🛡️ Website Security and Penetration Testing
The security of the Submitty website is of paramount importance due to its direct impact on student grades and academic integrity. Even a single vulnerability can lead to unfair academic advantages and legal complications concerning student data protection. Therefore, this project aimed to contribute to the assurance of proper access control, authorization mechanisms, and robust code that align with the high security standards expected from educational platforms like Submitty.
You can find all my merged PRs in this link.
🎯 Project Scope
The primary goal of this project was to conduct an extensive penetration testing campaign to identify and remediate potential vulnerabilities in the Submitty website. The scope of the project encompassed a wide array of attacks, spanning from common web vulnerabilities to more advanced exploitation techniques. The ultimate aim was to fortify the security posture of Submitty and bolster its protection against malicious attacks.
💡 Penetration Testing Highlights
Throughout the Google Summer of Code program, I engaged in a full-fledged penetration testing lifecycle. I meticulously tested the Submitty website for vulnerabilities and potential security gaps.
☠️ Attacks
The following list presents an overview of the attacks that were tested:
- Cross-Site Scripting (XSS)
- SQL Injection
- Cross-Site Request Forgery (CSRF)
- Remote File Inclusion (RFI)
- Local File Inclusion (LFI)
- Server-Side Request Forgery (SSRF)
- Clickjacking
- Directory Traversal
- XML External Entity (XXE) Injection
- Zip Bomb
- Command Injection
- Path Traversal
- Session Hijacking
- Remote Code Execution (RCE)
- Open Redirects
- Authentication Bypass
- XML Injection
- JSON Injection
- DOM-based XSS
- HTML Injection
- Web Shell Upload
- XML Quadratic Blowup
- Reflected File Download
- Null Byte Injection
- File Upload
🛠️ Tools
To achieve a comprehensive security assessment, I used various security tools, including but not limited to:
- Nessus
- Nikto
- SQLMap
- Burp Suite
- Nmap
- Wireshark
- Metasploit
- OWASP ZAP (Zed Attack Proxy)
🔎 Static Code Analysis
In addition to dynamic testing, I performed static code analysis using prominent vulnerability scanning tools such as:
- CodeQL Analysis
- Snyk Security
- DevSkim
- Codacy Security Scan
- EthicalCheck
🔐 Security PRs
This section contains pull requests related to security enhancements, fixes, and updates.
Cache Control
Implemented Cache-Control header to ensure proper resource caching behavior. This prevents intermediaries from caching the resource, reducing the risk of serving outdated content.
Content Type Options
Content-Type-Options header stops pages from loading during content-sniffing attacks, significantly reducing security risks by preventing incorrect MIME type interpretation.
Content Security Policy
Implemented Content-Security-Policy header which prevents external iframe embedding, bolstering security by mitigating clickjacking threats.
Adding CORS Security Headers
Implemented CORS security headers to prevent cross-origin attacks, enhancing web security by preventing potentially unsafe cross-origin interactions, safeguarding against credential leakage and minimizing data exposure risks.
Referrer Policy Header
Implemented Referrer-Policy header to prevent the leakage of sensitive information, reducing the risk of information disclosure attacks.
Whitelisting MIME Types
Whitelisted MIME types to prevent the execution of potentially dangerous file types. This reduces the risk of remote code execution and other malicious attacks. Only the allowed MIME types can be uploaded to the server.
👾 Bugfix PRs
In this category, you’ll find pull requests aimed at resolving various bugs.
Registration Section Input Validation
Student Name in Blind Grading
Download Files For Hidden Test Cases
Number of Late Days
🎨 UI/UX PRs
This section showcases pull requests that enhance the look, feel, and overall usability of our system.
Peer Grading Submission Browser
Student Photos Upload Instructions
Grade Inquiries per Grader
Course Materials to Course Staff
📚 Documentation PRs
This category contains pull requests that added documentation of the Submitty.
InstallationTroubleshooting for Remote Users
Virtual Machine Snapshots
Updating Disabled Functions List
🚩 Conclusion
The Submitty Website Security and Penetration Testing project was an exciting and rewarding journey. By executing a wide array of attacks and utilizing many security tools, I aimed to create a safer and more resilient platform for educational purposes. I am thrilled to have contributed to the enhancement of Submitty’s security and to have strengthened its overall security posture.
For any inquiries, feedback, or additional information, please feel free to contact me at musaabimran2001@gmail.com.
🤝 Acknowledgment
I extend my heartfelt gratitude to the Submitty team for their unwavering support throughout the Google Summer of Code program. My sincere thanks to mentors Dr. Barb Cutler and Chris Reed for their invaluable guidance, which significantly enriched my learning experience. Their expertise and insights were pivotal in shaping my growth, and I eagerly anticipate contributing to Submitty in the future.
Sincerely,