearson Education.
• 2. Principles of Information Security, Whitman, Thomson. VULNERABILITY ASSESSMENT AND PENETRATION TESTING (Professional Elective - I) M.Tech CNIS/CN/CYS I Year I Sem. L T P C 3 0 0 3

Pre-requisites:

• 1. Knowledge in information security.
• 2. Knowledge on Web Application.

Course Objectives:

• 1. Give an introduction to Vulnerability Assessment and Penetration Testing.
• 2. To be familiar with the Penetration Testing and Tools.
• 3. To get an exposure to Metasploit exploitation tool, Linux exploit and Windows exploit.
• 4. To gain knowledge on Web Application Security Vulnerabilities, Vulnerability analysis and Malware analysis.

Course Outcomes:

• 1. Understand social engineering attacks
• 2. Learn to handle the vulnerabilities of a Web application.
• 3. Perform penetration testing
• 4. Analyze the malware type and impact.

UNIT - I

Introduction Ethics of Ethical Hacking: Why you need to understand your enemy’s tactics, recognizing the gray areas in security, Vulnerability Assessment and Penetration Testing. Penetration Testing and Tools: Social Engineering Attacks: How a social engineering attack works, conducting a social engineering attack, common attacks used in penetration testing, preparing yourself for face-to-face attacks, defending against social engineering attacks.

UNIT - II

Physical Penetration Attacks: Why a physical penetration is important, conducting a physical penetration, Common ways into a building, Defending against physical penetrations. Insider Attacks: Conducting an insider attack, Defending against insider attacks. Metasploit: The Big Picture, Getting Metasploit, Using the Metasploit Console to Launch Exploits, Exploiting Client-Side Vulnerabilities with Metasploit, Penetration Testing with Metasploit’s Meterpreter, Automating and Scripting Metasploit, Going Further with Metasploit.

UNIT - III

Managing a Penetration Test: planning a penetration test, structuring a penetration test, execution of a penetration test, information sharing during a penetration test, reporting the results of a Penetration Test. Basic Linux Exploits: Stack Operations, Buffer Overflows, Local Buffer Overflow Exploits, Exploit Development Process. Windows Exploits: Compiling and Debugging Windows Programs, Writing Windows Exploits, Understanding Structured Exception Handling (SEH), Understanding Windows Memory Protections (XPSP3, Vista, 7 and Server 2008), Bypassing Windows Memory Protections.

UNIT - IV

Web Application Security Vulnerabilities: Overview of top web application security vulnerabilities, Injection vulnerabilities, cross-Site scripting vulnerabilities, the rest of the OWASP Top Ten SQL Injection vulnerabilities, Cross-site scripting vulnerabilities. Vulnerability Analysis: Passive Analysis, Source Code Analysis, Binary Analysis.

UNIT - V

Client-Side Browser Exploits: Why client-side vulnerabilities are interesting, Internet explorer security concepts, history of client- side exploits and latest trends, finding new browser-based vulnerabilities

heap spray to exploit, protecting yourself from client-side exploit. Malware Analysis: Collecting Malware and Initial Analysis: Malware, Latest Trends in Honeynet Technology, Catching Malware: Setting the Trap, Initial Analysis of Malware.

TEXT BOOKS:

• 1. Gray Hat Hacking-The Ethical Hackers Handbook”, Allen Harper, Stephen Sims, Michael Baucom, 3rd Edition, Tata Mc Graw-Hill.
• 2. The Web Application Hacker’s Handbook-Discovering and Exploiting Security flaws”, Dafydd Suttard, Marcus pinto, 1st Edition, Wiley Publishing.

REFERENCES:

• 1. Penetration Testing: Hands-on Introduction to Hacking, Georgia Weidman, 1st Edition, No Starch Press.
• 2. The Pen Tester Blueprint-Starting a Career as an Ethical Hacker, L. Wylie, Kim Crawly, 1st Edition, Wiley Publications.