Only two machines in the ACMEs network will be targeted in the attack. It is assumed in this phase of the project, that you have only remote access to the target machines, i.e., all access should be done through Kali as attack machines. In other words, you cannot login locally into the machines and attack them. However, local access is allowed in the Part 2 of the project.

The project will be performed using Kali as attack machine and a virtual image that mirrors as much as possible the target network. You must download the image at the following link: https://drive.google.com/file/d/0B1xnRxT-Y8DMdHRkNmZUWDdXdm8/view?usp=sharing

Install it on your own machine. The installation guidelines are provided in a separate file available on D2L.

1. Using a network scanner (e.g. zenmap), extract the topology information of the company's private network. Identifyavailable hosts, and for each host, find the IP address, Operating System, running services and open ports. Ensure that you specify the exact versions.

2. Identify vulnerable services (using e.g. nessus); briefly explain why you think these services are vulnerable.

3. Try to gain access to the private network by attacking the account of Ms. Alice Sandhuon machine UB12using a password cracking tool (e.g. ncrack or hydra or medusa or any other tools). You can use as dictionary the filephpbb.pwd(under /usr/share/ncrack) and target one of the running services (e.g. FTP, SSH, etc.).

4. After gaining access to the private network, locate and exfiltrateone of the source code files of the companys new mobile application (from the GIT code server), which is among the most valuable trade secrets of the company, and is supposed to remain confidential.