Question 2. (35 POINTS) In a web based transaction, you can give harm to client in many ways. One of them is to use a proxy to trap transferred values from client to server and modify them on the way. In this exercise you will use the Paros web application security tool for this purpose to test your own web documents. Download and install the free Paros tool from URL: http://www.parosproxy.org/index.shtml (available for Unix and Windows OSes). Please follow the installation steps carefully (e.g. you need to make sure that JDK/Java Run Time Environment (JRE) 1.4.2 -or above- is installed on your computer already). Paros works in interaction with your web browser. So, you need to set the proxy settings of your browser as well. The users guide for Paros at the same URL seem to have been removed. So, you may use the following links to get help with the Paros tool: http://www.madirish.net/191 2 https://www.youtube.com/watch?v=Ytr0DmVE5Bo http://singhshardul.blogspot.com/2007/06/paros-proxy-step-by-step-guide.html http://www.michaelboman.org/books/paros-proxy A simple search on Internet should also retrieve supporting documents for this tool. Then, create test web documents with php scripts that uses: - Case 1: Simple get methods (e.g. getting username and password, demographic information of user, etc.). - Case 2: Simple post method. Note: The get and post methods have been introduced in class. You can also refer to the attached help for hw7.ppt document to see the sample code in which these two methods are used. If you have problems with running your php code, please collaborate with our TAs to get help. Using the Paros tool, analyze both case 1 and case 2 above and submit the following:

2.A.) (20 POINTS: 10 POINTS for get, 10 POINTS for post) Vulnerability report of your test web documents. How serious is the vulnerability of your code? High, medium, or else? Include this report in your homework report and comment on this.

2.B.) (15 POINTS: 7.5 POINTS for get, 7.5 POINTS for post) Use Trap response and Trap request functions of the Paros tool to capture the on the fly requests/responses and try modifying them. Take screen shots for this test and include in your homework report.