2017 juni examen

Theorie

• 8 moeilijke doordenk multiple choice vragen (met meerdere mogelijke juiste antwoorden, en je moet ze allemaal juist hebben)

• DNS query response gegeven van alle servers waarlangs de DNS query gaat. Leg uit met schema wat er gebeurt, wanneer wie welke responses geeft, welke queries iteratief/recursief zijn.

• Waarom wordt er bij SSL/TCL zowel symmetrische als asymmetrische encryptie gebruikt? Leg uit met een schema van SSL en zeg waar welke gebruikt wordt (toy of echte SSL)

Praktijk

Praktijkexamen 22/05/2017

• Give a list of all words with 14, 15 or 16 unique letters. The output format should look like this:

Words with 14 letters: word1 word2 word3

Words with 15 letters: word4 word5

...

for n in 14 15 16; do echo "Words with $n letters:" $(grep -P "^.{$n}$" dutch | grep -vP '(.).*\1'); done

• Give a list of the usernames tried in ftp_bruteforce.pcap. You can only use tshark and sort (Step by step solution: https://wiki.uclllabs.be/index.php/TShark_Tutorial#Exercises)

tshark -r ftp_bruteforce.pcap -Y 'ftp.request.command == USER' -T fields -e ‘ftp.request.arg’ | sort -u

• Give the current time (format: Time= hh:mm:ss (dd-mm-yyyy))

echo 'Time=' $(date +'%T (%x)') | tr / -

• Write a oneliner to decode the following file "secret" (contents: RGUgcHVudGVuIG9wIGRlemUgdnJhYWcgemlqbiBhbCBiaW5uZW4uCg==)

The file ends with '==' indicating base64 padding: openssl enc -d -base64 < secret

• Write a oneliner to display the fingerprint, serial and public key of wiki.uclllabs.be

echo | openssl s_client -connect wiki.uclllabs.be:443 2>/dev/null | openssl x509 -fingerprint -serial -pubkey -noout

Praktijkexamen 24/05/2017

• There is a website running - https://darthvader.uclllabs.be/nw2/lab1 - which is only accessible from 193.191.177.1. That is the IP address of leia.uclllabs.be. Create an ssh tunnel between server leia and the webserver darthvader

ssh -L 10000:darthvader.uclllabs.be:443 [email protected] -p 22345

• Give a list of words with 5 letters that are also palindromes.

grep -P '^(.)(.).\2\1$' dutch

• Show the file /etc/debconf.conf on screen without comment lines (i.e. lines starting with a #).

grep -vP '^#' /etc/debconf.conf

• Give a list of the usernames tried in ftp_bruteforce.pcap. You can only use tshark and sort (Step by step solution: https://wiki.uclllabs.be/index.php/TShark_Tutorial#Exercises)

tshark -r ftp_bruteforce.pcap -Y 'ftp.request.command == USER' -T fields -e ‘ftp.request.arg’ | sort -u

• Write a oneliner to display the fingerprint, serial and public key of wiki.uclllabs.be

echo | openssl s_client -connect wiki.uclllabs.be:443 2>/dev/null | openssl x509 -fingerprint -serial -pubkey