Documentation of SHiNE bachelorproject ws 07/08 March 31, 2008 Abstract SHiNE - Security and Hacking in Network Environments is a students Bachelor project based on the Master project NetS-X. The target of this project is an implementation of a learning environment, which leads the user through network specific problems and security tasks. 2 Contents 1 Objectives [ar, rb] 7 2 Competitor analysis [dl, pm] 7 2.1 Overview . .7 2.2 Applied security laboratory . .8 2.3 Tele-Lab IT-Security . .8 2.4 Cyber Ciege . .8 3 2D-Game 8 3.1 Description of 2D Game[cs] . .8 3.2 Overall story [fe, af, sg] . .9 3.3 Sequence chart[fe, af, sg] . 10 3.4 Integration items/characters in overall story [sg, fe, af] . 11 3.5 In-Game assistance [sg, fe, af] . 13 3.6 Behavior NPCs (Implementation XML)[sg, fe, af] . 13 3.7 Realisation Flash-Client[cs, ju] . 14 3.7.1 Implementation . 15 3.7.2 State Machine . 16 3.7.3 Gameobjects(NPCs, items, trigger areas) . 18 3.7.4 Tile editor . 19 3.7.5 Waypoint editor [dl] . 20 4 Description of Game Topology [ts] 22 5 Scenarios 23 5.1 Basic scenarios [jp] . 23 5.1.1 Console . 23 5.1.2 Vi . 25 5.2 Man-in-the-middle scenarios . 26 5.2.1 ARP-Spoofing [rb] . 26 5.2.2 Hijacking[rb] . 29 3 5.2.3 SSL-Cracking [aoe] . 31 5.3 Passwort Hacking [ts] . 32 5.3.1 John the Ripper . 32 5.3.2 Cron John . 33 5.3.3 Hydra . 34 5.4 Honeyd [pm] . 35 5.4.1 honeypot detection . 35 5.5 Monitoring Tools [cg] . 37 5.5.1 Cacti . 37 5.6 IDS scenarios [jl] . 39 5.6.1 Run snort . 39 5.6.2 Create snort rule . 40 5.7 DNS [mt] . 42 5.7.1 DNS Basics . 42 5.7.2 DNS Server manipulation . 43 5.7.3 DNS-Spoofing . 44 5.7.4 Domain . 46 5.8 Learning scenarios [ts] . 47 5.8.1 LDAP . 47 5.8.2 RADIUS . 47 6 Overall System Conventions and Design [ar, dg, sd, tr] 48 6.1 Conventions . 48 6.1.1 Overall Systemconcept [ar, sd, tr] . 48 6.1.2 Overall Designconcept [ar, dg, sd, tr] . 49 6.1.3 Namefinding [ar] . 52 6.1.4 Styleguide [dg] . 52 6.1.5 Rights [tr] . 58 6.2 Webinterface [ar, dg, sd, tr] . 60 6.2.1 Login / Registration [dg] . 61 6.2.2 PDA-Screens [ar, sd] . 61 4 6.2.3 Administration Screen [master] . 63 6.3 2D Gamedesign . 64 6.3.1 The Flashgame Graphics [tr, ar] . 64 6.3.2 The Characters [dg, mf] . 64 6.4 Implementation MVCs in CakePHP [sd] . 65 7 Overall Gameplay-Improvements [af, sg, tr] 66 7.1 Enhancements in Communications . 66 7.2 Improvements to the game itself . 66 7.3 Missions . 67 7.4 Graphics . 67 7.5 Real world and 2D-Game relationship . 68 7.6 Content creation for the 2D-Game . 68 A Capability planning[fe] 68 A.1 Personnel planning . 68 A.2 Time management with Gantt-Diagram . 69 B External presentation 71 B.1 Flyer, poster, handouts [dg, cs] . 71 B.2 Website [rb, ar] . 73 C 2D-Game 74 C.1 Script[fe, af, sg] . 74 C.2 Realisation Flash-Client[cs, ju] . 80 C.2.1 Game server interface [cs, ju] . 80 C.2.2 The tile map [cs, ju] . 83 C.2.3 Scene management and animations [cs] . 85 C.2.4 Pathfinding [cs, ju] . 86 C.2.5 Class diagram [cs, ju] . 89 5 D Game topoloy 90 D.1 Manual Net Topology installation [jl, mt, aoe] . 90 D.1.1 Activate Topology at the PC's . 90 D.1.2 Setting up the Network devices . 91 D.2 Manual Game server installation [sd] . 91 D.2.1 Linux installation . 91 D.2.2 Windows installation . 92 E Scenarios 93 E.1 Basic scenarios [jp] . 93 E.1.1 Console . 93 E.1.2 Vi . 97 E.2 Man-in-the-middle scenarios . 102 E.2.1 ARP-Spoofing [rb] . 102 E.2.2 Hijacking[rb] . 114 E.2.3 SSL-Cracking [aoe] . 125 E.3 Passwort Hacking [ts] . 132 E.3.1 John the Ripper . 132 E.3.2 Cron John . 138 E.3.3 Hydra . 144 E.4 Honeyd [pm] . 147 E.5 Monitoring Tools [cg] . 152 E.5.1 Cacti . 152 E.5.2 Ntop . 161 E.6 IDS scenarios [jl] . 162 E.6.1 Run snort . ..