Cis2026N Ethical Hacking|Chronological Audit Assessment Answer

IPCop is a Linux based firewall/router that controls the access to different zones of the system (zones can be seen as separate network entities, with no traffic across zones allowed without special permission):Red — the InternetGreen — the safe zone for maximum protectionOrange — a DMZ designed for Web, mail, or other Internet serversBlue — for wireless networksOrange Zone:The webserver is an Ubuntu 16.04 LTS machine running Apache 2.4.xThe email server is a MS Windows Server 2012R2, running MailEnable Standard Edition 10.26Green Zone: The Server: Windows 2012R2, with Active Directory, DHCP, DNS, IIS. The server also run a MySQL Server 5.5, the back-end for a custom web application that is used by the financial office. The server contains also shared folders, which are used for different purposes: projects, advisors reports, and other classified and non-classified documentsThe workstations are Windows 10.Blue Zone:Employees and volunteers are allowed to bring their own device and connect to the internet.No further information and no credentials are given except the public IP address and the domain name of the web server (since this information is purely hypothetical we simply use these placeholders <PUBLIC_IP_ADDRESS> and <DOMAIN_NAME> to indicate them in your report). The client specifically requests that:-No data should be lost from any system during the pen testing. If any change is done, for a proof-of-concept, you should also identify a procedure to restore the system to the previous state; -The risk of disrupting the services should be minimised, in particular during office hours;-You have a limited number of hours for this task, so your planning should prioritise the key services and components;-The pen testing activities should be carried out with FOSS or free software, unless such option does not exist for a specific task. In this case, you should make clear the licence terms and costs.TaskYou should write a report (approximately 4500 words, submitted in PDF format) detailing your plan, with a justification for tools and techniques used, the results and a complete chronological audit trail of hacking actions taken in line with expected professional and ethical standards.In particular, for the practical part, you have to carry out a pen testing limited to a given component.For the rest of the work, use the information provided in the scenario, and make the appropriate an reasonable assumptions if necessary (provide a rationale for itTeesside University-4-The report will have cover all the stages of the ethical hacking methodology. The report should include at least the following elements (xx% indicates the weight in the mark allocation): 1.Demonstration of understanding of the scenario and discussion of the pre-engagement interactions. (10%)2.Identification of relevant tools for each stage of the ethical hacking. (10%)3.Appropriate information gathering and threat modelling (10%)4.Identification of security vulnerabilities (10%)5.Exploitation of the vulnerabilities (10%)6.Post exploitation activities (10%)7.Reporting of the findings and potential suggestions for countermeasures (10%)8.Critical reflection of self-performance and the development of skills for employment as a computer security professional.