Computer Security Project

[Honda_Boy]

My group and I are working on a project for Computer Security and we have 2 Linux machines running Ubuntu 8.10 x64 and 2 Windows XP Pro SP2 x86 Machines. Our project involves using the Linux machines to carry out some form of attack. We are starting off attacking the Windows machines with just the Windows Firewall. Then we will start adding levels of security such as firewalls and what not. While we are attacking with the Linux machines, we will also be trying to defend on the Windows machines. We may also do an attack against the Linux machines with the Windows machines.

Here's the problem. We have absolutely no clue how to go about doing this. And no I'm trying to hack anyone. I'm serious about this being a group project for my computer security class. We have to write a report on our theories, methods, and results afterwords. We just need a simple attack to satisfy our project needs.

Thanks for any help.

[iccaros]

here is a great place to start

http://www.amazon.com/Hacking-Art-Exploita...4150&sr=8-1

This book goes into great detail on how to hack your systems..

[Honda_Boy]

how relevant would the first edition of that book be cause we already have the first edition.

[iccaros]

I may have good stuff.. I don't have it..

the second edition has out dated stuff, but the concepts work..

it teaches how to exploit and keep your system safe down to the software level.

for example, to hack a web server it first teaches you how to write code for a web server so you can see how they parse HTML

tools like nmap and http://www.openvas.org/ are very useful

[iccaros]

sorry http://www.nessus.org is free for home use and is more up to date than openvas

[Matt]

Head over to http://www.securityfocus.com/vulnerabilities

It is a great database of security vulnerabilities. You can search for various software on there. It gives info about the exploit and usually some proof-of-concept code.

If you look around google, there are other exploit sites (that I won't mention here) that may prove very useful.

[Carnevil]

You could also look at Metasploit.

http://www.metasploit.com/

[Honda_Boy]

We bailed on the Linux attack Windows idea and tried a Denial of Service from one Windows machine to another then multiple machines to another and just used the Linux computer to monitor network traffic.

Results..... we failed miserably (we got a good grade but failed our objective). The best we could manage was disabling the computer we were acting FROM. The system we attacked was unaffected.

[Matt]

We bailed on the Linux attack Windows idea and tried a Denial of Service from one Windows machine to another then multiple machines to another and just used the Linux computer to monitor network traffic.

Results..... we failed miserably (we got a good grade but failed our objective). The best we could manage was disabling the computer we were acting FROM. The system we attacked was unaffected.

Was the target machine a server of some sort? What were you trying to bring down with your DoS?