Infosec Skills Challenge: October [Cybersecurity Career Awareness Week Edition]

Security by design is an approach to software and hardware development that aims to construct systems free of vulnerabilities by implementing best practices and safeguards. However, it is relatively new as a notion, and prior to it, the aim of software developers was more oriented in functionality than security. The same principle can be seen in protocols such as HTTP, FTP, or POP. Because they apply no data encryption, these protocols are often referred to as clear-text protocols. Anyone who is intercepting the traffic between two entities that communicate using clear-text protocols can see the data flowing through the network in plain text. These protocols gave rise to attacks such as Man-in-the-middle (a malicious actor impersonating legitimate users) and sensitive data exposure. To cover the security holes of clear-text protocols, versions that applied encryption to data were developed.

This lab covers multiple secure coding errors commonly found in Python, including deserialization and XML based attacks.

The Metasploit framework is a powerful tool that ethical hackers can use to investigate systematic vulnerabilities on networks and servers. Because it’s an open-source framework, it can be easily customized and used with most operating systems. This framework has become the go-to exploit development and mitigation tool. Before Metasploit, pen testers had to manually perform all explorations and write their code to exploit the vulnerability.