Análisis de vulnerabilidades del servidor e-learning de la ESPOCH para la implementación de mejores prácticas de seguridad-acceso.

Abstract

A vulnerability analysis was carried out at the E-learning server of the Polytechnic School of Chimborazo in order to increase security and access practices. We analyzed the current situation of the E-learning server, for this we used several software such as: Kali Linux, Nessus, Nexpose that find security fails through the scan and attack with several plugins and tools that incorporate such programs. In the laboratory there were several tests of scanning, enumeration of services and attacks to the server. The test of scanning was done with the Whois.net tool that gave us the user profile of the server, the enumeration test of service performed with the tool Nmap that performs an intense analysis and gives all the services offered by the server, including the versions of the same. Five main attacks were chosen: SQL Injection attack that violates the database. CROSS-SITE SCRIPTING attack that alters the current state of server by changing information based on script codes. SNIFFING attack, spies and captures the passwords of plain text through the internet. Attack DoS, sends thousands of packets to the server then saturating the real requests and letting users not to use. PHISHING attack, which clones the actual page for an alternate with the idea of stealing passwords. The E-learning server was 80% vulnerable to attacks. It is concluded that the E-learning server is a vulnerable site for these network attacks. They could be solved by implementing Web encryption certificates, firewall policies and DMZ implementations that restricts the network privileges to the server both inbound and outbound, blocking the control and access to the administrators with privileged ranges and services to which they try to enter from the internet towards the internal network. It is recommended to continue updating with new security policies since a web server is never 100% safe from any computer attack.