Lambda - Kasutaja kaastöö [et]

ITX8080

2011-12-20T23:55:18Z

Anttix: /* Points scored so far */

= General Information =
== Schedule ==

Lecture TH 17:45 - 21:15 (odd weeks)

Practice TH 17:45 - 21:15 (even weeks)

== Communication ==

Discussinons will be held at course forum in Moodle.

https://moodle.e-ope.ee/course/view.php?id=4319

All scenario proposals must be posted to their own respective forums.

Please register your account today at http://moodle.e-ope.ee

The lecturers can be reached via the course coordinator:

antti.andreimann only-people-please eesti.ee

= Grading =

Best of the bunch will score points.

Points will be awareded for the:

* Best simulation proposal
* Best result obtained in the lab environment
* Best lab report

In total it is possible to score three points for every two weeks.

Maximum score is 3, nobody will be awareded more.

Minimum score to pass is 1.

For those who can not score a single point, an
examination proposals will received from those
of you who scored 3 and voted.

== Points scored so far ==

Margus - 3pts (lecture 1 vote, lab 2 testing method, lab 3 result)

Andres - 1pts (best lab 1 report)

Michal - 1pts (best lab 1 result)

Alexandre - 1pts (best lab 2 result)

Roman - 1pts (best lab 2 report)

Allan - 3pts (best lab 3 proposal with Predrag, lucky SOB scenario 4 proposal, best scenario 5 proposal)

Predrag - 2pts (best lab 3 proposal with Allan, best scenario 5 proposal)

Mauno P - 3pts (best lab 3 report, best lab 4 report, best scenario 7 proposal)

Robert P - 3 pts (best scenario 4 proposal, best lab 4 result, best lab 5 result)

Anis - 1 pts (best lab 4 result)

Mart - 1 pts (best lab 5 report)

Ronny - 1 pts (best lab 7 report)

Mikheil - 1 pts (best lab 6 report)

Jan - 1pts (best lab 8 result)

Franck - 1pts (best lab 8 report)

= Scenarios =

== Scenario 1 ==

There is a Wordpress based blog.

The client is worried: How many visitors can they handle before they die.

Establish a baseline: How many page displays per second AT LEAST we can handle.
Disruption of the site operation is NOT acceptable.

Minimal budget!

Assume upstream bandwidth can cope...

Be as detailed and technical as You possibly can.

=== Proposals ===

* Install a similar system on test hardware
** Test hardware is smaller than
* Extrapolate from current system logs
** Must have some load ...
** It may NOT be linear (it usually isn't!)
* Generate some load (without breaking it) and extrapolate from logs
* Find existing performance graphs for wordpress ... (highly unlikely)

=== Simulation environment ===

* Real hardware
* Virtualization platform

Pick what is closer to the real system.

=== Benchmarking tools ===

* httpPerf
* pagetop
* htop
* AB - apache bench
* curl / wget + custom scripts
* JMeter
* Grinder
* wpscan - wordpress specific

=== How to separate benchmark tools from the server? ===

* Use to VMs, Use CPU allocation in virtualization environment to allocate different CPUs for different VMs
* Put VM disk images on different disks (probably an overkill)?
* Monitor process table and make sure that test tools consume significantly less than web server processes. Lower the priority of the test tools.
* Start monitoring load and page views. Generate some load on real system. How?

How do we define the system is dead?

Page view takes longer than 10sec.

=== Determining if referenced content has an effect on results ===
* Make a list of all references the main page has
* Measure the performance of all the URLs
* Disregard the ones that load at least two magnitudes faster.

=== How to measure the results? ===

* Measure response times and number of parallel requests using the benchmarking tool itself
* Deduct the numbers from server logs
* Put the system under load, test with a normal browser if the load time is reasonable.

=== What to document? ===

* Exact configuration of the benchmarking tool (command line, scripts, config files etc. for EACH test performed)
* The version of the benchmarking tool used
* Virtualization platform
* Hardware specification
* URL of the page tested
* Wordpress configuration
* Wordpress content !!!
* Wordpress version
* Web server configuration
* Web server version (apache, php, sql, etc)
* The measurement results (page load times under each different test)
* Web browser used to measure response time (type, version, operating system)
* Operating system configuration (version, software installed, customizations etc).
* The AUTHOR! and the DATE!

Write evertyhing down at ONCE.
if using VM-s save the image.

=== Lab1 ===

* Virtualization platform: VirtualBox
** 512M memory, 1 CPU for each VM
* Wordpress 3.2.1 with default settings (no extra plugins, no performance tweaks, default skin) and default home page
* Ubuntu Server 10.04 LTS 32bit
* Web server: Apache2, SQL: MySQL (default versions bundled with OS)
* Point will go to the person that can produce the most dense graph showing the number of concurrent connections against the response time. Individual tests used to plot the data must be repeated at least 3 times.

You will need to create two different virtual machines, one is going to be the wordpress server and the 2nd one is the client which is used to attack the server.

To be able to connect between the two virtual machines, You need to add an additional network adapter to both hosts. It can be either "Host Only" or "Internal" type.

To enable the new adapters in Ubuntu edit the file: /etc/network/interfaces

ITX8080

2011-12-15T22:04:02Z

Anttix: /* Points scored so far */

= General Information =
== Schedule ==

Lecture TH 17:45 - 21:15 (odd weeks)

Practice TH 17:45 - 21:15 (even weeks)

== Communication ==

Discussinons will be held at course forum in Moodle.

https://moodle.e-ope.ee/course/view.php?id=4319

All scenario proposals must be posted to their own respective forums.

Please register your account today at http://moodle.e-ope.ee

The lecturers can be reached via the course coordinator:

antti.andreimann only-people-please eesti.ee

= Grading =

Best of the bunch will score points.

Points will be awareded for the:

* Best simulation proposal
* Best result obtained in the lab environment
* Best lab report

In total it is possible to score three points for every two weeks.

Maximum score is 3, nobody will be awareded more.

Minimum score to pass is 1.

For those who can not score a single point, an
examination proposals will received from those
of you who scored 3 and voted.

== Points scored so far ==

Margus - 3pts (lecture 1 vote, lab 2 testing method, lab 3 result)

Andres - 1pts (best lab 1 report)

Michal - 1pts (best lab 1 result)

Alexandre - 1pts (best lab 2 result)

Roman - 1pts (best lab 2 report)

Allan - 3pts (best lab 3 proposal with Predrag, lucky SOB scenario 4 proposal, best scenario 5 proposal)

Predrag - 2pts (best lab 3 proposal with Allan, best scenario 5 proposal)

Mauno P - 3pts (best lab 3 report, best lab 4 report, best scenario 7 proposal)

Robert P - 3 pts (best scenario 4 proposal, best lab 4 result, best lab 5 result)

Anis - 1 pts (best lab 4 result)

Mart - 1 pts (best lab 5 report)

Ronny - 1 pts (best lab 7 report)

Mikheil - 1 pts (best lab 6 report)

Jan - 1pts (best lab 8 result)

= Scenarios =

== Scenario 1 ==

There is a Wordpress based blog.

The client is worried: How many visitors can they handle before they die.

Establish a baseline: How many page displays per second AT LEAST we can handle.
Disruption of the site operation is NOT acceptable.

Minimal budget!

Assume upstream bandwidth can cope...

Be as detailed and technical as You possibly can.

=== Proposals ===

* Install a similar system on test hardware
** Test hardware is smaller than
* Extrapolate from current system logs
** Must have some load ...
** It may NOT be linear (it usually isn't!)
* Generate some load (without breaking it) and extrapolate from logs
* Find existing performance graphs for wordpress ... (highly unlikely)

=== Simulation environment ===

* Real hardware
* Virtualization platform

Pick what is closer to the real system.

=== Benchmarking tools ===

* httpPerf
* pagetop
* htop
* AB - apache bench
* curl / wget + custom scripts
* JMeter
* Grinder
* wpscan - wordpress specific

=== How to separate benchmark tools from the server? ===

* Use to VMs, Use CPU allocation in virtualization environment to allocate different CPUs for different VMs
* Put VM disk images on different disks (probably an overkill)?
* Monitor process table and make sure that test tools consume significantly less than web server processes. Lower the priority of the test tools.
* Start monitoring load and page views. Generate some load on real system. How?

How do we define the system is dead?

Page view takes longer than 10sec.

=== Determining if referenced content has an effect on results ===
* Make a list of all references the main page has
* Measure the performance of all the URLs
* Disregard the ones that load at least two magnitudes faster.

=== How to measure the results? ===

* Measure response times and number of parallel requests using the benchmarking tool itself
* Deduct the numbers from server logs
* Put the system under load, test with a normal browser if the load time is reasonable.

=== What to document? ===

* Exact configuration of the benchmarking tool (command line, scripts, config files etc. for EACH test performed)
* The version of the benchmarking tool used
* Virtualization platform
* Hardware specification
* URL of the page tested
* Wordpress configuration
* Wordpress content !!!
* Wordpress version
* Web server configuration
* Web server version (apache, php, sql, etc)
* The measurement results (page load times under each different test)
* Web browser used to measure response time (type, version, operating system)
* Operating system configuration (version, software installed, customizations etc).
* The AUTHOR! and the DATE!

Write evertyhing down at ONCE.
if using VM-s save the image.

=== Lab1 ===

* Virtualization platform: VirtualBox
** 512M memory, 1 CPU for each VM
* Wordpress 3.2.1 with default settings (no extra plugins, no performance tweaks, default skin) and default home page
* Ubuntu Server 10.04 LTS 32bit
* Web server: Apache2, SQL: MySQL (default versions bundled with OS)
* Point will go to the person that can produce the most dense graph showing the number of concurrent connections against the response time. Individual tests used to plot the data must be repeated at least 3 times.

You will need to create two different virtual machines, one is going to be the wordpress server and the 2nd one is the client which is used to attack the server.

To be able to connect between the two virtual machines, You need to add an additional network adapter to both hosts. It can be either "Host Only" or "Internal" type.

To enable the new adapters in Ubuntu edit the file: /etc/network/interfaces

ITX8080

2011-12-13T15:02:22Z

Anttix: /* Points scored so far */

= General Information =
== Schedule ==

Lecture TH 17:45 - 21:15 (odd weeks)

Practice TH 17:45 - 21:15 (even weeks)

== Communication ==

Discussinons will be held at course forum in Moodle.

https://moodle.e-ope.ee/course/view.php?id=4319

All scenario proposals must be posted to their own respective forums.

Please register your account today at http://moodle.e-ope.ee

The lecturers can be reached via the course coordinator:

antti.andreimann only-people-please eesti.ee

= Grading =

Best of the bunch will score points.

Points will be awareded for the:

* Best simulation proposal
* Best result obtained in the lab environment
* Best lab report

In total it is possible to score three points for every two weeks.

Maximum score is 3, nobody will be awareded more.

Minimum score to pass is 1.

For those who can not score a single point, an
examination proposals will received from those
of you who scored 3 and voted.

== Points scored so far ==

Margus - 3pts (lecture 1 vote, lab 2 testing method, lab 3 result)

Andres - 1pts (best lab 1 report)

Michal - 1pts (best lab 1 result)

Alexandre - 1pts (best lab 2 result)

Roman - 1pts (best lab 2 report)

Allan - 3pts (best lab 3 proposal with Predrag, lucky SOB scenario 4 proposal, best scenario 5 proposal)

Predrag - 2pts (best lab 3 proposal with Allan, best scenario 5 proposal)

Mauno P - 3pts (best lab 3 report, best lab 4 report, best scenario 7 proposal)

Robert P - 3 pts (best scenario 4 proposal, best lab 4 result, best lab 5 result)

Anis - 1 pts (best lab 4 result)

Mart - 1 pts (best lab 5 report)

Ronny - 1 pts (best lab 7 report)

Mikheil - 1 pts (best lab 6 report)

= Scenarios =

== Scenario 1 ==

There is a Wordpress based blog.

The client is worried: How many visitors can they handle before they die.

Establish a baseline: How many page displays per second AT LEAST we can handle.
Disruption of the site operation is NOT acceptable.

Minimal budget!

Assume upstream bandwidth can cope...

Be as detailed and technical as You possibly can.

=== Proposals ===

* Install a similar system on test hardware
** Test hardware is smaller than
* Extrapolate from current system logs
** Must have some load ...
** It may NOT be linear (it usually isn't!)
* Generate some load (without breaking it) and extrapolate from logs
* Find existing performance graphs for wordpress ... (highly unlikely)

=== Simulation environment ===

* Real hardware
* Virtualization platform

Pick what is closer to the real system.

=== Benchmarking tools ===

* httpPerf
* pagetop
* htop
* AB - apache bench
* curl / wget + custom scripts
* JMeter
* Grinder
* wpscan - wordpress specific

=== How to separate benchmark tools from the server? ===

* Use to VMs, Use CPU allocation in virtualization environment to allocate different CPUs for different VMs
* Put VM disk images on different disks (probably an overkill)?
* Monitor process table and make sure that test tools consume significantly less than web server processes. Lower the priority of the test tools.
* Start monitoring load and page views. Generate some load on real system. How?

How do we define the system is dead?

Page view takes longer than 10sec.

=== Determining if referenced content has an effect on results ===
* Make a list of all references the main page has
* Measure the performance of all the URLs
* Disregard the ones that load at least two magnitudes faster.

=== How to measure the results? ===

* Measure response times and number of parallel requests using the benchmarking tool itself
* Deduct the numbers from server logs
* Put the system under load, test with a normal browser if the load time is reasonable.

=== What to document? ===

* Exact configuration of the benchmarking tool (command line, scripts, config files etc. for EACH test performed)
* The version of the benchmarking tool used
* Virtualization platform
* Hardware specification
* URL of the page tested
* Wordpress configuration
* Wordpress content !!!
* Wordpress version
* Web server configuration
* Web server version (apache, php, sql, etc)
* The measurement results (page load times under each different test)
* Web browser used to measure response time (type, version, operating system)
* Operating system configuration (version, software installed, customizations etc).
* The AUTHOR! and the DATE!

Write evertyhing down at ONCE.
if using VM-s save the image.

=== Lab1 ===

* Virtualization platform: VirtualBox
** 512M memory, 1 CPU for each VM
* Wordpress 3.2.1 with default settings (no extra plugins, no performance tweaks, default skin) and default home page
* Ubuntu Server 10.04 LTS 32bit
* Web server: Apache2, SQL: MySQL (default versions bundled with OS)
* Point will go to the person that can produce the most dense graph showing the number of concurrent connections against the response time. Individual tests used to plot the data must be repeated at least 3 times.

You will need to create two different virtual machines, one is going to be the wordpress server and the 2nd one is the client which is used to attack the server.

To be able to connect between the two virtual machines, You need to add an additional network adapter to both hosts. It can be either "Host Only" or "Internal" type.

To enable the new adapters in Ubuntu edit the file: /etc/network/interfaces

ITX8080

2011-11-24T19:00:00Z

Anttix: /* Points scored so far */

= General Information =
== Schedule ==

Lecture TH 17:45 - 21:15 (odd weeks)

Practice TH 17:45 - 21:15 (even weeks)

== Communication ==

Discussinons will be held at course forum in Moodle.

https://moodle.e-ope.ee/course/view.php?id=4319

All scenario proposals must be posted to their own respective forums.

Please register your account today at http://moodle.e-ope.ee

The lecturers can be reached via the course coordinator:

antti.andreimann only-people-please eesti.ee

= Grading =

Best of the bunch will score points.

Points will be awareded for the:

* Best simulation proposal
* Best result obtained in the lab environment
* Best lab report

In total it is possible to score three points for every two weeks.

Maximum score is 3, nobody will be awareded more.

Minimum score to pass is 1.

For those who can not score a single point, an
examination proposals will received from those
of you who scored 3 and voted.

== Points scored so far ==

Margus - 3pts (lecture 1 vote, lab 2 testing method, lab 3 result)

Andres - 1pts (best lab 1 report)

Michal - 1pts (best lab 1 result)

Alexandre - 1pts (best lab 2 result)

Roman - 1pts (best lab 2 report)

Allan - 3pts (best lab 3 proposal with Predrag, lucky SOB scenario 4 proposal, best scenario 5 proposal)

Predrag - 2pts (best lab 3 proposal with Allan, best scenario 5 proposal)

Mauno P - 2pts (best lab 3 report, best lab 4 report)

Robert P - 3 pts (best scenario 4 proposal, best lab 4 result, best lab 5 result)

Anis - 1 pts (best lab 4 result)

Mart - 1 pts (best lab 5 report)

= Scenarios =

== Scenario 1 ==

There is a Wordpress based blog.

The client is worried: How many visitors can they handle before they die.

Establish a baseline: How many page displays per second AT LEAST we can handle.
Disruption of the site operation is NOT acceptable.

Minimal budget!

Assume upstream bandwidth can cope...

Be as detailed and technical as You possibly can.

=== Proposals ===

* Install a similar system on test hardware
** Test hardware is smaller than
* Extrapolate from current system logs
** Must have some load ...
** It may NOT be linear (it usually isn't!)
* Generate some load (without breaking it) and extrapolate from logs
* Find existing performance graphs for wordpress ... (highly unlikely)

=== Simulation environment ===

* Real hardware
* Virtualization platform

Pick what is closer to the real system.

=== Benchmarking tools ===

* httpPerf
* pagetop
* htop
* AB - apache bench
* curl / wget + custom scripts
* JMeter
* Grinder
* wpscan - wordpress specific

=== How to separate benchmark tools from the server? ===

* Use to VMs, Use CPU allocation in virtualization environment to allocate different CPUs for different VMs
* Put VM disk images on different disks (probably an overkill)?
* Monitor process table and make sure that test tools consume significantly less than web server processes. Lower the priority of the test tools.
* Start monitoring load and page views. Generate some load on real system. How?

How do we define the system is dead?

Page view takes longer than 10sec.

=== Determining if referenced content has an effect on results ===
* Make a list of all references the main page has
* Measure the performance of all the URLs
* Disregard the ones that load at least two magnitudes faster.

=== How to measure the results? ===

* Measure response times and number of parallel requests using the benchmarking tool itself
* Deduct the numbers from server logs
* Put the system under load, test with a normal browser if the load time is reasonable.

=== What to document? ===

* Exact configuration of the benchmarking tool (command line, scripts, config files etc. for EACH test performed)
* The version of the benchmarking tool used
* Virtualization platform
* Hardware specification
* URL of the page tested
* Wordpress configuration
* Wordpress content !!!
* Wordpress version
* Web server configuration
* Web server version (apache, php, sql, etc)
* The measurement results (page load times under each different test)
* Web browser used to measure response time (type, version, operating system)
* Operating system configuration (version, software installed, customizations etc).
* The AUTHOR! and the DATE!

Write evertyhing down at ONCE.
if using VM-s save the image.

=== Lab1 ===

* Virtualization platform: VirtualBox
** 512M memory, 1 CPU for each VM
* Wordpress 3.2.1 with default settings (no extra plugins, no performance tweaks, default skin) and default home page
* Ubuntu Server 10.04 LTS 32bit
* Web server: Apache2, SQL: MySQL (default versions bundled with OS)
* Point will go to the person that can produce the most dense graph showing the number of concurrent connections against the response time. Individual tests used to plot the data must be repeated at least 3 times.

You will need to create two different virtual machines, one is going to be the wordpress server and the 2nd one is the client which is used to attack the server.

To be able to connect between the two virtual machines, You need to add an additional network adapter to both hosts. It can be either "Host Only" or "Internal" type.

To enable the new adapters in Ubuntu edit the file: /etc/network/interfaces

ITX8080

2011-11-17T19:27:06Z

Anttix: /* Points scored so far */

= General Information =
== Schedule ==

Lecture TH 17:45 - 21:15 (odd weeks)

Practice TH 17:45 - 21:15 (even weeks)

== Communication ==

Discussinons will be held at course forum in Moodle.

https://moodle.e-ope.ee/course/view.php?id=4319

All scenario proposals must be posted to their own respective forums.

Please register your account today at http://moodle.e-ope.ee

The lecturers can be reached via the course coordinator:

antti.andreimann only-people-please eesti.ee

= Grading =

Best of the bunch will score points.

Points will be awareded for the:

* Best simulation proposal
* Best result obtained in the lab environment
* Best lab report

In total it is possible to score three points for every two weeks.

Maximum score is 3, nobody will be awareded more.

Minimum score to pass is 1.

For those who can not score a single point, an
examination proposals will received from those
of you who scored 3 and voted.

== Points scored so far ==

Margus - 3pts (lecture 1 vote, lab 2 testing method, lab 3 result)

Andres - 1pts (best lab 1 report)

Michal - 1pts (best lab 1 result)

Alexandre - 1pts (best lab 2 result)

Roman - 1pts (best lab 2 report)

Allan - 3pts (best lab 3 proposal with Predrag, lucky SOB scenario 4 proposal, best scenario 5 proposal)

Predrag - 1pts (best lab 3 proposal with Allan)

Mauno P - 2pts (best lab 3 report, best lab 4 report)

Robert P - 2 pts (best scenario 4 proposal, best lab 4 result)

Anis - 1 pts (best lab 4 result)

Mart - 1 pts (best lab 5 report)

= Scenarios =

== Scenario 1 ==

There is a Wordpress based blog.

The client is worried: How many visitors can they handle before they die.

Establish a baseline: How many page displays per second AT LEAST we can handle.
Disruption of the site operation is NOT acceptable.

Minimal budget!

Assume upstream bandwidth can cope...

Be as detailed and technical as You possibly can.

=== Proposals ===

* Install a similar system on test hardware
** Test hardware is smaller than
* Extrapolate from current system logs
** Must have some load ...
** It may NOT be linear (it usually isn't!)
* Generate some load (without breaking it) and extrapolate from logs
* Find existing performance graphs for wordpress ... (highly unlikely)

=== Simulation environment ===

* Real hardware
* Virtualization platform

Pick what is closer to the real system.

=== Benchmarking tools ===

* httpPerf
* pagetop
* htop
* AB - apache bench
* curl / wget + custom scripts
* JMeter
* Grinder
* wpscan - wordpress specific

=== How to separate benchmark tools from the server? ===

* Use to VMs, Use CPU allocation in virtualization environment to allocate different CPUs for different VMs
* Put VM disk images on different disks (probably an overkill)?
* Monitor process table and make sure that test tools consume significantly less than web server processes. Lower the priority of the test tools.
* Start monitoring load and page views. Generate some load on real system. How?

How do we define the system is dead?

Page view takes longer than 10sec.

=== Determining if referenced content has an effect on results ===
* Make a list of all references the main page has
* Measure the performance of all the URLs
* Disregard the ones that load at least two magnitudes faster.

=== How to measure the results? ===

* Measure response times and number of parallel requests using the benchmarking tool itself
* Deduct the numbers from server logs
* Put the system under load, test with a normal browser if the load time is reasonable.

=== What to document? ===

* Exact configuration of the benchmarking tool (command line, scripts, config files etc. for EACH test performed)
* The version of the benchmarking tool used
* Virtualization platform
* Hardware specification
* URL of the page tested
* Wordpress configuration
* Wordpress content !!!
* Wordpress version
* Web server configuration
* Web server version (apache, php, sql, etc)
* The measurement results (page load times under each different test)
* Web browser used to measure response time (type, version, operating system)
* Operating system configuration (version, software installed, customizations etc).
* The AUTHOR! and the DATE!

Write evertyhing down at ONCE.
if using VM-s save the image.

=== Lab1 ===

* Virtualization platform: VirtualBox
** 512M memory, 1 CPU for each VM
* Wordpress 3.2.1 with default settings (no extra plugins, no performance tweaks, default skin) and default home page
* Ubuntu Server 10.04 LTS 32bit
* Web server: Apache2, SQL: MySQL (default versions bundled with OS)
* Point will go to the person that can produce the most dense graph showing the number of concurrent connections against the response time. Individual tests used to plot the data must be repeated at least 3 times.

You will need to create two different virtual machines, one is going to be the wordpress server and the 2nd one is the client which is used to attack the server.

To be able to connect between the two virtual machines, You need to add an additional network adapter to both hosts. It can be either "Host Only" or "Internal" type.

To enable the new adapters in Ubuntu edit the file: /etc/network/interfaces

ITX8080

2011-11-17T19:26:40Z

Anttix: /* Points scored so far */

= General Information =
== Schedule ==

Lecture TH 17:45 - 21:15 (odd weeks)

Practice TH 17:45 - 21:15 (even weeks)

== Communication ==

Discussinons will be held at course forum in Moodle.

https://moodle.e-ope.ee/course/view.php?id=4319

All scenario proposals must be posted to their own respective forums.

Please register your account today at http://moodle.e-ope.ee

The lecturers can be reached via the course coordinator:

antti.andreimann only-people-please eesti.ee

= Grading =

Best of the bunch will score points.

Points will be awareded for the:

* Best simulation proposal
* Best result obtained in the lab environment
* Best lab report

In total it is possible to score three points for every two weeks.

Maximum score is 3, nobody will be awareded more.

Minimum score to pass is 1.

For those who can not score a single point, an
examination proposals will received from those
of you who scored 3 and voted.

== Points scored so far ==

Margus - 3pts (lecture 1 vote, lab 2 testing method, lab 3 result)

Andres - 1pts (best lab 1 report)

Michal - 1pts (best lab 1 result)

Alexandre - 1pts (best lab 2 result)

Roman - 1pts (best lab 2 report)

Allan - 3pts (best lab 3 proposal with Predrag, lucky SOB scenario 4 proposal, best scenario 5 proposal)

Predrag - 1pts (best lab 3 proposal with Allan)

Mauno P - 2pts (best lab 3 report, best lab 4 report)

Robert P - 2 pts (best scenario 4 proposal, best lab 4 result)

Anis - 1 pts (best lab 4 result)

= Scenarios =

== Scenario 1 ==

There is a Wordpress based blog.

The client is worried: How many visitors can they handle before they die.

Establish a baseline: How many page displays per second AT LEAST we can handle.
Disruption of the site operation is NOT acceptable.

Minimal budget!

Assume upstream bandwidth can cope...

Be as detailed and technical as You possibly can.

=== Proposals ===

* Install a similar system on test hardware
** Test hardware is smaller than
* Extrapolate from current system logs
** Must have some load ...
** It may NOT be linear (it usually isn't!)
* Generate some load (without breaking it) and extrapolate from logs
* Find existing performance graphs for wordpress ... (highly unlikely)

=== Simulation environment ===

* Real hardware
* Virtualization platform

Pick what is closer to the real system.

=== Benchmarking tools ===

* httpPerf
* pagetop
* htop
* AB - apache bench
* curl / wget + custom scripts
* JMeter
* Grinder
* wpscan - wordpress specific

=== How to separate benchmark tools from the server? ===

* Use to VMs, Use CPU allocation in virtualization environment to allocate different CPUs for different VMs
* Put VM disk images on different disks (probably an overkill)?
* Monitor process table and make sure that test tools consume significantly less than web server processes. Lower the priority of the test tools.
* Start monitoring load and page views. Generate some load on real system. How?

How do we define the system is dead?

Page view takes longer than 10sec.

=== Determining if referenced content has an effect on results ===
* Make a list of all references the main page has
* Measure the performance of all the URLs
* Disregard the ones that load at least two magnitudes faster.

=== How to measure the results? ===

* Measure response times and number of parallel requests using the benchmarking tool itself
* Deduct the numbers from server logs
* Put the system under load, test with a normal browser if the load time is reasonable.

=== What to document? ===

* Exact configuration of the benchmarking tool (command line, scripts, config files etc. for EACH test performed)
* The version of the benchmarking tool used
* Virtualization platform
* Hardware specification
* URL of the page tested
* Wordpress configuration
* Wordpress content !!!
* Wordpress version
* Web server configuration
* Web server version (apache, php, sql, etc)
* The measurement results (page load times under each different test)
* Web browser used to measure response time (type, version, operating system)
* Operating system configuration (version, software installed, customizations etc).
* The AUTHOR! and the DATE!

Write evertyhing down at ONCE.
if using VM-s save the image.

=== Lab1 ===

* Virtualization platform: VirtualBox
** 512M memory, 1 CPU for each VM
* Wordpress 3.2.1 with default settings (no extra plugins, no performance tweaks, default skin) and default home page
* Ubuntu Server 10.04 LTS 32bit
* Web server: Apache2, SQL: MySQL (default versions bundled with OS)
* Point will go to the person that can produce the most dense graph showing the number of concurrent connections against the response time. Individual tests used to plot the data must be repeated at least 3 times.

You will need to create two different virtual machines, one is going to be the wordpress server and the 2nd one is the client which is used to attack the server.

To be able to connect between the two virtual machines, You need to add an additional network adapter to both hosts. It can be either "Host Only" or "Internal" type.

To enable the new adapters in Ubuntu edit the file: /etc/network/interfaces

ITX8080

2011-11-03T22:02:28Z

Anttix: /* Points scored so far */

= General Information =
== Schedule ==

Lecture TH 17:45 - 21:15 (odd weeks)

Practice TH 17:45 - 21:15 (even weeks)

== Communication ==

Discussinons will be held at course forum in Moodle.

https://moodle.e-ope.ee/course/view.php?id=4319

All scenario proposals must be posted to their own respective forums.

Please register your account today at http://moodle.e-ope.ee

The lecturers can be reached via the course coordinator:

antti.andreimann only-people-please eesti.ee

= Grading =

Best of the bunch will score points.

Points will be awareded for the:

* Best simulation proposal
* Best result obtained in the lab environment
* Best lab report

In total it is possible to score three points for every two weeks.

Maximum score is 3, nobody will be awareded more.

Minimum score to pass is 1.

For those who can not score a single point, an
examination proposals will received from those
of you who scored 3 and voted.

== Points scored so far ==

Margus - 3pts (lecture 1 vote, lab 2 testing method, lab 3 result)

Andres - 1pts (best lab 1 report)

Michal - 1pts (best lab 1 result)

Alexandre - 1pts (best lab 2 result)

Roman - 1pts (best lab 2 report)

Allan - 2pts (best lab 3 proposal with Predrag, lucky SOB scenario 4 proposal)

Predrag - 1pts (best lab 3 proposal with Allan)

Mauno P - 2pts (best lab 3 report, best lab 4 report)

Robert P - 2 pts (best scenario 4 proposal, best lab 4 result)

Anis - 1 pts (best lab 4 result)

= Scenarios =

== Scenario 1 ==

There is a Wordpress based blog.

The client is worried: How many visitors can they handle before they die.

Establish a baseline: How many page displays per second AT LEAST we can handle.
Disruption of the site operation is NOT acceptable.

Minimal budget!

Assume upstream bandwidth can cope...

Be as detailed and technical as You possibly can.

=== Proposals ===

* Install a similar system on test hardware
** Test hardware is smaller than
* Extrapolate from current system logs
** Must have some load ...
** It may NOT be linear (it usually isn't!)
* Generate some load (without breaking it) and extrapolate from logs
* Find existing performance graphs for wordpress ... (highly unlikely)

=== Simulation environment ===

* Real hardware
* Virtualization platform

Pick what is closer to the real system.

=== Benchmarking tools ===

* httpPerf
* pagetop
* htop
* AB - apache bench
* curl / wget + custom scripts
* JMeter
* Grinder
* wpscan - wordpress specific

=== How to separate benchmark tools from the server? ===

* Use to VMs, Use CPU allocation in virtualization environment to allocate different CPUs for different VMs
* Put VM disk images on different disks (probably an overkill)?
* Monitor process table and make sure that test tools consume significantly less than web server processes. Lower the priority of the test tools.
* Start monitoring load and page views. Generate some load on real system. How?

How do we define the system is dead?

Page view takes longer than 10sec.

=== Determining if referenced content has an effect on results ===
* Make a list of all references the main page has
* Measure the performance of all the URLs
* Disregard the ones that load at least two magnitudes faster.

=== How to measure the results? ===

* Measure response times and number of parallel requests using the benchmarking tool itself
* Deduct the numbers from server logs
* Put the system under load, test with a normal browser if the load time is reasonable.

=== What to document? ===

* Exact configuration of the benchmarking tool (command line, scripts, config files etc. for EACH test performed)
* The version of the benchmarking tool used
* Virtualization platform
* Hardware specification
* URL of the page tested
* Wordpress configuration
* Wordpress content !!!
* Wordpress version
* Web server configuration
* Web server version (apache, php, sql, etc)
* The measurement results (page load times under each different test)
* Web browser used to measure response time (type, version, operating system)
* Operating system configuration (version, software installed, customizations etc).
* The AUTHOR! and the DATE!

Write evertyhing down at ONCE.
if using VM-s save the image.

=== Lab1 ===

* Virtualization platform: VirtualBox
** 512M memory, 1 CPU for each VM
* Wordpress 3.2.1 with default settings (no extra plugins, no performance tweaks, default skin) and default home page
* Ubuntu Server 10.04 LTS 32bit
* Web server: Apache2, SQL: MySQL (default versions bundled with OS)
* Point will go to the person that can produce the most dense graph showing the number of concurrent connections against the response time. Individual tests used to plot the data must be repeated at least 3 times.

You will need to create two different virtual machines, one is going to be the wordpress server and the 2nd one is the client which is used to attack the server.

To be able to connect between the two virtual machines, You need to add an additional network adapter to both hosts. It can be either "Host Only" or "Internal" type.

To enable the new adapters in Ubuntu edit the file: /etc/network/interfaces

ITX8080

2011-11-03T21:01:23Z

Anttix: /* Points scored so far */

= General Information =
== Schedule ==

Lecture TH 17:45 - 21:15 (odd weeks)

Practice TH 17:45 - 21:15 (even weeks)

== Communication ==

Discussinons will be held at course forum in Moodle.

https://moodle.e-ope.ee/course/view.php?id=4319

All scenario proposals must be posted to their own respective forums.

Please register your account today at http://moodle.e-ope.ee

The lecturers can be reached via the course coordinator:

antti.andreimann only-people-please eesti.ee

= Grading =

Best of the bunch will score points.

Points will be awareded for the:

* Best simulation proposal
* Best result obtained in the lab environment
* Best lab report

In total it is possible to score three points for every two weeks.

Maximum score is 3, nobody will be awareded more.

Minimum score to pass is 1.

For those who can not score a single point, an
examination proposals will received from those
of you who scored 3 and voted.

== Points scored so far ==

Margus - 3pts (lecture 1 vote, lab 2 testing method, lab 3 result)

Andres - 1pts (best lab 1 report)

Michal - 1pts (best lab 1 result)

Alexandre - 1pts (best lab 2 result)

Roman - 1pts (best lab 2 report)

Allan - 2pts (best lab 3 proposal with Predrag, lucky SOB scenario 4 proposal)

Predrag - 1pts (best lab 3 proposal with Allan)

Mauno P - 2pts (best lab 3 report, best lab 4 report)

Robert P - 1 pts (best scenario 4 proposal)

Anis - 1 pts (best lab 4 result)

= Scenarios =

== Scenario 1 ==

There is a Wordpress based blog.

The client is worried: How many visitors can they handle before they die.

Establish a baseline: How many page displays per second AT LEAST we can handle.
Disruption of the site operation is NOT acceptable.

Minimal budget!

Assume upstream bandwidth can cope...

Be as detailed and technical as You possibly can.

=== Proposals ===

* Install a similar system on test hardware
** Test hardware is smaller than
* Extrapolate from current system logs
** Must have some load ...
** It may NOT be linear (it usually isn't!)
* Generate some load (without breaking it) and extrapolate from logs
* Find existing performance graphs for wordpress ... (highly unlikely)

=== Simulation environment ===

* Real hardware
* Virtualization platform

Pick what is closer to the real system.

=== Benchmarking tools ===

* httpPerf
* pagetop
* htop
* AB - apache bench
* curl / wget + custom scripts
* JMeter
* Grinder
* wpscan - wordpress specific

=== How to separate benchmark tools from the server? ===

* Use to VMs, Use CPU allocation in virtualization environment to allocate different CPUs for different VMs
* Put VM disk images on different disks (probably an overkill)?
* Monitor process table and make sure that test tools consume significantly less than web server processes. Lower the priority of the test tools.
* Start monitoring load and page views. Generate some load on real system. How?

How do we define the system is dead?

Page view takes longer than 10sec.

=== Determining if referenced content has an effect on results ===
* Make a list of all references the main page has
* Measure the performance of all the URLs
* Disregard the ones that load at least two magnitudes faster.

=== How to measure the results? ===

* Measure response times and number of parallel requests using the benchmarking tool itself
* Deduct the numbers from server logs
* Put the system under load, test with a normal browser if the load time is reasonable.

=== What to document? ===

* Exact configuration of the benchmarking tool (command line, scripts, config files etc. for EACH test performed)
* The version of the benchmarking tool used
* Virtualization platform
* Hardware specification
* URL of the page tested
* Wordpress configuration
* Wordpress content !!!
* Wordpress version
* Web server configuration
* Web server version (apache, php, sql, etc)
* The measurement results (page load times under each different test)
* Web browser used to measure response time (type, version, operating system)
* Operating system configuration (version, software installed, customizations etc).
* The AUTHOR! and the DATE!

Write evertyhing down at ONCE.
if using VM-s save the image.

=== Lab1 ===

* Virtualization platform: VirtualBox
** 512M memory, 1 CPU for each VM
* Wordpress 3.2.1 with default settings (no extra plugins, no performance tweaks, default skin) and default home page
* Ubuntu Server 10.04 LTS 32bit
* Web server: Apache2, SQL: MySQL (default versions bundled with OS)
* Point will go to the person that can produce the most dense graph showing the number of concurrent connections against the response time. Individual tests used to plot the data must be repeated at least 3 times.

You will need to create two different virtual machines, one is going to be the wordpress server and the 2nd one is the client which is used to attack the server.

To be able to connect between the two virtual machines, You need to add an additional network adapter to both hosts. It can be either "Host Only" or "Internal" type.

To enable the new adapters in Ubuntu edit the file: /etc/network/interfaces

ITX8080

2011-11-03T20:42:38Z

Anttix: /* Points scored so far */

= General Information =
== Schedule ==

Lecture TH 17:45 - 21:15 (odd weeks)

Practice TH 17:45 - 21:15 (even weeks)

== Communication ==

Discussinons will be held at course forum in Moodle.

https://moodle.e-ope.ee/course/view.php?id=4319

All scenario proposals must be posted to their own respective forums.

Please register your account today at http://moodle.e-ope.ee

The lecturers can be reached via the course coordinator:

antti.andreimann only-people-please eesti.ee

= Grading =

Best of the bunch will score points.

Points will be awareded for the:

* Best simulation proposal
* Best result obtained in the lab environment
* Best lab report

In total it is possible to score three points for every two weeks.

Maximum score is 3, nobody will be awareded more.

Minimum score to pass is 1.

For those who can not score a single point, an
examination proposals will received from those
of you who scored 3 and voted.

== Points scored so far ==

Margus - 3pts (lecture 1 vote, lab 2 testing method, lab 3 result)

Andres - 1pts (best lab 1 report)

Michal - 1pts (best lab 1 result)

Alexandre - 1pts (best lab 2 result)

Roman - 1pts (best lab 2 report)

Allan - 2pts (best lab 3 proposal with Predrag, lucky SOB scenario 4 proposal)

Predrag - 1pts (best lab 3 proposal with Allan)

Mauno P - 2pts (best lab 3 report, best lab 4 report)

Robert P - 1 pts (best scenario 4 proposal)

= Scenarios =

== Scenario 1 ==

There is a Wordpress based blog.

The client is worried: How many visitors can they handle before they die.

Establish a baseline: How many page displays per second AT LEAST we can handle.
Disruption of the site operation is NOT acceptable.

Minimal budget!

Assume upstream bandwidth can cope...

Be as detailed and technical as You possibly can.

=== Proposals ===

* Install a similar system on test hardware
** Test hardware is smaller than
* Extrapolate from current system logs
** Must have some load ...
** It may NOT be linear (it usually isn't!)
* Generate some load (without breaking it) and extrapolate from logs
* Find existing performance graphs for wordpress ... (highly unlikely)

=== Simulation environment ===

* Real hardware
* Virtualization platform

Pick what is closer to the real system.

=== Benchmarking tools ===

* httpPerf
* pagetop
* htop
* AB - apache bench
* curl / wget + custom scripts
* JMeter
* Grinder
* wpscan - wordpress specific

=== How to separate benchmark tools from the server? ===

* Use to VMs, Use CPU allocation in virtualization environment to allocate different CPUs for different VMs
* Put VM disk images on different disks (probably an overkill)?
* Monitor process table and make sure that test tools consume significantly less than web server processes. Lower the priority of the test tools.
* Start monitoring load and page views. Generate some load on real system. How?

How do we define the system is dead?

Page view takes longer than 10sec.

=== Determining if referenced content has an effect on results ===
* Make a list of all references the main page has
* Measure the performance of all the URLs
* Disregard the ones that load at least two magnitudes faster.

=== How to measure the results? ===

* Measure response times and number of parallel requests using the benchmarking tool itself
* Deduct the numbers from server logs
* Put the system under load, test with a normal browser if the load time is reasonable.

=== What to document? ===

* Exact configuration of the benchmarking tool (command line, scripts, config files etc. for EACH test performed)
* The version of the benchmarking tool used
* Virtualization platform
* Hardware specification
* URL of the page tested
* Wordpress configuration
* Wordpress content !!!
* Wordpress version
* Web server configuration
* Web server version (apache, php, sql, etc)
* The measurement results (page load times under each different test)
* Web browser used to measure response time (type, version, operating system)
* Operating system configuration (version, software installed, customizations etc).
* The AUTHOR! and the DATE!

Write evertyhing down at ONCE.
if using VM-s save the image.

=== Lab1 ===

* Virtualization platform: VirtualBox
** 512M memory, 1 CPU for each VM
* Wordpress 3.2.1 with default settings (no extra plugins, no performance tweaks, default skin) and default home page
* Ubuntu Server 10.04 LTS 32bit
* Web server: Apache2, SQL: MySQL (default versions bundled with OS)
* Point will go to the person that can produce the most dense graph showing the number of concurrent connections against the response time. Individual tests used to plot the data must be repeated at least 3 times.

You will need to create two different virtual machines, one is going to be the wordpress server and the 2nd one is the client which is used to attack the server.

To be able to connect between the two virtual machines, You need to add an additional network adapter to both hosts. It can be either "Host Only" or "Internal" type.

To enable the new adapters in Ubuntu edit the file: /etc/network/interfaces

ITX8080

2011-10-13T19:47:44Z

Anttix: /* Points scored so far */

= General Information =
== Schedule ==

Lecture TH 17:45 - 21:15 (odd weeks)

Practice TH 17:45 - 21:15 (even weeks)

== Communication ==

Discussinons will be held at course forum in Moodle.

https://moodle.e-ope.ee/course/view.php?id=4319

All scenario proposals must be posted to their own respective forums.

Please register your account today at http://moodle.e-ope.ee

The lecturers can be reached via the course coordinator:

antti.andreimann only-people-please eesti.ee

= Grading =

Best of the bunch will score points.

Points will be awareded for the:

* Best simulation proposal
* Best result obtained in the lab environment
* Best lab report

In total it is possible to score three points for every two weeks.

Maximum score is 3, nobody will be awareded more.

Minimum score to pass is 1.

For those who can not score a single point, an
examination proposals will received from those
of you who scored 3 and voted.

== Points scored so far ==

Margus - 3pts (lecture 1 vote, lab 2 testing method, lab 3 result)

Andres - 1pts (best lab 1 report)

Michal - 1pts (best lab 1 result)

Alexandre - 1pts (best lab 2 result)

Roman - 1pts (best lab 2 report)

Allan - 1pts (best lab 3 proposal with Predrag)

Predrag - 1pts (best lab 3 proposal with Allan)

Mauno P - 1pts (best lab 3 report)

Robert P - 1 pts (best scenario 4 proposal)

= Scenarios =

== Scenario 1 ==

There is a Wordpress based blog.

The client is worried: How many visitors can they handle before they die.

Establish a baseline: How many page displays per second AT LEAST we can handle.
Disruption of the site operation is NOT acceptable.

Minimal budget!

Assume upstream bandwidth can cope...

Be as detailed and technical as You possibly can.

=== Proposals ===

* Install a similar system on test hardware
** Test hardware is smaller than
* Extrapolate from current system logs
** Must have some load ...
** It may NOT be linear (it usually isn't!)
* Generate some load (without breaking it) and extrapolate from logs
* Find existing performance graphs for wordpress ... (highly unlikely)

=== Simulation environment ===

* Real hardware
* Virtualization platform

Pick what is closer to the real system.

=== Benchmarking tools ===

* httpPerf
* pagetop
* htop
* AB - apache bench
* curl / wget + custom scripts
* JMeter
* Grinder
* wpscan - wordpress specific

=== How to separate benchmark tools from the server? ===

* Use to VMs, Use CPU allocation in virtualization environment to allocate different CPUs for different VMs
* Put VM disk images on different disks (probably an overkill)?
* Monitor process table and make sure that test tools consume significantly less than web server processes. Lower the priority of the test tools.
* Start monitoring load and page views. Generate some load on real system. How?

How do we define the system is dead?

Page view takes longer than 10sec.

=== Determining if referenced content has an effect on results ===
* Make a list of all references the main page has
* Measure the performance of all the URLs
* Disregard the ones that load at least two magnitudes faster.

=== How to measure the results? ===

* Measure response times and number of parallel requests using the benchmarking tool itself
* Deduct the numbers from server logs
* Put the system under load, test with a normal browser if the load time is reasonable.

=== What to document? ===

* Exact configuration of the benchmarking tool (command line, scripts, config files etc. for EACH test performed)
* The version of the benchmarking tool used
* Virtualization platform
* Hardware specification
* URL of the page tested
* Wordpress configuration
* Wordpress content !!!
* Wordpress version
* Web server configuration
* Web server version (apache, php, sql, etc)
* The measurement results (page load times under each different test)
* Web browser used to measure response time (type, version, operating system)
* Operating system configuration (version, software installed, customizations etc).
* The AUTHOR! and the DATE!

Write evertyhing down at ONCE.
if using VM-s save the image.

=== Lab1 ===

* Virtualization platform: VirtualBox
** 512M memory, 1 CPU for each VM
* Wordpress 3.2.1 with default settings (no extra plugins, no performance tweaks, default skin) and default home page
* Ubuntu Server 10.04 LTS 32bit
* Web server: Apache2, SQL: MySQL (default versions bundled with OS)
* Point will go to the person that can produce the most dense graph showing the number of concurrent connections against the response time. Individual tests used to plot the data must be repeated at least 3 times.

You will need to create two different virtual machines, one is going to be the wordpress server and the 2nd one is the client which is used to attack the server.

To be able to connect between the two virtual machines, You need to add an additional network adapter to both hosts. It can be either "Host Only" or "Internal" type.

To enable the new adapters in Ubuntu edit the file: /etc/network/interfaces

ITX8080

2011-10-06T21:12:36Z

Anttix: /* Points scored so far */

= General Information =
== Schedule ==

Lecture TH 17:45 - 21:15 (odd weeks)

Practice TH 17:45 - 21:15 (even weeks)

== Communication ==

Discussinons will be held at course forum in Moodle.

https://moodle.e-ope.ee/course/view.php?id=4319

All scenario proposals must be posted to their own respective forums.

Please register your account today at http://moodle.e-ope.ee

The lecturers can be reached via the course coordinator:

antti.andreimann only-people-please eesti.ee

= Grading =

Best of the bunch will score points.

Points will be awareded for the:

* Best simulation proposal
* Best result obtained in the lab environment
* Best lab report

In total it is possible to score three points for every two weeks.

Maximum score is 3, nobody will be awareded more.

Minimum score to pass is 1.

For those who can not score a single point, an
examination proposals will received from those
of you who scored 3 and voted.

== Points scored so far ==

Margus - 3pts (lecture 1 vote, lab 2 testing method, lab 3 result)

Andres - 1pts (best lab 1 report)

Michal - 1pts (best lab 1 result)

Alexandre - 1pts (best lab 2 result)

Roman - 1pts (best lab 2 report)

= Scenarios =

== Scenario 1 ==

There is a Wordpress based blog.

The client is worried: How many visitors can they handle before they die.

Establish a baseline: How many page displays per second AT LEAST we can handle.
Disruption of the site operation is NOT acceptable.

Minimal budget!

Assume upstream bandwidth can cope...

Be as detailed and technical as You possibly can.

=== Proposals ===

* Install a similar system on test hardware
** Test hardware is smaller than
* Extrapolate from current system logs
** Must have some load ...
** It may NOT be linear (it usually isn't!)
* Generate some load (without breaking it) and extrapolate from logs
* Find existing performance graphs for wordpress ... (highly unlikely)

=== Simulation environment ===

* Real hardware
* Virtualization platform

Pick what is closer to the real system.

=== Benchmarking tools ===

* httpPerf
* pagetop
* htop
* AB - apache bench
* curl / wget + custom scripts
* JMeter
* Grinder
* wpscan - wordpress specific

=== How to separate benchmark tools from the server? ===

* Use to VMs, Use CPU allocation in virtualization environment to allocate different CPUs for different VMs
* Put VM disk images on different disks (probably an overkill)?
* Monitor process table and make sure that test tools consume significantly less than web server processes. Lower the priority of the test tools.
* Start monitoring load and page views. Generate some load on real system. How?

How do we define the system is dead?

Page view takes longer than 10sec.

=== Determining if referenced content has an effect on results ===
* Make a list of all references the main page has
* Measure the performance of all the URLs
* Disregard the ones that load at least two magnitudes faster.

=== How to measure the results? ===

* Measure response times and number of parallel requests using the benchmarking tool itself
* Deduct the numbers from server logs
* Put the system under load, test with a normal browser if the load time is reasonable.

=== What to document? ===

* Exact configuration of the benchmarking tool (command line, scripts, config files etc. for EACH test performed)
* The version of the benchmarking tool used
* Virtualization platform
* Hardware specification
* URL of the page tested
* Wordpress configuration
* Wordpress content !!!
* Wordpress version
* Web server configuration
* Web server version (apache, php, sql, etc)
* The measurement results (page load times under each different test)
* Web browser used to measure response time (type, version, operating system)
* Operating system configuration (version, software installed, customizations etc).
* The AUTHOR! and the DATE!

Write evertyhing down at ONCE.
if using VM-s save the image.

=== Lab1 ===

* Virtualization platform: VirtualBox
** 512M memory, 1 CPU for each VM
* Wordpress 3.2.1 with default settings (no extra plugins, no performance tweaks, default skin) and default home page
* Ubuntu Server 10.04 LTS 32bit
* Web server: Apache2, SQL: MySQL (default versions bundled with OS)
* Point will go to the person that can produce the most dense graph showing the number of concurrent connections against the response time. Individual tests used to plot the data must be repeated at least 3 times.

You will need to create two different virtual machines, one is going to be the wordpress server and the 2nd one is the client which is used to attack the server.

To be able to connect between the two virtual machines, You need to add an additional network adapter to both hosts. It can be either "Host Only" or "Internal" type.

To enable the new adapters in Ubuntu edit the file: /etc/network/interfaces

ITX8080

2011-10-06T18:14:58Z

Anttix: /* Points scored so far */

= General Information =
== Schedule ==

Lecture TH 17:45 - 21:15 (odd weeks)

Practice TH 17:45 - 21:15 (even weeks)

== Communication ==

Discussinons will be held at course forum in Moodle.

https://moodle.e-ope.ee/course/view.php?id=4319

All scenario proposals must be posted to their own respective forums.

Please register your account today at http://moodle.e-ope.ee

The lecturers can be reached via the course coordinator:

antti.andreimann only-people-please eesti.ee

= Grading =

Best of the bunch will score points.

Points will be awareded for the:

* Best simulation proposal
* Best result obtained in the lab environment
* Best lab report

In total it is possible to score three points for every two weeks.

Maximum score is 3, nobody will be awareded more.

Minimum score to pass is 1.

For those who can not score a single point, an
examination proposals will received from those
of you who scored 3 and voted.

== Points scored so far ==

Margus - 2pts (lecture 1 vote, lab 2 testing method)

Andres - 1pts (best lab 1 report)

Michal - 1pts (best lab 1 result)

Alexandre - 1pts (best lab 2 result)

Roman - 1pts (best lab 2 report)

= Scenarios =

== Scenario 1 ==

There is a Wordpress based blog.

The client is worried: How many visitors can they handle before they die.

Establish a baseline: How many page displays per second AT LEAST we can handle.
Disruption of the site operation is NOT acceptable.

Minimal budget!

Assume upstream bandwidth can cope...

Be as detailed and technical as You possibly can.

=== Proposals ===

* Install a similar system on test hardware
** Test hardware is smaller than
* Extrapolate from current system logs
** Must have some load ...
** It may NOT be linear (it usually isn't!)
* Generate some load (without breaking it) and extrapolate from logs
* Find existing performance graphs for wordpress ... (highly unlikely)

=== Simulation environment ===

* Real hardware
* Virtualization platform

Pick what is closer to the real system.

=== Benchmarking tools ===

* httpPerf
* pagetop
* htop
* AB - apache bench
* curl / wget + custom scripts
* JMeter
* Grinder
* wpscan - wordpress specific

=== How to separate benchmark tools from the server? ===

* Use to VMs, Use CPU allocation in virtualization environment to allocate different CPUs for different VMs
* Put VM disk images on different disks (probably an overkill)?
* Monitor process table and make sure that test tools consume significantly less than web server processes. Lower the priority of the test tools.
* Start monitoring load and page views. Generate some load on real system. How?

How do we define the system is dead?

Page view takes longer than 10sec.

=== Determining if referenced content has an effect on results ===
* Make a list of all references the main page has
* Measure the performance of all the URLs
* Disregard the ones that load at least two magnitudes faster.

=== How to measure the results? ===

* Measure response times and number of parallel requests using the benchmarking tool itself
* Deduct the numbers from server logs
* Put the system under load, test with a normal browser if the load time is reasonable.

=== What to document? ===

* Exact configuration of the benchmarking tool (command line, scripts, config files etc. for EACH test performed)
* The version of the benchmarking tool used
* Virtualization platform
* Hardware specification
* URL of the page tested
* Wordpress configuration
* Wordpress content !!!
* Wordpress version
* Web server configuration
* Web server version (apache, php, sql, etc)
* The measurement results (page load times under each different test)
* Web browser used to measure response time (type, version, operating system)
* Operating system configuration (version, software installed, customizations etc).
* The AUTHOR! and the DATE!

Write evertyhing down at ONCE.
if using VM-s save the image.

=== Lab1 ===

* Virtualization platform: VirtualBox
** 512M memory, 1 CPU for each VM
* Wordpress 3.2.1 with default settings (no extra plugins, no performance tweaks, default skin) and default home page
* Ubuntu Server 10.04 LTS 32bit
* Web server: Apache2, SQL: MySQL (default versions bundled with OS)
* Point will go to the person that can produce the most dense graph showing the number of concurrent connections against the response time. Individual tests used to plot the data must be repeated at least 3 times.

You will need to create two different virtual machines, one is going to be the wordpress server and the 2nd one is the client which is used to attack the server.

To be able to connect between the two virtual machines, You need to add an additional network adapter to both hosts. It can be either "Host Only" or "Internal" type.

To enable the new adapters in Ubuntu edit the file: /etc/network/interfaces

ITX8080

2011-09-29T21:10:01Z

Anttix: /* Points scored so far */

= General Information =
== Schedule ==

Lecture TH 17:45 - 21:15 (odd weeks)

Practice TH 17:45 - 21:15 (even weeks)

== Communication ==

Discussinons will be held at course forum in Moodle.

https://moodle.e-ope.ee/course/view.php?id=4319

All scenario proposals must be posted to their own respective forums.

Please register your account today at http://moodle.e-ope.ee

The lecturers can be reached via the course coordinator:

antti.andreimann only-people-please eesti.ee

= Grading =

Best of the bunch will score points.

Points will be awareded for the:

* Best simulation proposal
* Best result obtained in the lab environment
* Best lab report

In total it is possible to score three points for every two weeks.

Maximum score is 3, nobody will be awareded more.

Minimum score to pass is 1.

For those who can not score a single point, an
examination proposals will received from those
of you who scored 3 and voted.

== Points scored so far ==

Margus - 2pts (lecture 1 vote, lab 2 testing method)

Andres - 1pts (best lab 1 report)

Alexandre - 1pts (best lab 2 result)

Roman - 1pts (best lab 2 report)

= Scenarios =

== Scenario 1 ==

There is a Wordpress based blog.

The client is worried: How many visitors can they handle before they die.

Establish a baseline: How many page displays per second AT LEAST we can handle.
Disruption of the site operation is NOT acceptable.

Minimal budget!

Assume upstream bandwidth can cope...

Be as detailed and technical as You possibly can.

=== Proposals ===

* Install a similar system on test hardware
** Test hardware is smaller than
* Extrapolate from current system logs
** Must have some load ...
** It may NOT be linear (it usually isn't!)
* Generate some load (without breaking it) and extrapolate from logs
* Find existing performance graphs for wordpress ... (highly unlikely)

=== Simulation environment ===

* Real hardware
* Virtualization platform

Pick what is closer to the real system.

=== Benchmarking tools ===

* httpPerf
* pagetop
* htop
* AB - apache bench
* curl / wget + custom scripts
* JMeter
* Grinder
* wpscan - wordpress specific

=== How to separate benchmark tools from the server? ===

* Use to VMs, Use CPU allocation in virtualization environment to allocate different CPUs for different VMs
* Put VM disk images on different disks (probably an overkill)?
* Monitor process table and make sure that test tools consume significantly less than web server processes. Lower the priority of the test tools.
* Start monitoring load and page views. Generate some load on real system. How?

How do we define the system is dead?

Page view takes longer than 10sec.

=== Determining if referenced content has an effect on results ===
* Make a list of all references the main page has
* Measure the performance of all the URLs
* Disregard the ones that load at least two magnitudes faster.

=== How to measure the results? ===

* Measure response times and number of parallel requests using the benchmarking tool itself
* Deduct the numbers from server logs
* Put the system under load, test with a normal browser if the load time is reasonable.

=== What to document? ===

* Exact configuration of the benchmarking tool (command line, scripts, config files etc. for EACH test performed)
* The version of the benchmarking tool used
* Virtualization platform
* Hardware specification
* URL of the page tested
* Wordpress configuration
* Wordpress content !!!
* Wordpress version
* Web server configuration
* Web server version (apache, php, sql, etc)
* The measurement results (page load times under each different test)
* Web browser used to measure response time (type, version, operating system)
* Operating system configuration (version, software installed, customizations etc).
* The AUTHOR! and the DATE!

Write evertyhing down at ONCE.
if using VM-s save the image.

=== Lab1 ===

* Virtualization platform: VirtualBox
** 512M memory, 1 CPU for each VM
* Wordpress 3.2.1 with default settings (no extra plugins, no performance tweaks, default skin) and default home page
* Ubuntu Server 10.04 LTS 32bit
* Web server: Apache2, SQL: MySQL (default versions bundled with OS)
* Point will go to the person that can produce the most dense graph showing the number of concurrent connections against the response time. Individual tests used to plot the data must be repeated at least 3 times.

You will need to create two different virtual machines, one is going to be the wordpress server and the 2nd one is the client which is used to attack the server.

To be able to connect between the two virtual machines, You need to add an additional network adapter to both hosts. It can be either "Host Only" or "Internal" type.

To enable the new adapters in Ubuntu edit the file: /etc/network/interfaces

ITX8080

2011-09-22T21:03:22Z

Anttix: /* Points scored so far */

= General Information =
== Schedule ==

Lecture TH 17:45 - 21:15 (odd weeks)

Practice TH 17:45 - 21:15 (even weeks)

== Communication ==

Discussinons will be held at course forum in Moodle.

https://moodle.e-ope.ee/course/view.php?id=4319

All scenario proposals must be posted to their own respective forums.

Please register your account today at http://moodle.e-ope.ee

The lecturers can be reached via the course coordinator:

antti.andreimann only-people-please eesti.ee

= Grading =

Best of the bunch will score points.

Points will be awareded for the:

* Best simulation proposal
* Best result obtained in the lab environment
* Best lab report

In total it is possible to score three points for every two weeks.

Maximum score is 3, nobody will be awareded more.

Minimum score to pass is 1.

For those who can not score a single point, an
examination proposals will received from those
of you who scored 3 and voted.

== Points scored so far ==

Margus - 2pts (lecture 1 vote, lab 2 testing method)

Report writer #1 - 1pts (best lab 1 report)

Alexandre - 1pts (best lab 2 result)

= Scenarios =

== Scenario 1 ==

There is a Wordpress based blog.

The client is worried: How many visitors can they handle before they die.

Establish a baseline: How many page displays per second AT LEAST we can handle.
Disruption of the site operation is NOT acceptable.

Minimal budget!

Assume upstream bandwidth can cope...

Be as detailed and technical as You possibly can.

=== Proposals ===

* Install a similar system on test hardware
** Test hardware is smaller than
* Extrapolate from current system logs
** Must have some load ...
** It may NOT be linear (it usually isn't!)
* Generate some load (without breaking it) and extrapolate from logs
* Find existing performance graphs for wordpress ... (highly unlikely)

=== Simulation environment ===

* Real hardware
* Virtualization platform

Pick what is closer to the real system.

=== Benchmarking tools ===

* httpPerf
* pagetop
* htop
* AB - apache bench
* curl / wget + custom scripts
* JMeter
* Grinder
* wpscan - wordpress specific

=== How to separate benchmark tools from the server? ===

* Use to VMs, Use CPU allocation in virtualization environment to allocate different CPUs for different VMs
* Put VM disk images on different disks (probably an overkill)?
* Monitor process table and make sure that test tools consume significantly less than web server processes. Lower the priority of the test tools.
* Start monitoring load and page views. Generate some load on real system. How?

How do we define the system is dead?

Page view takes longer than 10sec.

=== Determining if referenced content has an effect on results ===
* Make a list of all references the main page has
* Measure the performance of all the URLs
* Disregard the ones that load at least two magnitudes faster.

=== How to measure the results? ===

* Measure response times and number of parallel requests using the benchmarking tool itself
* Deduct the numbers from server logs
* Put the system under load, test with a normal browser if the load time is reasonable.

=== What to document? ===

* Exact configuration of the benchmarking tool (command line, scripts, config files etc. for EACH test performed)
* The version of the benchmarking tool used
* Virtualization platform
* Hardware specification
* URL of the page tested
* Wordpress configuration
* Wordpress content !!!
* Wordpress version
* Web server configuration
* Web server version (apache, php, sql, etc)
* The measurement results (page load times under each different test)
* Web browser used to measure response time (type, version, operating system)
* Operating system configuration (version, software installed, customizations etc).
* The AUTHOR! and the DATE!

Write evertyhing down at ONCE.
if using VM-s save the image.

=== Lab1 ===

* Virtualization platform: VirtualBox
** 512M memory, 1 CPU for each VM
* Wordpress 3.2.1 with default settings (no extra plugins, no performance tweaks, default skin) and default home page
* Ubuntu Server 10.04 LTS 32bit
* Web server: Apache2, SQL: MySQL (default versions bundled with OS)
* Point will go to the person that can produce the most dense graph showing the number of concurrent connections against the response time. Individual tests used to plot the data must be repeated at least 3 times.

You will need to create two different virtual machines, one is going to be the wordpress server and the 2nd one is the client which is used to attack the server.

To be able to connect between the two virtual machines, You need to add an additional network adapter to both hosts. It can be either "Host Only" or "Internal" type.

To enable the new adapters in Ubuntu edit the file: /etc/network/interfaces

ITX8080

2011-09-22T21:00:42Z

Anttix: /* Points scored so far */

= General Information =
== Schedule ==

Lecture TH 17:45 - 21:15 (odd weeks)

Practice TH 17:45 - 21:15 (even weeks)

== Communication ==

Discussinons will be held at course forum in Moodle.

https://moodle.e-ope.ee/course/view.php?id=4319

All scenario proposals must be posted to their own respective forums.

Please register your account today at http://moodle.e-ope.ee

The lecturers can be reached via the course coordinator:

antti.andreimann only-people-please eesti.ee

= Grading =

Best of the bunch will score points.

Points will be awareded for the:

* Best simulation proposal
* Best result obtained in the lab environment
* Best lab report

In total it is possible to score three points for every two weeks.

Maximum score is 3, nobody will be awareded more.

Minimum score to pass is 1.

For those who can not score a single point, an
examination proposals will received from those
of you who scored 3 and voted.

== Points scored so far ==

Margus - 2pts (lecture 1 vote, lab 2 testing method)
Report writer #1 - 1pts (best lab 1 report)

= Scenarios =

== Scenario 1 ==

There is a Wordpress based blog.

The client is worried: How many visitors can they handle before they die.

Establish a baseline: How many page displays per second AT LEAST we can handle.
Disruption of the site operation is NOT acceptable.

Minimal budget!

Assume upstream bandwidth can cope...

Be as detailed and technical as You possibly can.

=== Proposals ===

* Install a similar system on test hardware
** Test hardware is smaller than
* Extrapolate from current system logs
** Must have some load ...
** It may NOT be linear (it usually isn't!)
* Generate some load (without breaking it) and extrapolate from logs
* Find existing performance graphs for wordpress ... (highly unlikely)

=== Simulation environment ===

* Real hardware
* Virtualization platform

Pick what is closer to the real system.

=== Benchmarking tools ===

* httpPerf
* pagetop
* htop
* AB - apache bench
* curl / wget + custom scripts
* JMeter
* Grinder
* wpscan - wordpress specific

=== How to separate benchmark tools from the server? ===

* Use to VMs, Use CPU allocation in virtualization environment to allocate different CPUs for different VMs
* Put VM disk images on different disks (probably an overkill)?
* Monitor process table and make sure that test tools consume significantly less than web server processes. Lower the priority of the test tools.
* Start monitoring load and page views. Generate some load on real system. How?

How do we define the system is dead?

Page view takes longer than 10sec.

=== Determining if referenced content has an effect on results ===
* Make a list of all references the main page has
* Measure the performance of all the URLs
* Disregard the ones that load at least two magnitudes faster.

=== How to measure the results? ===

* Measure response times and number of parallel requests using the benchmarking tool itself
* Deduct the numbers from server logs
* Put the system under load, test with a normal browser if the load time is reasonable.

=== What to document? ===

* Exact configuration of the benchmarking tool (command line, scripts, config files etc. for EACH test performed)
* The version of the benchmarking tool used
* Virtualization platform
* Hardware specification
* URL of the page tested
* Wordpress configuration
* Wordpress content !!!
* Wordpress version
* Web server configuration
* Web server version (apache, php, sql, etc)
* The measurement results (page load times under each different test)
* Web browser used to measure response time (type, version, operating system)
* Operating system configuration (version, software installed, customizations etc).
* The AUTHOR! and the DATE!

Write evertyhing down at ONCE.
if using VM-s save the image.

=== Lab1 ===

* Virtualization platform: VirtualBox
** 512M memory, 1 CPU for each VM
* Wordpress 3.2.1 with default settings (no extra plugins, no performance tweaks, default skin) and default home page
* Ubuntu Server 10.04 LTS 32bit
* Web server: Apache2, SQL: MySQL (default versions bundled with OS)
* Point will go to the person that can produce the most dense graph showing the number of concurrent connections against the response time. Individual tests used to plot the data must be repeated at least 3 times.

You will need to create two different virtual machines, one is going to be the wordpress server and the 2nd one is the client which is used to attack the server.

To be able to connect between the two virtual machines, You need to add an additional network adapter to both hosts. It can be either "Host Only" or "Internal" type.

To enable the new adapters in Ubuntu edit the file: /etc/network/interfaces

ITX8080

2011-09-08T18:32:07Z

Anttix: /* Lab1 */

= General Information =
== Schedule ==

Lecture TH 17:45 - 21:15 (odd weeks)

Practice TH 17:45 - 21:15 (even weeks)

== Communication ==

Discussinons will be held at course forum in Moodle.

https://moodle.e-ope.ee/course/view.php?id=4319

All scenario proposals must be posted to their own respective forums.

Please register your account today at http://moodle.e-ope.ee

The lecturers can be reached via the course coordinator:

antti.andreimann only-people-please eesti.ee

= Grading =

Best of the bunch will score points.

Points will be awareded for the:

* Best simulation proposal
* Best result obtained in the lab environment
* Best lab report

In total it is possible to score three points for every two weeks.

Maximum score is 3, nobody will be awareded more.

Minimum score to pass is 1.

For those who can not score a single point, an
examination proposals will received from those
of you who scored 3 and voted.

== Points scored so far ==

Margus - 1pts

= Scenarios =

== Scenario 1 ==

There is a Wordpress based blog.

The client is worried: How many visitors can they handle before they die.

Establish a baseline: How many page displays per second AT LEAST we can handle.
Disruption of the site operation is NOT acceptable.

Minimal budget!

Assume upstream bandwidth can cope...

Be as detailed and technical as You possibly can.

=== Proposals ===

* Install a similar system on test hardware
** Test hardware is smaller than
* Extrapolate from current system logs
** Must have some load ...
** It may NOT be linear (it usually isn't!)
* Generate some load (without breaking it) and extrapolate from logs
* Find existing performance graphs for wordpress ... (highly unlikely)

=== Simulation environment ===

* Real hardware
* Virtualization platform

Pick what is closer to the real system.

=== Benchmarking tools ===

* httpPerf
* pagetop
* htop
* AB - apache bench
* curl / wget + custom scripts
* JMeter
* Grinder
* wpscan - wordpress specific

=== How to separate benchmark tools from the server? ===

* Use to VMs, Use CPU allocation in virtualization environment to allocate different CPUs for different VMs
* Put VM disk images on different disks (probably an overkill)?
* Monitor process table and make sure that test tools consume significantly less than web server processes. Lower the priority of the test tools.
* Start monitoring load and page views. Generate some load on real system. How?

How do we define the system is dead?

Page view takes longer than 10sec.

=== Determining if referenced content has an effect on results ===
* Make a list of all references the main page has
* Measure the performance of all the URLs
* Disregard the ones that load at least two magnitudes faster.

=== How to measure the results? ===

* Measure response times and number of parallel requests using the benchmarking tool itself
* Deduct the numbers from server logs
* Put the system under load, test with a normal browser if the load time is reasonable.

=== What to document? ===

* Exact configuration of the benchmarking tool (command line, scripts, config files etc. for EACH test performed)
* The version of the benchmarking tool used
* Virtualization platform
* Hardware specification
* URL of the page tested
* Wordpress configuration
* Wordpress content !!!
* Wordpress version
* Web server configuration
* Web server version (apache, php, sql, etc)
* The measurement results (page load times under each different test)
* Web browser used to measure response time (type, version, operating system)
* Operating system configuration (version, software installed, customizations etc).
* The AUTHOR! and the DATE!

Write evertyhing down at ONCE.
if using VM-s save the image.

=== Lab1 ===

* Virtualization platform: VirtualBox
** 512M memory, 1 CPU for each VM
* Wordpress 3.2.1 with default settings (no extra plugins, no performance tweaks, default skin) and default home page
* Ubuntu Server 10.04 LTS 32bit
* Web server: Apache2, SQL: MySQL (default versions bundled with OS)
* Point will go to the person that can produce the most dense graph showing the number of concurrent connections against the response time. Individual tests used to plot the data must be repeated at least 3 times.

You will need to create two different virtual machines, one is going to be the wordpress server and the 2nd one is the client which is used to attack the server.

To be able to connect between the two virtual machines, You need to add an additional network adapter to both hosts. It can be either "Host Only" or "Internal" type.

To enable the new adapters in Ubuntu edit the file: /etc/network/interfaces

ITX8080

2011-09-08T17:10:45Z

Anttix: /* Communication */

= General Information =
== Schedule ==

Lecture TH 17:45 - 21:15 (odd weeks)

Practice TH 17:45 - 21:15 (even weeks)

== Communication ==

Discussinons will be held at course forum in Moodle.

https://moodle.e-ope.ee/course/view.php?id=4319

All scenario proposals must be posted to their own respective forums.

Please register your account today at http://moodle.e-ope.ee

The lecturers can be reached via the course coordinator:

antti.andreimann only-people-please eesti.ee

= Grading =

Best of the bunch will score points.

Points will be awareded for the:

* Best simulation proposal
* Best result obtained in the lab environment
* Best lab report

In total it is possible to score three points for every two weeks.

Maximum score is 3, nobody will be awareded more.

Minimum score to pass is 1.

For those who can not score a single point, an
examination proposals will received from those
of you who scored 3 and voted.

== Points scored so far ==

Margus - 1pts

= Scenarios =

== Scenario 1 ==

There is a Wordpress based blog.

The client is worried: How many visitors can they handle before they die.

Establish a baseline: How many page displays per second AT LEAST we can handle.
Disruption of the site operation is NOT acceptable.

Minimal budget!

Assume upstream bandwidth can cope...

Be as detailed and technical as You possibly can.

=== Proposals ===

* Install a similar system on test hardware
** Test hardware is smaller than
* Extrapolate from current system logs
** Must have some load ...
** It may NOT be linear (it usually isn't!)
* Generate some load (without breaking it) and extrapolate from logs
* Find existing performance graphs for wordpress ... (highly unlikely)

=== Simulation environment ===

* Real hardware
* Virtualization platform

Pick what is closer to the real system.

=== Benchmarking tools ===

* httpPerf
* pagetop
* htop
* AB - apache bench
* curl / wget + custom scripts
* JMeter
* Grinder
* wpscan - wordpress specific

=== How to separate benchmark tools from the server? ===

* Use to VMs, Use CPU allocation in virtualization environment to allocate different CPUs for different VMs
* Put VM disk images on different disks (probably an overkill)?
* Monitor process table and make sure that test tools consume significantly less than web server processes. Lower the priority of the test tools.
* Start monitoring load and page views. Generate some load on real system. How?

How do we define the system is dead?

Page view takes longer than 10sec.

=== Determining if referenced content has an effect on results ===
* Make a list of all references the main page has
* Measure the performance of all the URLs
* Disregard the ones that load at least two magnitudes faster.

=== How to measure the results? ===

* Measure response times and number of parallel requests using the benchmarking tool itself
* Deduct the numbers from server logs
* Put the system under load, test with a normal browser if the load time is reasonable.

=== What to document? ===

* Exact configuration of the benchmarking tool (command line, scripts, config files etc. for EACH test performed)
* The version of the benchmarking tool used
* Virtualization platform
* Hardware specification
* URL of the page tested
* Wordpress configuration
* Wordpress content !!!
* Wordpress version
* Web server configuration
* Web server version (apache, php, sql, etc)
* The measurement results (page load times under each different test)
* Web browser used to measure response time (type, version, operating system)
* Operating system configuration (version, software installed, customizations etc).
* The AUTHOR! and the DATE!

Write evertyhing down at ONCE.
if using VM-s save the image.

=== Lab1 ===

* Virtualization platform: VirtualBox
** 512M memory, 1 CPU for each VM
* Wordpress 3.2.1 with default settings (no extra plugins, no performance tweaks, default skin) and default home page
* Ubuntu Server 10.04 LTS 32bit
* Web server: Apache2, SQL: MySQL (default versions bundled with OS)
* Point will go to the person that can produce the most dense graph showing the number of concurrent connections against the response time. Individual tests used to plot the data must be repeated at least 3 times.

ITX8080

2011-09-01T20:30:21Z

Anttix:

= General Information =
== Schedule ==

Lecture TH 17:45 - 21:15 (odd weeks)

Practice TH 17:45 - 21:15 (even weeks)

== Communication ==

Discussinons will be held at course forum in Moodle.
Link and details will appear here as soon as the e-course is created by administrators.
Please register your account today at http://moodle.e-ope.ee

The lecturers can be reached via the course coordinator:

antti.andreimann only-people-please eesti.ee

= Grading =

Best of the bunch will score points.

Points will be awareded for the:

* Best simulation proposal
* Best result obtained in the lab environment
* Best lab report

In total it is possible to score three points for every two weeks.

Maximum score is 3, nobody will be awareded more.

Minimum score to pass is 1.

For those who can not score a single point, an
examination proposals will received from those
of you who scored 3 and voted.

== Points scored so far ==

Margus - 1pts

= Scenarios =

== Scenario 1 ==

There is a Wordpress based blog.

The client is worried: How many visitors can they handle before they die.

Establish a baseline: How many page displays per second AT LEAST we can handle.
Disruption of the site operation is NOT acceptable.

Minimal budget!

Assume upstream bandwidth can cope...

Be as detailed and technical as You possibly can.

=== Proposals ===

* Install a similar system on test hardware
** Test hardware is smaller than
* Extrapolate from current system logs
** Must have some load ...
** It may NOT be linear (it usually isn't!)
* Generate some load (without breaking it) and extrapolate from logs
* Find existing performance graphs for wordpress ... (highly unlikely)

=== Simulation environment ===

* Real hardware
* Virtualization platform

Pick what is closer to the real system.

=== Benchmarking tools ===

* httpPerf
* pagetop
* htop
* AB - apache bench
* curl / wget + custom scripts
* JMeter
* Grinder
* wpscan - wordpress specific

=== How to separate benchmark tools from the server? ===

* Use to VMs, Use CPU allocation in virtualization environment to allocate different CPUs for different VMs
* Put VM disk images on different disks (probably an overkill)?
* Monitor process table and make sure that test tools consume significantly less than web server processes. Lower the priority of the test tools.
* Start monitoring load and page views. Generate some load on real system. How?

How do we define the system is dead?

Page view takes longer than 10sec.

=== Determining if referenced content has an effect on results ===
* Make a list of all references the main page has
* Measure the performance of all the URLs
* Disregard the ones that load at least two magnitudes faster.

=== How to measure the results? ===

* Measure response times and number of parallel requests using the benchmarking tool itself
* Deduct the numbers from server logs
* Put the system under load, test with a normal browser if the load time is reasonable.

=== What to document? ===

* Exact configuration of the benchmarking tool (command line, scripts, config files etc. for EACH test performed)
* The version of the benchmarking tool used
* Virtualization platform
* Hardware specification
* URL of the page tested
* Wordpress configuration
* Wordpress content !!!
* Wordpress version
* Web server configuration
* Web server version (apache, php, sql, etc)
* The measurement results (page load times under each different test)
* Web browser used to measure response time (type, version, operating system)
* Operating system configuration (version, software installed, customizations etc).
* The AUTHOR! and the DATE!

Write evertyhing down at ONCE.
if using VM-s save the image.

=== Lab1 ===

* Virtualization platform: VirtualBox
** 512M memory, 1 CPU for each VM
* Wordpress 3.2.1 with default settings (no extra plugins, no performance tweaks, default skin) and default home page
* Ubuntu Server 10.04 LTS 32bit
* Web server: Apache2, SQL: MySQL (default versions bundled with OS)
* Point will go to the person that can produce the most dense graph showing the number of concurrent connections against the response time. Individual tests used to plot the data must be repeated at least 3 times.

ITX8080

2011-09-01T20:22:18Z

Anttix: /* Scenario 1 */

= General Information =
== Schedule ==

Lecture TH 17:45 - 21:15 (odd weeks)

Practice TH 17:45 - 21:15 (even weeks)

== Communication ==

Discussinons will be held at course forum in Moodle.
Link and details will appear here as soon as the e-course is created by administrators.
Please register your account today at http://moodle.e-ope.ee

The lecturers can be reached via the course coordinator:

antti.andreimann only-people-please eesti.ee

= Grading =

Best of the bunch will score points.

Points will be awareded for the:

* Best simulation proposal
* Best result obtained in the lab environment
* Best lab report

In total it is possible to score three points for every two weeks.

Maximum score is 3, nobody will be awareded more.

Minimum score to pass is 1.

For those who can not score a single point, an
examination proposals will received from those
of you who scored 3 and voted.

= Scenarios =

== Scenario 1 ==

There is a Wordpress based blog.

The client is worried: How many visitors can they handle before they die.

Establish a baseline: How many page displays per second AT LEAST we can handle.
Disruption of the site operation is NOT acceptable.

Minimal budget!

Assume upstream bandwidth can cope...

Be as detailed and technical as You possibly can.

=== Proposals ===

* Install a similar system on test hardware
** Test hardware is smaller than
* Extrapolate from current system logs
** Must have some load ...
** It may NOT be linear (it usually isn't!)
* Generate some load (without breaking it) and extrapolate from logs
* Find existing performance graphs for wordpress ... (highly unlikely)

=== Simulation environment ===

* Real hardware
* Virtualization platform

Pick what is closer to the real system.

=== Benchmarking tools ===

* httpPerf
* pagetop
* htop
* AB - apache bench
* curl / wget + custom scripts
* JMeter
* Grinder
* wpscan - wordpress specific

=== How to separate benchmark tools from the server? ===

* Use to VMs, Use CPU allocation in virtualization environment to allocate different CPUs for different VMs
* Put VM disk images on different disks (probably an overkill)?
* Monitor process table and make sure that test tools consume significantly less than web server processes. Lower the priority of the test tools.
* Start monitoring load and page views. Generate some load on real system. How?

How do we define the system is dead?

Page view takes longer than 10sec.

=== Determining if referenced content has an effect on results ===
* Make a list of all references the main page has
* Measure the performance of all the URLs
* Disregard the ones that load at least two magnitudes faster.

=== How to measure the results? ===

* Measure response times and number of parallel requests using the benchmarking tool itself
* Deduct the numbers from server logs
* Put the system under load, test with a normal browser if the load time is reasonable.

=== What to document? ===

* Exact configuration of the benchmarking tool (command line, scripts, config files etc. for EACH test performed)
* The version of the benchmarking tool used
* Virtualization platform
* Hardware specification
* URL of the page tested
* Wordpress configuration
* Wordpress content !!!
* Wordpress version
* Web server configuration
* Web server version (apache, php, sql, etc)
* The measurement results (page load times under each different test)
* Web browser used to measure response time (type, version, operating system)
* Operating system configuration (version, software installed, customizations etc).
* The AUTHOR! and the DATE!

Write evertyhing down at ONCE.
if using VM-s save the image.

Margus - 1pts

=== Lab1 ===

* Virtualization platform: VirtualBox
* Point will go to the person that can produce the most dense graph showing the number of concurrent connections against the response time. Individual tests used to plot the data must be repeated at least 3 times.
* Latest wordpress with default home page
* Ubuntu Server 10.04 LTS 32bit
* Web server: Apache2, SQL: MySQL (default versions bundled with OS)

ITX8080

2011-09-01T19:45:43Z

Anttix: /* Scenario 1 */

= General Information =
== Schedule ==

Lecture TH 17:45 - 21:15 (odd weeks)

Practice TH 17:45 - 21:15 (even weeks)

== Communication ==

Discussinons will be held at course forum in Moodle.
Link and details will appear here as soon as the e-course is created by administrators.
Please register your account today at http://moodle.e-ope.ee

The lecturers can be reached via the course coordinator:

antti.andreimann only-people-please eesti.ee

= Grading =

Best of the bunch will score points.

Points will be awareded for the:

* Best simulation proposal
* Best result obtained in the lab environment
* Best lab report

In total it is possible to score three points for every two weeks.

Maximum score is 3, nobody will be awareded more.

Minimum score to pass is 1.

For those who can not score a single point, an
examination proposals will received from those
of you who scored 3 and voted.

= Scenarios =

== Scenario 1 ==

There is a Wordpress based blog.

The client is worried: How many visitors can they handle before they die.

Establish a baseline: How many page displays per second AT LEAST we can handle.
Disruption of the site operation is NOT acceptable.

Minimal budget!

Assume upstream bandwidth can cope...

Be as detailed and technical as You possibly can.

Proposals

* Install a similar system on test hardware
- Test hardware is smaller than
* Extrapolate from current system logs
- Must have some load ...
- It may NOT be linear (it usually isn't!)
* Generate some load (without breaking it) and extrapolate from logs
* Find existing performance graphs for wordpress ... (highly unlikely)

Simulation environment

* Real hardware
* Virtualization platform

Pick what is closer to the real system.

Benchmarking tools
* httpPerf
* pagetop
* htop
* AB - apache bench
* curl / wget + custom scripts
* JMeter
* Grinder
* wpscan - wordpress specific

How to separate benchmark tools from the server?

* Use to VMs, Use CPU allocation in virtualization environment to allocate different CPUs for different VMs
* Put VM disk images on different disks (probably an overkill)?

* Monitor process table and make sure that test tools consume significantly less than web server processes. Lower the priority of the test tools.

* Start monitoring load and page views. Generate some load on real system. How?

How do we define the system is dead?
Page view takes longer than 10sec.

* Make a list of all references the main page has
* Measure the performance of all the URLs
* Disregard the ones that load at least two magnitudes faster.

How to measure the results?
* Measure response times and number of parallel requests using the benchmarking tool itself
* Deduct the numbers from server logs
* Put the system under load, test with a normal browser if the load time is reasonable.

What to document?

* Exact configuration of the benchmarking tool (command line, scripts, config files etc. for EACH test performed)
* The version of the benchmarking tool used
* Virtualization platform
* Hardware specification
* URL of the page tested
* Wordpress configuration
* Wordpress content !!!
* Wordpress version
* Web server configuration
* Web server version (apache, php, sql, etc)
* The measurement results (page load times under each different test)
* Web browser used to measure response time (type, version, operating system)
* Operating system configuration (version, software installed, customizations etc).
* The AUTHOR! and the DATE!

Write evertyhing down at ONCE.
if using VM-s save the image.

ITX8080

2011-09-01T18:06:10Z

Anttix:

= General Information =
== Schedule ==

Lecture TH 17:45 - 21:15 (odd weeks)

Practice TH 17:45 - 21:15 (even weeks)

== Communication ==

Discussinons will be held at course forum in Moodle.
Link and details will appear here as soon as the e-course is created by administrators.
Please register your account today at http://moodle.e-ope.ee

The lecturers can be reached via the course coordinator:

antti.andreimann only-people-please eesti.ee

= Grading =

Best of the bunch will score points.

Points will be awareded for the:

* Best simulation proposal
* Best result obtained in the lab environment
* Best lab report

In total it is possible to score three points for every two weeks.

Maximum score is 3, nobody will be awareded more.

Minimum score to pass is 1.

For those who can not score a single point, an
examination proposals will received from those
of you who scored 3 and voted.

= Scenarios =

== Scenario 1 ==

There is a Wordpress based blog.

The client is worried: How many visitors can they handle before they die.

Establish a baseline: How many page displays per second AT LEAST we can handle.
Disruption of the site operation is NOT acceptable.

Minimal budget!

Be as detailed and technical as You possibly can.

ITX8080

2011-09-01T18:03:03Z

Anttix:

= General Information =
== Schedule ==

Lecture TH 17:45 - 21:15 (odd weeks)

Practice FR 17:45 - 21:15 (even weeks)

== Communication ==

Discussinons will be held at course forum in Moodle.
Link and details will appear here as soon as the e-course is created by administrators.
Please register your account today at http://moodle.e-ope.ee

The lecturers can be reached via the course coordinator:

antti.andreimann only-people-please eesti.ee

= Grading =

Best of the bunch will score points.

Points will be awareded for the:

* Best simulation proposal
* Best result obtained in the lab environment
* Best lab report

In total it is possible to score three points for every two weeks.

Maximum score is 3, nobody will be awareded more.

Minimum score to pass is 1.

For those who can not score a single point, an
examination proposals will received from those
of you who scored 3 and voted.

= Scenarios =

== Scenario 1 ==

There is a Wordpress based blog.

The client is worried: How many visitors can they handle before they die.

Establish a baseline: How many page displays per second AT LEAST we can handle.
Disruption of the site operation is NOT acceptable.

Minimal budget!

Be as detailed and technical as You possibly can.

ITX8080 Archived

2011-09-01T17:55:20Z

Anttix:

This is a historic version for archival purposes

= General Information =
== Schedule ==

Lecture TH 12:00 - 13:30

Practice FR 14:00 - 17:30

== Communication ==

Discussinons will be held at: itx8080 atatat googlegroups.com

Send e-mail to hannesa at-no-spam-please gmail.com for an invitation.

The lecturers can be reached via the course coordinator:

antti.andreimann only-people-please eesti.ee

== Points awarded so far ==

Arnis : 3 points - ab testing solution, best countermeasure proposed for scenario 4, best snort rules proposed for scenario 6

Igor : 3 points - wordpress virtualization solution, lab 3 report, IDS testing solution

Kaarel : 2 points - lab 1 report and conclusions, lab 3 solution

Märt : 3 points - wordpress testing procedure, best wordpress optimization (wp-cache + php-apc), best lab 2 report.

Roland: 2 points - best Lab 4 report, IDS testing solution

Hannes: 1 point - best lab 6 report

Siim: 1 point - most popular scenario 7 solution

Urmas: 2 points - lab 5 report, the set of viruses used in lab 7

Martti: 1 point - best lab 7 report

Stefan: 1 points - best solutions developed during lab 8-1

Jeremy: 1 point - best solution developed during lab 8-2

Christopher: 1 point - best lab 8-1 report

Alexandra: 1 point - best lab 8-2 report.

= Scenarios =

== Scenario 1 ==
There is a Wordpress based blog.

The client is worried: How many visitors can they handle before they die.

Establish a baseline: How many page displays per second AT LEAST we can handle.
Disruption of the site operation is NOT acceptable.

Minimal budget!

Be as detailed and technical as You possibly can.

Post to the discussion group the following information:

# Detailed description of the simulation of the site. eg. if You're going to virtualize it then how? If You are running it as a process, then how You separate it from the real machine?
# Detailed description of the attack / benchmark tools picked. Where You are going to run them? What tools? How many copies? How you are going to collect the results?!!!

=== Proposals ===
Benchmarking:
* AB - Discussed in lecture
* http://tsung.erlang-projects.org - Jérémy
* wget + AB - Arnis
* http://jakarta.apache.org/jmeter/ - Roland, Jérémy
* http://grinder.sourceforge.net/ - Märt
* http://httpd.apache.org/test/flood/ - Hannes
* Normal monitoring software on live server - Urmas

Simulation of the system:
* VirtualBox - Roland, Jérémy
* VMWare ESX - Igor
* VMWare Player - Marina
* Amazon EC2 - Märt
* KVM - Siim
* Original hardware - Hannes

=== Lab 1 ===
We will need to create two different virtual machines, one is going to be the wordpress server and the 2nd one is the client which is used to attack the server. It's probably easiest to install only one image and then clone it.

Hard disk image cloning is best done with

Linux:
VBoxManage clonehd FirstUbuntu.vdi SecondUbuntu.vdi

Windows:
"C:\Program Files\Oracle\VirtualBox\VBoxManage.exe" clonehd FirstUbuntu.vdi SecondUbuntu.vdi

After cloning the image create another virtual machine and attach the 2nd disk to that machine. As the result there will be two different virtual machines with two different virtual hard disks.

To be able to connect between the two virtual machines, You need to add an
additional network adapter to both hosts. It can be either "Host Only" or
"Internal" type.

To enable the new adapters in Ubuntu edit the file: /etc/network/interfaces

== Scenario 2 ==
Design a method for evaluating any speedup solutions for the wordpress.
A repeatable process to evaluate the claims.
Whatever optimizations.
The process must be detailed enough so that somebody else can get the same results when applying that.
The "other person" is expected to have IT knowledge sufficient to install and run a Linux desktop.
The method must specify the level performance
at which the site is considered DEAD.
Budget requirements: Low - Dedicated machine + dedicated tester.

=== Lab 2 ===
* Get Virtual machine disk image and instructions from: http://www.tud.ttu.ee/~anttix/lab2/ '''NB! DO NOT DOWNLOAD IMAGE FROM THE LINK NOTED IN INSTRUCTIONS PDF, IT WILL BE SLOW'''
* Fix bug in image (see below)
* Measure the effect of these wordpress plugins:
** [http://wordpress.org/extend/plugins/wp-super-cache/ WP Super Cache]
** [http://wordpress.org/extend/plugins/wp-cache/ WP-Cache]
* Devise Your own optimizations for the site

Bug in image: the ip address of the VM is saved in WP database as 192.168.56.3
It is advised tu run the Target VM first and run the "sudo dhclient" command first in Target VM.
Then check active IP of target by command "ifconfig". If it is not 192.168.56.3, then situation can be fixed by running:

In Target VM: "sudo ifconfig eth2 192.168.56.3"
In Client VM: "sudo ifconfig eth2 192.168.56.4"

==== A note to Windows users ====
Use this command line to access VBoxManage program

"C:\Program Files\Oracle\VirtualBox\VBoxManage.exe"

==== Wordpress Admin access ====
Username: admin
Password: QIaTemvskSeM

==== Note to Ubuntu users ====
VirtualBox with WiFi Does NOT work properly http://ubuntuforums.org/showthread.php?t=782936

== Scenario 3 ==
Your client is worried about some stuff posted on a blog. They ask You to take care of it.
They have a throwaway "script kiddie" in a third world country, who will mount the attack
so You don't need to worry about hiding the attackers identity.

Devise a way to attack a wordpress (default installation) based site to render it
unusable (page view times over 60 seconds).

Attack resources: one PC, a script kiddie, internet connection of 2Mbit/s.

How are we going to evaluate the solutions?
* Easy to use instructions
* The most efficient use of available resources

Defacing will count, IF it works for the latest version of wordpress.

=== Lab 3 ===
Possible attacks:

* Brute force overload (AB or other benchmark), bang the slowest page possible.
* Connection flood (slowloris)
* SYN Flood (eg. with hping)
* Banging expensive operations (eg. adding big comments)
* etc.

== Scenario 4 ==
Develop countermeasures for the attacks simulated in Lab 3.

Limitations:
* No additional hardware
* No reactive measures

=== Lab 4 ===

Evaluate the countermeasures against attacks.
The countermeasures must not have negative effects
on "normal usage pattern".

Normal usage pattern is defined as:
* Bursts of 10 connections per IP address in 1 second
* Page load times not over 20 seconds

== Scenario 5 ==
Create a solution and instructions for testing IDS
systems against the wordpress site and attacks
tried in lab 3.

A repeatable process to evaluate vendor claims.
Whatever passive IDS system delivered as a VM or a dedicated box.

Creating the IDS system itself is out of scope.

The process must be detailed enough so that somebody else can get the same results when applying that.
The "other person" is expected to have IT knowledge sufficient to install and run a Linux desktop.

Budget requirements: Modest - 2 Dedicated machines + dedicated tester + networking equipment to connect these together.

The process must test at least the following:
* Port scan
* SYN flood
* slowloris/pyloris
* Ab overwhelming attack

=== Lab 5 ===
Instructions for installing Snort IDS and its web GUI called 'acidbase': https://help.ubuntu.com/community/SnortIDS

== Scenario 6 ==

Develop/download/find/whatever a SNORT configuration (rulesets, preprocessors, whatever)
that performs better than the default configuration in lab 5 tests.
By better we mean:
* Less false positives
* Less false negatives
* The objectives are contradictory so the rule of thumb is one false negative per 10 false positives eg. solution with 10 false positives and 2 false negatives is better than the solution with 100 false positives and 1 false negatives, but the solution with 10 false positives and 1 false negative is better than the solution with 1 false positive and 2 false negatives.
* Attack is defined by a single invocation of the test script.

== Scenario 7 ==

There is a new remote vulnerability in Windows.
You became aware of a new virus that targets this vulnerability at 7 PM.
The antivirus vendor has released an updated virus database, but it's probably not installed
on all of the computers yet. Your company has 500 employees, with half of them running on laptops. You have to decide in 12 hours, if You need to collect all the employee's laptops in the morning.

Collecting the laptops has a high cost in lost employee productivity: There will be a queue of laptops waiting to be inspected. You can assume that all of the laptops can be inspected in half a day.

Limits: You can not mitigate the risk by changing the network configuration, You do not know how many laptops are still in the building. You can not take the servers offline.

Resources: 5 workers, some networking equipment, real servers (you can not disrupt those), "samples" of existing systems: a few spare workstations, a few spare laptops,

What do You know about the virus?
* It disables antivirus software
* It disables automatic software updates
* It can be cleaned up only manually in about 1 manhour

You need to develop an action plan:
* What You test in those scarce 12 hours?
* How?
* How do You weigh the results to make the decision?
* The plan itself must be short and easy to understand so You can write it on a whiteboard.
* Justifications for the specific actions go to a separate file/document.

=== Lab 7 ===
* Get viruses and XP install ISO-s from http://www.tud.ttu.ee/~anttix/lab7/
** Password for the protected zip: doomsday
* Alternatively, get Siims image
* Set up 5 VMS and connect them to a private network (or Host-Only network if You can't configure private nets):
** Plain old XP without any virus scanner (clean)
** Plain old XP with a virus scanner eg Avast (clean)
** Windows XP SP3, no virus scanner (clean)
** Plain old XP without any virus scanner (infected)
** Ubuntu Linux with tcpdump running
* If You have enogh time You can either:
** Find some more Worms and unleash them on Your virtual network (thanx to Urmas for those links)
*** http://vx.netlux.org/
*** http://www.excellentcontent.com/xbart/cbezels/
*** http://hacker-mc.blogspot.com/2008/12/pacoto-hacker.html
*** http://www.rohitab.com/discuss/oldfiles/
** Try to install Windows XP while it is connected to the infected network and see if You manage to install patches or antivirus before getting infected.

Measure the time it takes for the virus to penetrate the machines.
Note if virus scanner was able to catch the virus even if the underlying flaw in
windows wasn't patched.
Test if the SP3 version is immune to attacks originating from the network,
even when virus scanner is not installed.

== Scenario 8 ==

Find a solution to simulate a network of 300 PC-s in a single corporate environment, accessing a software update service at once.

Determine the load on primary internet connection and the router.
Assume that updates server will be able to keep up.

Tools to consider
* [http://www.ssfnet.org/homePage.html SSFNet]
* [http://www.omnetpp.org/ OMNeT++]

Additional resources
* [http://www.ssfnet.org/Exchange/gallery/index.html SSFNet module gallery]
* [http://code.google.com/p/omnet-httptools/ omnet-httptools]

=== Lab 8 ===
==== OMNet++ (Free for academic use only) ====
====== Install OMNeT++ ======
# Compile OMNet++ using these instructions: http://omnetpp.org/doc/omnetpp41/InstallGuide.pdf
# Run omnetpp IDE
# Choose Tutorials->Tic-toc tutorial from welcome page to open Tutorial documentation. Welcome page can be accessed from Help menu if You have accidentally closed it.
# Choose Go to workbench
# Click on tictoc in "Project Explorer" (on left hand pane)
# Choose Project->Open Project
# Choose Project->Build All

====== Install OMNeT++ INET framework ======
# Download https://github.com/downloads/inet-framework/inet/inet-20100723-src.tgz
# Create a directory named omnetpp-workspace and unpack inet-20100723-src.tgz in that directory.
# Switch Eclipse workspace to the newly-created directory: File -> Switch Workspace and select omnetpp-workspace.
# Follow instructions in omnetpp-workspace/inet/INSTALL file in the "If you are using the IDE" section

==== NS-3 (GPL Licensed) ====
Install all dependencies according to instructions [http://www.nsnam.org/wiki/index.php/Installation here] and [http://www.nsnam.org/wiki/index.php/PyViz here]

'''NB! Do not clone or compile anything yet'''

Clone NS-3 repositories
hg clone http://code.nsnam.org/ns-3-allinone
cd ns-3-allinone
./download.py -n gjc/ns-3.9-pyviz

Build NS-3
./build.py

Read the introduction slides during the build :)
* http://www.nsnam.org/tutorials/geni-tutorial-part1.pdf
* http://www.nsnam.org/tutorials.html

If You are unable to install the stuff, You may get an
Ubuntu VM with all of the stuff preinstalled from

http://www.tud.ttu.ee/~anttix/lab8/ubuntu10.04-omnetpp_ns3.vdi

Run Example visualizations
cd ns-3.9-pyviz
./waf --pyrun examples/flowmon/wifi-olsr-flowmon.py
./waf --run "examples/wireless/wifi-wired-bridging --viz=1"
./waf --run "examples/wireless/wifi-ap --viz=1"

Get itx8080 samples from:
http://www.tud.ttu.ee/~anttix/lab8/ns3-tty-v2.tar.gz

Run the samples
./waf --run "examples/tty/lecture1 --viz=1"
./waf --run "examples/tty/lecture2 --viz=1"
./waf --run examples/tty/lecture5

Look at the generated files: wantraffic*

Now create a new simulation that uses TCP networking instead of UDP. Refer to examples in examples/tcp.

== Scenario 9 ==

Simulate a DDoS attack against a network of web servers.

* 2 types of attacks
** SYN Flood
** "AB" style attack

Assumptions:
* 1000 "infected" hosts performing the attack
* 10 web servers, located in 5 locations
* The infected host only attacks one server
* The target to attack is selected randomly
* Assume that servers can keep up with the flood
* Data transferred during each connection is about 500kb

Objectives:
* Assess the bandwidth these attacks consume in each location

You can only implement a subset of constraints and assumptions.
Do as much as You can, maybe others have done even less :D

=== Lab 9 ===

Start by implementing proper network topology:
* Create a CSMA(ring) network for each location (5 networks in total)
* Set the speed to 100Mbit/s
* Create 3 nodes for each location (2 servers, 1 router)
* Connect nodes to their respective networks
* Create another CSMA(ring) network to mimic the internet core
* Create 6 nodes to act as core routers on that network
** one for each simulated location
** an "extra" router that all attackers will be connected to
* Set the speed of the internet core to 10Gbit/s
* Connect location routers to respective core routers via Point-to-Point links
* Set the speed of those Point-to-Point links to 10Mbit/s
* Create 20 attacker nodes (just to speed up testing and development, You can increase that number to 1000 later)
* Connect all attacker nodes to the "extra" core router with point-to-point links
* Set the speed of attacker links to 1Mbit/s

ITX8080 Archived

2011-09-01T17:52:49Z

Anttix:

= General Information =
== Schedule ==

Lecture TH 12:00 - 13:30

Practice FR 14:00 - 17:30

== Communication ==

Discussinons will be held at: itx8080 atatat googlegroups.com

Send e-mail to hannesa at-no-spam-please gmail.com for an invitation.

The lecturers can be reached via the course coordinator:

antti.andreimann only-people-please eesti.ee

== Points awarded so far ==

Arnis : 3 points - ab testing solution, best countermeasure proposed for scenario 4, best snort rules proposed for scenario 6

Igor : 3 points - wordpress virtualization solution, lab 3 report, IDS testing solution

Kaarel : 2 points - lab 1 report and conclusions, lab 3 solution

Märt : 3 points - wordpress testing procedure, best wordpress optimization (wp-cache + php-apc), best lab 2 report.

Roland: 2 points - best Lab 4 report, IDS testing solution

Hannes: 1 point - best lab 6 report

Siim: 1 point - most popular scenario 7 solution

Urmas: 2 points - lab 5 report, the set of viruses used in lab 7

Martti: 1 point - best lab 7 report

Stefan: 1 points - best solutions developed during lab 8-1

Jeremy: 1 point - best solution developed during lab 8-2

Christopher: 1 point - best lab 8-1 report

Alexandra: 1 point - best lab 8-2 report.

= Scenarios =

== Scenario 1 ==
There is a Wordpress based blog.

The client is worried: How many visitors can they handle before they die.

Establish a baseline: How many page displays per second AT LEAST we can handle.
Disruption of the site operation is NOT acceptable.

Minimal budget!

Be as detailed and technical as You possibly can.

Post to the discussion group the following information:

# Detailed description of the simulation of the site. eg. if You're going to virtualize it then how? If You are running it as a process, then how You separate it from the real machine?
# Detailed description of the attack / benchmark tools picked. Where You are going to run them? What tools? How many copies? How you are going to collect the results?!!!

=== Proposals ===
Benchmarking:
* AB - Discussed in lecture
* http://tsung.erlang-projects.org - Jérémy
* wget + AB - Arnis
* http://jakarta.apache.org/jmeter/ - Roland, Jérémy
* http://grinder.sourceforge.net/ - Märt
* http://httpd.apache.org/test/flood/ - Hannes
* Normal monitoring software on live server - Urmas

Simulation of the system:
* VirtualBox - Roland, Jérémy
* VMWare ESX - Igor
* VMWare Player - Marina
* Amazon EC2 - Märt
* KVM - Siim
* Original hardware - Hannes

=== Lab 1 ===
We will need to create two different virtual machines, one is going to be the wordpress server and the 2nd one is the client which is used to attack the server. It's probably easiest to install only one image and then clone it.

Hard disk image cloning is best done with

Linux:
VBoxManage clonehd FirstUbuntu.vdi SecondUbuntu.vdi

Windows:
"C:\Program Files\Oracle\VirtualBox\VBoxManage.exe" clonehd FirstUbuntu.vdi SecondUbuntu.vdi

After cloning the image create another virtual machine and attach the 2nd disk to that machine. As the result there will be two different virtual machines with two different virtual hard disks.

To be able to connect between the two virtual machines, You need to add an
additional network adapter to both hosts. It can be either "Host Only" or
"Internal" type.

To enable the new adapters in Ubuntu edit the file: /etc/network/interfaces

== Scenario 2 ==
Design a method for evaluating any speedup solutions for the wordpress.
A repeatable process to evaluate the claims.
Whatever optimizations.
The process must be detailed enough so that somebody else can get the same results when applying that.
The "other person" is expected to have IT knowledge sufficient to install and run a Linux desktop.
The method must specify the level performance
at which the site is considered DEAD.
Budget requirements: Low - Dedicated machine + dedicated tester.

=== Lab 2 ===
* Get Virtual machine disk image and instructions from: http://www.tud.ttu.ee/~anttix/lab2/ '''NB! DO NOT DOWNLOAD IMAGE FROM THE LINK NOTED IN INSTRUCTIONS PDF, IT WILL BE SLOW'''
* Fix bug in image (see below)
* Measure the effect of these wordpress plugins:
** [http://wordpress.org/extend/plugins/wp-super-cache/ WP Super Cache]
** [http://wordpress.org/extend/plugins/wp-cache/ WP-Cache]
* Devise Your own optimizations for the site

Bug in image: the ip address of the VM is saved in WP database as 192.168.56.3
It is advised tu run the Target VM first and run the "sudo dhclient" command first in Target VM.
Then check active IP of target by command "ifconfig". If it is not 192.168.56.3, then situation can be fixed by running:

In Target VM: "sudo ifconfig eth2 192.168.56.3"
In Client VM: "sudo ifconfig eth2 192.168.56.4"

==== A note to Windows users ====
Use this command line to access VBoxManage program

"C:\Program Files\Oracle\VirtualBox\VBoxManage.exe"

==== Wordpress Admin access ====
Username: admin
Password: QIaTemvskSeM

==== Note to Ubuntu users ====
VirtualBox with WiFi Does NOT work properly http://ubuntuforums.org/showthread.php?t=782936

== Scenario 3 ==
Your client is worried about some stuff posted on a blog. They ask You to take care of it.
They have a throwaway "script kiddie" in a third world country, who will mount the attack
so You don't need to worry about hiding the attackers identity.

Devise a way to attack a wordpress (default installation) based site to render it
unusable (page view times over 60 seconds).

Attack resources: one PC, a script kiddie, internet connection of 2Mbit/s.

How are we going to evaluate the solutions?
* Easy to use instructions
* The most efficient use of available resources

Defacing will count, IF it works for the latest version of wordpress.

=== Lab 3 ===
Possible attacks:

* Brute force overload (AB or other benchmark), bang the slowest page possible.
* Connection flood (slowloris)
* SYN Flood (eg. with hping)
* Banging expensive operations (eg. adding big comments)
* etc.

== Scenario 4 ==
Develop countermeasures for the attacks simulated in Lab 3.

Limitations:
* No additional hardware
* No reactive measures

=== Lab 4 ===

Evaluate the countermeasures against attacks.
The countermeasures must not have negative effects
on "normal usage pattern".

Normal usage pattern is defined as:
* Bursts of 10 connections per IP address in 1 second
* Page load times not over 20 seconds

== Scenario 5 ==
Create a solution and instructions for testing IDS
systems against the wordpress site and attacks
tried in lab 3.

A repeatable process to evaluate vendor claims.
Whatever passive IDS system delivered as a VM or a dedicated box.

Creating the IDS system itself is out of scope.

The process must be detailed enough so that somebody else can get the same results when applying that.
The "other person" is expected to have IT knowledge sufficient to install and run a Linux desktop.

Budget requirements: Modest - 2 Dedicated machines + dedicated tester + networking equipment to connect these together.

The process must test at least the following:
* Port scan
* SYN flood
* slowloris/pyloris
* Ab overwhelming attack

=== Lab 5 ===
Instructions for installing Snort IDS and its web GUI called 'acidbase': https://help.ubuntu.com/community/SnortIDS

== Scenario 6 ==

Develop/download/find/whatever a SNORT configuration (rulesets, preprocessors, whatever)
that performs better than the default configuration in lab 5 tests.
By better we mean:
* Less false positives
* Less false negatives
* The objectives are contradictory so the rule of thumb is one false negative per 10 false positives eg. solution with 10 false positives and 2 false negatives is better than the solution with 100 false positives and 1 false negatives, but the solution with 10 false positives and 1 false negative is better than the solution with 1 false positive and 2 false negatives.
* Attack is defined by a single invocation of the test script.

== Scenario 7 ==

There is a new remote vulnerability in Windows.
You became aware of a new virus that targets this vulnerability at 7 PM.
The antivirus vendor has released an updated virus database, but it's probably not installed
on all of the computers yet. Your company has 500 employees, with half of them running on laptops. You have to decide in 12 hours, if You need to collect all the employee's laptops in the morning.

Collecting the laptops has a high cost in lost employee productivity: There will be a queue of laptops waiting to be inspected. You can assume that all of the laptops can be inspected in half a day.

Limits: You can not mitigate the risk by changing the network configuration, You do not know how many laptops are still in the building. You can not take the servers offline.

Resources: 5 workers, some networking equipment, real servers (you can not disrupt those), "samples" of existing systems: a few spare workstations, a few spare laptops,

What do You know about the virus?
* It disables antivirus software
* It disables automatic software updates
* It can be cleaned up only manually in about 1 manhour

You need to develop an action plan:
* What You test in those scarce 12 hours?
* How?
* How do You weigh the results to make the decision?
* The plan itself must be short and easy to understand so You can write it on a whiteboard.
* Justifications for the specific actions go to a separate file/document.

=== Lab 7 ===
* Get viruses and XP install ISO-s from http://www.tud.ttu.ee/~anttix/lab7/
** Password for the protected zip: doomsday
* Alternatively, get Siims image
* Set up 5 VMS and connect them to a private network (or Host-Only network if You can't configure private nets):
** Plain old XP without any virus scanner (clean)
** Plain old XP with a virus scanner eg Avast (clean)
** Windows XP SP3, no virus scanner (clean)
** Plain old XP without any virus scanner (infected)
** Ubuntu Linux with tcpdump running
* If You have enogh time You can either:
** Find some more Worms and unleash them on Your virtual network (thanx to Urmas for those links)
*** http://vx.netlux.org/
*** http://www.excellentcontent.com/xbart/cbezels/
*** http://hacker-mc.blogspot.com/2008/12/pacoto-hacker.html
*** http://www.rohitab.com/discuss/oldfiles/
** Try to install Windows XP while it is connected to the infected network and see if You manage to install patches or antivirus before getting infected.

Measure the time it takes for the virus to penetrate the machines.
Note if virus scanner was able to catch the virus even if the underlying flaw in
windows wasn't patched.
Test if the SP3 version is immune to attacks originating from the network,
even when virus scanner is not installed.

== Scenario 8 ==

Find a solution to simulate a network of 300 PC-s in a single corporate environment, accessing a software update service at once.

Determine the load on primary internet connection and the router.
Assume that updates server will be able to keep up.

Tools to consider
* [http://www.ssfnet.org/homePage.html SSFNet]
* [http://www.omnetpp.org/ OMNeT++]

Additional resources
* [http://www.ssfnet.org/Exchange/gallery/index.html SSFNet module gallery]
* [http://code.google.com/p/omnet-httptools/ omnet-httptools]

=== Lab 8 ===
==== OMNet++ (Free for academic use only) ====
====== Install OMNeT++ ======
# Compile OMNet++ using these instructions: http://omnetpp.org/doc/omnetpp41/InstallGuide.pdf
# Run omnetpp IDE
# Choose Tutorials->Tic-toc tutorial from welcome page to open Tutorial documentation. Welcome page can be accessed from Help menu if You have accidentally closed it.
# Choose Go to workbench
# Click on tictoc in "Project Explorer" (on left hand pane)
# Choose Project->Open Project
# Choose Project->Build All

====== Install OMNeT++ INET framework ======
# Download https://github.com/downloads/inet-framework/inet/inet-20100723-src.tgz
# Create a directory named omnetpp-workspace and unpack inet-20100723-src.tgz in that directory.
# Switch Eclipse workspace to the newly-created directory: File -> Switch Workspace and select omnetpp-workspace.
# Follow instructions in omnetpp-workspace/inet/INSTALL file in the "If you are using the IDE" section

==== NS-3 (GPL Licensed) ====
Install all dependencies according to instructions [http://www.nsnam.org/wiki/index.php/Installation here] and [http://www.nsnam.org/wiki/index.php/PyViz here]

'''NB! Do not clone or compile anything yet'''

Clone NS-3 repositories
hg clone http://code.nsnam.org/ns-3-allinone
cd ns-3-allinone
./download.py -n gjc/ns-3.9-pyviz

Build NS-3
./build.py

Read the introduction slides during the build :)
* http://www.nsnam.org/tutorials/geni-tutorial-part1.pdf
* http://www.nsnam.org/tutorials.html

If You are unable to install the stuff, You may get an
Ubuntu VM with all of the stuff preinstalled from

http://www.tud.ttu.ee/~anttix/lab8/ubuntu10.04-omnetpp_ns3.vdi

Run Example visualizations
cd ns-3.9-pyviz
./waf --pyrun examples/flowmon/wifi-olsr-flowmon.py
./waf --run "examples/wireless/wifi-wired-bridging --viz=1"
./waf --run "examples/wireless/wifi-ap --viz=1"

Get itx8080 samples from:
http://www.tud.ttu.ee/~anttix/lab8/ns3-tty-v2.tar.gz

Run the samples
./waf --run "examples/tty/lecture1 --viz=1"
./waf --run "examples/tty/lecture2 --viz=1"
./waf --run examples/tty/lecture5

Look at the generated files: wantraffic*

Now create a new simulation that uses TCP networking instead of UDP. Refer to examples in examples/tcp.

== Scenario 9 ==

Simulate a DDoS attack against a network of web servers.

* 2 types of attacks
** SYN Flood
** "AB" style attack

Assumptions:
* 1000 "infected" hosts performing the attack
* 10 web servers, located in 5 locations
* The infected host only attacks one server
* The target to attack is selected randomly
* Assume that servers can keep up with the flood
* Data transferred during each connection is about 500kb

Objectives:
* Assess the bandwidth these attacks consume in each location

You can only implement a subset of constraints and assumptions.
Do as much as You can, maybe others have done even less :D

=== Lab 9 ===

Start by implementing proper network topology:
* Create a CSMA(ring) network for each location (5 networks in total)
* Set the speed to 100Mbit/s
* Create 3 nodes for each location (2 servers, 1 router)
* Connect nodes to their respective networks
* Create another CSMA(ring) network to mimic the internet core
* Create 6 nodes to act as core routers on that network
** one for each simulated location
** an "extra" router that all attackers will be connected to
* Set the speed of the internet core to 10Gbit/s
* Connect location routers to respective core routers via Point-to-Point links
* Set the speed of those Point-to-Point links to 10Mbit/s
* Create 20 attacker nodes (just to speed up testing and development, You can increase that number to 1000 later)
* Connect all attacker nodes to the "extra" core router with point-to-point links
* Set the speed of attacker links to 1Mbit/s

Võrgurakendused I 2018

2011-08-31T11:12:14Z

Anttix: /* Praktilised tööd */

<table>
<tr>
<td>
[[Pilt:Engine.jpg|left|mootor]]
</td>
<td>
Ainekood: ITV0110 
Link: http://www.lambda.ee/index.php/V%C3%B5rgurakendused_I ehk http://www.lambda.ee/index/itv0110 
Punkte: 3.5 AP ehk 5 EAP 
Lektor: [http://tanel.tammet.googlepages.com Tanel Tammet] 
Kontakt: tammet@staff.ttu.ee, 6203457, TTÜ AK223 
olemas on ka [[Võrgurakendused_I 2010| 2010 aasta arhiiv]] koos kõigi eelmise aasta materjalidega. 
</td>
</tr>
</table>

== Aeg, koht, tulemus ==

Loenguid nädalas: 2 tundi (üks loeng) teisipäeviti 16:00-17:30 ruumis VII-131

Praktikume nädalas: 2 tundi (üks praktikum). Kui pole teisiti märgitud, toimuvad praktikumid:
* kolmapäeval 10:00-11:30 ruumides IT-213E, IT-213I rühmadele IABB37, IAPB37
* neljapäeval 08:00-09:30 ruumides IT-213D, IT-213H rühmadele IABB31, IABB32, IAPB31, IAPB32
* neljapäeval 14.00-15:30 ruumis IT-213D rühmale IAPB33



Kursus lõpeb hindelise arvestusega. Hinne sõltub kursuse jooksul tehtud praktikumide tulemustest (60%) pluss kursuse lõpus toimuva kontrolltöö tulemustest (40%).

NB! Esimese loengu annab Antti Andreimann: Tanel Tammet on konverentsil.

Küsimuste küsimiseks ja omavaheliseks suhtlemiseks on avatud kursuse "Üldfoorum" aadressil:

https://moodle.e-ope.ee/mod/forum/view.php?id=200854

== Kursuse eesmärk ==

Lihtsamate veebirakenduste põhimõtted ja nende kirjutamise oskus nii brauseri kui serveri poolel. Konkreetsemalt:
* html-i kirjutamise oskus, esmane tutvus CSS-i ja javascriptiga.
* serveripoolse rakenduse kirjutamise põhimõtted, cgi protokoll, erinevate keelte (sh C, php, python, java) kasutamise sissejuhatus serverirakendustes.
* lihtsamad SQLi kasutamise oskused.

Kursusel eeldatakse elementaarsete programmeerimisoskuste olemasolu. Kes programmeerimisega üldse kokku puutunud ei ole või seda paralleelselt ei õpi, ei suuda kursust läbida.

== Analoogilised kursused ==

TTÜ-s on sama kursust varem lugenud K. Kikkas (vt [http://akadeemia.kakupesa.net/arhiiv/VR1/loengud/ loengumaterjale]) ja I. Liiv (vt [http://innar.li.ttu.ee/index.php?option=displaypage&Itemid=55&op=page&SubMenu= praksimaterjale]), ITK-s luges analoogilist kursust esialgu T. Tammet (vt vanu [http://deepthought.ttu.ee/it/vorgutarkvara/wav3080/ materjale]), praegusajal loeb A. Andreimann (vt vabalt kättesaadavaid [http://enos.itcollege.ee/~aandreim/vr1/latest/ materjale]).

== Praktilised tööd ==

Praktilisi töid juhendavad esialgu Tanel ja Antti, hiljem võib lisanduda veel juhendajaid.

Kursusel on neli kohustuslikku praktilist ẗööd. Iga töö annab 0-15 punkti. Hilinenud tööd annavad poole punktidest. Töid võib (ja on soovitav) esitada enne tähtaega.

Kõik tööd tuleb esitada ise TTÜ arvutiklassis: emailiga saadetud töid ei arvestata. Kasutada võib nii klassi arvuteid kui oma arvutit, brauser ja operatsioonisüsteem on vabalt valitavad. Serverirakenduste tööde jaoks on võimalik kasutada ülikooli serverit, soovi korral ka oma serverit.

NB! rühmadele IABB37, IAPB37 kehtivad erinõuded. [https://moodle.e-ope.ee/mod/page/view.php?id=200865 Loe siit ...]

* [[ITV0110 1. töö: Html põhioskused|Html põhioskused]]. Tähtaeg neljapäev, 15. september.

NB! Järgmised tööd on näited aastast 2010, praegusel kursusel tehakse neis muutusi, kuid üldjoontes jäävad ülesanded sarnaseks. Tähtajad on juba uued, 2011 aasta jaoks.

* [[ITV0110 2. töö: CSS, javascript, veebiserver| CSS, javascript, veebiserver]]. Tähtaeg neljapäev, 13. oktoober.
* [[ITV0110 3. töö: Lihtne serverirakendus: vormid ja cgi|Lihtne serverirakendus: vormid ja cgi]]. Tähtaeg neljapäev, 17. november.
* [[ITV0110 4. töö: Andmebaasiga serverakendus|Andmebaasiga serverakendus]]. Sisuks on väga lihtsakoelise "mini-facebooki" ehitamine. Programmeerimiskeeleks on PHP ja andmebaasiks mysql või postgresql. Tähtaeg neljapäev, 15. detsember.

Kursuse edukaks läbimiseks peavad kõik praktilised tööd olema tehtud.

== Loengute plaan ja materjalid ==

Alltoodud teemad kaetakse igaüks ühe-kahe loenguga. Suur osa loengutest on pühendatud näidete läbitegemisele ning seletamisele, ette-programmeerimisele ja praktikumide osalisele realiseerimisele.

; Sissejuhatus ja meeldetuletus

Tutvuda lühidalt:
:* Interneti baastehnoloogia IT sissejuhatusest: [[Media:Itsissejuhatus10o08.ppt|Itsissejuhatus10o08.ppt]], [[Media:Itsissejuhatus10o08.pdf|Itsissejuhatus10o08.pdf]].
:* [http://www.w3.org/MarkUp/Guide/ Raggetti mikrotutorial algajatele]
:* head eestikeelsed sissejuhatused [http://innar.li.ttu.ee/failid/VR_2006.pdf Innar Liivilt (pdf)] ja [http://akadeemia.kakupesa.net/arhiiv/VR1/loengud/loeng3 Kaido Kikkaselt (html)]
:* http://www.w3schools.com/.
:* http://www.w3c.org/.

; HTML põhioskused

Lugeda ja proovida läbi (st vaja põhimõtted selgeks õppida):
:* [http://www.w3schools.com/html/default.asp w3schools html tutorial basic blokk].
Loe lisaks läbi ka
:* [http://www.w3.org/MarkUp/Guide/Advanced.html Raggetti klassikaline tutorial, eeskätt tabelid]
:* [http://innar.li.ttu.ee/failid/VR_2006.pdf Innar Liivi sissejuhatus, eeskätt värvid ja pildid]
:* [http://www.w3.org/TR/html401/struct/tables.html täiendavat tabelitest ametlikust standardist]
Tutvu lisaks kasuliku tagide nimistuga:
:* [http://joshduck.com/periodic-table.html htmli elementide perioodiline tabel]

; CSS põhioskused

Lugeda ja proovida läbi (st vaja põhimõtted selgeks õppida):
* [http://www.w3.org/MarkUp/Guide/Style.html First CSS intro]
* [http://www.w3schools.com/css/ w3schools'i css tutorial]: : kindlasti "basic" ja "styling" blokid, huvi korral loe edasi ("box model", "advanced) ka, kuid need viimased ei ole kohustuslikud.
Tutvu lisaks listide+CSS-i kasutamisega menüüde jms jaoks:
* [http://css.maxdesign.com.au/listamatic/ listikasutus] ja sealtsamast [http://css.maxdesign.com.au/listutorial/index.htm listikasutuse tutorialid]

; Javascript põhioskused

Kaks loengut: (a) sissejuhatus (b) reaalne kasutamine brauseris (html ja css muutmine, evendid jne)

Vaata soenduseks/demoks [http://www.chromeexperiments.com/ Google kogutud näiteid].

Seejärel loe läbi ja proovi järgi selles järjekorras:
* [http://en.wikipedia.org/wiki/JavaScript Wikipedia javascripti üldartikkel]: ülevaade, ajalugu jne. Keelt siit ei õpi!
* [http://www.w3schools.com/js/default.asp W3schools javascripti sissejuhatus]: JS Basic ja JS Objects osad. Mõned asjad jäävad siin veidi ebaselgeks!
* [http://en.wikipedia.org/wiki/JavaScript_syntax Wikipedia Javascripti keele kiirõpetus]: loe ja proovi paralleelselt w3schools-ga. Siit saab mõned asjad selgemaks kui ainult w3schoolsist.

NB! Selle tulemusena on sul baasettekujutus javascripti keelest, aga mitte reaalsest kasutusest (seda vaatame järgmises loengus).

Javascripti kasutamine brauseris: alustuseks on hea vaadata põhjalikku näidete loetelu

* [http://www.w3schools.com/js/js_ex_dom.asp html dom objektid]: põhiasjad
* [http://www.tizag.com/javascriptT/javascriptform.php form validation]: klassikaline rakendus
* [http://www.w3schools.com/js/js_ex_browser.asp brauseriobjektid]: vahel kah kasulikud

ja tingimata lugeda sinna juurde teegijuhendeid:

* [http://www.w3schools.com/jsref/dom_obj_all.asp html dom ülevaadet]
* [http://www.w3schools.com/jsref/dom_obj_event.asp html events ülevaadet]
* [http://www.w3schools.com/jsref/dom_obj_style.asp style lugemine/muutmine js-s: hädavajalik reference]

; Praktilist teisest praktikumist

Kuidas ja kuhu faile serverisse üles laadida jms: loe [[ITV0110 2. töö: CSS, javascript, veebiserver| teise praktikumi materjalidest]]

; Cgi töötlemine eri keeltes (C, python, bash, java, ...)

Kõigepealt loe ja proovi tingimata ise läbi teha: [[pythoni cgi-d dijkstra serveris: kiire sissejuhatus]]

Tutvu linuxi shelli elementaarsete käskudega [http://www.tuxfiles.org/linuxhelp/linuxcommands.html sellest lühiõpetusest] ja täiendavalt [http://info.ee.surrey.ac.uk/Teaching/Unix/ selle tutoriali] peatükkidest üks kuni viis. Iga käsu juures on abiks man, näiteks <tt>man ls</tt>. Huvi korral googelda lisaks.

Seejärel loe neid materjale CGI protokollist ja CGI programmidest serveris:

* [http://www.jmarshall.com/easy/cgi/ lihtne sissejuhatus cgi-desse]
* [[Media:cgi.pdf|cgi.pdf: detailsem juhend]]
* [http://www.cs.tut.fi/~jkorpela/forms/cgic.html cgi C keeles]
* [http://webpython.codepoint.net/cgi_tutorial cgi Pythonis]
* [http://www.yolinux.com/TUTORIALS/BashShellCgi.html cgi Bashis]

ning siis vaata lisaks loengus tehtud/proovitud [[lihtsaid cgi programminäiteid]] eri keeltes.

Cgi jaoks on olemas ka nö [http://www.rfc-editor.org/rfc/rfc3875.txt rfc-standard], mille lugemine on aga pisut vaevarikas (nagu enamikel standarditel) ja üldjuhul on praktilisem lugeda hoopis ülaltoodud õpetusi ja vaadata
näiteid.

; Veebiserveri ehitusest ja konfigureerimisest

Kõigepealt tutvu või tuleta meelde http protokolli põhimõtteid:

* [http://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol http wikipedias]
* [http://www.jmarshall.com/easy/http/ veel http-st]
* [http://www.factini.com/c/httpViewer/ headerite jms vaatamise veebiabivahend]

Veebiserverist paremaks arusaamiseks tasub veidi eksperimenteerida [[Media:Itsissejuhatus_tiny.zip|pisikese veebiserveriga]].

Enimkasutatav veebiserver Apache:

* [http://httpd.apache.org/ apache oma koduleht]
* [http://en.wikipedia.org/wiki/Apache_HTTP_Server wikipedia apachest]
* [http://news.netcraft.com/archives/category/web-server-survey/ veebiserverite kasutusstatistikat]

Apache konfigureerimisest:

* [http://www.jlk.net/apache/beginners.shtml sissejuhatus algajatele]
* [http://httpd.apache.org/docs/2.2/ ametlik juhend]

; Python ja näiteid kasutamisest serverirakendustes

Tutvumine kolmanda praktikumiga: [[ITV0110 3. töö: Lihtne serverirakendus: vormid ja cgi|vormid ja cgi]]. Praksi jaoks vajaliku koodi kirjutamise harjutamine (loengus etteprogrammeerimine).

Sealt leiad ka soovitused esmatutvuseks Pythoniga (praktikumi jaoks piisab kõige lihtsamatest Pythoni konstruktsioonidest ja cgi teegist, keerukamaid asju pole otseselt vaja):
* loe [http://docs.python.org/tutorial/ tutoriali] algust (keerulised andmestruktuurid, moodulite ja klasside värgi võid esialgu lugemata jätta)
* lisaks [http://docs.python.org/library/cgi.html cgi teegi õpetust].
* Hea mõte on paralleelselt teha lahti Pythoni interpretaator ja katsetada kõrvale asju otse Pythoni käsureal. Kui su masinas Pythonit pole, siis installeeri!
* Paljud kasulikud asjad on kirjas Pythoni [http://docs.python.org/library/index.html#library-index teegi dokumentatsioonis].
* [[Kasulikke pythoni näitejuppe cgi jaoks]]
* Konkreetsete küsimuste korral aitab tihti googeldamine.

; Serverirakendused PHP-s, näited

* Väikese ajaloolise ülevaate leiad [http://en.wikipedia.org/wiki/PHP wikipeediast]
* Põhiõpetus on [http://www.php.net/manual/en/ php oma saidil]: loe sealt kõigepealt [http://www.php.net/manual/en/tutorial.php sissejuhatavat tutoriali]
* [http://w3schools.com/php/default.asp W3school-si php tutorial] on samuti päris OK.

; SQL

Loe selles järjekorras:

* [http://web.njit.edu/~song/courses/is698/SQL_tutorials.ppt hea esimene sissejuhatus]
* [http://www.w3schools.com/sql/default.asp w3schools'i tutorial]
* [http://dev.mysql.com/doc/refman/5.0/en/tutorial.html mysql esmane tutorial] ja [http://dev.mysql.com/doc/refman/5.0/en/index.html mysql manuaal]

; SQL serverirakendustes

* Vaata [[lihtsaid php ja mysql näiteid]] loengust.
* [http://dmsa.concordia.ca/tutorial_files/shortsql.ppt mysql PHP-s: ppt]
* [http://www.tizag.com/mysqlTutorial/ mysql PHP-s: veebitutorial]
* [http://blogs.techrepublic.com.com/security/?p=2368 SQL injection] vt ka [http://lh6.ggpht.com/_5YF7KQZuZS0/S6dvFXu5OoI/AAAAAAAACWM/qTcVpMxcDnA/licence%20plate%20camera%20sql%20injection_2%5B3%5D.jpg?imgmax=800 seda] ja [http://www.schneier.com/blog/archives/2010/10/pen-and-paper_s.html seda] ja [http://alicebobandmallory.com/articles/2010/09/23/did-little-bobby-tables-migrate-to-sweden seda]
* [http://www.w3schools.com/php/default.asp w3schools PHP tutorial all vasakul Mysql blokk]
* [[Vorgurakendused 1 SQL naited loengust]]

; Sessioonid, cookied, sisselogimine, autentimine

Mõned lingid:

* basic authentication [http://en.wikipedia.org/wiki/Basic_access_authentication wikipedias], [http://httpd.apache.org/docs/2.0/howto/auth.html apache manuaalis] ja [[basic authentication näited]]
* cookie [http://en.wikipedia.org/wiki/HTTP_cookie wikipedias], php cookie handling [http://w3schools.com/PHP/php_cookies.asp w3schools-st] ja [http://www.php.net/manual/en/function.setcookie.php php manuaalist]
* [http://oreilly.com/catalog/webdbapps/chapter/ch08.html ok sessiooniõpetus]
* php sessioonihandling [http://w3schools.com/PHP/php_sessions.asp w3schools] ja siit [http://ee.php.net/manual/en/book.session.php php mahukas sessiooni-manuaal] ja siit [http://www.tizag.com/phpT/phpsessions.php eraldi tutorial]
* väike [http://www.secologic.org/downloads/web/051123_eurosec_course_material_on_web_application_session_management.ppt ok sessioonihalduse tutorial]
* [[autentimise näide php sessiooniga]]

; Ajax

* Loe seotud tehnoloogiatest: [http://en.wikipedia.org/wiki/Ajax_%28programming%29 wikipedia ajax], [http://en.wikipedia.org/wiki/XMLHttpRequest wikipedia xmlhttprequest], [http://en.wikipedia.org/wiki/JSON wikipedia json]
* [[xmlhttprequest ja jsonile rakendatud eval näited]]

== Vajalikud tööriistad ==

Oma arvutiga töö tegemiseks peab seal olema vähemalt

* [http://notepad-plus-plus.org/ Notepad++]
* [http://www.mozilla.com Mozilla Firefox]

== Lugemismaterjale ==

Üldist:

* [http://www.w3schools.com/ Mitu head tutoriali eri teemadel]
* [http://www.websitetips.com/ suur kogu häid tutoriale, artikleid ja soovitusi]
* Lisamaterjale kursusest [[Kasutajaliidesed võrgutehnoloogia baasil]]

HTML:

* [http://www.w3.org/MarkUp/Guide/ Raggetti tutorial algajatele]
* [http://akadeemia.kakupesa.net/arhiiv/VR1/loengud/loeng3 Kaido Kikkase hea eestikeelne sissejuhatus]
* [http://innar.li.ttu.ee/failid/VR_2006.pdf Innar Liivi hea eestikeelne sissejuhatus]
* [http://www.w3schools.com/html/ w3schools'i põhjalik html tutorial]
* [http://joshduck.com/periodic-table.html tore tagide nimistu]
* [http://www.w3.org/TR/html4/ HTML 4.01 ametlik standard]
* [http://www.w3.org/TR/html5/ HTML 5.0 ametlik draft]

HTML+CSS+Javascript:

* [http://www.w3.org/MarkUp/Guide/Style.html First CSS intro]
* [http://www.w3schools.com/css/ w3schools'i css tutorial]
* [http://www.w3schools.com/js/ w3schools'i javascripti tutorial]

* [http://www.alistapart.com/ A list apart]
* [http://css.maxdesign.com.au/listamatic/ listikasutus]

HTTP

* [http://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol http wikipedias]
* http://www.jmarshall.com/easy/http/
* [http://www.w3.org/Protocols/HTTP/AsImplemented.html T. Berners-Lee leiutatud esimene HTTP spec]
* [http://www.garshol.priv.no/download/text/http-tut.html hea väike HTTP ja CGI tutorial]
* [http://www.factini.com/c/httpViewer/ headerite jms vaatamise veebiabivahend]

CGI programmid serveris

* [http://www.jmarshall.com/easy/cgi/ lihtne sissejuhatus cgi-desse]
* [[Media:cgi.pdf|cgi.pdf: detailsem juhend]]
* [http://www.whizkidtech.redprince.net/cgi-bin/tutorial cgi esmane sissejuhatus Bashi näidetega]
* [http://www.cs.tut.fi/~jkorpela/forms/cgic.html cgi C keeles]
* [http://webpython.codepoint.net/cgi_tutorial cgi Pythonis]
* [http://www.yolinux.com/TUTORIALS/BashShellCgi.html cgi Bashis]
* [[Media:Itsissejuhatus_tiny.zip|Tiny www server]] ja [[lihtsaid cgi programminäiteid]]

PHP ja MySQL

* http://www.php.net/ sh http://www.php.net/tut.php või http://www.php.net/manual/en/tutorial.php
* http://www.mysql.org, alustuseks http://dev.mysql.com/doc/refman/5.1/en/tutorial.html

Veebiserverid:

* [[Media:Itsissejuhatus_tiny.zip|Tiny www server]] ja [[lihtsaid cgi programminäiteid]]
* http://www.devside.net/guides/windows/apache
* http://net.tutsplus.com/tutorials/php/how-to-setup-a-dedicated-web-server-for-free/
* http://www.yolinux.com/TUTORIALS/LinuxTutorialWebSiteConfig.html

[[Category:Kursus]]

Võrgurakendused I 2018

2011-08-31T11:11:34Z

Anttix: /* Praktilised tööd */

<table>
<tr>
<td>
[[Pilt:Engine.jpg|left|mootor]]
</td>
<td>
Ainekood: ITV0110 
Link: http://www.lambda.ee/index.php/V%C3%B5rgurakendused_I ehk http://www.lambda.ee/index/itv0110 
Punkte: 3.5 AP ehk 5 EAP 
Lektor: [http://tanel.tammet.googlepages.com Tanel Tammet] 
Kontakt: tammet@staff.ttu.ee, 6203457, TTÜ AK223 
olemas on ka [[Võrgurakendused_I 2010| 2010 aasta arhiiv]] koos kõigi eelmise aasta materjalidega. 
</td>
</tr>
</table>

== Aeg, koht, tulemus ==

Loenguid nädalas: 2 tundi (üks loeng) teisipäeviti 16:00-17:30 ruumis VII-131

Praktikume nädalas: 2 tundi (üks praktikum). Kui pole teisiti märgitud, toimuvad praktikumid:
* kolmapäeval 10:00-11:30 ruumides IT-213E, IT-213I rühmadele IABB37, IAPB37
* neljapäeval 08:00-09:30 ruumides IT-213D, IT-213H rühmadele IABB31, IABB32, IAPB31, IAPB32
* neljapäeval 14.00-15:30 ruumis IT-213D rühmale IAPB33



Kursus lõpeb hindelise arvestusega. Hinne sõltub kursuse jooksul tehtud praktikumide tulemustest (60%) pluss kursuse lõpus toimuva kontrolltöö tulemustest (40%).

NB! Esimese loengu annab Antti Andreimann: Tanel Tammet on konverentsil.

Küsimuste küsimiseks ja omavaheliseks suhtlemiseks on avatud kursuse "Üldfoorum" aadressil:

https://moodle.e-ope.ee/mod/forum/view.php?id=200854

== Kursuse eesmärk ==

Lihtsamate veebirakenduste põhimõtted ja nende kirjutamise oskus nii brauseri kui serveri poolel. Konkreetsemalt:
* html-i kirjutamise oskus, esmane tutvus CSS-i ja javascriptiga.
* serveripoolse rakenduse kirjutamise põhimõtted, cgi protokoll, erinevate keelte (sh C, php, python, java) kasutamise sissejuhatus serverirakendustes.
* lihtsamad SQLi kasutamise oskused.

Kursusel eeldatakse elementaarsete programmeerimisoskuste olemasolu. Kes programmeerimisega üldse kokku puutunud ei ole või seda paralleelselt ei õpi, ei suuda kursust läbida.

== Analoogilised kursused ==

TTÜ-s on sama kursust varem lugenud K. Kikkas (vt [http://akadeemia.kakupesa.net/arhiiv/VR1/loengud/ loengumaterjale]) ja I. Liiv (vt [http://innar.li.ttu.ee/index.php?option=displaypage&Itemid=55&op=page&SubMenu= praksimaterjale]), ITK-s luges analoogilist kursust esialgu T. Tammet (vt vanu [http://deepthought.ttu.ee/it/vorgutarkvara/wav3080/ materjale]), praegusajal loeb A. Andreimann (vt vabalt kättesaadavaid [http://enos.itcollege.ee/~aandreim/vr1/latest/ materjale]).

== Praktilised tööd ==

Praktilisi töid juhendavad esialgu Tanel ja Antti, hiljem võib lisanduda veel juhendajaid.

Kursusel on neli kohustuslikku praktilist ẗööd. Iga töö annab 0-15 punkti. Hilinenud tööd annavad poole punktidest. Töid võib (ja on soovitav) esitada enne tähtaega.

Kõik tööd tuleb esitada ise TTÜ arvutiklassis: emailiga saadetud töid ei arvestata. Kasutada võib nii klassi arvuteid kui oma arvutit, brauser ja operatsioonisüsteem on vabalt valitavad. Serverirakenduste tööde jaoks on võimalik kasutada ülikooli serverit, soovi korral ka oma serverit.

NB! rühmadele IABB37, IAPB37 kehtivad erinõuded. [https://moodle.e-ope.ee/mod/page/view.php?id=200865 Loe siit ...]

https://moodle.e-ope.ee/course/view.php?id=4269

* [[ITV0110 1. töö: Html põhioskused|Html põhioskused]]. Tähtaeg neljapäev, 15. september.

NB! Järgmised tööd on näited aastast 2010, praegusel kursusel tehakse neis muutusi, kuid üldjoontes jäävad ülesanded sarnaseks. Tähtajad on juba uued, 2011 aasta jaoks.

* [[ITV0110 2. töö: CSS, javascript, veebiserver| CSS, javascript, veebiserver]]. Tähtaeg neljapäev, 13. oktoober.
* [[ITV0110 3. töö: Lihtne serverirakendus: vormid ja cgi|Lihtne serverirakendus: vormid ja cgi]]. Tähtaeg neljapäev, 17. november.
* [[ITV0110 4. töö: Andmebaasiga serverakendus|Andmebaasiga serverakendus]]. Sisuks on väga lihtsakoelise "mini-facebooki" ehitamine. Programmeerimiskeeleks on PHP ja andmebaasiks mysql või postgresql. Tähtaeg neljapäev, 15. detsember.

Kursuse edukaks läbimiseks peavad kõik praktilised tööd olema tehtud.

== Loengute plaan ja materjalid ==

Alltoodud teemad kaetakse igaüks ühe-kahe loenguga. Suur osa loengutest on pühendatud näidete läbitegemisele ning seletamisele, ette-programmeerimisele ja praktikumide osalisele realiseerimisele.

; Sissejuhatus ja meeldetuletus

Tutvuda lühidalt:
:* Interneti baastehnoloogia IT sissejuhatusest: [[Media:Itsissejuhatus10o08.ppt|Itsissejuhatus10o08.ppt]], [[Media:Itsissejuhatus10o08.pdf|Itsissejuhatus10o08.pdf]].
:* [http://www.w3.org/MarkUp/Guide/ Raggetti mikrotutorial algajatele]
:* head eestikeelsed sissejuhatused [http://innar.li.ttu.ee/failid/VR_2006.pdf Innar Liivilt (pdf)] ja [http://akadeemia.kakupesa.net/arhiiv/VR1/loengud/loeng3 Kaido Kikkaselt (html)]
:* http://www.w3schools.com/.
:* http://www.w3c.org/.

; HTML põhioskused

Lugeda ja proovida läbi (st vaja põhimõtted selgeks õppida):
:* [http://www.w3schools.com/html/default.asp w3schools html tutorial basic blokk].
Loe lisaks läbi ka
:* [http://www.w3.org/MarkUp/Guide/Advanced.html Raggetti klassikaline tutorial, eeskätt tabelid]
:* [http://innar.li.ttu.ee/failid/VR_2006.pdf Innar Liivi sissejuhatus, eeskätt värvid ja pildid]
:* [http://www.w3.org/TR/html401/struct/tables.html täiendavat tabelitest ametlikust standardist]
Tutvu lisaks kasuliku tagide nimistuga:
:* [http://joshduck.com/periodic-table.html htmli elementide perioodiline tabel]

; CSS põhioskused

Lugeda ja proovida läbi (st vaja põhimõtted selgeks õppida):
* [http://www.w3.org/MarkUp/Guide/Style.html First CSS intro]
* [http://www.w3schools.com/css/ w3schools'i css tutorial]: : kindlasti "basic" ja "styling" blokid, huvi korral loe edasi ("box model", "advanced) ka, kuid need viimased ei ole kohustuslikud.
Tutvu lisaks listide+CSS-i kasutamisega menüüde jms jaoks:
* [http://css.maxdesign.com.au/listamatic/ listikasutus] ja sealtsamast [http://css.maxdesign.com.au/listutorial/index.htm listikasutuse tutorialid]

; Javascript põhioskused

Kaks loengut: (a) sissejuhatus (b) reaalne kasutamine brauseris (html ja css muutmine, evendid jne)

Vaata soenduseks/demoks [http://www.chromeexperiments.com/ Google kogutud näiteid].

Seejärel loe läbi ja proovi järgi selles järjekorras:
* [http://en.wikipedia.org/wiki/JavaScript Wikipedia javascripti üldartikkel]: ülevaade, ajalugu jne. Keelt siit ei õpi!
* [http://www.w3schools.com/js/default.asp W3schools javascripti sissejuhatus]: JS Basic ja JS Objects osad. Mõned asjad jäävad siin veidi ebaselgeks!
* [http://en.wikipedia.org/wiki/JavaScript_syntax Wikipedia Javascripti keele kiirõpetus]: loe ja proovi paralleelselt w3schools-ga. Siit saab mõned asjad selgemaks kui ainult w3schoolsist.

NB! Selle tulemusena on sul baasettekujutus javascripti keelest, aga mitte reaalsest kasutusest (seda vaatame järgmises loengus).

Javascripti kasutamine brauseris: alustuseks on hea vaadata põhjalikku näidete loetelu

* [http://www.w3schools.com/js/js_ex_dom.asp html dom objektid]: põhiasjad
* [http://www.tizag.com/javascriptT/javascriptform.php form validation]: klassikaline rakendus
* [http://www.w3schools.com/js/js_ex_browser.asp brauseriobjektid]: vahel kah kasulikud

ja tingimata lugeda sinna juurde teegijuhendeid:

* [http://www.w3schools.com/jsref/dom_obj_all.asp html dom ülevaadet]
* [http://www.w3schools.com/jsref/dom_obj_event.asp html events ülevaadet]
* [http://www.w3schools.com/jsref/dom_obj_style.asp style lugemine/muutmine js-s: hädavajalik reference]

; Praktilist teisest praktikumist

Kuidas ja kuhu faile serverisse üles laadida jms: loe [[ITV0110 2. töö: CSS, javascript, veebiserver| teise praktikumi materjalidest]]

; Cgi töötlemine eri keeltes (C, python, bash, java, ...)

Kõigepealt loe ja proovi tingimata ise läbi teha: [[pythoni cgi-d dijkstra serveris: kiire sissejuhatus]]

Tutvu linuxi shelli elementaarsete käskudega [http://www.tuxfiles.org/linuxhelp/linuxcommands.html sellest lühiõpetusest] ja täiendavalt [http://info.ee.surrey.ac.uk/Teaching/Unix/ selle tutoriali] peatükkidest üks kuni viis. Iga käsu juures on abiks man, näiteks <tt>man ls</tt>. Huvi korral googelda lisaks.

Seejärel loe neid materjale CGI protokollist ja CGI programmidest serveris:

* [http://www.jmarshall.com/easy/cgi/ lihtne sissejuhatus cgi-desse]
* [[Media:cgi.pdf|cgi.pdf: detailsem juhend]]
* [http://www.cs.tut.fi/~jkorpela/forms/cgic.html cgi C keeles]
* [http://webpython.codepoint.net/cgi_tutorial cgi Pythonis]
* [http://www.yolinux.com/TUTORIALS/BashShellCgi.html cgi Bashis]

ning siis vaata lisaks loengus tehtud/proovitud [[lihtsaid cgi programminäiteid]] eri keeltes.

Cgi jaoks on olemas ka nö [http://www.rfc-editor.org/rfc/rfc3875.txt rfc-standard], mille lugemine on aga pisut vaevarikas (nagu enamikel standarditel) ja üldjuhul on praktilisem lugeda hoopis ülaltoodud õpetusi ja vaadata
näiteid.

; Veebiserveri ehitusest ja konfigureerimisest

Kõigepealt tutvu või tuleta meelde http protokolli põhimõtteid:

* [http://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol http wikipedias]
* [http://www.jmarshall.com/easy/http/ veel http-st]
* [http://www.factini.com/c/httpViewer/ headerite jms vaatamise veebiabivahend]

Veebiserverist paremaks arusaamiseks tasub veidi eksperimenteerida [[Media:Itsissejuhatus_tiny.zip|pisikese veebiserveriga]].

Enimkasutatav veebiserver Apache:

* [http://httpd.apache.org/ apache oma koduleht]
* [http://en.wikipedia.org/wiki/Apache_HTTP_Server wikipedia apachest]
* [http://news.netcraft.com/archives/category/web-server-survey/ veebiserverite kasutusstatistikat]

Apache konfigureerimisest:

* [http://www.jlk.net/apache/beginners.shtml sissejuhatus algajatele]
* [http://httpd.apache.org/docs/2.2/ ametlik juhend]

; Python ja näiteid kasutamisest serverirakendustes

Tutvumine kolmanda praktikumiga: [[ITV0110 3. töö: Lihtne serverirakendus: vormid ja cgi|vormid ja cgi]]. Praksi jaoks vajaliku koodi kirjutamise harjutamine (loengus etteprogrammeerimine).

Sealt leiad ka soovitused esmatutvuseks Pythoniga (praktikumi jaoks piisab kõige lihtsamatest Pythoni konstruktsioonidest ja cgi teegist, keerukamaid asju pole otseselt vaja):
* loe [http://docs.python.org/tutorial/ tutoriali] algust (keerulised andmestruktuurid, moodulite ja klasside värgi võid esialgu lugemata jätta)
* lisaks [http://docs.python.org/library/cgi.html cgi teegi õpetust].
* Hea mõte on paralleelselt teha lahti Pythoni interpretaator ja katsetada kõrvale asju otse Pythoni käsureal. Kui su masinas Pythonit pole, siis installeeri!
* Paljud kasulikud asjad on kirjas Pythoni [http://docs.python.org/library/index.html#library-index teegi dokumentatsioonis].
* [[Kasulikke pythoni näitejuppe cgi jaoks]]
* Konkreetsete küsimuste korral aitab tihti googeldamine.

; Serverirakendused PHP-s, näited

* Väikese ajaloolise ülevaate leiad [http://en.wikipedia.org/wiki/PHP wikipeediast]
* Põhiõpetus on [http://www.php.net/manual/en/ php oma saidil]: loe sealt kõigepealt [http://www.php.net/manual/en/tutorial.php sissejuhatavat tutoriali]
* [http://w3schools.com/php/default.asp W3school-si php tutorial] on samuti päris OK.

; SQL

Loe selles järjekorras:

* [http://web.njit.edu/~song/courses/is698/SQL_tutorials.ppt hea esimene sissejuhatus]
* [http://www.w3schools.com/sql/default.asp w3schools'i tutorial]
* [http://dev.mysql.com/doc/refman/5.0/en/tutorial.html mysql esmane tutorial] ja [http://dev.mysql.com/doc/refman/5.0/en/index.html mysql manuaal]

; SQL serverirakendustes

* Vaata [[lihtsaid php ja mysql näiteid]] loengust.
* [http://dmsa.concordia.ca/tutorial_files/shortsql.ppt mysql PHP-s: ppt]
* [http://www.tizag.com/mysqlTutorial/ mysql PHP-s: veebitutorial]
* [http://blogs.techrepublic.com.com/security/?p=2368 SQL injection] vt ka [http://lh6.ggpht.com/_5YF7KQZuZS0/S6dvFXu5OoI/AAAAAAAACWM/qTcVpMxcDnA/licence%20plate%20camera%20sql%20injection_2%5B3%5D.jpg?imgmax=800 seda] ja [http://www.schneier.com/blog/archives/2010/10/pen-and-paper_s.html seda] ja [http://alicebobandmallory.com/articles/2010/09/23/did-little-bobby-tables-migrate-to-sweden seda]
* [http://www.w3schools.com/php/default.asp w3schools PHP tutorial all vasakul Mysql blokk]
* [[Vorgurakendused 1 SQL naited loengust]]

; Sessioonid, cookied, sisselogimine, autentimine

Mõned lingid:

* basic authentication [http://en.wikipedia.org/wiki/Basic_access_authentication wikipedias], [http://httpd.apache.org/docs/2.0/howto/auth.html apache manuaalis] ja [[basic authentication näited]]
* cookie [http://en.wikipedia.org/wiki/HTTP_cookie wikipedias], php cookie handling [http://w3schools.com/PHP/php_cookies.asp w3schools-st] ja [http://www.php.net/manual/en/function.setcookie.php php manuaalist]
* [http://oreilly.com/catalog/webdbapps/chapter/ch08.html ok sessiooniõpetus]
* php sessioonihandling [http://w3schools.com/PHP/php_sessions.asp w3schools] ja siit [http://ee.php.net/manual/en/book.session.php php mahukas sessiooni-manuaal] ja siit [http://www.tizag.com/phpT/phpsessions.php eraldi tutorial]
* väike [http://www.secologic.org/downloads/web/051123_eurosec_course_material_on_web_application_session_management.ppt ok sessioonihalduse tutorial]
* [[autentimise näide php sessiooniga]]

; Ajax

* Loe seotud tehnoloogiatest: [http://en.wikipedia.org/wiki/Ajax_%28programming%29 wikipedia ajax], [http://en.wikipedia.org/wiki/XMLHttpRequest wikipedia xmlhttprequest], [http://en.wikipedia.org/wiki/JSON wikipedia json]
* [[xmlhttprequest ja jsonile rakendatud eval näited]]

== Vajalikud tööriistad ==

Oma arvutiga töö tegemiseks peab seal olema vähemalt

* [http://notepad-plus-plus.org/ Notepad++]
* [http://www.mozilla.com Mozilla Firefox]

== Lugemismaterjale ==

Üldist:

* [http://www.w3schools.com/ Mitu head tutoriali eri teemadel]
* [http://www.websitetips.com/ suur kogu häid tutoriale, artikleid ja soovitusi]
* Lisamaterjale kursusest [[Kasutajaliidesed võrgutehnoloogia baasil]]

HTML:

* [http://www.w3.org/MarkUp/Guide/ Raggetti tutorial algajatele]
* [http://akadeemia.kakupesa.net/arhiiv/VR1/loengud/loeng3 Kaido Kikkase hea eestikeelne sissejuhatus]
* [http://innar.li.ttu.ee/failid/VR_2006.pdf Innar Liivi hea eestikeelne sissejuhatus]
* [http://www.w3schools.com/html/ w3schools'i põhjalik html tutorial]
* [http://joshduck.com/periodic-table.html tore tagide nimistu]
* [http://www.w3.org/TR/html4/ HTML 4.01 ametlik standard]
* [http://www.w3.org/TR/html5/ HTML 5.0 ametlik draft]

HTML+CSS+Javascript:

* [http://www.w3.org/MarkUp/Guide/Style.html First CSS intro]
* [http://www.w3schools.com/css/ w3schools'i css tutorial]
* [http://www.w3schools.com/js/ w3schools'i javascripti tutorial]

* [http://www.alistapart.com/ A list apart]
* [http://css.maxdesign.com.au/listamatic/ listikasutus]

HTTP

* [http://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol http wikipedias]
* http://www.jmarshall.com/easy/http/
* [http://www.w3.org/Protocols/HTTP/AsImplemented.html T. Berners-Lee leiutatud esimene HTTP spec]
* [http://www.garshol.priv.no/download/text/http-tut.html hea väike HTTP ja CGI tutorial]
* [http://www.factini.com/c/httpViewer/ headerite jms vaatamise veebiabivahend]

CGI programmid serveris

* [http://www.jmarshall.com/easy/cgi/ lihtne sissejuhatus cgi-desse]
* [[Media:cgi.pdf|cgi.pdf: detailsem juhend]]
* [http://www.whizkidtech.redprince.net/cgi-bin/tutorial cgi esmane sissejuhatus Bashi näidetega]
* [http://www.cs.tut.fi/~jkorpela/forms/cgic.html cgi C keeles]
* [http://webpython.codepoint.net/cgi_tutorial cgi Pythonis]
* [http://www.yolinux.com/TUTORIALS/BashShellCgi.html cgi Bashis]
* [[Media:Itsissejuhatus_tiny.zip|Tiny www server]] ja [[lihtsaid cgi programminäiteid]]

PHP ja MySQL

* http://www.php.net/ sh http://www.php.net/tut.php või http://www.php.net/manual/en/tutorial.php
* http://www.mysql.org, alustuseks http://dev.mysql.com/doc/refman/5.1/en/tutorial.html

Veebiserverid:

* [[Media:Itsissejuhatus_tiny.zip|Tiny www server]] ja [[lihtsaid cgi programminäiteid]]
* http://www.devside.net/guides/windows/apache
* http://net.tutsplus.com/tutorials/php/how-to-setup-a-dedicated-web-server-for-free/
* http://www.yolinux.com/TUTORIALS/LinuxTutorialWebSiteConfig.html

[[Category:Kursus]]

Võrgurakendused I 2018

2011-08-31T10:47:56Z

Anttix: /* Aeg, koht, tulemus */

<table>
<tr>
<td>
[[Pilt:Engine.jpg|left|mootor]]
</td>
<td>
Ainekood: ITV0110 
Link: http://www.lambda.ee/index.php/V%C3%B5rgurakendused_I ehk http://www.lambda.ee/index/itv0110 
Punkte: 3.5 AP ehk 5 EAP 
Lektor: [http://tanel.tammet.googlepages.com Tanel Tammet] 
Kontakt: tammet@staff.ttu.ee, 6203457, TTÜ AK223 
olemas on ka [[Võrgurakendused_I 2010| 2010 aasta arhiiv]] koos kõigi eelmise aasta materjalidega. 
</td>
</tr>
</table>

== Aeg, koht, tulemus ==

Loenguid nädalas: 2 tundi (üks loeng) teisipäeviti 16:00-17:30 ruumis VII-131

Praktikume nädalas: 2 tundi (üks praktikum). Kui pole teisiti märgitud, toimuvad praktikumid:
* kolmapäeval 10:00-11:30 ruumides IT-213E, IT-213I rühmadele IABB37, IAPB37
* neljapäeval 08:00-09:30 ruumides IT-213D, IT-213H rühmadele IABB31, IABB32, IAPB31, IAPB32
* neljapäeval 14.00-15:30 ruumis IT-213D rühmale IAPB33



Kursus lõpeb hindelise arvestusega. Hinne sõltub kursuse jooksul tehtud praktikumide tulemustest (60%) pluss kursuse lõpus toimuva kontrolltöö tulemustest (40%).

NB! Esimese loengu annab Antti Andreimann: Tanel Tammet on konverentsil.

Küsimuste küsimiseks ja omavaheliseks suhtlemiseks on avatud kursuse "Üldfoorum" aadressil:

https://moodle.e-ope.ee/mod/forum/view.php?id=200854

== Kursuse eesmärk ==

Lihtsamate veebirakenduste põhimõtted ja nende kirjutamise oskus nii brauseri kui serveri poolel. Konkreetsemalt:
* html-i kirjutamise oskus, esmane tutvus CSS-i ja javascriptiga.
* serveripoolse rakenduse kirjutamise põhimõtted, cgi protokoll, erinevate keelte (sh C, php, python, java) kasutamise sissejuhatus serverirakendustes.
* lihtsamad SQLi kasutamise oskused.

Kursusel eeldatakse elementaarsete programmeerimisoskuste olemasolu. Kes programmeerimisega üldse kokku puutunud ei ole või seda paralleelselt ei õpi, ei suuda kursust läbida.

== Analoogilised kursused ==

TTÜ-s on sama kursust varem lugenud K. Kikkas (vt [http://akadeemia.kakupesa.net/arhiiv/VR1/loengud/ loengumaterjale]) ja I. Liiv (vt [http://innar.li.ttu.ee/index.php?option=displaypage&Itemid=55&op=page&SubMenu= praksimaterjale]), ITK-s luges analoogilist kursust esialgu T. Tammet (vt vanu [http://deepthought.ttu.ee/it/vorgutarkvara/wav3080/ materjale]), praegusajal loeb A. Andreimann (vt vabalt kättesaadavaid [http://enos.itcollege.ee/~aandreim/vr1/latest/ materjale]).

== Praktilised tööd ==

Praktilisi töid juhendavad esialgu Tanel ja Antti, hiljem võib lisanduda veel juhendajaid.

Kursusel on neli kohustuslikku praktilist ẗööd. Iga töö annab 0-15 punkti. Hilinenud tööd annavad poole punktidest. Töid võib (ja on soovitav) esitada enne tähtaega.

Kõik tööd tuleb esitada ise TTÜ arvutiklassis: emailiga saadetud töid ei arvestata. Kasutada võib nii klassi arvuteid kui oma arvutit, brauser ja operatsioonisüsteem on vabalt valitavad. Serverirakenduste tööde jaoks on võimalik kasutada ülikooli serverit, soovi korral ka oma serverit.

* [[ITV0110 1. töö: Html põhioskused|Html põhioskused]]. Tähtaeg neljapäev, 15. september.

NB! Järgmised tööd on näited aastast 2010, praegusel kursusel tehakse neis muutusi, kuid üldjoontes jäävad ülesanded sarnaseks. Tähtajad on juba uued, 2011 aasta jaoks.

* [[ITV0110 2. töö: CSS, javascript, veebiserver| CSS, javascript, veebiserver]]. Tähtaeg neljapäev, 13. oktoober.
* [[ITV0110 3. töö: Lihtne serverirakendus: vormid ja cgi|Lihtne serverirakendus: vormid ja cgi]]. Tähtaeg neljapäev, 17. november.
* [[ITV0110 4. töö: Andmebaasiga serverakendus|Andmebaasiga serverakendus]]. Sisuks on väga lihtsakoelise "mini-facebooki" ehitamine. Programmeerimiskeeleks on PHP ja andmebaasiks mysql või postgresql. Tähtaeg neljapäev, 15. detsember.

Kursuse edukaks läbimiseks peavad kõik praktilised tööd olema tehtud.

== Loengute plaan ja materjalid ==

Alltoodud teemad kaetakse igaüks ühe-kahe loenguga. Suur osa loengutest on pühendatud näidete läbitegemisele ning seletamisele, ette-programmeerimisele ja praktikumide osalisele realiseerimisele.

; Sissejuhatus ja meeldetuletus

Tutvuda lühidalt:
:* Interneti baastehnoloogia IT sissejuhatusest: [[Media:Itsissejuhatus10o08.ppt|Itsissejuhatus10o08.ppt]], [[Media:Itsissejuhatus10o08.pdf|Itsissejuhatus10o08.pdf]].
:* [http://www.w3.org/MarkUp/Guide/ Raggetti mikrotutorial algajatele]
:* head eestikeelsed sissejuhatused [http://innar.li.ttu.ee/failid/VR_2006.pdf Innar Liivilt (pdf)] ja [http://akadeemia.kakupesa.net/arhiiv/VR1/loengud/loeng3 Kaido Kikkaselt (html)]
:* http://www.w3schools.com/.
:* http://www.w3c.org/.

; HTML põhioskused

Lugeda ja proovida läbi (st vaja põhimõtted selgeks õppida):
:* [http://www.w3schools.com/html/default.asp w3schools html tutorial basic blokk].
Loe lisaks läbi ka
:* [http://www.w3.org/MarkUp/Guide/Advanced.html Raggetti klassikaline tutorial, eeskätt tabelid]
:* [http://innar.li.ttu.ee/failid/VR_2006.pdf Innar Liivi sissejuhatus, eeskätt värvid ja pildid]
:* [http://www.w3.org/TR/html401/struct/tables.html täiendavat tabelitest ametlikust standardist]
Tutvu lisaks kasuliku tagide nimistuga:
:* [http://joshduck.com/periodic-table.html htmli elementide perioodiline tabel]

; CSS põhioskused

Lugeda ja proovida läbi (st vaja põhimõtted selgeks õppida):
* [http://www.w3.org/MarkUp/Guide/Style.html First CSS intro]
* [http://www.w3schools.com/css/ w3schools'i css tutorial]: : kindlasti "basic" ja "styling" blokid, huvi korral loe edasi ("box model", "advanced) ka, kuid need viimased ei ole kohustuslikud.
Tutvu lisaks listide+CSS-i kasutamisega menüüde jms jaoks:
* [http://css.maxdesign.com.au/listamatic/ listikasutus] ja sealtsamast [http://css.maxdesign.com.au/listutorial/index.htm listikasutuse tutorialid]

; Javascript põhioskused

Kaks loengut: (a) sissejuhatus (b) reaalne kasutamine brauseris (html ja css muutmine, evendid jne)

Vaata soenduseks/demoks [http://www.chromeexperiments.com/ Google kogutud näiteid].

Seejärel loe läbi ja proovi järgi selles järjekorras:
* [http://en.wikipedia.org/wiki/JavaScript Wikipedia javascripti üldartikkel]: ülevaade, ajalugu jne. Keelt siit ei õpi!
* [http://www.w3schools.com/js/default.asp W3schools javascripti sissejuhatus]: JS Basic ja JS Objects osad. Mõned asjad jäävad siin veidi ebaselgeks!
* [http://en.wikipedia.org/wiki/JavaScript_syntax Wikipedia Javascripti keele kiirõpetus]: loe ja proovi paralleelselt w3schools-ga. Siit saab mõned asjad selgemaks kui ainult w3schoolsist.

NB! Selle tulemusena on sul baasettekujutus javascripti keelest, aga mitte reaalsest kasutusest (seda vaatame järgmises loengus).

Javascripti kasutamine brauseris: alustuseks on hea vaadata põhjalikku näidete loetelu

* [http://www.w3schools.com/js/js_ex_dom.asp html dom objektid]: põhiasjad
* [http://www.tizag.com/javascriptT/javascriptform.php form validation]: klassikaline rakendus
* [http://www.w3schools.com/js/js_ex_browser.asp brauseriobjektid]: vahel kah kasulikud

ja tingimata lugeda sinna juurde teegijuhendeid:

* [http://www.w3schools.com/jsref/dom_obj_all.asp html dom ülevaadet]
* [http://www.w3schools.com/jsref/dom_obj_event.asp html events ülevaadet]
* [http://www.w3schools.com/jsref/dom_obj_style.asp style lugemine/muutmine js-s: hädavajalik reference]

; Praktilist teisest praktikumist

Kuidas ja kuhu faile serverisse üles laadida jms: loe [[ITV0110 2. töö: CSS, javascript, veebiserver| teise praktikumi materjalidest]]

; Cgi töötlemine eri keeltes (C, python, bash, java, ...)

Kõigepealt loe ja proovi tingimata ise läbi teha: [[pythoni cgi-d dijkstra serveris: kiire sissejuhatus]]

Tutvu linuxi shelli elementaarsete käskudega [http://www.tuxfiles.org/linuxhelp/linuxcommands.html sellest lühiõpetusest] ja täiendavalt [http://info.ee.surrey.ac.uk/Teaching/Unix/ selle tutoriali] peatükkidest üks kuni viis. Iga käsu juures on abiks man, näiteks <tt>man ls</tt>. Huvi korral googelda lisaks.

Seejärel loe neid materjale CGI protokollist ja CGI programmidest serveris:

* [http://www.jmarshall.com/easy/cgi/ lihtne sissejuhatus cgi-desse]
* [[Media:cgi.pdf|cgi.pdf: detailsem juhend]]
* [http://www.cs.tut.fi/~jkorpela/forms/cgic.html cgi C keeles]
* [http://webpython.codepoint.net/cgi_tutorial cgi Pythonis]
* [http://www.yolinux.com/TUTORIALS/BashShellCgi.html cgi Bashis]

ning siis vaata lisaks loengus tehtud/proovitud [[lihtsaid cgi programminäiteid]] eri keeltes.

Cgi jaoks on olemas ka nö [http://www.rfc-editor.org/rfc/rfc3875.txt rfc-standard], mille lugemine on aga pisut vaevarikas (nagu enamikel standarditel) ja üldjuhul on praktilisem lugeda hoopis ülaltoodud õpetusi ja vaadata
näiteid.

; Veebiserveri ehitusest ja konfigureerimisest

Kõigepealt tutvu või tuleta meelde http protokolli põhimõtteid:

* [http://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol http wikipedias]
* [http://www.jmarshall.com/easy/http/ veel http-st]
* [http://www.factini.com/c/httpViewer/ headerite jms vaatamise veebiabivahend]

Veebiserverist paremaks arusaamiseks tasub veidi eksperimenteerida [[Media:Itsissejuhatus_tiny.zip|pisikese veebiserveriga]].

Enimkasutatav veebiserver Apache:

* [http://httpd.apache.org/ apache oma koduleht]
* [http://en.wikipedia.org/wiki/Apache_HTTP_Server wikipedia apachest]
* [http://news.netcraft.com/archives/category/web-server-survey/ veebiserverite kasutusstatistikat]

Apache konfigureerimisest:

* [http://www.jlk.net/apache/beginners.shtml sissejuhatus algajatele]
* [http://httpd.apache.org/docs/2.2/ ametlik juhend]

; Python ja näiteid kasutamisest serverirakendustes

Tutvumine kolmanda praktikumiga: [[ITV0110 3. töö: Lihtne serverirakendus: vormid ja cgi|vormid ja cgi]]. Praksi jaoks vajaliku koodi kirjutamise harjutamine (loengus etteprogrammeerimine).

Sealt leiad ka soovitused esmatutvuseks Pythoniga (praktikumi jaoks piisab kõige lihtsamatest Pythoni konstruktsioonidest ja cgi teegist, keerukamaid asju pole otseselt vaja):
* loe [http://docs.python.org/tutorial/ tutoriali] algust (keerulised andmestruktuurid, moodulite ja klasside värgi võid esialgu lugemata jätta)
* lisaks [http://docs.python.org/library/cgi.html cgi teegi õpetust].
* Hea mõte on paralleelselt teha lahti Pythoni interpretaator ja katsetada kõrvale asju otse Pythoni käsureal. Kui su masinas Pythonit pole, siis installeeri!
* Paljud kasulikud asjad on kirjas Pythoni [http://docs.python.org/library/index.html#library-index teegi dokumentatsioonis].
* [[Kasulikke pythoni näitejuppe cgi jaoks]]
* Konkreetsete küsimuste korral aitab tihti googeldamine.

; Serverirakendused PHP-s, näited

* Väikese ajaloolise ülevaate leiad [http://en.wikipedia.org/wiki/PHP wikipeediast]
* Põhiõpetus on [http://www.php.net/manual/en/ php oma saidil]: loe sealt kõigepealt [http://www.php.net/manual/en/tutorial.php sissejuhatavat tutoriali]
* [http://w3schools.com/php/default.asp W3school-si php tutorial] on samuti päris OK.

; SQL

Loe selles järjekorras:

* [http://web.njit.edu/~song/courses/is698/SQL_tutorials.ppt hea esimene sissejuhatus]
* [http://www.w3schools.com/sql/default.asp w3schools'i tutorial]
* [http://dev.mysql.com/doc/refman/5.0/en/tutorial.html mysql esmane tutorial] ja [http://dev.mysql.com/doc/refman/5.0/en/index.html mysql manuaal]

; SQL serverirakendustes

* Vaata [[lihtsaid php ja mysql näiteid]] loengust.
* [http://dmsa.concordia.ca/tutorial_files/shortsql.ppt mysql PHP-s: ppt]
* [http://www.tizag.com/mysqlTutorial/ mysql PHP-s: veebitutorial]
* [http://blogs.techrepublic.com.com/security/?p=2368 SQL injection] vt ka [http://lh6.ggpht.com/_5YF7KQZuZS0/S6dvFXu5OoI/AAAAAAAACWM/qTcVpMxcDnA/licence%20plate%20camera%20sql%20injection_2%5B3%5D.jpg?imgmax=800 seda] ja [http://www.schneier.com/blog/archives/2010/10/pen-and-paper_s.html seda] ja [http://alicebobandmallory.com/articles/2010/09/23/did-little-bobby-tables-migrate-to-sweden seda]
* [http://www.w3schools.com/php/default.asp w3schools PHP tutorial all vasakul Mysql blokk]
* [[Vorgurakendused 1 SQL naited loengust]]

; Sessioonid, cookied, sisselogimine, autentimine

Mõned lingid:

* basic authentication [http://en.wikipedia.org/wiki/Basic_access_authentication wikipedias], [http://httpd.apache.org/docs/2.0/howto/auth.html apache manuaalis] ja [[basic authentication näited]]
* cookie [http://en.wikipedia.org/wiki/HTTP_cookie wikipedias], php cookie handling [http://w3schools.com/PHP/php_cookies.asp w3schools-st] ja [http://www.php.net/manual/en/function.setcookie.php php manuaalist]
* [http://oreilly.com/catalog/webdbapps/chapter/ch08.html ok sessiooniõpetus]
* php sessioonihandling [http://w3schools.com/PHP/php_sessions.asp w3schools] ja siit [http://ee.php.net/manual/en/book.session.php php mahukas sessiooni-manuaal] ja siit [http://www.tizag.com/phpT/phpsessions.php eraldi tutorial]
* väike [http://www.secologic.org/downloads/web/051123_eurosec_course_material_on_web_application_session_management.ppt ok sessioonihalduse tutorial]
* [[autentimise näide php sessiooniga]]

; Ajax

* Loe seotud tehnoloogiatest: [http://en.wikipedia.org/wiki/Ajax_%28programming%29 wikipedia ajax], [http://en.wikipedia.org/wiki/XMLHttpRequest wikipedia xmlhttprequest], [http://en.wikipedia.org/wiki/JSON wikipedia json]
* [[xmlhttprequest ja jsonile rakendatud eval näited]]

== Vajalikud tööriistad ==

Oma arvutiga töö tegemiseks peab seal olema vähemalt

* [http://notepad-plus-plus.org/ Notepad++]
* [http://www.mozilla.com Mozilla Firefox]

== Lugemismaterjale ==

Üldist:

* [http://www.w3schools.com/ Mitu head tutoriali eri teemadel]
* [http://www.websitetips.com/ suur kogu häid tutoriale, artikleid ja soovitusi]
* Lisamaterjale kursusest [[Kasutajaliidesed võrgutehnoloogia baasil]]

HTML:

* [http://www.w3.org/MarkUp/Guide/ Raggetti tutorial algajatele]
* [http://akadeemia.kakupesa.net/arhiiv/VR1/loengud/loeng3 Kaido Kikkase hea eestikeelne sissejuhatus]
* [http://innar.li.ttu.ee/failid/VR_2006.pdf Innar Liivi hea eestikeelne sissejuhatus]
* [http://www.w3schools.com/html/ w3schools'i põhjalik html tutorial]
* [http://joshduck.com/periodic-table.html tore tagide nimistu]
* [http://www.w3.org/TR/html4/ HTML 4.01 ametlik standard]
* [http://www.w3.org/TR/html5/ HTML 5.0 ametlik draft]

HTML+CSS+Javascript:

* [http://www.w3.org/MarkUp/Guide/Style.html First CSS intro]
* [http://www.w3schools.com/css/ w3schools'i css tutorial]
* [http://www.w3schools.com/js/ w3schools'i javascripti tutorial]

* [http://www.alistapart.com/ A list apart]
* [http://css.maxdesign.com.au/listamatic/ listikasutus]

HTTP

* [http://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol http wikipedias]
* http://www.jmarshall.com/easy/http/
* [http://www.w3.org/Protocols/HTTP/AsImplemented.html T. Berners-Lee leiutatud esimene HTTP spec]
* [http://www.garshol.priv.no/download/text/http-tut.html hea väike HTTP ja CGI tutorial]
* [http://www.factini.com/c/httpViewer/ headerite jms vaatamise veebiabivahend]

CGI programmid serveris

* [http://www.jmarshall.com/easy/cgi/ lihtne sissejuhatus cgi-desse]
* [[Media:cgi.pdf|cgi.pdf: detailsem juhend]]
* [http://www.whizkidtech.redprince.net/cgi-bin/tutorial cgi esmane sissejuhatus Bashi näidetega]
* [http://www.cs.tut.fi/~jkorpela/forms/cgic.html cgi C keeles]
* [http://webpython.codepoint.net/cgi_tutorial cgi Pythonis]
* [http://www.yolinux.com/TUTORIALS/BashShellCgi.html cgi Bashis]
* [[Media:Itsissejuhatus_tiny.zip|Tiny www server]] ja [[lihtsaid cgi programminäiteid]]

PHP ja MySQL

* http://www.php.net/ sh http://www.php.net/tut.php või http://www.php.net/manual/en/tutorial.php
* http://www.mysql.org, alustuseks http://dev.mysql.com/doc/refman/5.1/en/tutorial.html

Veebiserverid:

* [[Media:Itsissejuhatus_tiny.zip|Tiny www server]] ja [[lihtsaid cgi programminäiteid]]
* http://www.devside.net/guides/windows/apache
* http://net.tutsplus.com/tutorials/php/how-to-setup-a-dedicated-web-server-for-free/
* http://www.yolinux.com/TUTORIALS/LinuxTutorialWebSiteConfig.html

[[Category:Kursus]]

Võrgurakendused I 2018

2011-08-31T10:47:44Z

Anttix: /* Aeg, koht, tulemus */

<table>
<tr>
<td>
[[Pilt:Engine.jpg|left|mootor]]
</td>
<td>
Ainekood: ITV0110 
Link: http://www.lambda.ee/index.php/V%C3%B5rgurakendused_I ehk http://www.lambda.ee/index/itv0110 
Punkte: 3.5 AP ehk 5 EAP 
Lektor: [http://tanel.tammet.googlepages.com Tanel Tammet] 
Kontakt: tammet@staff.ttu.ee, 6203457, TTÜ AK223 
olemas on ka [[Võrgurakendused_I 2010| 2010 aasta arhiiv]] koos kõigi eelmise aasta materjalidega. 
</td>
</tr>
</table>

== Aeg, koht, tulemus ==

Loenguid nädalas: 2 tundi (üks loeng) teisipäeviti 16:00-17:30 ruumis VII-131

Praktikume nädalas: 2 tundi (üks praktikum). Kui pole teisiti märgitud, toimuvad praktikumid:
* kolmapäeval 10:00-11:30 ruumides IT-213E, IT-213I rühmadele IABB37, IAPB37
* neljapäeval 08:00-09:30 ruumides IT-213D, IT-213H rühmadele IABB31, IABB32, IAPB31, IAPB32
* neljapäeval 14.00-15:30 ruumis IT-213D rühmale IAPB33



Kursus lõpeb hindelise arvestusega. Hinne sõltub kursuse jooksul tehtud praktikumide tulemustest (60%) pluss kursuse lõpus toimuva kontrolltöö tulemustest (40%).

NB! Esimese loengu annab Antti Andreimann: Tanel Tammet on konverentsil.

Küsimuste küsimiseks ja omavaheliseks suhtlemiseks on avatud kursuse "Üldfoorum" aadressil:
https://moodle.e-ope.ee/mod/forum/view.php?id=200854

== Kursuse eesmärk ==

Lihtsamate veebirakenduste põhimõtted ja nende kirjutamise oskus nii brauseri kui serveri poolel. Konkreetsemalt:
* html-i kirjutamise oskus, esmane tutvus CSS-i ja javascriptiga.
* serveripoolse rakenduse kirjutamise põhimõtted, cgi protokoll, erinevate keelte (sh C, php, python, java) kasutamise sissejuhatus serverirakendustes.
* lihtsamad SQLi kasutamise oskused.

Kursusel eeldatakse elementaarsete programmeerimisoskuste olemasolu. Kes programmeerimisega üldse kokku puutunud ei ole või seda paralleelselt ei õpi, ei suuda kursust läbida.

== Analoogilised kursused ==

TTÜ-s on sama kursust varem lugenud K. Kikkas (vt [http://akadeemia.kakupesa.net/arhiiv/VR1/loengud/ loengumaterjale]) ja I. Liiv (vt [http://innar.li.ttu.ee/index.php?option=displaypage&Itemid=55&op=page&SubMenu= praksimaterjale]), ITK-s luges analoogilist kursust esialgu T. Tammet (vt vanu [http://deepthought.ttu.ee/it/vorgutarkvara/wav3080/ materjale]), praegusajal loeb A. Andreimann (vt vabalt kättesaadavaid [http://enos.itcollege.ee/~aandreim/vr1/latest/ materjale]).

== Praktilised tööd ==

Praktilisi töid juhendavad esialgu Tanel ja Antti, hiljem võib lisanduda veel juhendajaid.

Kursusel on neli kohustuslikku praktilist ẗööd. Iga töö annab 0-15 punkti. Hilinenud tööd annavad poole punktidest. Töid võib (ja on soovitav) esitada enne tähtaega.

Kõik tööd tuleb esitada ise TTÜ arvutiklassis: emailiga saadetud töid ei arvestata. Kasutada võib nii klassi arvuteid kui oma arvutit, brauser ja operatsioonisüsteem on vabalt valitavad. Serverirakenduste tööde jaoks on võimalik kasutada ülikooli serverit, soovi korral ka oma serverit.

* [[ITV0110 1. töö: Html põhioskused|Html põhioskused]]. Tähtaeg neljapäev, 15. september.

NB! Järgmised tööd on näited aastast 2010, praegusel kursusel tehakse neis muutusi, kuid üldjoontes jäävad ülesanded sarnaseks. Tähtajad on juba uued, 2011 aasta jaoks.

* [[ITV0110 2. töö: CSS, javascript, veebiserver| CSS, javascript, veebiserver]]. Tähtaeg neljapäev, 13. oktoober.
* [[ITV0110 3. töö: Lihtne serverirakendus: vormid ja cgi|Lihtne serverirakendus: vormid ja cgi]]. Tähtaeg neljapäev, 17. november.
* [[ITV0110 4. töö: Andmebaasiga serverakendus|Andmebaasiga serverakendus]]. Sisuks on väga lihtsakoelise "mini-facebooki" ehitamine. Programmeerimiskeeleks on PHP ja andmebaasiks mysql või postgresql. Tähtaeg neljapäev, 15. detsember.

Kursuse edukaks läbimiseks peavad kõik praktilised tööd olema tehtud.

== Loengute plaan ja materjalid ==

Alltoodud teemad kaetakse igaüks ühe-kahe loenguga. Suur osa loengutest on pühendatud näidete läbitegemisele ning seletamisele, ette-programmeerimisele ja praktikumide osalisele realiseerimisele.

; Sissejuhatus ja meeldetuletus

Tutvuda lühidalt:
:* Interneti baastehnoloogia IT sissejuhatusest: [[Media:Itsissejuhatus10o08.ppt|Itsissejuhatus10o08.ppt]], [[Media:Itsissejuhatus10o08.pdf|Itsissejuhatus10o08.pdf]].
:* [http://www.w3.org/MarkUp/Guide/ Raggetti mikrotutorial algajatele]
:* head eestikeelsed sissejuhatused [http://innar.li.ttu.ee/failid/VR_2006.pdf Innar Liivilt (pdf)] ja [http://akadeemia.kakupesa.net/arhiiv/VR1/loengud/loeng3 Kaido Kikkaselt (html)]
:* http://www.w3schools.com/.
:* http://www.w3c.org/.

; HTML põhioskused

Lugeda ja proovida läbi (st vaja põhimõtted selgeks õppida):
:* [http://www.w3schools.com/html/default.asp w3schools html tutorial basic blokk].
Loe lisaks läbi ka
:* [http://www.w3.org/MarkUp/Guide/Advanced.html Raggetti klassikaline tutorial, eeskätt tabelid]
:* [http://innar.li.ttu.ee/failid/VR_2006.pdf Innar Liivi sissejuhatus, eeskätt värvid ja pildid]
:* [http://www.w3.org/TR/html401/struct/tables.html täiendavat tabelitest ametlikust standardist]
Tutvu lisaks kasuliku tagide nimistuga:
:* [http://joshduck.com/periodic-table.html htmli elementide perioodiline tabel]

; CSS põhioskused

Lugeda ja proovida läbi (st vaja põhimõtted selgeks õppida):
* [http://www.w3.org/MarkUp/Guide/Style.html First CSS intro]
* [http://www.w3schools.com/css/ w3schools'i css tutorial]: : kindlasti "basic" ja "styling" blokid, huvi korral loe edasi ("box model", "advanced) ka, kuid need viimased ei ole kohustuslikud.
Tutvu lisaks listide+CSS-i kasutamisega menüüde jms jaoks:
* [http://css.maxdesign.com.au/listamatic/ listikasutus] ja sealtsamast [http://css.maxdesign.com.au/listutorial/index.htm listikasutuse tutorialid]

; Javascript põhioskused

Kaks loengut: (a) sissejuhatus (b) reaalne kasutamine brauseris (html ja css muutmine, evendid jne)

Vaata soenduseks/demoks [http://www.chromeexperiments.com/ Google kogutud näiteid].

Seejärel loe läbi ja proovi järgi selles järjekorras:
* [http://en.wikipedia.org/wiki/JavaScript Wikipedia javascripti üldartikkel]: ülevaade, ajalugu jne. Keelt siit ei õpi!
* [http://www.w3schools.com/js/default.asp W3schools javascripti sissejuhatus]: JS Basic ja JS Objects osad. Mõned asjad jäävad siin veidi ebaselgeks!
* [http://en.wikipedia.org/wiki/JavaScript_syntax Wikipedia Javascripti keele kiirõpetus]: loe ja proovi paralleelselt w3schools-ga. Siit saab mõned asjad selgemaks kui ainult w3schoolsist.

NB! Selle tulemusena on sul baasettekujutus javascripti keelest, aga mitte reaalsest kasutusest (seda vaatame järgmises loengus).

Javascripti kasutamine brauseris: alustuseks on hea vaadata põhjalikku näidete loetelu

* [http://www.w3schools.com/js/js_ex_dom.asp html dom objektid]: põhiasjad
* [http://www.tizag.com/javascriptT/javascriptform.php form validation]: klassikaline rakendus
* [http://www.w3schools.com/js/js_ex_browser.asp brauseriobjektid]: vahel kah kasulikud

ja tingimata lugeda sinna juurde teegijuhendeid:

* [http://www.w3schools.com/jsref/dom_obj_all.asp html dom ülevaadet]
* [http://www.w3schools.com/jsref/dom_obj_event.asp html events ülevaadet]
* [http://www.w3schools.com/jsref/dom_obj_style.asp style lugemine/muutmine js-s: hädavajalik reference]

; Praktilist teisest praktikumist

Kuidas ja kuhu faile serverisse üles laadida jms: loe [[ITV0110 2. töö: CSS, javascript, veebiserver| teise praktikumi materjalidest]]

; Cgi töötlemine eri keeltes (C, python, bash, java, ...)

Kõigepealt loe ja proovi tingimata ise läbi teha: [[pythoni cgi-d dijkstra serveris: kiire sissejuhatus]]

Tutvu linuxi shelli elementaarsete käskudega [http://www.tuxfiles.org/linuxhelp/linuxcommands.html sellest lühiõpetusest] ja täiendavalt [http://info.ee.surrey.ac.uk/Teaching/Unix/ selle tutoriali] peatükkidest üks kuni viis. Iga käsu juures on abiks man, näiteks <tt>man ls</tt>. Huvi korral googelda lisaks.

Seejärel loe neid materjale CGI protokollist ja CGI programmidest serveris:

* [http://www.jmarshall.com/easy/cgi/ lihtne sissejuhatus cgi-desse]
* [[Media:cgi.pdf|cgi.pdf: detailsem juhend]]
* [http://www.cs.tut.fi/~jkorpela/forms/cgic.html cgi C keeles]
* [http://webpython.codepoint.net/cgi_tutorial cgi Pythonis]
* [http://www.yolinux.com/TUTORIALS/BashShellCgi.html cgi Bashis]

ning siis vaata lisaks loengus tehtud/proovitud [[lihtsaid cgi programminäiteid]] eri keeltes.

Cgi jaoks on olemas ka nö [http://www.rfc-editor.org/rfc/rfc3875.txt rfc-standard], mille lugemine on aga pisut vaevarikas (nagu enamikel standarditel) ja üldjuhul on praktilisem lugeda hoopis ülaltoodud õpetusi ja vaadata
näiteid.

; Veebiserveri ehitusest ja konfigureerimisest

Kõigepealt tutvu või tuleta meelde http protokolli põhimõtteid:

* [http://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol http wikipedias]
* [http://www.jmarshall.com/easy/http/ veel http-st]
* [http://www.factini.com/c/httpViewer/ headerite jms vaatamise veebiabivahend]

Veebiserverist paremaks arusaamiseks tasub veidi eksperimenteerida [[Media:Itsissejuhatus_tiny.zip|pisikese veebiserveriga]].

Enimkasutatav veebiserver Apache:

* [http://httpd.apache.org/ apache oma koduleht]
* [http://en.wikipedia.org/wiki/Apache_HTTP_Server wikipedia apachest]
* [http://news.netcraft.com/archives/category/web-server-survey/ veebiserverite kasutusstatistikat]

Apache konfigureerimisest:

* [http://www.jlk.net/apache/beginners.shtml sissejuhatus algajatele]
* [http://httpd.apache.org/docs/2.2/ ametlik juhend]

; Python ja näiteid kasutamisest serverirakendustes

Tutvumine kolmanda praktikumiga: [[ITV0110 3. töö: Lihtne serverirakendus: vormid ja cgi|vormid ja cgi]]. Praksi jaoks vajaliku koodi kirjutamise harjutamine (loengus etteprogrammeerimine).

Sealt leiad ka soovitused esmatutvuseks Pythoniga (praktikumi jaoks piisab kõige lihtsamatest Pythoni konstruktsioonidest ja cgi teegist, keerukamaid asju pole otseselt vaja):
* loe [http://docs.python.org/tutorial/ tutoriali] algust (keerulised andmestruktuurid, moodulite ja klasside värgi võid esialgu lugemata jätta)
* lisaks [http://docs.python.org/library/cgi.html cgi teegi õpetust].
* Hea mõte on paralleelselt teha lahti Pythoni interpretaator ja katsetada kõrvale asju otse Pythoni käsureal. Kui su masinas Pythonit pole, siis installeeri!
* Paljud kasulikud asjad on kirjas Pythoni [http://docs.python.org/library/index.html#library-index teegi dokumentatsioonis].
* [[Kasulikke pythoni näitejuppe cgi jaoks]]
* Konkreetsete küsimuste korral aitab tihti googeldamine.

; Serverirakendused PHP-s, näited

* Väikese ajaloolise ülevaate leiad [http://en.wikipedia.org/wiki/PHP wikipeediast]
* Põhiõpetus on [http://www.php.net/manual/en/ php oma saidil]: loe sealt kõigepealt [http://www.php.net/manual/en/tutorial.php sissejuhatavat tutoriali]
* [http://w3schools.com/php/default.asp W3school-si php tutorial] on samuti päris OK.

; SQL

Loe selles järjekorras:

* [http://web.njit.edu/~song/courses/is698/SQL_tutorials.ppt hea esimene sissejuhatus]
* [http://www.w3schools.com/sql/default.asp w3schools'i tutorial]
* [http://dev.mysql.com/doc/refman/5.0/en/tutorial.html mysql esmane tutorial] ja [http://dev.mysql.com/doc/refman/5.0/en/index.html mysql manuaal]

; SQL serverirakendustes

* Vaata [[lihtsaid php ja mysql näiteid]] loengust.
* [http://dmsa.concordia.ca/tutorial_files/shortsql.ppt mysql PHP-s: ppt]
* [http://www.tizag.com/mysqlTutorial/ mysql PHP-s: veebitutorial]
* [http://blogs.techrepublic.com.com/security/?p=2368 SQL injection] vt ka [http://lh6.ggpht.com/_5YF7KQZuZS0/S6dvFXu5OoI/AAAAAAAACWM/qTcVpMxcDnA/licence%20plate%20camera%20sql%20injection_2%5B3%5D.jpg?imgmax=800 seda] ja [http://www.schneier.com/blog/archives/2010/10/pen-and-paper_s.html seda] ja [http://alicebobandmallory.com/articles/2010/09/23/did-little-bobby-tables-migrate-to-sweden seda]
* [http://www.w3schools.com/php/default.asp w3schools PHP tutorial all vasakul Mysql blokk]
* [[Vorgurakendused 1 SQL naited loengust]]

; Sessioonid, cookied, sisselogimine, autentimine

Mõned lingid:

* basic authentication [http://en.wikipedia.org/wiki/Basic_access_authentication wikipedias], [http://httpd.apache.org/docs/2.0/howto/auth.html apache manuaalis] ja [[basic authentication näited]]
* cookie [http://en.wikipedia.org/wiki/HTTP_cookie wikipedias], php cookie handling [http://w3schools.com/PHP/php_cookies.asp w3schools-st] ja [http://www.php.net/manual/en/function.setcookie.php php manuaalist]
* [http://oreilly.com/catalog/webdbapps/chapter/ch08.html ok sessiooniõpetus]
* php sessioonihandling [http://w3schools.com/PHP/php_sessions.asp w3schools] ja siit [http://ee.php.net/manual/en/book.session.php php mahukas sessiooni-manuaal] ja siit [http://www.tizag.com/phpT/phpsessions.php eraldi tutorial]
* väike [http://www.secologic.org/downloads/web/051123_eurosec_course_material_on_web_application_session_management.ppt ok sessioonihalduse tutorial]
* [[autentimise näide php sessiooniga]]

; Ajax

* Loe seotud tehnoloogiatest: [http://en.wikipedia.org/wiki/Ajax_%28programming%29 wikipedia ajax], [http://en.wikipedia.org/wiki/XMLHttpRequest wikipedia xmlhttprequest], [http://en.wikipedia.org/wiki/JSON wikipedia json]
* [[xmlhttprequest ja jsonile rakendatud eval näited]]

== Vajalikud tööriistad ==

Oma arvutiga töö tegemiseks peab seal olema vähemalt

* [http://notepad-plus-plus.org/ Notepad++]
* [http://www.mozilla.com Mozilla Firefox]

== Lugemismaterjale ==

Üldist:

* [http://www.w3schools.com/ Mitu head tutoriali eri teemadel]
* [http://www.websitetips.com/ suur kogu häid tutoriale, artikleid ja soovitusi]
* Lisamaterjale kursusest [[Kasutajaliidesed võrgutehnoloogia baasil]]

HTML:

* [http://www.w3.org/MarkUp/Guide/ Raggetti tutorial algajatele]
* [http://akadeemia.kakupesa.net/arhiiv/VR1/loengud/loeng3 Kaido Kikkase hea eestikeelne sissejuhatus]
* [http://innar.li.ttu.ee/failid/VR_2006.pdf Innar Liivi hea eestikeelne sissejuhatus]
* [http://www.w3schools.com/html/ w3schools'i põhjalik html tutorial]
* [http://joshduck.com/periodic-table.html tore tagide nimistu]
* [http://www.w3.org/TR/html4/ HTML 4.01 ametlik standard]
* [http://www.w3.org/TR/html5/ HTML 5.0 ametlik draft]

HTML+CSS+Javascript:

* [http://www.w3.org/MarkUp/Guide/Style.html First CSS intro]
* [http://www.w3schools.com/css/ w3schools'i css tutorial]
* [http://www.w3schools.com/js/ w3schools'i javascripti tutorial]

* [http://www.alistapart.com/ A list apart]
* [http://css.maxdesign.com.au/listamatic/ listikasutus]

HTTP

* [http://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol http wikipedias]
* http://www.jmarshall.com/easy/http/
* [http://www.w3.org/Protocols/HTTP/AsImplemented.html T. Berners-Lee leiutatud esimene HTTP spec]
* [http://www.garshol.priv.no/download/text/http-tut.html hea väike HTTP ja CGI tutorial]
* [http://www.factini.com/c/httpViewer/ headerite jms vaatamise veebiabivahend]

CGI programmid serveris

* [http://www.jmarshall.com/easy/cgi/ lihtne sissejuhatus cgi-desse]
* [[Media:cgi.pdf|cgi.pdf: detailsem juhend]]
* [http://www.whizkidtech.redprince.net/cgi-bin/tutorial cgi esmane sissejuhatus Bashi näidetega]
* [http://www.cs.tut.fi/~jkorpela/forms/cgic.html cgi C keeles]
* [http://webpython.codepoint.net/cgi_tutorial cgi Pythonis]
* [http://www.yolinux.com/TUTORIALS/BashShellCgi.html cgi Bashis]
* [[Media:Itsissejuhatus_tiny.zip|Tiny www server]] ja [[lihtsaid cgi programminäiteid]]

PHP ja MySQL

* http://www.php.net/ sh http://www.php.net/tut.php või http://www.php.net/manual/en/tutorial.php
* http://www.mysql.org, alustuseks http://dev.mysql.com/doc/refman/5.1/en/tutorial.html

Veebiserverid:

* [[Media:Itsissejuhatus_tiny.zip|Tiny www server]] ja [[lihtsaid cgi programminäiteid]]
* http://www.devside.net/guides/windows/apache
* http://net.tutsplus.com/tutorials/php/how-to-setup-a-dedicated-web-server-for-free/
* http://www.yolinux.com/TUTORIALS/LinuxTutorialWebSiteConfig.html

[[Category:Kursus]]

ITV0110 1. töö: Html põhioskused

2011-08-31T10:27:05Z

Anttix:

Esimene ülesanne on inspireeritud [http://innar.li.ttu.ee/failid/VR_2006.pdf Innar Liivi html juhendist] ja Tanel Tammeti varasematest analoogilistest ülesannetest.

Seda on väga soovitav teha kolmes etapis, hinnatakse aga kogutulemust.

Ülesandena loodud lehtedel peavad olema olemas alltoodud elemendid, igati sobiv ja soovitav on sinna lisada muid mõistlikke ja huvitavaid asju ka omal initsiatiivil.

NB! Lehed tuleb luua hariliku teksti(programmeerimis)redaktoriga (soovitavad näiteks notepad++ või scite), mitte puhtalt visuaalse redaktoriga. Esitamisel peab oskama juhendajale seletada, mida konkreetsed htmli markupi osad teie lehel teevad ja miks nad seal on. Teile arusaamatuid htmli markupe elemente ei tohi kasutada (st enne kasutamist tuleb nendega mõne htmli õppematerjaliga tutvuda!).

Loodud lehti võib selles ülesandes hoida lihtsalt arvuti failisüsteemis (ei pea olema laetud serverisse).

Lehtede loomisel on hea kasutada valmis [http://enos.itcollege.ee/~aandreim/vr1/latest/Praktikumid/prax1/toorik.html toorikut] (kasutamiseks võtad View Page Source ja teed Copy-Paste)

;esimene etapp

Tehke teksti(programmeerimis)redaktoriga 5 html lehte, mis on omavahel lingitud ja sisaldavad infot teie enda kohta (ei pea olema tõene info!). Pealehel olgu mh menüü, näiteks: Minust, Sõbrad, Lingid, Hobid jne.

;teine etapp

Joonistage mõne graafikaprogrammiga 5 pilti (mõned neist, võivad olla ka teie enda tehtud fotod, osad peavad aga olema joonistatud), salvestage neist osad GIF ja osad JPEG formaati ning lisage nad koduleheküljele eelmisest ülesandest (5 html lehte, omavahel lingitud). Kõigil lehtedel olgu siis mõni ise joonistatud/pildistatud GIF või JPEG formaatides pilt.

Neile lehtedele tuleb järgmisena panna osadele taustavärv ning osadele taustapildid. Samuti tuleb ära muuta tavaliste ning külastatud linkide värvid - vaikimisi on need üldiselt sinised ning lillad - muutke omale meeldivaks. Seekord proovige rõhku panna ka visuaalsele küljele - "hea maitse standardit" ei ole küll olemas, ent püüdke anda endasat parim!

;kolmas etapp

Proovige teha taoline tabel, kasutage ka tabelil ning lahtril tausta värve ja püüdke tõepoolest süveneda tabeli tegemise põhimõtetesse (mitte lihtsalt kuskilt näite järgi), sest tüüpilised vead väljundis on enamasti tabeli tõttu (ka visuaalsete html-redaktorite puhul) ning teil on kindlasti vaja oskust tabeli html-teksti käsitsi parandada.

<pre>
Nr Nimi Matemaatika Inglise keel
1 Aleksei Matiisen 95 77
2 Lea Kuusik 88 99
3 Leo Roost 32 83
4 Tarmo Eessaar 100 100
</pre>

Kui selline tabel tööle saadud, siis kasutage oma eelmistes ülesannetes tehtud lehekülgedel tabeleid - s.t. vasakule veergu pange menüü ning paremale sisu - mis tähendab, et kogu teie lehekülge ümbritseb üks suur tabel. Lisaks kasutage tabelit ka mõnes sisuosas.

ITV0110 1. töö: Html põhioskused

2011-08-31T10:26:39Z

Anttix:

Esimene ülesanne on inspireeritud [http://innar.li.ttu.ee/failid/VR_2006.pdf Innar Liivi html juhendist] ja Tanel Tammeti varasematest analoogilistest ülesannetest.

Seda on väga soovitav teha kolmes etapis, hinnatakse aga kogutulemust.

Ülesandena loodud lehtedel peavad olema olemas alltoodud elemendid, igati sobiv ja soovitav on sinna lisada muid mõistlikke ja huvitavaid asju ka omal initsiatiivil.

NB! Lehed tuleb luua hariliku teksti(programmeerimis)redaktoriga (soovitavad näiteks notepad++ või scite), mitte puhtalt visuaalse redaktoriga. Esitamisel peab oskama juhendajale seletada, mida konkreetsed htmli markupi osad teie lehel teevad ja miks nad seal on. Teile arusaamatuid htmli markupe elemente ei tohi kasutada (st enne kasutamist tuleb nendega mõne htmli õppematerjaliga tutvuda!).

Loodud lehti võib selles ülesandes hoida lihtsalt arvuti failisüsteemis (ei pea olema laetud serverisse).

Lehtede loomisel on hea kasutada valmis [ http://enos.itcollege.ee/~aandreim/vr1/latest/Praktikumid/prax1/toorik.html toorikut ] (kasutamiseks võtad View Page Source ja teed Copy-Paste)

;esimene etapp

Tehke teksti(programmeerimis)redaktoriga 5 html lehte, mis on omavahel lingitud ja sisaldavad infot teie enda kohta (ei pea olema tõene info!). Pealehel olgu mh menüü, näiteks: Minust, Sõbrad, Lingid, Hobid jne.

;teine etapp

Joonistage mõne graafikaprogrammiga 5 pilti (mõned neist, võivad olla ka teie enda tehtud fotod, osad peavad aga olema joonistatud), salvestage neist osad GIF ja osad JPEG formaati ning lisage nad koduleheküljele eelmisest ülesandest (5 html lehte, omavahel lingitud). Kõigil lehtedel olgu siis mõni ise joonistatud/pildistatud GIF või JPEG formaatides pilt.

Neile lehtedele tuleb järgmisena panna osadele taustavärv ning osadele taustapildid. Samuti tuleb ära muuta tavaliste ning külastatud linkide värvid - vaikimisi on need üldiselt sinised ning lillad - muutke omale meeldivaks. Seekord proovige rõhku panna ka visuaalsele küljele - "hea maitse standardit" ei ole küll olemas, ent püüdke anda endasat parim!

;kolmas etapp

Proovige teha taoline tabel, kasutage ka tabelil ning lahtril tausta värve ja püüdke tõepoolest süveneda tabeli tegemise põhimõtetesse (mitte lihtsalt kuskilt näite järgi), sest tüüpilised vead väljundis on enamasti tabeli tõttu (ka visuaalsete html-redaktorite puhul) ning teil on kindlasti vaja oskust tabeli html-teksti käsitsi parandada.

<pre>
Nr Nimi Matemaatika Inglise keel
1 Aleksei Matiisen 95 77
2 Lea Kuusik 88 99
3 Leo Roost 32 83
4 Tarmo Eessaar 100 100
</pre>

Kui selline tabel tööle saadud, siis kasutage oma eelmistes ülesannetes tehtud lehekülgedel tabeleid - s.t. vasakule veergu pange menüü ning paremale sisu - mis tähendab, et kogu teie lehekülge ümbritseb üks suur tabel. Lisaks kasutage tabelit ka mõnes sisuosas.

Võrgurakendused I 2018

2011-08-31T10:22:26Z

Anttix:

<table>
<tr>
<td>
[[Pilt:Engine.jpg|left|mootor]]
</td>
<td>
Ainekood: ITV0110 
Link: http://www.lambda.ee/index.php/V%C3%B5rgurakendused_I ehk http://www.lambda.ee/index/itv0110 
Punkte: 3.5 AP ehk 5 EAP 
Lektor: [http://tanel.tammet.googlepages.com Tanel Tammet] 
Kontakt: tammet@staff.ttu.ee, 6203457, TTÜ AK223 
olemas on ka [[Võrgurakendused_I 2010| 2010 aasta arhiiv]] koos kõigi eelmise aasta materjalidega. 
</td>
</tr>
</table>

== Aeg, koht, tulemus ==

Loenguid nädalas: 2 tundi (üks loeng) teisipäeviti 16:00-17:30 ruumis VII-131

Praktikume nädalas: 2 tundi (üks praktikum). Kui pole teisiti märgitud, toimuvad praktikumid:
* kolmapäeval 10:00-11:30 ruumides IT-213E, IT-213I rühmadele IABB37, IAPB37
* neljapäeval 08:00-09:30 ruumides IT-213D, IT-213H rühmadele IABB31, IABB32, IAPB31, IAPB32
* neljapäeval 14.00-15:30 ruumis IT-213D rühmale IAPB33



Kursus lõpeb hindelise arvestusega. Hinne sõltub kursuse jooksul tehtud praktikumide tulemustest (60%) pluss kursuse lõpus toimuva kontrolltöö tulemustest (40%).

NB! Esimese loengu annab Antti Andreimann: Tanel Tammet on konverentsil.

== Kursuse eesmärk ==

Lihtsamate veebirakenduste põhimõtted ja nende kirjutamise oskus nii brauseri kui serveri poolel. Konkreetsemalt:
* html-i kirjutamise oskus, esmane tutvus CSS-i ja javascriptiga.
* serveripoolse rakenduse kirjutamise põhimõtted, cgi protokoll, erinevate keelte (sh C, php, python, java) kasutamise sissejuhatus serverirakendustes.
* lihtsamad SQLi kasutamise oskused.

Kursusel eeldatakse elementaarsete programmeerimisoskuste olemasolu. Kes programmeerimisega üldse kokku puutunud ei ole või seda paralleelselt ei õpi, ei suuda kursust läbida.

== Analoogilised kursused ==

TTÜ-s on sama kursust varem lugenud K. Kikkas (vt [http://akadeemia.kakupesa.net/arhiiv/VR1/loengud/ loengumaterjale]) ja I. Liiv (vt [http://innar.li.ttu.ee/index.php?option=displaypage&Itemid=55&op=page&SubMenu= praksimaterjale]), ITK-s luges analoogilist kursust esialgu T. Tammet (vt vanu [http://deepthought.ttu.ee/it/vorgutarkvara/wav3080/ materjale]), praegusajal loeb A. Andreimann (vt vabalt kättesaadavaid [http://enos.itcollege.ee/~aandreim/vr1/latest/ materjale]).

== Praktilised tööd ==

Praktilisi töid juhendavad esialgu Tanel ja Antti, hiljem võib lisanduda veel juhendajaid.

Kursusel on neli kohustuslikku praktilist ẗööd. Iga töö annab 0-15 punkti. Hilinenud tööd annavad poole punktidest. Töid võib (ja on soovitav) esitada enne tähtaega.

Kõik tööd tuleb esitada ise TTÜ arvutiklassis: emailiga saadetud töid ei arvestata. Kasutada võib nii klassi arvuteid kui oma arvutit, brauser ja operatsioonisüsteem on vabalt valitavad. Serverirakenduste tööde jaoks on võimalik kasutada ülikooli serverit, soovi korral ka oma serverit.

* [[ITV0110 1. töö: Html põhioskused|Html põhioskused]]. Tähtaeg neljapäev, 15. september.

NB! Järgmised tööd on näited aastast 2010, praegusel kursusel tehakse neis muutusi, kuid üldjoontes jäävad ülesanded sarnaseks. Tähtajad on juba uued, 2011 aasta jaoks.

* [[ITV0110 2. töö: CSS, javascript, veebiserver| CSS, javascript, veebiserver]]. Tähtaeg neljapäev, 13. oktoober.
* [[ITV0110 3. töö: Lihtne serverirakendus: vormid ja cgi|Lihtne serverirakendus: vormid ja cgi]]. Tähtaeg neljapäev, 17. november.
* [[ITV0110 4. töö: Andmebaasiga serverakendus|Andmebaasiga serverakendus]]. Sisuks on väga lihtsakoelise "mini-facebooki" ehitamine. Programmeerimiskeeleks on PHP ja andmebaasiks mysql või postgresql. Tähtaeg neljapäev, 15. detsember.

Kursuse edukaks läbimiseks peavad kõik praktilised tööd olema tehtud.

== Loengute plaan ja materjalid ==

Alltoodud teemad kaetakse igaüks ühe-kahe loenguga. Suur osa loengutest on pühendatud näidete läbitegemisele ning seletamisele, ette-programmeerimisele ja praktikumide osalisele realiseerimisele.

; Sissejuhatus ja meeldetuletus

Tutvuda lühidalt:
:* Interneti baastehnoloogia IT sissejuhatusest: [[Media:Itsissejuhatus10o08.ppt|Itsissejuhatus10o08.ppt]], [[Media:Itsissejuhatus10o08.pdf|Itsissejuhatus10o08.pdf]].
:* [http://www.w3.org/MarkUp/Guide/ Raggetti mikrotutorial algajatele]
:* head eestikeelsed sissejuhatused [http://innar.li.ttu.ee/failid/VR_2006.pdf Innar Liivilt (pdf)] ja [http://akadeemia.kakupesa.net/arhiiv/VR1/loengud/loeng3 Kaido Kikkaselt (html)]
:* http://www.w3schools.com/.
:* http://www.w3c.org/.

; HTML põhioskused

Lugeda ja proovida läbi (st vaja põhimõtted selgeks õppida):
:* [http://www.w3schools.com/html/default.asp w3schools html tutorial basic blokk].
Loe lisaks läbi ka
:* [http://www.w3.org/MarkUp/Guide/Advanced.html Raggetti klassikaline tutorial, eeskätt tabelid]
:* [http://innar.li.ttu.ee/failid/VR_2006.pdf Innar Liivi sissejuhatus, eeskätt värvid ja pildid]
:* [http://www.w3.org/TR/html401/struct/tables.html täiendavat tabelitest ametlikust standardist]
Tutvu lisaks kasuliku tagide nimistuga:
:* [http://joshduck.com/periodic-table.html htmli elementide perioodiline tabel]

; CSS põhioskused

Lugeda ja proovida läbi (st vaja põhimõtted selgeks õppida):
* [http://www.w3.org/MarkUp/Guide/Style.html First CSS intro]
* [http://www.w3schools.com/css/ w3schools'i css tutorial]: : kindlasti "basic" ja "styling" blokid, huvi korral loe edasi ("box model", "advanced) ka, kuid need viimased ei ole kohustuslikud.
Tutvu lisaks listide+CSS-i kasutamisega menüüde jms jaoks:
* [http://css.maxdesign.com.au/listamatic/ listikasutus] ja sealtsamast [http://css.maxdesign.com.au/listutorial/index.htm listikasutuse tutorialid]

; Javascript põhioskused

Kaks loengut: (a) sissejuhatus (b) reaalne kasutamine brauseris (html ja css muutmine, evendid jne)

Vaata soenduseks/demoks [http://www.chromeexperiments.com/ Google kogutud näiteid].

Seejärel loe läbi ja proovi järgi selles järjekorras:
* [http://en.wikipedia.org/wiki/JavaScript Wikipedia javascripti üldartikkel]: ülevaade, ajalugu jne. Keelt siit ei õpi!
* [http://www.w3schools.com/js/default.asp W3schools javascripti sissejuhatus]: JS Basic ja JS Objects osad. Mõned asjad jäävad siin veidi ebaselgeks!
* [http://en.wikipedia.org/wiki/JavaScript_syntax Wikipedia Javascripti keele kiirõpetus]: loe ja proovi paralleelselt w3schools-ga. Siit saab mõned asjad selgemaks kui ainult w3schoolsist.

NB! Selle tulemusena on sul baasettekujutus javascripti keelest, aga mitte reaalsest kasutusest (seda vaatame järgmises loengus).

Javascripti kasutamine brauseris: alustuseks on hea vaadata põhjalikku näidete loetelu

* [http://www.w3schools.com/js/js_ex_dom.asp html dom objektid]: põhiasjad
* [http://www.tizag.com/javascriptT/javascriptform.php form validation]: klassikaline rakendus
* [http://www.w3schools.com/js/js_ex_browser.asp brauseriobjektid]: vahel kah kasulikud

ja tingimata lugeda sinna juurde teegijuhendeid:

* [http://www.w3schools.com/jsref/dom_obj_all.asp html dom ülevaadet]
* [http://www.w3schools.com/jsref/dom_obj_event.asp html events ülevaadet]
* [http://www.w3schools.com/jsref/dom_obj_style.asp style lugemine/muutmine js-s: hädavajalik reference]

; Praktilist teisest praktikumist

Kuidas ja kuhu faile serverisse üles laadida jms: loe [[ITV0110 2. töö: CSS, javascript, veebiserver| teise praktikumi materjalidest]]

; Cgi töötlemine eri keeltes (C, python, bash, java, ...)

Kõigepealt loe ja proovi tingimata ise läbi teha: [[pythoni cgi-d dijkstra serveris: kiire sissejuhatus]]

Tutvu linuxi shelli elementaarsete käskudega [http://www.tuxfiles.org/linuxhelp/linuxcommands.html sellest lühiõpetusest] ja täiendavalt [http://info.ee.surrey.ac.uk/Teaching/Unix/ selle tutoriali] peatükkidest üks kuni viis. Iga käsu juures on abiks man, näiteks <tt>man ls</tt>. Huvi korral googelda lisaks.

Seejärel loe neid materjale CGI protokollist ja CGI programmidest serveris:

* [http://www.jmarshall.com/easy/cgi/ lihtne sissejuhatus cgi-desse]
* [[Media:cgi.pdf|cgi.pdf: detailsem juhend]]
* [http://www.cs.tut.fi/~jkorpela/forms/cgic.html cgi C keeles]
* [http://webpython.codepoint.net/cgi_tutorial cgi Pythonis]
* [http://www.yolinux.com/TUTORIALS/BashShellCgi.html cgi Bashis]

ning siis vaata lisaks loengus tehtud/proovitud [[lihtsaid cgi programminäiteid]] eri keeltes.

Cgi jaoks on olemas ka nö [http://www.rfc-editor.org/rfc/rfc3875.txt rfc-standard], mille lugemine on aga pisut vaevarikas (nagu enamikel standarditel) ja üldjuhul on praktilisem lugeda hoopis ülaltoodud õpetusi ja vaadata
näiteid.

; Veebiserveri ehitusest ja konfigureerimisest

Kõigepealt tutvu või tuleta meelde http protokolli põhimõtteid:

* [http://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol http wikipedias]
* [http://www.jmarshall.com/easy/http/ veel http-st]
* [http://www.factini.com/c/httpViewer/ headerite jms vaatamise veebiabivahend]

Veebiserverist paremaks arusaamiseks tasub veidi eksperimenteerida [[Media:Itsissejuhatus_tiny.zip|pisikese veebiserveriga]].

Enimkasutatav veebiserver Apache:

* [http://httpd.apache.org/ apache oma koduleht]
* [http://en.wikipedia.org/wiki/Apache_HTTP_Server wikipedia apachest]
* [http://news.netcraft.com/archives/category/web-server-survey/ veebiserverite kasutusstatistikat]

Apache konfigureerimisest:

* [http://www.jlk.net/apache/beginners.shtml sissejuhatus algajatele]
* [http://httpd.apache.org/docs/2.2/ ametlik juhend]

; Python ja näiteid kasutamisest serverirakendustes

Tutvumine kolmanda praktikumiga: [[ITV0110 3. töö: Lihtne serverirakendus: vormid ja cgi|vormid ja cgi]]. Praksi jaoks vajaliku koodi kirjutamise harjutamine (loengus etteprogrammeerimine).

Sealt leiad ka soovitused esmatutvuseks Pythoniga (praktikumi jaoks piisab kõige lihtsamatest Pythoni konstruktsioonidest ja cgi teegist, keerukamaid asju pole otseselt vaja):
* loe [http://docs.python.org/tutorial/ tutoriali] algust (keerulised andmestruktuurid, moodulite ja klasside värgi võid esialgu lugemata jätta)
* lisaks [http://docs.python.org/library/cgi.html cgi teegi õpetust].
* Hea mõte on paralleelselt teha lahti Pythoni interpretaator ja katsetada kõrvale asju otse Pythoni käsureal. Kui su masinas Pythonit pole, siis installeeri!
* Paljud kasulikud asjad on kirjas Pythoni [http://docs.python.org/library/index.html#library-index teegi dokumentatsioonis].
* [[Kasulikke pythoni näitejuppe cgi jaoks]]
* Konkreetsete küsimuste korral aitab tihti googeldamine.

; Serverirakendused PHP-s, näited

* Väikese ajaloolise ülevaate leiad [http://en.wikipedia.org/wiki/PHP wikipeediast]
* Põhiõpetus on [http://www.php.net/manual/en/ php oma saidil]: loe sealt kõigepealt [http://www.php.net/manual/en/tutorial.php sissejuhatavat tutoriali]
* [http://w3schools.com/php/default.asp W3school-si php tutorial] on samuti päris OK.

; SQL

Loe selles järjekorras:

* [http://web.njit.edu/~song/courses/is698/SQL_tutorials.ppt hea esimene sissejuhatus]
* [http://www.w3schools.com/sql/default.asp w3schools'i tutorial]
* [http://dev.mysql.com/doc/refman/5.0/en/tutorial.html mysql esmane tutorial] ja [http://dev.mysql.com/doc/refman/5.0/en/index.html mysql manuaal]

; SQL serverirakendustes

* Vaata [[lihtsaid php ja mysql näiteid]] loengust.
* [http://dmsa.concordia.ca/tutorial_files/shortsql.ppt mysql PHP-s: ppt]
* [http://www.tizag.com/mysqlTutorial/ mysql PHP-s: veebitutorial]
* [http://blogs.techrepublic.com.com/security/?p=2368 SQL injection] vt ka [http://lh6.ggpht.com/_5YF7KQZuZS0/S6dvFXu5OoI/AAAAAAAACWM/qTcVpMxcDnA/licence%20plate%20camera%20sql%20injection_2%5B3%5D.jpg?imgmax=800 seda] ja [http://www.schneier.com/blog/archives/2010/10/pen-and-paper_s.html seda] ja [http://alicebobandmallory.com/articles/2010/09/23/did-little-bobby-tables-migrate-to-sweden seda]
* [http://www.w3schools.com/php/default.asp w3schools PHP tutorial all vasakul Mysql blokk]
* [[Vorgurakendused 1 SQL naited loengust]]

; Sessioonid, cookied, sisselogimine, autentimine

Mõned lingid:

* basic authentication [http://en.wikipedia.org/wiki/Basic_access_authentication wikipedias], [http://httpd.apache.org/docs/2.0/howto/auth.html apache manuaalis] ja [[basic authentication näited]]
* cookie [http://en.wikipedia.org/wiki/HTTP_cookie wikipedias], php cookie handling [http://w3schools.com/PHP/php_cookies.asp w3schools-st] ja [http://www.php.net/manual/en/function.setcookie.php php manuaalist]
* [http://oreilly.com/catalog/webdbapps/chapter/ch08.html ok sessiooniõpetus]
* php sessioonihandling [http://w3schools.com/PHP/php_sessions.asp w3schools] ja siit [http://ee.php.net/manual/en/book.session.php php mahukas sessiooni-manuaal] ja siit [http://www.tizag.com/phpT/phpsessions.php eraldi tutorial]
* väike [http://www.secologic.org/downloads/web/051123_eurosec_course_material_on_web_application_session_management.ppt ok sessioonihalduse tutorial]
* [[autentimise näide php sessiooniga]]

; Ajax

* Loe seotud tehnoloogiatest: [http://en.wikipedia.org/wiki/Ajax_%28programming%29 wikipedia ajax], [http://en.wikipedia.org/wiki/XMLHttpRequest wikipedia xmlhttprequest], [http://en.wikipedia.org/wiki/JSON wikipedia json]
* [[xmlhttprequest ja jsonile rakendatud eval näited]]

== Vajalikud tööriistad ==

Oma arvutiga töö tegemiseks peab seal olema vähemalt

* [http://notepad-plus-plus.org/ Notepad++]
* [http://www.mozilla.com Mozilla Firefox]

== Lugemismaterjale ==

Üldist:

* [http://www.w3schools.com/ Mitu head tutoriali eri teemadel]
* [http://www.websitetips.com/ suur kogu häid tutoriale, artikleid ja soovitusi]
* Lisamaterjale kursusest [[Kasutajaliidesed võrgutehnoloogia baasil]]

HTML:

* [http://www.w3.org/MarkUp/Guide/ Raggetti tutorial algajatele]
* [http://akadeemia.kakupesa.net/arhiiv/VR1/loengud/loeng3 Kaido Kikkase hea eestikeelne sissejuhatus]
* [http://innar.li.ttu.ee/failid/VR_2006.pdf Innar Liivi hea eestikeelne sissejuhatus]
* [http://www.w3schools.com/html/ w3schools'i põhjalik html tutorial]
* [http://joshduck.com/periodic-table.html tore tagide nimistu]
* [http://www.w3.org/TR/html4/ HTML 4.01 ametlik standard]
* [http://www.w3.org/TR/html5/ HTML 5.0 ametlik draft]

HTML+CSS+Javascript:

* [http://www.w3.org/MarkUp/Guide/Style.html First CSS intro]
* [http://www.w3schools.com/css/ w3schools'i css tutorial]
* [http://www.w3schools.com/js/ w3schools'i javascripti tutorial]

* [http://www.alistapart.com/ A list apart]
* [http://css.maxdesign.com.au/listamatic/ listikasutus]

HTTP

* [http://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol http wikipedias]
* http://www.jmarshall.com/easy/http/
* [http://www.w3.org/Protocols/HTTP/AsImplemented.html T. Berners-Lee leiutatud esimene HTTP spec]
* [http://www.garshol.priv.no/download/text/http-tut.html hea väike HTTP ja CGI tutorial]
* [http://www.factini.com/c/httpViewer/ headerite jms vaatamise veebiabivahend]

CGI programmid serveris

* [http://www.jmarshall.com/easy/cgi/ lihtne sissejuhatus cgi-desse]
* [[Media:cgi.pdf|cgi.pdf: detailsem juhend]]
* [http://www.whizkidtech.redprince.net/cgi-bin/tutorial cgi esmane sissejuhatus Bashi näidetega]
* [http://www.cs.tut.fi/~jkorpela/forms/cgic.html cgi C keeles]
* [http://webpython.codepoint.net/cgi_tutorial cgi Pythonis]
* [http://www.yolinux.com/TUTORIALS/BashShellCgi.html cgi Bashis]
* [[Media:Itsissejuhatus_tiny.zip|Tiny www server]] ja [[lihtsaid cgi programminäiteid]]

PHP ja MySQL

* http://www.php.net/ sh http://www.php.net/tut.php või http://www.php.net/manual/en/tutorial.php
* http://www.mysql.org, alustuseks http://dev.mysql.com/doc/refman/5.1/en/tutorial.html

Veebiserverid:

* [[Media:Itsissejuhatus_tiny.zip|Tiny www server]] ja [[lihtsaid cgi programminäiteid]]
* http://www.devside.net/guides/windows/apache
* http://net.tutsplus.com/tutorials/php/how-to-setup-a-dedicated-web-server-for-free/
* http://www.yolinux.com/TUTORIALS/LinuxTutorialWebSiteConfig.html

[[Category:Kursus]]

Võrgurakendused I 2018

2011-08-31T10:21:23Z

Anttix:

<table>
<tr>
<td>
[[Pilt:Engine.jpg|left|mootor]]
</td>
<td>
Ainekood: ITV0110 
Link: http://www.lambda.ee/index.php/V%C3%B5rgurakendused_I ehk http://www.lambda.ee/index/itv0110 
Punkte: 3.5 AP ehk 5 EAP 
Lektor: [http://tanel.tammet.googlepages.com Tanel Tammet] 
Kontakt: tammet@staff.ttu.ee, 6203457, TTÜ AK223 
olemas on ka [[Võrgurakendused_I 2010| 2010 aasta arhiiv]] koos kõigi eelmise aasta materjalidega. 
</td>
</tr>
</table>

== Aeg, koht, tulemus ==

Loenguid nädalas: 2 tundi (üks loeng) teisipäeviti 16:00-17:30 ruumis VII-131

Praktikume nädalas: 2 tundi (üks praktikum). Kui pole teisiti märgitud, toimuvad praktikumid:
* kolmapäeval 10:00-11:30 ruumides IT-213E, IT-213I rühmadele IABB37, IAPB37
* neljapäeval 08:00-09:30 ruumides IT-213D, IT-213H rühmadele IABB31, IABB32, IAPB31, IAPB32
* neljapäeval 14.00-15:30 ruumis IT-213D rühmale IAPB33



Kursus lõpeb hindelise arvestusega. Hinne sõltub kursuse jooksul tehtud praktikumide tulemustest (60%) pluss kursuse lõpus toimuva kontrolltöö tulemustest (40%).

NB! Esimese loengu annab Antti Andreimann: Tanel Tammet on konverentsil.

== Kursuse eesmärk ==

Lihtsamate veebirakenduste põhimõtted ja nende kirjutamise oskus nii brauseri kui serveri poolel. Konkreetsemalt:
* html-i kirjutamise oskus, esmane tutvus CSS-i ja javascriptiga.
* serveripoolse rakenduse kirjutamise põhimõtted, cgi protokoll, erinevate keelte (sh C, php, python, java) kasutamise sissejuhatus serverirakendustes.
* lihtsamad SQLi kasutamise oskused.

Kursusel eeldatakse elementaarsete programmeerimisoskuste olemasolu. Kes programmeerimisega üldse kokku puutunud ei ole või seda paralleelselt ei õpi, ei suuda kursust läbida.

== Analoogilised kursused ==

TTÜ-s on sama kursust varem lugenud K. Kikkas (vt [http://akadeemia.kakupesa.net/arhiiv/VR1/loengud/ loengumaterjale]) ja I. Liiv (vt [http://innar.li.ttu.ee/index.php?option=displaypage&Itemid=55&op=page&SubMenu= praksimaterjale]), ITK-s luges analoogilist kursust esialgu T. Tammet (vt vanu [http://deepthought.ttu.ee/it/vorgutarkvara/wav3080/ materjale]), praegusajal loeb A. Andreimann (vt vabalt kättesaadavaid [http://enos.itcollege.ee/~aandreim/vr1/latest/ materjale]).

== Praktilised tööd ==

Praktilisi töid juhendavad esialgu Tanel ja Antti, hiljem võib lisanduda veel juhendajaid.

Kursusel on neli kohustuslikku praktilist ẗööd. Iga töö annab 0-15 punkti. Hilinenud tööd annavad poole punktidest. Töid võib (ja on soovitav) esitada enne tähtaega.

Kõik tööd tuleb esitada ise TTÜ arvutiklassis: emailiga saadetud töid ei arvestata. Kasutada võib nii klassi arvuteid kui oma arvutit, brauser ja operatsioonisüsteem on vabalt valitavad. Serverirakenduste tööde jaoks on võimalik kasutada ülikooli serverit, soovi korral ka oma serverit.

* [[ITV0110 1. töö: Html põhioskused|Html põhioskused]]. Tähtaeg neljapäev, 15. september.

NB! Järgmised tööd on näited aastast 2010, praegusel kursusel tehakse neis muutusi, kuid üldjoontes jäävad ülesanded sarnaseks. Tähtajad on juba uued, 2011 aasta jaoks.

* [[ITV0110 2. töö: CSS, javascript, veebiserver| CSS, javascript, veebiserver]]. Tähtaeg neljapäev, 13. oktoober.
* [[ITV0110 3. töö: Lihtne serverirakendus: vormid ja cgi|Lihtne serverirakendus: vormid ja cgi]]. Tähtaeg neljapäev, 17. november.
* [[ITV0110 4. töö: Andmebaasiga serverakendus|Andmebaasiga serverakendus]]. Sisuks on väga lihtsakoelise "mini-facebooki" ehitamine. Programmeerimiskeeleks on PHP ja andmebaasiks mysql või postgresql. Tähtaeg neljapäev, 15. detsember.

Kursuse edukaks läbimiseks peavad kõik praktilised tööd olema tehtud.

== Loengute plaan ja materjalid ==

Alltoodud teemad kaetakse igaüks ühe-kahe loenguga. Suur osa loengutest on pühendatud näidete läbitegemisele ning seletamisele, ette-programmeerimisele ja praktikumide osalisele realiseerimisele.

; Sissejuhatus ja meeldetuletus

Tutvuda lühidalt:
:* Interneti baastehnoloogia IT sissejuhatusest: [[Media:Itsissejuhatus10o08.ppt|Itsissejuhatus10o08.ppt]], [[Media:Itsissejuhatus10o08.pdf|Itsissejuhatus10o08.pdf]].
:* [http://www.w3.org/MarkUp/Guide/ Raggetti mikrotutorial algajatele]
:* head eestikeelsed sissejuhatused [http://innar.li.ttu.ee/failid/VR_2006.pdf Innar Liivilt (pdf)] ja [http://akadeemia.kakupesa.net/arhiiv/VR1/loengud/loeng3 Kaido Kikkaselt (html)]
:* http://www.w3schools.com/.
:* http://www.w3c.org/.

; HTML põhioskused

Lugeda ja proovida läbi (st vaja põhimõtted selgeks õppida):
:* [http://www.w3schools.com/html/default.asp w3schools html tutorial basic blokk].
Loe lisaks läbi ka
:* [http://www.w3.org/MarkUp/Guide/Advanced.html Raggetti klassikaline tutorial, eeskätt tabelid]
:* [http://innar.li.ttu.ee/failid/VR_2006.pdf Innar Liivi sissejuhatus, eeskätt värvid ja pildid]
:* [http://www.w3.org/TR/html401/struct/tables.html täiendavat tabelitest ametlikust standardist]
Tutvu lisaks kasuliku tagide nimistuga:
:* [http://joshduck.com/periodic-table.html htmli elementide perioodiline tabel]

; CSS põhioskused

Lugeda ja proovida läbi (st vaja põhimõtted selgeks õppida):
* [http://www.w3.org/MarkUp/Guide/Style.html First CSS intro]
* [http://www.w3schools.com/css/ w3schools'i css tutorial]: : kindlasti "basic" ja "styling" blokid, huvi korral loe edasi ("box model", "advanced) ka, kuid need viimased ei ole kohustuslikud.
Tutvu lisaks listide+CSS-i kasutamisega menüüde jms jaoks:
* [http://css.maxdesign.com.au/listamatic/ listikasutus] ja sealtsamast [http://css.maxdesign.com.au/listutorial/index.htm listikasutuse tutorialid]

; Javascript põhioskused

Kaks loengut: (a) sissejuhatus (b) reaalne kasutamine brauseris (html ja css muutmine, evendid jne)

Vaata soenduseks/demoks [http://www.chromeexperiments.com/ Google kogutud näiteid].

Seejärel loe läbi ja proovi järgi selles järjekorras:
* [http://en.wikipedia.org/wiki/JavaScript Wikipedia javascripti üldartikkel]: ülevaade, ajalugu jne. Keelt siit ei õpi!
* [http://www.w3schools.com/js/default.asp W3schools javascripti sissejuhatus]: JS Basic ja JS Objects osad. Mõned asjad jäävad siin veidi ebaselgeks!
* [http://en.wikipedia.org/wiki/JavaScript_syntax Wikipedia Javascripti keele kiirõpetus]: loe ja proovi paralleelselt w3schools-ga. Siit saab mõned asjad selgemaks kui ainult w3schoolsist.

NB! Selle tulemusena on sul baasettekujutus javascripti keelest, aga mitte reaalsest kasutusest (seda vaatame järgmises loengus).

Javascripti kasutamine brauseris: alustuseks on hea vaadata põhjalikku näidete loetelu

* [http://www.w3schools.com/js/js_ex_dom.asp html dom objektid]: põhiasjad
* [http://www.tizag.com/javascriptT/javascriptform.php form validation]: klassikaline rakendus
* [http://www.w3schools.com/js/js_ex_browser.asp brauseriobjektid]: vahel kah kasulikud

ja tingimata lugeda sinna juurde teegijuhendeid:

* [http://www.w3schools.com/jsref/dom_obj_all.asp html dom ülevaadet]
* [http://www.w3schools.com/jsref/dom_obj_event.asp html events ülevaadet]
* [http://www.w3schools.com/jsref/dom_obj_style.asp style lugemine/muutmine js-s: hädavajalik reference]

; Praktilist teisest praktikumist

Kuidas ja kuhu faile serverisse üles laadida jms: loe [[ITV0110 2. töö: CSS, javascript, veebiserver| teise praktikumi materjalidest]]

; Cgi töötlemine eri keeltes (C, python, bash, java, ...)

Kõigepealt loe ja proovi tingimata ise läbi teha: [[pythoni cgi-d dijkstra serveris: kiire sissejuhatus]]

Tutvu linuxi shelli elementaarsete käskudega [http://www.tuxfiles.org/linuxhelp/linuxcommands.html sellest lühiõpetusest] ja täiendavalt [http://info.ee.surrey.ac.uk/Teaching/Unix/ selle tutoriali] peatükkidest üks kuni viis. Iga käsu juures on abiks man, näiteks <tt>man ls</tt>. Huvi korral googelda lisaks.

Seejärel loe neid materjale CGI protokollist ja CGI programmidest serveris:

* [http://www.jmarshall.com/easy/cgi/ lihtne sissejuhatus cgi-desse]
* [[Media:cgi.pdf|cgi.pdf: detailsem juhend]]
* [http://www.cs.tut.fi/~jkorpela/forms/cgic.html cgi C keeles]
* [http://webpython.codepoint.net/cgi_tutorial cgi Pythonis]
* [http://www.yolinux.com/TUTORIALS/BashShellCgi.html cgi Bashis]

ning siis vaata lisaks loengus tehtud/proovitud [[lihtsaid cgi programminäiteid]] eri keeltes.

Cgi jaoks on olemas ka nö [http://www.rfc-editor.org/rfc/rfc3875.txt rfc-standard], mille lugemine on aga pisut vaevarikas (nagu enamikel standarditel) ja üldjuhul on praktilisem lugeda hoopis ülaltoodud õpetusi ja vaadata
näiteid.

; Veebiserveri ehitusest ja konfigureerimisest

Kõigepealt tutvu või tuleta meelde http protokolli põhimõtteid:

* [http://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol http wikipedias]
* [http://www.jmarshall.com/easy/http/ veel http-st]
* [http://www.factini.com/c/httpViewer/ headerite jms vaatamise veebiabivahend]

Veebiserverist paremaks arusaamiseks tasub veidi eksperimenteerida [[Media:Itsissejuhatus_tiny.zip|pisikese veebiserveriga]].

Enimkasutatav veebiserver Apache:

* [http://httpd.apache.org/ apache oma koduleht]
* [http://en.wikipedia.org/wiki/Apache_HTTP_Server wikipedia apachest]
* [http://news.netcraft.com/archives/category/web-server-survey/ veebiserverite kasutusstatistikat]

Apache konfigureerimisest:

* [http://www.jlk.net/apache/beginners.shtml sissejuhatus algajatele]
* [http://httpd.apache.org/docs/2.2/ ametlik juhend]

; Python ja näiteid kasutamisest serverirakendustes

Tutvumine kolmanda praktikumiga: [[ITV0110 3. töö: Lihtne serverirakendus: vormid ja cgi|vormid ja cgi]]. Praksi jaoks vajaliku koodi kirjutamise harjutamine (loengus etteprogrammeerimine).

Sealt leiad ka soovitused esmatutvuseks Pythoniga (praktikumi jaoks piisab kõige lihtsamatest Pythoni konstruktsioonidest ja cgi teegist, keerukamaid asju pole otseselt vaja):
* loe [http://docs.python.org/tutorial/ tutoriali] algust (keerulised andmestruktuurid, moodulite ja klasside värgi võid esialgu lugemata jätta)
* lisaks [http://docs.python.org/library/cgi.html cgi teegi õpetust].
* Hea mõte on paralleelselt teha lahti Pythoni interpretaator ja katsetada kõrvale asju otse Pythoni käsureal. Kui su masinas Pythonit pole, siis installeeri!
* Paljud kasulikud asjad on kirjas Pythoni [http://docs.python.org/library/index.html#library-index teegi dokumentatsioonis].
* [[Kasulikke pythoni näitejuppe cgi jaoks]]
* Konkreetsete küsimuste korral aitab tihti googeldamine.

; Serverirakendused PHP-s, näited

* Väikese ajaloolise ülevaate leiad [http://en.wikipedia.org/wiki/PHP wikipeediast]
* Põhiõpetus on [http://www.php.net/manual/en/ php oma saidil]: loe sealt kõigepealt [http://www.php.net/manual/en/tutorial.php sissejuhatavat tutoriali]
* [http://w3schools.com/php/default.asp W3school-si php tutorial] on samuti päris OK.

; SQL

Loe selles järjekorras:

* [http://web.njit.edu/~song/courses/is698/SQL_tutorials.ppt hea esimene sissejuhatus]
* [http://www.w3schools.com/sql/default.asp w3schools'i tutorial]
* [http://dev.mysql.com/doc/refman/5.0/en/tutorial.html mysql esmane tutorial] ja [http://dev.mysql.com/doc/refman/5.0/en/index.html mysql manuaal]

; SQL serverirakendustes

* Vaata [[lihtsaid php ja mysql näiteid]] loengust.
* [http://dmsa.concordia.ca/tutorial_files/shortsql.ppt mysql PHP-s: ppt]
* [http://www.tizag.com/mysqlTutorial/ mysql PHP-s: veebitutorial]
* [http://blogs.techrepublic.com.com/security/?p=2368 SQL injection] vt ka [http://lh6.ggpht.com/_5YF7KQZuZS0/S6dvFXu5OoI/AAAAAAAACWM/qTcVpMxcDnA/licence%20plate%20camera%20sql%20injection_2%5B3%5D.jpg?imgmax=800 seda] ja [http://www.schneier.com/blog/archives/2010/10/pen-and-paper_s.html seda] ja [http://alicebobandmallory.com/articles/2010/09/23/did-little-bobby-tables-migrate-to-sweden seda]
* [http://www.w3schools.com/php/default.asp w3schools PHP tutorial all vasakul Mysql blokk]
* [[Vorgurakendused 1 SQL naited loengust]]

; Sessioonid, cookied, sisselogimine, autentimine

Mõned lingid:

* basic authentication [http://en.wikipedia.org/wiki/Basic_access_authentication wikipedias], [http://httpd.apache.org/docs/2.0/howto/auth.html apache manuaalis] ja [[basic authentication näited]]
* cookie [http://en.wikipedia.org/wiki/HTTP_cookie wikipedias], php cookie handling [http://w3schools.com/PHP/php_cookies.asp w3schools-st] ja [http://www.php.net/manual/en/function.setcookie.php php manuaalist]
* [http://oreilly.com/catalog/webdbapps/chapter/ch08.html ok sessiooniõpetus]
* php sessioonihandling [http://w3schools.com/PHP/php_sessions.asp w3schools] ja siit [http://ee.php.net/manual/en/book.session.php php mahukas sessiooni-manuaal] ja siit [http://www.tizag.com/phpT/phpsessions.php eraldi tutorial]
* väike [http://www.secologic.org/downloads/web/051123_eurosec_course_material_on_web_application_session_management.ppt ok sessioonihalduse tutorial]
* [[autentimise näide php sessiooniga]]

; Ajax

* Loe seotud tehnoloogiatest: [http://en.wikipedia.org/wiki/Ajax_%28programming%29 wikipedia ajax], [http://en.wikipedia.org/wiki/XMLHttpRequest wikipedia xmlhttprequest], [http://en.wikipedia.org/wiki/JSON wikipedia json]
* [[xmlhttprequest ja jsonile rakendatud eval näited]]

== Vajalikud tööriistad ==

* [http://notepad-plus-plus.org/ Notepad++]

== Lugemismaterjale ==

Üldist:

* [http://www.w3schools.com/ Mitu head tutoriali eri teemadel]
* [http://www.websitetips.com/ suur kogu häid tutoriale, artikleid ja soovitusi]
* Lisamaterjale kursusest [[Kasutajaliidesed võrgutehnoloogia baasil]]

HTML:

* [http://www.w3.org/MarkUp/Guide/ Raggetti tutorial algajatele]
* [http://akadeemia.kakupesa.net/arhiiv/VR1/loengud/loeng3 Kaido Kikkase hea eestikeelne sissejuhatus]
* [http://innar.li.ttu.ee/failid/VR_2006.pdf Innar Liivi hea eestikeelne sissejuhatus]
* [http://www.w3schools.com/html/ w3schools'i põhjalik html tutorial]
* [http://joshduck.com/periodic-table.html tore tagide nimistu]
* [http://www.w3.org/TR/html4/ HTML 4.01 ametlik standard]
* [http://www.w3.org/TR/html5/ HTML 5.0 ametlik draft]

HTML+CSS+Javascript:

* [http://www.w3.org/MarkUp/Guide/Style.html First CSS intro]
* [http://www.w3schools.com/css/ w3schools'i css tutorial]
* [http://www.w3schools.com/js/ w3schools'i javascripti tutorial]

* [http://www.alistapart.com/ A list apart]
* [http://css.maxdesign.com.au/listamatic/ listikasutus]

HTTP

* [http://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol http wikipedias]
* http://www.jmarshall.com/easy/http/
* [http://www.w3.org/Protocols/HTTP/AsImplemented.html T. Berners-Lee leiutatud esimene HTTP spec]
* [http://www.garshol.priv.no/download/text/http-tut.html hea väike HTTP ja CGI tutorial]
* [http://www.factini.com/c/httpViewer/ headerite jms vaatamise veebiabivahend]

CGI programmid serveris

* [http://www.jmarshall.com/easy/cgi/ lihtne sissejuhatus cgi-desse]
* [[Media:cgi.pdf|cgi.pdf: detailsem juhend]]
* [http://www.whizkidtech.redprince.net/cgi-bin/tutorial cgi esmane sissejuhatus Bashi näidetega]
* [http://www.cs.tut.fi/~jkorpela/forms/cgic.html cgi C keeles]
* [http://webpython.codepoint.net/cgi_tutorial cgi Pythonis]
* [http://www.yolinux.com/TUTORIALS/BashShellCgi.html cgi Bashis]
* [[Media:Itsissejuhatus_tiny.zip|Tiny www server]] ja [[lihtsaid cgi programminäiteid]]

PHP ja MySQL

* http://www.php.net/ sh http://www.php.net/tut.php või http://www.php.net/manual/en/tutorial.php
* http://www.mysql.org, alustuseks http://dev.mysql.com/doc/refman/5.1/en/tutorial.html

Veebiserverid:

* [[Media:Itsissejuhatus_tiny.zip|Tiny www server]] ja [[lihtsaid cgi programminäiteid]]
* http://www.devside.net/guides/windows/apache
* http://net.tutsplus.com/tutorials/php/how-to-setup-a-dedicated-web-server-for-free/
* http://www.yolinux.com/TUTORIALS/LinuxTutorialWebSiteConfig.html

[[Category:Kursus]]

ITX8080

2010-12-17T15:33:13Z

Anttix: /* Lab 9 */

ITX8080

2010-12-17T15:30:45Z

Anttix: /* Lab 9 */

= General Information =
== Schedule ==

Lecture TH 12:00 - 13:30

Practice FR 14:00 - 17:30

== Communication ==

Discussinons will be held at: itx8080 atatat googlegroups.com

Send e-mail to hannesa at-no-spam-please gmail.com for an invitation.

The lecturers can be reached via the course coordinator:

antti.andreimann only-people-please eesti.ee

== Points awarded so far ==

Arnis : 3 points - ab testing solution, best countermeasure proposed for scenario 4, best snort rules proposed for scenario 6

Igor : 3 points - wordpress virtualization solution, lab 3 report, IDS testing solution

Kaarel : 2 points - lab 1 report and conclusions, lab 3 solution

Märt : 3 points - wordpress testing procedure, best wordpress optimization (wp-cache + php-apc), best lab 2 report.

Roland: 2 points - best Lab 4 report, IDS testing solution

Hannes: 1 point - best lab 6 report

Siim: 1 point - most popular scenario 7 solution

Urmas: 2 points - lab 5 report, the set of viruses used in lab 7

Martti: 1 point - best lab 7 report

Stefan: 1 points - best solutions developed during lab 8-1

Jeremy: 1 point - best solution developed during lab 8-2

Christopher: 1 point - best lab 8-1 report

Alexandra: 1 point - best lab 8-2 report.

= Scenarios =

== Scenario 1 ==
There is a Wordpress based blog.

The client is worried: How many visitors can they handle before they die.

Establish a baseline: How many page displays per second AT LEAST we can handle.
Disruption of the site operation is NOT acceptable.

Minimal budget!

Be as detailed and technical as You possibly can.

Post to the discussion group the following information:

# Detailed description of the simulation of the site. eg. if You're going to virtualize it then how? If You are running it as a process, then how You separate it from the real machine?
# Detailed description of the attack / benchmark tools picked. Where You are going to run them? What tools? How many copies? How you are going to collect the results?!!!

=== Proposals ===
Benchmarking:
* AB - Discussed in lecture
* http://tsung.erlang-projects.org - Jérémy
* wget + AB - Arnis
* http://jakarta.apache.org/jmeter/ - Roland, Jérémy
* http://grinder.sourceforge.net/ - Märt
* http://httpd.apache.org/test/flood/ - Hannes
* Normal monitoring software on live server - Urmas

Simulation of the system:
* VirtualBox - Roland, Jérémy
* VMWare ESX - Igor
* VMWare Player - Marina
* Amazon EC2 - Märt
* KVM - Siim
* Original hardware - Hannes

=== Lab 1 ===
We will need to create two different virtual machines, one is going to be the wordpress server and the 2nd one is the client which is used to attack the server. It's probably easiest to install only one image and then clone it.

Hard disk image cloning is best done with

Linux:
VBoxManage clonehd FirstUbuntu.vdi SecondUbuntu.vdi

Windows:
"C:\Program Files\Oracle\VirtualBox\VBoxManage.exe" clonehd FirstUbuntu.vdi SecondUbuntu.vdi

After cloning the image create another virtual machine and attach the 2nd disk to that machine. As the result there will be two different virtual machines with two different virtual hard disks.

To be able to connect between the two virtual machines, You need to add an
additional network adapter to both hosts. It can be either "Host Only" or
"Internal" type.

To enable the new adapters in Ubuntu edit the file: /etc/network/interfaces

== Scenario 2 ==
Design a method for evaluating any speedup solutions for the wordpress.
A repeatable process to evaluate the claims.
Whatever optimizations.
The process must be detailed enough so that somebody else can get the same results when applying that.
The "other person" is expected to have IT knowledge sufficient to install and run a Linux desktop.
The method must specify the level performance
at which the site is considered DEAD.
Budget requirements: Low - Dedicated machine + dedicated tester.

=== Lab 2 ===
* Get Virtual machine disk image and instructions from: http://www.tud.ttu.ee/~anttix/lab2/ '''NB! DO NOT DOWNLOAD IMAGE FROM THE LINK NOTED IN INSTRUCTIONS PDF, IT WILL BE SLOW'''
* Fix bug in image (see below)
* Measure the effect of these wordpress plugins:
** [http://wordpress.org/extend/plugins/wp-super-cache/ WP Super Cache]
** [http://wordpress.org/extend/plugins/wp-cache/ WP-Cache]
* Devise Your own optimizations for the site

Bug in image: the ip address of the VM is saved in WP database as 192.168.56.3
It is advised tu run the Target VM first and run the "sudo dhclient" command first in Target VM.
Then check active IP of target by command "ifconfig". If it is not 192.168.56.3, then situation can be fixed by running:

In Target VM: "sudo ifconfig eth2 192.168.56.3"
In Client VM: "sudo ifconfig eth2 192.168.56.4"

==== A note to Windows users ====
Use this command line to access VBoxManage program

"C:\Program Files\Oracle\VirtualBox\VBoxManage.exe"

==== Wordpress Admin access ====
Username: admin
Password: QIaTemvskSeM

==== Note to Ubuntu users ====
VirtualBox with WiFi Does NOT work properly http://ubuntuforums.org/showthread.php?t=782936

== Scenario 3 ==
Your client is worried about some stuff posted on a blog. They ask You to take care of it.
They have a throwaway "script kiddie" in a third world country, who will mount the attack
so You don't need to worry about hiding the attackers identity.

Devise a way to attack a wordpress (default installation) based site to render it
unusable (page view times over 60 seconds).

Attack resources: one PC, a script kiddie, internet connection of 2Mbit/s.

How are we going to evaluate the solutions?
* Easy to use instructions
* The most efficient use of available resources

Defacing will count, IF it works for the latest version of wordpress.

=== Lab 3 ===
Possible attacks:

* Brute force overload (AB or other benchmark), bang the slowest page possible.
* Connection flood (slowloris)
* SYN Flood (eg. with hping)
* Banging expensive operations (eg. adding big comments)
* etc.

== Scenario 4 ==
Develop countermeasures for the attacks simulated in Lab 3.

Limitations:
* No additional hardware
* No reactive measures

=== Lab 4 ===

Evaluate the countermeasures against attacks.
The countermeasures must not have negative effects
on "normal usage pattern".

Normal usage pattern is defined as:
* Bursts of 10 connections per IP address in 1 second
* Page load times not over 20 seconds

== Scenario 5 ==
Create a solution and instructions for testing IDS
systems against the wordpress site and attacks
tried in lab 3.

A repeatable process to evaluate vendor claims.
Whatever passive IDS system delivered as a VM or a dedicated box.

Creating the IDS system itself is out of scope.

The process must be detailed enough so that somebody else can get the same results when applying that.
The "other person" is expected to have IT knowledge sufficient to install and run a Linux desktop.

Budget requirements: Modest - 2 Dedicated machines + dedicated tester + networking equipment to connect these together.

The process must test at least the following:
* Port scan
* SYN flood
* slowloris/pyloris
* Ab overwhelming attack

=== Lab 5 ===
Instructions for installing Snort IDS and its web GUI called 'acidbase': https://help.ubuntu.com/community/SnortIDS

== Scenario 6 ==

Develop/download/find/whatever a SNORT configuration (rulesets, preprocessors, whatever)
that performs better than the default configuration in lab 5 tests.
By better we mean:
* Less false positives
* Less false negatives
* The objectives are contradictory so the rule of thumb is one false negative per 10 false positives eg. solution with 10 false positives and 2 false negatives is better than the solution with 100 false positives and 1 false negatives, but the solution with 10 false positives and 1 false negative is better than the solution with 1 false positive and 2 false negatives.
* Attack is defined by a single invocation of the test script.

== Scenario 7 ==

There is a new remote vulnerability in Windows.
You became aware of a new virus that targets this vulnerability at 7 PM.
The antivirus vendor has released an updated virus database, but it's probably not installed
on all of the computers yet. Your company has 500 employees, with half of them running on laptops. You have to decide in 12 hours, if You need to collect all the employee's laptops in the morning.

Collecting the laptops has a high cost in lost employee productivity: There will be a queue of laptops waiting to be inspected. You can assume that all of the laptops can be inspected in half a day.

Limits: You can not mitigate the risk by changing the network configuration, You do not know how many laptops are still in the building. You can not take the servers offline.

Resources: 5 workers, some networking equipment, real servers (you can not disrupt those), "samples" of existing systems: a few spare workstations, a few spare laptops,

What do You know about the virus?
* It disables antivirus software
* It disables automatic software updates
* It can be cleaned up only manually in about 1 manhour

You need to develop an action plan:
* What You test in those scarce 12 hours?
* How?
* How do You weigh the results to make the decision?
* The plan itself must be short and easy to understand so You can write it on a whiteboard.
* Justifications for the specific actions go to a separate file/document.

=== Lab 7 ===
* Get viruses and XP install ISO-s from http://www.tud.ttu.ee/~anttix/lab7/
** Password for the protected zip: doomsday
* Alternatively, get Siims image
* Set up 5 VMS and connect them to a private network (or Host-Only network if You can't configure private nets):
** Plain old XP without any virus scanner (clean)
** Plain old XP with a virus scanner eg Avast (clean)
** Windows XP SP3, no virus scanner (clean)
** Plain old XP without any virus scanner (infected)
** Ubuntu Linux with tcpdump running
* If You have enogh time You can either:
** Find some more Worms and unleash them on Your virtual network (thanx to Urmas for those links)
*** http://vx.netlux.org/
*** http://www.excellentcontent.com/xbart/cbezels/
*** http://hacker-mc.blogspot.com/2008/12/pacoto-hacker.html
*** http://www.rohitab.com/discuss/oldfiles/
** Try to install Windows XP while it is connected to the infected network and see if You manage to install patches or antivirus before getting infected.

Measure the time it takes for the virus to penetrate the machines.
Note if virus scanner was able to catch the virus even if the underlying flaw in
windows wasn't patched.
Test if the SP3 version is immune to attacks originating from the network,
even when virus scanner is not installed.

== Scenario 8 ==

Find a solution to simulate a network of 300 PC-s in a single corporate environment, accessing a software update service at once.

Determine the load on primary internet connection and the router.
Assume that updates server will be able to keep up.

Tools to consider
* [http://www.ssfnet.org/homePage.html SSFNet]
* [http://www.omnetpp.org/ OMNeT++]

Additional resources
* [http://www.ssfnet.org/Exchange/gallery/index.html SSFNet module gallery]
* [http://code.google.com/p/omnet-httptools/ omnet-httptools]

=== Lab 8 ===
==== OMNet++ (Free for academic use only) ====
====== Install OMNeT++ ======
# Compile OMNet++ using these instructions: http://omnetpp.org/doc/omnetpp41/InstallGuide.pdf
# Run omnetpp IDE
# Choose Tutorials->Tic-toc tutorial from welcome page to open Tutorial documentation. Welcome page can be accessed from Help menu if You have accidentally closed it.
# Choose Go to workbench
# Click on tictoc in "Project Explorer" (on left hand pane)
# Choose Project->Open Project
# Choose Project->Build All

====== Install OMNeT++ INET framework ======
# Download https://github.com/downloads/inet-framework/inet/inet-20100723-src.tgz
# Create a directory named omnetpp-workspace and unpack inet-20100723-src.tgz in that directory.
# Switch Eclipse workspace to the newly-created directory: File -> Switch Workspace and select omnetpp-workspace.
# Follow instructions in omnetpp-workspace/inet/INSTALL file in the "If you are using the IDE" section

==== NS-3 (GPL Licensed) ====
Install all dependencies according to instructions [http://www.nsnam.org/wiki/index.php/Installation here] and [http://www.nsnam.org/wiki/index.php/PyViz here]

'''NB! Do not clone or compile anything yet'''

Clone NS-3 repositories
hg clone http://code.nsnam.org/ns-3-allinone
cd ns-3-allinone
./download.py -n gjc/ns-3.9-pyviz

Build NS-3
./build.py

Read the introduction slides during the build :)
* http://www.nsnam.org/tutorials/geni-tutorial-part1.pdf
* http://www.nsnam.org/tutorials.html

If You are unable to install the stuff, You may get an
Ubuntu VM with all of the stuff preinstalled from

http://www.tud.ttu.ee/~anttix/lab8/ubuntu10.04-omnetpp_ns3.vdi

Run Example visualizations
cd ns-3.9-pyviz
./waf --pyrun examples/flowmon/wifi-olsr-flowmon.py
./waf --run "examples/wireless/wifi-wired-bridging --viz=1"
./waf --run "examples/wireless/wifi-ap --viz=1"

Get itx8080 samples from:
http://www.tud.ttu.ee/~anttix/lab8/ns3-tty-v2.tar.gz

Run the samples
./waf --run "examples/tty/lecture1 --viz=1"
./waf --run "examples/tty/lecture2 --viz=1"
./waf --run examples/tty/lecture5

Look at the generated files: wantraffic*

Now create a new simulation that uses TCP networking instead of UDP. Refer to examples in examples/tcp.

== Scenario 9 ==

Simulate a DDoS attack against a network of web servers.

* 2 types of attacks
** SYN Flood
** "AB" style attack

Assumptions:
* 1000 "infected" hosts performing the attack
* 10 web servers, located in 5 locations
* The infected host only attacks one server
* The target to attack is selected randomly
* Assume that servers can keep up with the flood
* Data transferred during each connection is about 500kb

Objectives:
* Assess the bandwidth these attacks consume in each location

You can only implement a subset of constraints and assumptions.
Do as much as You can, maybe others have done even less :D

=== Lab 9 ===

Start by implementing proper network topology:
* Create a csma (ring) network for each location (5 networks in total)
* Set speed of the local network to 100Mbit/s
* Create 3 nodes for each location (2 servers, 1 router)
* Connect the nodes to their respective networks
* Create another CSMA(ring) network to mimic the core network
* Create 6 nodes to act as routers on that network
** one for each simulated location
** an "extra router" that all attackers will be connected to
* Set the speed of the core network to 10Gbit/s
* Connect location routers to "core" routers via Point-to-Point links
* Set the speed of those Point-to-Point links to 10Mbit/s
* Create 20 attacker nodes (just to speed up testing and development, You can increase that number to 1000 later)
* Connect all attacker nodes to the "extra" core router with point-to-point links
* Set the speed of attacker links to 1Mbit/s

ITX8080

2010-12-17T15:30:30Z

Anttix:

= General Information =
== Schedule ==

Lecture TH 12:00 - 13:30

Practice FR 14:00 - 17:30

== Communication ==

Discussinons will be held at: itx8080 atatat googlegroups.com

Send e-mail to hannesa at-no-spam-please gmail.com for an invitation.

The lecturers can be reached via the course coordinator:

antti.andreimann only-people-please eesti.ee

== Points awarded so far ==

Arnis : 3 points - ab testing solution, best countermeasure proposed for scenario 4, best snort rules proposed for scenario 6

Igor : 3 points - wordpress virtualization solution, lab 3 report, IDS testing solution

Kaarel : 2 points - lab 1 report and conclusions, lab 3 solution

Märt : 3 points - wordpress testing procedure, best wordpress optimization (wp-cache + php-apc), best lab 2 report.

Roland: 2 points - best Lab 4 report, IDS testing solution

Hannes: 1 point - best lab 6 report

Siim: 1 point - most popular scenario 7 solution

Urmas: 2 points - lab 5 report, the set of viruses used in lab 7

Martti: 1 point - best lab 7 report

Stefan: 1 points - best solutions developed during lab 8-1

Jeremy: 1 point - best solution developed during lab 8-2

Christopher: 1 point - best lab 8-1 report

Alexandra: 1 point - best lab 8-2 report.

= Scenarios =

== Scenario 1 ==
There is a Wordpress based blog.

The client is worried: How many visitors can they handle before they die.

Establish a baseline: How many page displays per second AT LEAST we can handle.
Disruption of the site operation is NOT acceptable.

Minimal budget!

Be as detailed and technical as You possibly can.

Post to the discussion group the following information:

# Detailed description of the simulation of the site. eg. if You're going to virtualize it then how? If You are running it as a process, then how You separate it from the real machine?
# Detailed description of the attack / benchmark tools picked. Where You are going to run them? What tools? How many copies? How you are going to collect the results?!!!

=== Proposals ===
Benchmarking:
* AB - Discussed in lecture
* http://tsung.erlang-projects.org - Jérémy
* wget + AB - Arnis
* http://jakarta.apache.org/jmeter/ - Roland, Jérémy
* http://grinder.sourceforge.net/ - Märt
* http://httpd.apache.org/test/flood/ - Hannes
* Normal monitoring software on live server - Urmas

Simulation of the system:
* VirtualBox - Roland, Jérémy
* VMWare ESX - Igor
* VMWare Player - Marina
* Amazon EC2 - Märt
* KVM - Siim
* Original hardware - Hannes

=== Lab 1 ===
We will need to create two different virtual machines, one is going to be the wordpress server and the 2nd one is the client which is used to attack the server. It's probably easiest to install only one image and then clone it.

Hard disk image cloning is best done with

Linux:
VBoxManage clonehd FirstUbuntu.vdi SecondUbuntu.vdi

Windows:
"C:\Program Files\Oracle\VirtualBox\VBoxManage.exe" clonehd FirstUbuntu.vdi SecondUbuntu.vdi

After cloning the image create another virtual machine and attach the 2nd disk to that machine. As the result there will be two different virtual machines with two different virtual hard disks.

To be able to connect between the two virtual machines, You need to add an
additional network adapter to both hosts. It can be either "Host Only" or
"Internal" type.

To enable the new adapters in Ubuntu edit the file: /etc/network/interfaces

== Scenario 2 ==
Design a method for evaluating any speedup solutions for the wordpress.
A repeatable process to evaluate the claims.
Whatever optimizations.
The process must be detailed enough so that somebody else can get the same results when applying that.
The "other person" is expected to have IT knowledge sufficient to install and run a Linux desktop.
The method must specify the level performance
at which the site is considered DEAD.
Budget requirements: Low - Dedicated machine + dedicated tester.

=== Lab 2 ===
* Get Virtual machine disk image and instructions from: http://www.tud.ttu.ee/~anttix/lab2/ '''NB! DO NOT DOWNLOAD IMAGE FROM THE LINK NOTED IN INSTRUCTIONS PDF, IT WILL BE SLOW'''
* Fix bug in image (see below)
* Measure the effect of these wordpress plugins:
** [http://wordpress.org/extend/plugins/wp-super-cache/ WP Super Cache]
** [http://wordpress.org/extend/plugins/wp-cache/ WP-Cache]
* Devise Your own optimizations for the site

Bug in image: the ip address of the VM is saved in WP database as 192.168.56.3
It is advised tu run the Target VM first and run the "sudo dhclient" command first in Target VM.
Then check active IP of target by command "ifconfig". If it is not 192.168.56.3, then situation can be fixed by running:

In Target VM: "sudo ifconfig eth2 192.168.56.3"
In Client VM: "sudo ifconfig eth2 192.168.56.4"

==== A note to Windows users ====
Use this command line to access VBoxManage program

"C:\Program Files\Oracle\VirtualBox\VBoxManage.exe"

==== Wordpress Admin access ====
Username: admin
Password: QIaTemvskSeM

==== Note to Ubuntu users ====
VirtualBox with WiFi Does NOT work properly http://ubuntuforums.org/showthread.php?t=782936

== Scenario 3 ==
Your client is worried about some stuff posted on a blog. They ask You to take care of it.
They have a throwaway "script kiddie" in a third world country, who will mount the attack
so You don't need to worry about hiding the attackers identity.

Devise a way to attack a wordpress (default installation) based site to render it
unusable (page view times over 60 seconds).

Attack resources: one PC, a script kiddie, internet connection of 2Mbit/s.

How are we going to evaluate the solutions?
* Easy to use instructions
* The most efficient use of available resources

Defacing will count, IF it works for the latest version of wordpress.

=== Lab 3 ===
Possible attacks:

* Brute force overload (AB or other benchmark), bang the slowest page possible.
* Connection flood (slowloris)
* SYN Flood (eg. with hping)
* Banging expensive operations (eg. adding big comments)
* etc.

== Scenario 4 ==
Develop countermeasures for the attacks simulated in Lab 3.

Limitations:
* No additional hardware
* No reactive measures

=== Lab 4 ===

Evaluate the countermeasures against attacks.
The countermeasures must not have negative effects
on "normal usage pattern".

Normal usage pattern is defined as:
* Bursts of 10 connections per IP address in 1 second
* Page load times not over 20 seconds

== Scenario 5 ==
Create a solution and instructions for testing IDS
systems against the wordpress site and attacks
tried in lab 3.

A repeatable process to evaluate vendor claims.
Whatever passive IDS system delivered as a VM or a dedicated box.

Creating the IDS system itself is out of scope.

The process must be detailed enough so that somebody else can get the same results when applying that.
The "other person" is expected to have IT knowledge sufficient to install and run a Linux desktop.

Budget requirements: Modest - 2 Dedicated machines + dedicated tester + networking equipment to connect these together.

The process must test at least the following:
* Port scan
* SYN flood
* slowloris/pyloris
* Ab overwhelming attack

=== Lab 5 ===
Instructions for installing Snort IDS and its web GUI called 'acidbase': https://help.ubuntu.com/community/SnortIDS

== Scenario 6 ==

Develop/download/find/whatever a SNORT configuration (rulesets, preprocessors, whatever)
that performs better than the default configuration in lab 5 tests.
By better we mean:
* Less false positives
* Less false negatives
* The objectives are contradictory so the rule of thumb is one false negative per 10 false positives eg. solution with 10 false positives and 2 false negatives is better than the solution with 100 false positives and 1 false negatives, but the solution with 10 false positives and 1 false negative is better than the solution with 1 false positive and 2 false negatives.
* Attack is defined by a single invocation of the test script.

== Scenario 7 ==

There is a new remote vulnerability in Windows.
You became aware of a new virus that targets this vulnerability at 7 PM.
The antivirus vendor has released an updated virus database, but it's probably not installed
on all of the computers yet. Your company has 500 employees, with half of them running on laptops. You have to decide in 12 hours, if You need to collect all the employee's laptops in the morning.

Collecting the laptops has a high cost in lost employee productivity: There will be a queue of laptops waiting to be inspected. You can assume that all of the laptops can be inspected in half a day.

Limits: You can not mitigate the risk by changing the network configuration, You do not know how many laptops are still in the building. You can not take the servers offline.

Resources: 5 workers, some networking equipment, real servers (you can not disrupt those), "samples" of existing systems: a few spare workstations, a few spare laptops,

What do You know about the virus?
* It disables antivirus software
* It disables automatic software updates
* It can be cleaned up only manually in about 1 manhour

You need to develop an action plan:
* What You test in those scarce 12 hours?
* How?
* How do You weigh the results to make the decision?
* The plan itself must be short and easy to understand so You can write it on a whiteboard.
* Justifications for the specific actions go to a separate file/document.

=== Lab 7 ===
* Get viruses and XP install ISO-s from http://www.tud.ttu.ee/~anttix/lab7/
** Password for the protected zip: doomsday
* Alternatively, get Siims image
* Set up 5 VMS and connect them to a private network (or Host-Only network if You can't configure private nets):
** Plain old XP without any virus scanner (clean)
** Plain old XP with a virus scanner eg Avast (clean)
** Windows XP SP3, no virus scanner (clean)
** Plain old XP without any virus scanner (infected)
** Ubuntu Linux with tcpdump running
* If You have enogh time You can either:
** Find some more Worms and unleash them on Your virtual network (thanx to Urmas for those links)
*** http://vx.netlux.org/
*** http://www.excellentcontent.com/xbart/cbezels/
*** http://hacker-mc.blogspot.com/2008/12/pacoto-hacker.html
*** http://www.rohitab.com/discuss/oldfiles/
** Try to install Windows XP while it is connected to the infected network and see if You manage to install patches or antivirus before getting infected.

Measure the time it takes for the virus to penetrate the machines.
Note if virus scanner was able to catch the virus even if the underlying flaw in
windows wasn't patched.
Test if the SP3 version is immune to attacks originating from the network,
even when virus scanner is not installed.

== Scenario 8 ==

Find a solution to simulate a network of 300 PC-s in a single corporate environment, accessing a software update service at once.

Determine the load on primary internet connection and the router.
Assume that updates server will be able to keep up.

Tools to consider
* [http://www.ssfnet.org/homePage.html SSFNet]
* [http://www.omnetpp.org/ OMNeT++]

Additional resources
* [http://www.ssfnet.org/Exchange/gallery/index.html SSFNet module gallery]
* [http://code.google.com/p/omnet-httptools/ omnet-httptools]

=== Lab 8 ===
==== OMNet++ (Free for academic use only) ====
====== Install OMNeT++ ======
# Compile OMNet++ using these instructions: http://omnetpp.org/doc/omnetpp41/InstallGuide.pdf
# Run omnetpp IDE
# Choose Tutorials->Tic-toc tutorial from welcome page to open Tutorial documentation. Welcome page can be accessed from Help menu if You have accidentally closed it.
# Choose Go to workbench
# Click on tictoc in "Project Explorer" (on left hand pane)
# Choose Project->Open Project
# Choose Project->Build All

====== Install OMNeT++ INET framework ======
# Download https://github.com/downloads/inet-framework/inet/inet-20100723-src.tgz
# Create a directory named omnetpp-workspace and unpack inet-20100723-src.tgz in that directory.
# Switch Eclipse workspace to the newly-created directory: File -> Switch Workspace and select omnetpp-workspace.
# Follow instructions in omnetpp-workspace/inet/INSTALL file in the "If you are using the IDE" section

==== NS-3 (GPL Licensed) ====
Install all dependencies according to instructions [http://www.nsnam.org/wiki/index.php/Installation here] and [http://www.nsnam.org/wiki/index.php/PyViz here]

'''NB! Do not clone or compile anything yet'''

Clone NS-3 repositories
hg clone http://code.nsnam.org/ns-3-allinone
cd ns-3-allinone
./download.py -n gjc/ns-3.9-pyviz

Build NS-3
./build.py

Read the introduction slides during the build :)
* http://www.nsnam.org/tutorials/geni-tutorial-part1.pdf
* http://www.nsnam.org/tutorials.html

If You are unable to install the stuff, You may get an
Ubuntu VM with all of the stuff preinstalled from

http://www.tud.ttu.ee/~anttix/lab8/ubuntu10.04-omnetpp_ns3.vdi

Run Example visualizations
cd ns-3.9-pyviz
./waf --pyrun examples/flowmon/wifi-olsr-flowmon.py
./waf --run "examples/wireless/wifi-wired-bridging --viz=1"
./waf --run "examples/wireless/wifi-ap --viz=1"

Get itx8080 samples from:
http://www.tud.ttu.ee/~anttix/lab8/ns3-tty-v2.tar.gz

Run the samples
./waf --run "examples/tty/lecture1 --viz=1"
./waf --run "examples/tty/lecture2 --viz=1"
./waf --run examples/tty/lecture5

Look at the generated files: wantraffic*

Now create a new simulation that uses TCP networking instead of UDP. Refer to examples in examples/tcp.

== Scenario 9 ==

Simulate a DDoS attack against a network of web servers.

* 2 types of attacks
** SYN Flood
** "AB" style attack

Assumptions:
* 1000 "infected" hosts performing the attack
* 10 web servers, located in 5 locations
* The infected host only attacks one server
* The target to attack is selected randomly
* Assume that servers can keep up with the flood
* Data transferred during each connection is about 500kb

Objectives:
* Assess the bandwidth these attacks consume in each location

You can only implement a subset of constraints and assumptions.
Do as much as You can, maybe others have done even less :D

=== Lab 9 ===

Start by implementing proper network topology:
* Create a csma (ring) network for each location (5 networks in total)
* Set speed of the local network to 100Mbit/s
* Create 3 nodes for each location (2 servers, 1 router)
* Connect the nodes to their respective networks
* Create another CSMA(ring) network to mimic the core network
* Create 6 nodes to act as routers on that network
* one for each simulated location
* an "extra router" that all attackers will be connected to
* Set the speed of the core network to 10Gbit/s
* Connect location routers to "core" routers via Point-to-Point links
* Set the speed of those Point-to-Point links to 10Mbit/s
* Create 20 attacker nodes (just to speed up testing and development, You can increase that number to 1000 later)
* Connect all attacker nodes to the "extra" core router with point-to-point links
* Set the speed of attacker links to 1Mbit/s

ITX8080

2010-12-16T19:18:36Z

Anttix:

ITX8080

2010-12-16T13:38:58Z

Anttix:

= General Information =
== Schedule ==

Lecture TH 12:00 - 13:30

Practice FR 14:00 - 17:30

== Communication ==

Discussinons will be held at: itx8080 atatat googlegroups.com

Send e-mail to hannesa at-no-spam-please gmail.com for an invitation.

The lecturers can be reached via the course coordinator:

antti.andreimann only-people-please eesti.ee

== Points awarded so far ==

Arnis : 3 points - ab testing solution, best countermeasure proposed for scenario 4, best snort rules proposed for scenario 6

Igor : 3 points - wordpress virtualization solution, lab 3 report, IDS testing solution

Kaarel : 2 points - lab 1 report and conclusions, lab 3 solution

Märt : 3 points - wordpress testing procedure, best wordpress optimization (wp-cache + php-apc), best lab 2 report.

Roland: 2 points - best Lab 4 report, IDS testing solution

Hannes: 1 point - best lab 6 report

Siim: 1 point - most popular scenario 7 solution

Urmas: 2 points - lab 5 report, the set of viruses used in lab 7

Martti: 1 point - best lab 7 report

Stefan: 1 points - best solutions developed during lab 8-1

Jeremy: 1 point - best solution developed during lab 8-2

Christopher: 1 point - best lab 8-1 report

Alexandra: 1 point - best lab 8-2 report.

= Scenarios =

== Scenario 1 ==
There is a Wordpress based blog.

The client is worried: How many visitors can they handle before they die.

Establish a baseline: How many page displays per second AT LEAST we can handle.
Disruption of the site operation is NOT acceptable.

Minimal budget!

Be as detailed and technical as You possibly can.

Post to the discussion group the following information:

# Detailed description of the simulation of the site. eg. if You're going to virtualize it then how? If You are running it as a process, then how You separate it from the real machine?
# Detailed description of the attack / benchmark tools picked. Where You are going to run them? What tools? How many copies? How you are going to collect the results?!!!

=== Proposals ===
Benchmarking:
* AB - Discussed in lecture
* http://tsung.erlang-projects.org - Jérémy
* wget + AB - Arnis
* http://jakarta.apache.org/jmeter/ - Roland, Jérémy
* http://grinder.sourceforge.net/ - Märt
* http://httpd.apache.org/test/flood/ - Hannes
* Normal monitoring software on live server - Urmas

Simulation of the system:
* VirtualBox - Roland, Jérémy
* VMWare ESX - Igor
* VMWare Player - Marina
* Amazon EC2 - Märt
* KVM - Siim
* Original hardware - Hannes

=== Lab 1 ===
We will need to create two different virtual machines, one is going to be the wordpress server and the 2nd one is the client which is used to attack the server. It's probably easiest to install only one image and then clone it.

Hard disk image cloning is best done with

Linux:
VBoxManage clonehd FirstUbuntu.vdi SecondUbuntu.vdi

Windows:
"C:\Program Files\Oracle\VirtualBox\VBoxManage.exe" clonehd FirstUbuntu.vdi SecondUbuntu.vdi

After cloning the image create another virtual machine and attach the 2nd disk to that machine. As the result there will be two different virtual machines with two different virtual hard disks.

To be able to connect between the two virtual machines, You need to add an
additional network adapter to both hosts. It can be either "Host Only" or
"Internal" type.

To enable the new adapters in Ubuntu edit the file: /etc/network/interfaces

== Scenario 2 ==
Design a method for evaluating any speedup solutions for the wordpress.
A repeatable process to evaluate the claims.
Whatever optimizations.
The process must be detailed enough so that somebody else can get the same results when applying that.
The "other person" is expected to have IT knowledge sufficient to install and run a Linux desktop.
The method must specify the level performance
at which the site is considered DEAD.
Budget requirements: Low - Dedicated machine + dedicated tester.

=== Lab 2 ===
* Get Virtual machine disk image and instructions from: http://www.tud.ttu.ee/~anttix/lab2/ '''NB! DO NOT DOWNLOAD IMAGE FROM THE LINK NOTED IN INSTRUCTIONS PDF, IT WILL BE SLOW'''
* Fix bug in image (see below)
* Measure the effect of these wordpress plugins:
** [http://wordpress.org/extend/plugins/wp-super-cache/ WP Super Cache]
** [http://wordpress.org/extend/plugins/wp-cache/ WP-Cache]
* Devise Your own optimizations for the site

Bug in image: the ip address of the VM is saved in WP database as 192.168.56.3
It is advised tu run the Target VM first and run the "sudo dhclient" command first in Target VM.
Then check active IP of target by command "ifconfig". If it is not 192.168.56.3, then situation can be fixed by running:

In Target VM: "sudo ifconfig eth2 192.168.56.3"
In Client VM: "sudo ifconfig eth2 192.168.56.4"

==== A note to Windows users ====
Use this command line to access VBoxManage program

"C:\Program Files\Oracle\VirtualBox\VBoxManage.exe"

==== Wordpress Admin access ====
Username: admin
Password: QIaTemvskSeM

==== Note to Ubuntu users ====
VirtualBox with WiFi Does NOT work properly http://ubuntuforums.org/showthread.php?t=782936

== Scenario 3 ==
Your client is worried about some stuff posted on a blog. They ask You to take care of it.
They have a throwaway "script kiddie" in a third world country, who will mount the attack
so You don't need to worry about hiding the attackers identity.

Devise a way to attack a wordpress (default installation) based site to render it
unusable (page view times over 60 seconds).

Attack resources: one PC, a script kiddie, internet connection of 2Mbit/s.

How are we going to evaluate the solutions?
* Easy to use instructions
* The most efficient use of available resources

Defacing will count, IF it works for the latest version of wordpress.

=== Lab 3 ===
Possible attacks:

* Brute force overload (AB or other benchmark), bang the slowest page possible.
* Connection flood (slowloris)
* SYN Flood (eg. with hping)
* Banging expensive operations (eg. adding big comments)
* etc.

== Scenario 4 ==
Develop countermeasures for the attacks simulated in Lab 3.

Limitations:
* No additional hardware
* No reactive measures

=== Lab 4 ===

Evaluate the countermeasures against attacks.
The countermeasures must not have negative effects
on "normal usage pattern".

Normal usage pattern is defined as:
* Bursts of 10 connections per IP address in 1 second
* Page load times not over 20 seconds

== Scenario 5 ==
Create a solution and instructions for testing IDS
systems against the wordpress site and attacks
tried in lab 3.

A repeatable process to evaluate vendor claims.
Whatever passive IDS system delivered as a VM or a dedicated box.

Creating the IDS system itself is out of scope.

The process must be detailed enough so that somebody else can get the same results when applying that.
The "other person" is expected to have IT knowledge sufficient to install and run a Linux desktop.

Budget requirements: Modest - 2 Dedicated machines + dedicated tester + networking equipment to connect these together.

The process must test at least the following:
* Port scan
* SYN flood
* slowloris/pyloris
* Ab overwhelming attack

=== Lab 5 ===
Instructions for installing Snort IDS and its web GUI called 'acidbase': https://help.ubuntu.com/community/SnortIDS

== Scenario 6 ==

Develop/download/find/whatever a SNORT configuration (rulesets, preprocessors, whatever)
that performs better than the default configuration in lab 5 tests.
By better we mean:
* Less false positives
* Less false negatives
* The objectives are contradictory so the rule of thumb is one false negative per 10 false positives eg. solution with 10 false positives and 2 false negatives is better than the solution with 100 false positives and 1 false negatives, but the solution with 10 false positives and 1 false negative is better than the solution with 1 false positive and 2 false negatives.
* Attack is defined by a single invocation of the test script.

== Scenario 7 ==

There is a new remote vulnerability in Windows.
You became aware of a new virus that targets this vulnerability at 7 PM.
The antivirus vendor has released an updated virus database, but it's probably not installed
on all of the computers yet. Your company has 500 employees, with half of them running on laptops. You have to decide in 12 hours, if You need to collect all the employee's laptops in the morning.

Collecting the laptops has a high cost in lost employee productivity: There will be a queue of laptops waiting to be inspected. You can assume that all of the laptops can be inspected in half a day.

Limits: You can not mitigate the risk by changing the network configuration, You do not know how many laptops are still in the building. You can not take the servers offline.

Resources: 5 workers, some networking equipment, real servers (you can not disrupt those), "samples" of existing systems: a few spare workstations, a few spare laptops,

What do You know about the virus?
* It disables antivirus software
* It disables automatic software updates
* It can be cleaned up only manually in about 1 manhour

You need to develop an action plan:
* What You test in those scarce 12 hours?
* How?
* How do You weigh the results to make the decision?
* The plan itself must be short and easy to understand so You can write it on a whiteboard.
* Justifications for the specific actions go to a separate file/document.

=== Lab 7 ===
* Get viruses and XP install ISO-s from http://www.tud.ttu.ee/~anttix/lab7/
** Password for the protected zip: doomsday
* Alternatively, get Siims image
* Set up 5 VMS and connect them to a private network (or Host-Only network if You can't configure private nets):
** Plain old XP without any virus scanner (clean)
** Plain old XP with a virus scanner eg Avast (clean)
** Windows XP SP3, no virus scanner (clean)
** Plain old XP without any virus scanner (infected)
** Ubuntu Linux with tcpdump running
* If You have enogh time You can either:
** Find some more Worms and unleash them on Your virtual network (thanx to Urmas for those links)
*** http://vx.netlux.org/
*** http://www.excellentcontent.com/xbart/cbezels/
*** http://hacker-mc.blogspot.com/2008/12/pacoto-hacker.html
*** http://www.rohitab.com/discuss/oldfiles/
** Try to install Windows XP while it is connected to the infected network and see if You manage to install patches or antivirus before getting infected.

Measure the time it takes for the virus to penetrate the machines.
Note if virus scanner was able to catch the virus even if the underlying flaw in
windows wasn't patched.
Test if the SP3 version is immune to attacks originating from the network,
even when virus scanner is not installed.

== Scenario 8 ==

Find a solution to simulate a network of 300 PC-s in a single corporate environment, accessing a software update service at once.

Determine the load on primary internet connection and the router.
Assume that updates server will be able to keep up.

Tools to consider
* [http://www.ssfnet.org/homePage.html SSFNet]
* [http://www.omnetpp.org/ OMNeT++]

Additional resources
* [http://www.ssfnet.org/Exchange/gallery/index.html SSFNet module gallery]
* [http://code.google.com/p/omnet-httptools/ omnet-httptools]

=== Lab 8 ===
==== OMNet++ (Free for academic use only) ====
====== Install OMNeT++ ======
# Compile OMNet++ using these instructions: http://omnetpp.org/doc/omnetpp41/InstallGuide.pdf
# Run omnetpp IDE
# Choose Tutorials->Tic-toc tutorial from welcome page to open Tutorial documentation. Welcome page can be accessed from Help menu if You have accidentally closed it.
# Choose Go to workbench
# Click on tictoc in "Project Explorer" (on left hand pane)
# Choose Project->Open Project
# Choose Project->Build All

====== Install OMNeT++ INET framework ======
# Download https://github.com/downloads/inet-framework/inet/inet-20100723-src.tgz
# Create a directory named omnetpp-workspace and unpack inet-20100723-src.tgz in that directory.
# Switch Eclipse workspace to the newly-created directory: File -> Switch Workspace and select omnetpp-workspace.
# Follow instructions in omnetpp-workspace/inet/INSTALL file in the "If you are using the IDE" section

==== NS-3 (GPL Licensed) ====
Install all dependencies according to instructions [http://www.nsnam.org/wiki/index.php/Installation here] and [http://www.nsnam.org/wiki/index.php/PyViz here]

'''NB! Do not clone or compile anything yet'''

Clone NS-3 repositories
hg clone http://code.nsnam.org/ns-3-allinone
cd ns-3-allinone
./download.py -n gjc/ns-3.9-pyviz

Build NS-3
./build.py

Read the introduction slides during the build :)
* http://www.nsnam.org/tutorials/geni-tutorial-part1.pdf
* http://www.nsnam.org/tutorials.html

If You are unable to install the stuff, You may get an
Ubuntu VM with all of the stuff preinstalled from

http://www.tud.ttu.ee/~anttix/lab8/ubuntu10.04-omnetpp_ns3.vdi

Run Example visualizations
cd ns-3.9-pyviz
./waf --pyrun examples/flowmon/wifi-olsr-flowmon.py
./waf --run "examples/wireless/wifi-wired-bridging --viz=1"
./waf --run "examples/wireless/wifi-ap --viz=1"

Get itx8080 samples from:
http://www.tud.ttu.ee/~anttix/lab8/ns3-tty-v2.tar.gz

Run the samples
./waf --run examples/tty/lecture1
./waf --run "examples/tty/lecture2 --vis=1"
./waf --run examples/tty/lecture2

Look at the generated files: wantraffic*

Now create a new simulation that uses TCP networking instead of UDP. Refer to examples in examples/tcp.

== Scenario 9 ==

Simulate a DDoS attack against a network of web servers.

* 2 types of attacks
** SYN Flood
** "AB" style attack

Assumptions:
* 1000 "infected" hosts performing the attack
* 10 web servers, located in 5 locations
* The infected host only attacks one server
* The target to attack is selected randomly
* Assume that servers can keep up with the flood
* Data transferred during each connection is about 500kb

Objectives:
* Assess the bandwidth these attacks consume in each location

You can only implement a subset of constraints and assumptions.
Do as much as You can, maybe others have done even less :D

ITX8080

2010-12-03T18:38:45Z

Anttix: /* Points awarded so far */

= General Information =
== Schedule ==

Lecture TH 12:00 - 13:30

Practice FR 14:00 - 17:30

== Communication ==

Discussinons will be held at: itx8080 atatat googlegroups.com

Send e-mail to hannesa at-no-spam-please gmail.com for an invitation.

The lecturers can be reached via the course coordinator:

antti.andreimann only-people-please eesti.ee

== Points awarded so far ==

Arnis : 3 points - ab testing solution, best countermeasure proposed for scenario 4, best snort rules proposed for scenario 6

Igor : 3 points - wordpress virtualization solution, lab 3 report, IDS testing solution

Kaarel : 2 points - lab 1 report and conclusions, lab 3 solution

Märt : 3 points - wordpress testing procedure, best wordpress optimization (wp-cache + php-apc), best lab 2 report.

Roland: 2 points - best Lab 4 report, IDS testing solution

Hannes: 1 point - best lab 6 report

Siim: 1 point - most popular scenario 7 solution

Urmas: 2 points - lab 5 report, the set of viruses used in lab 7

Martti: 1 point - best lab 7 report

Stefan: 1 points - best solutions developed during lab 8-1

Jeremy: 1 point - best solution developed during lab 8-2

Christopher: 1 point - best lab 8-1 report

= Scenarios =

== Scenario 1 ==
There is a Wordpress based blog.

The client is worried: How many visitors can they handle before they die.

Establish a baseline: How many page displays per second AT LEAST we can handle.
Disruption of the site operation is NOT acceptable.

Minimal budget!

Be as detailed and technical as You possibly can.

Post to the discussion group the following information:

# Detailed description of the simulation of the site. eg. if You're going to virtualize it then how? If You are running it as a process, then how You separate it from the real machine?
# Detailed description of the attack / benchmark tools picked. Where You are going to run them? What tools? How many copies? How you are going to collect the results?!!!

=== Proposals ===
Benchmarking:
* AB - Discussed in lecture
* http://tsung.erlang-projects.org - Jérémy
* wget + AB - Arnis
* http://jakarta.apache.org/jmeter/ - Roland, Jérémy
* http://grinder.sourceforge.net/ - Märt
* http://httpd.apache.org/test/flood/ - Hannes
* Normal monitoring software on live server - Urmas

Simulation of the system:
* VirtualBox - Roland, Jérémy
* VMWare ESX - Igor
* VMWare Player - Marina
* Amazon EC2 - Märt
* KVM - Siim
* Original hardware - Hannes

=== Lab 1 ===
We will need to create two different virtual machines, one is going to be the wordpress server and the 2nd one is the client which is used to attack the server. It's probably easiest to install only one image and then clone it.

Hard disk image cloning is best done with

Linux:
VBoxManage clonehd FirstUbuntu.vdi SecondUbuntu.vdi

Windows:
"C:\Program Files\Oracle\VirtualBox\VBoxManage.exe" clonehd FirstUbuntu.vdi SecondUbuntu.vdi

After cloning the image create another virtual machine and attach the 2nd disk to that machine. As the result there will be two different virtual machines with two different virtual hard disks.

To be able to connect between the two virtual machines, You need to add an
additional network adapter to both hosts. It can be either "Host Only" or
"Internal" type.

To enable the new adapters in Ubuntu edit the file: /etc/network/interfaces

== Scenario 2 ==
Design a method for evaluating any speedup solutions for the wordpress.
A repeatable process to evaluate the claims.
Whatever optimizations.
The process must be detailed enough so that somebody else can get the same results when applying that.
The "other person" is expected to have IT knowledge sufficient to install and run a Linux desktop.
The method must specify the level performance
at which the site is considered DEAD.
Budget requirements: Low - Dedicated machine + dedicated tester.

=== Lab 2 ===
* Get Virtual machine disk image and instructions from: http://www.tud.ttu.ee/~anttix/lab2/ '''NB! DO NOT DOWNLOAD IMAGE FROM THE LINK NOTED IN INSTRUCTIONS PDF, IT WILL BE SLOW'''
* Fix bug in image (see below)
* Measure the effect of these wordpress plugins:
** [http://wordpress.org/extend/plugins/wp-super-cache/ WP Super Cache]
** [http://wordpress.org/extend/plugins/wp-cache/ WP-Cache]
* Devise Your own optimizations for the site

Bug in image: the ip address of the VM is saved in WP database as 192.168.56.3
It is advised tu run the Target VM first and run the "sudo dhclient" command first in Target VM.
Then check active IP of target by command "ifconfig". If it is not 192.168.56.3, then situation can be fixed by running:

In Target VM: "sudo ifconfig eth2 192.168.56.3"
In Client VM: "sudo ifconfig eth2 192.168.56.4"

==== A note to Windows users ====
Use this command line to access VBoxManage program

"C:\Program Files\Oracle\VirtualBox\VBoxManage.exe"

==== Wordpress Admin access ====
Username: admin
Password: QIaTemvskSeM

==== Note to Ubuntu users ====
VirtualBox with WiFi Does NOT work properly http://ubuntuforums.org/showthread.php?t=782936

== Scenario 3 ==
Your client is worried about some stuff posted on a blog. They ask You to take care of it.
They have a throwaway "script kiddie" in a third world country, who will mount the attack
so You don't need to worry about hiding the attackers identity.

Devise a way to attack a wordpress (default installation) based site to render it
unusable (page view times over 60 seconds).

Attack resources: one PC, a script kiddie, internet connection of 2Mbit/s.

How are we going to evaluate the solutions?
* Easy to use instructions
* The most efficient use of available resources

Defacing will count, IF it works for the latest version of wordpress.

=== Lab 3 ===
Possible attacks:

* Brute force overload (AB or other benchmark), bang the slowest page possible.
* Connection flood (slowloris)
* SYN Flood (eg. with hping)
* Banging expensive operations (eg. adding big comments)
* etc.

== Scenario 4 ==
Develop countermeasures for the attacks simulated in Lab 3.

Limitations:
* No additional hardware
* No reactive measures

=== Lab 4 ===

Evaluate the countermeasures against attacks.
The countermeasures must not have negative effects
on "normal usage pattern".

Normal usage pattern is defined as:
* Bursts of 10 connections per IP address in 1 second
* Page load times not over 20 seconds

== Scenario 5 ==
Create a solution and instructions for testing IDS
systems against the wordpress site and attacks
tried in lab 3.

A repeatable process to evaluate vendor claims.
Whatever passive IDS system delivered as a VM or a dedicated box.

Creating the IDS system itself is out of scope.

The process must be detailed enough so that somebody else can get the same results when applying that.
The "other person" is expected to have IT knowledge sufficient to install and run a Linux desktop.

Budget requirements: Modest - 2 Dedicated machines + dedicated tester + networking equipment to connect these together.

The process must test at least the following:
* Port scan
* SYN flood
* slowloris/pyloris
* Ab overwhelming attack

=== Lab 5 ===
Instructions for installing Snort IDS and its web GUI called 'acidbase': https://help.ubuntu.com/community/SnortIDS

== Scenario 6 ==

Develop/download/find/whatever a SNORT configuration (rulesets, preprocessors, whatever)
that performs better than the default configuration in lab 5 tests.
By better we mean:
* Less false positives
* Less false negatives
* The objectives are contradictory so the rule of thumb is one false negative per 10 false positives eg. solution with 10 false positives and 2 false negatives is better than the solution with 100 false positives and 1 false negatives, but the solution with 10 false positives and 1 false negative is better than the solution with 1 false positive and 2 false negatives.
* Attack is defined by a single invocation of the test script.

== Scenario 7 ==

There is a new remote vulnerability in Windows.
You became aware of a new virus that targets this vulnerability at 7 PM.
The antivirus vendor has released an updated virus database, but it's probably not installed
on all of the computers yet. Your company has 500 employees, with half of them running on laptops. You have to decide in 12 hours, if You need to collect all the employee's laptops in the morning.

Collecting the laptops has a high cost in lost employee productivity: There will be a queue of laptops waiting to be inspected. You can assume that all of the laptops can be inspected in half a day.

Limits: You can not mitigate the risk by changing the network configuration, You do not know how many laptops are still in the building. You can not take the servers offline.

Resources: 5 workers, some networking equipment, real servers (you can not disrupt those), "samples" of existing systems: a few spare workstations, a few spare laptops,

What do You know about the virus?
* It disables antivirus software
* It disables automatic software updates
* It can be cleaned up only manually in about 1 manhour

You need to develop an action plan:
* What You test in those scarce 12 hours?
* How?
* How do You weigh the results to make the decision?
* The plan itself must be short and easy to understand so You can write it on a whiteboard.
* Justifications for the specific actions go to a separate file/document.

=== Lab 7 ===
* Get viruses and XP install ISO-s from http://www.tud.ttu.ee/~anttix/lab7/
** Password for the protected zip: doomsday
* Alternatively, get Siims image
* Set up 5 VMS and connect them to a private network (or Host-Only network if You can't configure private nets):
** Plain old XP without any virus scanner (clean)
** Plain old XP with a virus scanner eg Avast (clean)
** Windows XP SP3, no virus scanner (clean)
** Plain old XP without any virus scanner (infected)
** Ubuntu Linux with tcpdump running
* If You have enogh time You can either:
** Find some more Worms and unleash them on Your virtual network (thanx to Urmas for those links)
*** http://vx.netlux.org/
*** http://www.excellentcontent.com/xbart/cbezels/
*** http://hacker-mc.blogspot.com/2008/12/pacoto-hacker.html
*** http://www.rohitab.com/discuss/oldfiles/
** Try to install Windows XP while it is connected to the infected network and see if You manage to install patches or antivirus before getting infected.

Measure the time it takes for the virus to penetrate the machines.
Note if virus scanner was able to catch the virus even if the underlying flaw in
windows wasn't patched.
Test if the SP3 version is immune to attacks originating from the network,
even when virus scanner is not installed.

== Scenario 8 ==

Find a solution to simulate a network of 300 PC-s in a single corporate environment, accessing a software update service at once.

Determine the load on primary internet connection and the router.
Assume that updates server will be able to keep up.

Tools to consider
* [http://www.ssfnet.org/homePage.html SSFNet]
* [http://www.omnetpp.org/ OMNeT++]

Additional resources
* [http://www.ssfnet.org/Exchange/gallery/index.html SSFNet module gallery]
* [http://code.google.com/p/omnet-httptools/ omnet-httptools]

=== Lab 8 ===
==== OMNet++ (Free for academic use only) ====
====== Install OMNeT++ ======
# Compile OMNet++ using these instructions: http://omnetpp.org/doc/omnetpp41/InstallGuide.pdf
# Run omnetpp IDE
# Choose Tutorials->Tic-toc tutorial from welcome page to open Tutorial documentation. Welcome page can be accessed from Help menu if You have accidentally closed it.
# Choose Go to workbench
# Click on tictoc in "Project Explorer" (on left hand pane)
# Choose Project->Open Project
# Choose Project->Build All

====== Install OMNeT++ INET framework ======
# Download https://github.com/downloads/inet-framework/inet/inet-20100723-src.tgz
# Create a directory named omnetpp-workspace and unpack inet-20100723-src.tgz in that directory.
# Switch Eclipse workspace to the newly-created directory: File -> Switch Workspace and select omnetpp-workspace.
# Follow instructions in omnetpp-workspace/inet/INSTALL file in the "If you are using the IDE" section

==== NS-3 (GPL Licensed) ====
Install all dependencies according to instructions [http://www.nsnam.org/wiki/index.php/Installation here] and [http://www.nsnam.org/wiki/index.php/PyViz here]

'''NB! Do not clone or compile anything yet'''

Clone NS-3 repositories
hg clone http://code.nsnam.org/ns-3-allinone
cd ns-3-allinone
./download.py -n gjc/ns-3.9-pyviz

Build NS-3
./build.py

Read the introduction slides during the build :)
* http://www.nsnam.org/tutorials/geni-tutorial-part1.pdf
* http://www.nsnam.org/tutorials.html

If You are unable to install the stuff, You may get an
Ubuntu VM with all of the stuff preinstalled from

http://www.tud.ttu.ee/~anttix/lab8/ubuntu10.04-omnetpp_ns3.vdi

Run Example visualizations
cd ns-3.9-pyviz
./waf --pyrun examples/flowmon/wifi-olsr-flowmon.py
./waf --run "examples/wireless/wifi-wired-bridging --viz=1"
./waf --run "examples/wireless/wifi-ap --viz=1"

Get itx8080 samples from:
http://www.tud.ttu.ee/~anttix/lab8/ns3-tty-v2.tar.gz

Run the samples
./waf --run examples/tty/lecture1
./waf --run "examples/tty/lecture2 --vis=1"
./waf --run examples/tty/lecture2

Look at the generated files: wantraffic*

Now create a new simulation that uses TCP networking instead of UDP. Refer to examples in examples/tcp.

== Scenario 9 ==

Simulate a DDoS attack against a network of web servers.

* 2 types of attacks
** SYN Flood
** "AB" style attack

Assumptions:
* 1000 "infected" hosts performing the attack
* 10 web servers, located in 5 locations
* The infected host only attacks one server
* The target to attack is selected randomly
* Assume that servers can keep up with the flood
* Data transferred during each connection is about 500kb

Objectives:
* Assess the bandwidth these attacks consume in each location

You can only implement a subset of constraints and assumptions.
Do as much as You can, maybe others have done even less :D

ITX8080

2010-12-03T18:36:55Z

Anttix: /* Points awarded so far */

= General Information =
== Schedule ==

Lecture TH 12:00 - 13:30

Practice FR 14:00 - 17:30

== Communication ==

Discussinons will be held at: itx8080 atatat googlegroups.com

Send e-mail to hannesa at-no-spam-please gmail.com for an invitation.

The lecturers can be reached via the course coordinator:

antti.andreimann only-people-please eesti.ee

== Points awarded so far ==

Arnis : 3 points - ab testing solution, best countermeasure proposed for scenario 4, best snort rules proposed for scenario 6

Igor : 3 points - wordpress virtualization solution, lab 3 report, IDS testing solution

Kaarel : 2 points - lab 1 report and conclusions, lab 3 solution

Märt : 3 points - wordpress testing procedure, best wordpress optimization (wp-cache + php-apc), best lab 2 report.

Roland: 2 points - best Lab 4 report, IDS testing solution

Hannes: 1 point - best lab 6 report

Siim: 1 point - most popular scenario 7 solution

Urmas: 2 points - lab 5 report, the set of viruses used in lab 7

Martti: 1 point - best lab 7 report

Stefan: 2 points - best solutions developed during lab 8-1 and 8-2

= Scenarios =

== Scenario 1 ==
There is a Wordpress based blog.

The client is worried: How many visitors can they handle before they die.

Establish a baseline: How many page displays per second AT LEAST we can handle.
Disruption of the site operation is NOT acceptable.

Minimal budget!

Be as detailed and technical as You possibly can.

Post to the discussion group the following information:

# Detailed description of the simulation of the site. eg. if You're going to virtualize it then how? If You are running it as a process, then how You separate it from the real machine?
# Detailed description of the attack / benchmark tools picked. Where You are going to run them? What tools? How many copies? How you are going to collect the results?!!!

=== Proposals ===
Benchmarking:
* AB - Discussed in lecture
* http://tsung.erlang-projects.org - Jérémy
* wget + AB - Arnis
* http://jakarta.apache.org/jmeter/ - Roland, Jérémy
* http://grinder.sourceforge.net/ - Märt
* http://httpd.apache.org/test/flood/ - Hannes
* Normal monitoring software on live server - Urmas

Simulation of the system:
* VirtualBox - Roland, Jérémy
* VMWare ESX - Igor
* VMWare Player - Marina
* Amazon EC2 - Märt
* KVM - Siim
* Original hardware - Hannes

=== Lab 1 ===
We will need to create two different virtual machines, one is going to be the wordpress server and the 2nd one is the client which is used to attack the server. It's probably easiest to install only one image and then clone it.

Hard disk image cloning is best done with

Linux:
VBoxManage clonehd FirstUbuntu.vdi SecondUbuntu.vdi

Windows:
"C:\Program Files\Oracle\VirtualBox\VBoxManage.exe" clonehd FirstUbuntu.vdi SecondUbuntu.vdi

After cloning the image create another virtual machine and attach the 2nd disk to that machine. As the result there will be two different virtual machines with two different virtual hard disks.

To be able to connect between the two virtual machines, You need to add an
additional network adapter to both hosts. It can be either "Host Only" or
"Internal" type.

To enable the new adapters in Ubuntu edit the file: /etc/network/interfaces

== Scenario 2 ==
Design a method for evaluating any speedup solutions for the wordpress.
A repeatable process to evaluate the claims.
Whatever optimizations.
The process must be detailed enough so that somebody else can get the same results when applying that.
The "other person" is expected to have IT knowledge sufficient to install and run a Linux desktop.
The method must specify the level performance
at which the site is considered DEAD.
Budget requirements: Low - Dedicated machine + dedicated tester.

=== Lab 2 ===
* Get Virtual machine disk image and instructions from: http://www.tud.ttu.ee/~anttix/lab2/ '''NB! DO NOT DOWNLOAD IMAGE FROM THE LINK NOTED IN INSTRUCTIONS PDF, IT WILL BE SLOW'''
* Fix bug in image (see below)
* Measure the effect of these wordpress plugins:
** [http://wordpress.org/extend/plugins/wp-super-cache/ WP Super Cache]
** [http://wordpress.org/extend/plugins/wp-cache/ WP-Cache]
* Devise Your own optimizations for the site

Bug in image: the ip address of the VM is saved in WP database as 192.168.56.3
It is advised tu run the Target VM first and run the "sudo dhclient" command first in Target VM.
Then check active IP of target by command "ifconfig". If it is not 192.168.56.3, then situation can be fixed by running:

In Target VM: "sudo ifconfig eth2 192.168.56.3"
In Client VM: "sudo ifconfig eth2 192.168.56.4"

==== A note to Windows users ====
Use this command line to access VBoxManage program

"C:\Program Files\Oracle\VirtualBox\VBoxManage.exe"

==== Wordpress Admin access ====
Username: admin
Password: QIaTemvskSeM

==== Note to Ubuntu users ====
VirtualBox with WiFi Does NOT work properly http://ubuntuforums.org/showthread.php?t=782936

== Scenario 3 ==
Your client is worried about some stuff posted on a blog. They ask You to take care of it.
They have a throwaway "script kiddie" in a third world country, who will mount the attack
so You don't need to worry about hiding the attackers identity.

Devise a way to attack a wordpress (default installation) based site to render it
unusable (page view times over 60 seconds).

Attack resources: one PC, a script kiddie, internet connection of 2Mbit/s.

How are we going to evaluate the solutions?
* Easy to use instructions
* The most efficient use of available resources

Defacing will count, IF it works for the latest version of wordpress.

=== Lab 3 ===
Possible attacks:

* Brute force overload (AB or other benchmark), bang the slowest page possible.
* Connection flood (slowloris)
* SYN Flood (eg. with hping)
* Banging expensive operations (eg. adding big comments)
* etc.

== Scenario 4 ==
Develop countermeasures for the attacks simulated in Lab 3.

Limitations:
* No additional hardware
* No reactive measures

=== Lab 4 ===

Evaluate the countermeasures against attacks.
The countermeasures must not have negative effects
on "normal usage pattern".

Normal usage pattern is defined as:
* Bursts of 10 connections per IP address in 1 second
* Page load times not over 20 seconds

== Scenario 5 ==
Create a solution and instructions for testing IDS
systems against the wordpress site and attacks
tried in lab 3.

A repeatable process to evaluate vendor claims.
Whatever passive IDS system delivered as a VM or a dedicated box.

Creating the IDS system itself is out of scope.

The process must be detailed enough so that somebody else can get the same results when applying that.
The "other person" is expected to have IT knowledge sufficient to install and run a Linux desktop.

Budget requirements: Modest - 2 Dedicated machines + dedicated tester + networking equipment to connect these together.

The process must test at least the following:
* Port scan
* SYN flood
* slowloris/pyloris
* Ab overwhelming attack

=== Lab 5 ===
Instructions for installing Snort IDS and its web GUI called 'acidbase': https://help.ubuntu.com/community/SnortIDS

== Scenario 6 ==

Develop/download/find/whatever a SNORT configuration (rulesets, preprocessors, whatever)
that performs better than the default configuration in lab 5 tests.
By better we mean:
* Less false positives
* Less false negatives
* The objectives are contradictory so the rule of thumb is one false negative per 10 false positives eg. solution with 10 false positives and 2 false negatives is better than the solution with 100 false positives and 1 false negatives, but the solution with 10 false positives and 1 false negative is better than the solution with 1 false positive and 2 false negatives.
* Attack is defined by a single invocation of the test script.

== Scenario 7 ==

There is a new remote vulnerability in Windows.
You became aware of a new virus that targets this vulnerability at 7 PM.
The antivirus vendor has released an updated virus database, but it's probably not installed
on all of the computers yet. Your company has 500 employees, with half of them running on laptops. You have to decide in 12 hours, if You need to collect all the employee's laptops in the morning.

Collecting the laptops has a high cost in lost employee productivity: There will be a queue of laptops waiting to be inspected. You can assume that all of the laptops can be inspected in half a day.

Limits: You can not mitigate the risk by changing the network configuration, You do not know how many laptops are still in the building. You can not take the servers offline.

Resources: 5 workers, some networking equipment, real servers (you can not disrupt those), "samples" of existing systems: a few spare workstations, a few spare laptops,

What do You know about the virus?
* It disables antivirus software
* It disables automatic software updates
* It can be cleaned up only manually in about 1 manhour

You need to develop an action plan:
* What You test in those scarce 12 hours?
* How?
* How do You weigh the results to make the decision?
* The plan itself must be short and easy to understand so You can write it on a whiteboard.
* Justifications for the specific actions go to a separate file/document.

=== Lab 7 ===
* Get viruses and XP install ISO-s from http://www.tud.ttu.ee/~anttix/lab7/
** Password for the protected zip: doomsday
* Alternatively, get Siims image
* Set up 5 VMS and connect them to a private network (or Host-Only network if You can't configure private nets):
** Plain old XP without any virus scanner (clean)
** Plain old XP with a virus scanner eg Avast (clean)
** Windows XP SP3, no virus scanner (clean)
** Plain old XP without any virus scanner (infected)
** Ubuntu Linux with tcpdump running
* If You have enogh time You can either:
** Find some more Worms and unleash them on Your virtual network (thanx to Urmas for those links)
*** http://vx.netlux.org/
*** http://www.excellentcontent.com/xbart/cbezels/
*** http://hacker-mc.blogspot.com/2008/12/pacoto-hacker.html
*** http://www.rohitab.com/discuss/oldfiles/
** Try to install Windows XP while it is connected to the infected network and see if You manage to install patches or antivirus before getting infected.

Measure the time it takes for the virus to penetrate the machines.
Note if virus scanner was able to catch the virus even if the underlying flaw in
windows wasn't patched.
Test if the SP3 version is immune to attacks originating from the network,
even when virus scanner is not installed.

== Scenario 8 ==

Find a solution to simulate a network of 300 PC-s in a single corporate environment, accessing a software update service at once.

Determine the load on primary internet connection and the router.
Assume that updates server will be able to keep up.

Tools to consider
* [http://www.ssfnet.org/homePage.html SSFNet]
* [http://www.omnetpp.org/ OMNeT++]

Additional resources
* [http://www.ssfnet.org/Exchange/gallery/index.html SSFNet module gallery]
* [http://code.google.com/p/omnet-httptools/ omnet-httptools]

=== Lab 8 ===
==== OMNet++ (Free for academic use only) ====
====== Install OMNeT++ ======
# Compile OMNet++ using these instructions: http://omnetpp.org/doc/omnetpp41/InstallGuide.pdf
# Run omnetpp IDE
# Choose Tutorials->Tic-toc tutorial from welcome page to open Tutorial documentation. Welcome page can be accessed from Help menu if You have accidentally closed it.
# Choose Go to workbench
# Click on tictoc in "Project Explorer" (on left hand pane)
# Choose Project->Open Project
# Choose Project->Build All

====== Install OMNeT++ INET framework ======
# Download https://github.com/downloads/inet-framework/inet/inet-20100723-src.tgz
# Create a directory named omnetpp-workspace and unpack inet-20100723-src.tgz in that directory.
# Switch Eclipse workspace to the newly-created directory: File -> Switch Workspace and select omnetpp-workspace.
# Follow instructions in omnetpp-workspace/inet/INSTALL file in the "If you are using the IDE" section

==== NS-3 (GPL Licensed) ====
Install all dependencies according to instructions [http://www.nsnam.org/wiki/index.php/Installation here] and [http://www.nsnam.org/wiki/index.php/PyViz here]

'''NB! Do not clone or compile anything yet'''

Clone NS-3 repositories
hg clone http://code.nsnam.org/ns-3-allinone
cd ns-3-allinone
./download.py -n gjc/ns-3.9-pyviz

Build NS-3
./build.py

Read the introduction slides during the build :)
* http://www.nsnam.org/tutorials/geni-tutorial-part1.pdf
* http://www.nsnam.org/tutorials.html

If You are unable to install the stuff, You may get an
Ubuntu VM with all of the stuff preinstalled from

http://www.tud.ttu.ee/~anttix/lab8/ubuntu10.04-omnetpp_ns3.vdi

Run Example visualizations
cd ns-3.9-pyviz
./waf --pyrun examples/flowmon/wifi-olsr-flowmon.py
./waf --run "examples/wireless/wifi-wired-bridging --viz=1"
./waf --run "examples/wireless/wifi-ap --viz=1"

Get itx8080 samples from:
http://www.tud.ttu.ee/~anttix/lab8/ns3-tty-v2.tar.gz

Run the samples
./waf --run examples/tty/lecture1
./waf --run "examples/tty/lecture2 --vis=1"
./waf --run examples/tty/lecture2

Look at the generated files: wantraffic*

Now create a new simulation that uses TCP networking instead of UDP. Refer to examples in examples/tcp.

== Scenario 9 ==

Simulate a DDoS attack against a network of web servers.

* 2 types of attacks
** SYN Flood
** "AB" style attack

Assumptions:
* 1000 "infected" hosts performing the attack
* 10 web servers, located in 5 locations
* The infected host only attacks one server
* The target to attack is selected randomly
* Assume that servers can keep up with the flood
* Data transferred during each connection is about 500kb

Objectives:
* Assess the bandwidth these attacks consume in each location

You can only implement a subset of constraints and assumptions.
Do as much as You can, maybe others have done even less :D

ITX8080

2010-12-03T17:33:43Z

Anttix: /* NS-3 (GPL Licensed) */

= General Information =
== Schedule ==

Lecture TH 12:00 - 13:30

Practice FR 14:00 - 17:30

== Communication ==

Discussinons will be held at: itx8080 atatat googlegroups.com

Send e-mail to hannesa at-no-spam-please gmail.com for an invitation.

The lecturers can be reached via the course coordinator:

antti.andreimann only-people-please eesti.ee

== Points awarded so far ==

Arnis : 3 points - ab testing solution, best countermeasure proposed for scenario 4, best snort rules proposed for scenario 6

Igor : 3 points - wordpress virtualization solution, lab 3 report, IDS testing solution

Kaarel : 2 points - lab 1 report and conclusions, lab 3 solution

Märt : 3 points - wordpress testing procedure, best wordpress optimization (wp-cache + php-apc), best lab 2 report.

Roland: 2 points - best Lab 4 report, IDS testing solution

Hannes: 1 point - best lab 6 report

Siim: 1 point - most popular scenario 7 solution

Urmas: 2 points - lab 5 report, the set of viruses used in lab 7

Martti: 1 point - best lab 7 report

Stefan: 1 point - best solution developed during lab 8

= Scenarios =

== Scenario 1 ==
There is a Wordpress based blog.

The client is worried: How many visitors can they handle before they die.

Establish a baseline: How many page displays per second AT LEAST we can handle.
Disruption of the site operation is NOT acceptable.

Minimal budget!

Be as detailed and technical as You possibly can.

Post to the discussion group the following information:

# Detailed description of the simulation of the site. eg. if You're going to virtualize it then how? If You are running it as a process, then how You separate it from the real machine?
# Detailed description of the attack / benchmark tools picked. Where You are going to run them? What tools? How many copies? How you are going to collect the results?!!!

=== Proposals ===
Benchmarking:
* AB - Discussed in lecture
* http://tsung.erlang-projects.org - Jérémy
* wget + AB - Arnis
* http://jakarta.apache.org/jmeter/ - Roland, Jérémy
* http://grinder.sourceforge.net/ - Märt
* http://httpd.apache.org/test/flood/ - Hannes
* Normal monitoring software on live server - Urmas

Simulation of the system:
* VirtualBox - Roland, Jérémy
* VMWare ESX - Igor
* VMWare Player - Marina
* Amazon EC2 - Märt
* KVM - Siim
* Original hardware - Hannes

=== Lab 1 ===
We will need to create two different virtual machines, one is going to be the wordpress server and the 2nd one is the client which is used to attack the server. It's probably easiest to install only one image and then clone it.

Hard disk image cloning is best done with

Linux:
VBoxManage clonehd FirstUbuntu.vdi SecondUbuntu.vdi

Windows:
"C:\Program Files\Oracle\VirtualBox\VBoxManage.exe" clonehd FirstUbuntu.vdi SecondUbuntu.vdi

After cloning the image create another virtual machine and attach the 2nd disk to that machine. As the result there will be two different virtual machines with two different virtual hard disks.

To be able to connect between the two virtual machines, You need to add an
additional network adapter to both hosts. It can be either "Host Only" or
"Internal" type.

To enable the new adapters in Ubuntu edit the file: /etc/network/interfaces

== Scenario 2 ==
Design a method for evaluating any speedup solutions for the wordpress.
A repeatable process to evaluate the claims.
Whatever optimizations.
The process must be detailed enough so that somebody else can get the same results when applying that.
The "other person" is expected to have IT knowledge sufficient to install and run a Linux desktop.
The method must specify the level performance
at which the site is considered DEAD.
Budget requirements: Low - Dedicated machine + dedicated tester.

=== Lab 2 ===
* Get Virtual machine disk image and instructions from: http://www.tud.ttu.ee/~anttix/lab2/ '''NB! DO NOT DOWNLOAD IMAGE FROM THE LINK NOTED IN INSTRUCTIONS PDF, IT WILL BE SLOW'''
* Fix bug in image (see below)
* Measure the effect of these wordpress plugins:
** [http://wordpress.org/extend/plugins/wp-super-cache/ WP Super Cache]
** [http://wordpress.org/extend/plugins/wp-cache/ WP-Cache]
* Devise Your own optimizations for the site

Bug in image: the ip address of the VM is saved in WP database as 192.168.56.3
It is advised tu run the Target VM first and run the "sudo dhclient" command first in Target VM.
Then check active IP of target by command "ifconfig". If it is not 192.168.56.3, then situation can be fixed by running:

In Target VM: "sudo ifconfig eth2 192.168.56.3"
In Client VM: "sudo ifconfig eth2 192.168.56.4"

==== A note to Windows users ====
Use this command line to access VBoxManage program

"C:\Program Files\Oracle\VirtualBox\VBoxManage.exe"

==== Wordpress Admin access ====
Username: admin
Password: QIaTemvskSeM

==== Note to Ubuntu users ====
VirtualBox with WiFi Does NOT work properly http://ubuntuforums.org/showthread.php?t=782936

== Scenario 3 ==
Your client is worried about some stuff posted on a blog. They ask You to take care of it.
They have a throwaway "script kiddie" in a third world country, who will mount the attack
so You don't need to worry about hiding the attackers identity.

Devise a way to attack a wordpress (default installation) based site to render it
unusable (page view times over 60 seconds).

Attack resources: one PC, a script kiddie, internet connection of 2Mbit/s.

How are we going to evaluate the solutions?
* Easy to use instructions
* The most efficient use of available resources

Defacing will count, IF it works for the latest version of wordpress.

=== Lab 3 ===
Possible attacks:

* Brute force overload (AB or other benchmark), bang the slowest page possible.
* Connection flood (slowloris)
* SYN Flood (eg. with hping)
* Banging expensive operations (eg. adding big comments)
* etc.

== Scenario 4 ==
Develop countermeasures for the attacks simulated in Lab 3.

Limitations:
* No additional hardware
* No reactive measures

=== Lab 4 ===

Evaluate the countermeasures against attacks.
The countermeasures must not have negative effects
on "normal usage pattern".

Normal usage pattern is defined as:
* Bursts of 10 connections per IP address in 1 second
* Page load times not over 20 seconds

== Scenario 5 ==
Create a solution and instructions for testing IDS
systems against the wordpress site and attacks
tried in lab 3.

A repeatable process to evaluate vendor claims.
Whatever passive IDS system delivered as a VM or a dedicated box.

Creating the IDS system itself is out of scope.

The process must be detailed enough so that somebody else can get the same results when applying that.
The "other person" is expected to have IT knowledge sufficient to install and run a Linux desktop.

Budget requirements: Modest - 2 Dedicated machines + dedicated tester + networking equipment to connect these together.

The process must test at least the following:
* Port scan
* SYN flood
* slowloris/pyloris
* Ab overwhelming attack

=== Lab 5 ===
Instructions for installing Snort IDS and its web GUI called 'acidbase': https://help.ubuntu.com/community/SnortIDS

== Scenario 6 ==

Develop/download/find/whatever a SNORT configuration (rulesets, preprocessors, whatever)
that performs better than the default configuration in lab 5 tests.
By better we mean:
* Less false positives
* Less false negatives
* The objectives are contradictory so the rule of thumb is one false negative per 10 false positives eg. solution with 10 false positives and 2 false negatives is better than the solution with 100 false positives and 1 false negatives, but the solution with 10 false positives and 1 false negative is better than the solution with 1 false positive and 2 false negatives.
* Attack is defined by a single invocation of the test script.

== Scenario 7 ==

There is a new remote vulnerability in Windows.
You became aware of a new virus that targets this vulnerability at 7 PM.
The antivirus vendor has released an updated virus database, but it's probably not installed
on all of the computers yet. Your company has 500 employees, with half of them running on laptops. You have to decide in 12 hours, if You need to collect all the employee's laptops in the morning.

Collecting the laptops has a high cost in lost employee productivity: There will be a queue of laptops waiting to be inspected. You can assume that all of the laptops can be inspected in half a day.

Limits: You can not mitigate the risk by changing the network configuration, You do not know how many laptops are still in the building. You can not take the servers offline.

Resources: 5 workers, some networking equipment, real servers (you can not disrupt those), "samples" of existing systems: a few spare workstations, a few spare laptops,

What do You know about the virus?
* It disables antivirus software
* It disables automatic software updates
* It can be cleaned up only manually in about 1 manhour

You need to develop an action plan:
* What You test in those scarce 12 hours?
* How?
* How do You weigh the results to make the decision?
* The plan itself must be short and easy to understand so You can write it on a whiteboard.
* Justifications for the specific actions go to a separate file/document.

=== Lab 7 ===
* Get viruses and XP install ISO-s from http://www.tud.ttu.ee/~anttix/lab7/
** Password for the protected zip: doomsday
* Alternatively, get Siims image
* Set up 5 VMS and connect them to a private network (or Host-Only network if You can't configure private nets):
** Plain old XP without any virus scanner (clean)
** Plain old XP with a virus scanner eg Avast (clean)
** Windows XP SP3, no virus scanner (clean)
** Plain old XP without any virus scanner (infected)
** Ubuntu Linux with tcpdump running
* If You have enogh time You can either:
** Find some more Worms and unleash them on Your virtual network (thanx to Urmas for those links)
*** http://vx.netlux.org/
*** http://www.excellentcontent.com/xbart/cbezels/
*** http://hacker-mc.blogspot.com/2008/12/pacoto-hacker.html
*** http://www.rohitab.com/discuss/oldfiles/
** Try to install Windows XP while it is connected to the infected network and see if You manage to install patches or antivirus before getting infected.

Measure the time it takes for the virus to penetrate the machines.
Note if virus scanner was able to catch the virus even if the underlying flaw in
windows wasn't patched.
Test if the SP3 version is immune to attacks originating from the network,
even when virus scanner is not installed.

== Scenario 8 ==

Find a solution to simulate a network of 300 PC-s in a single corporate environment, accessing a software update service at once.

Determine the load on primary internet connection and the router.
Assume that updates server will be able to keep up.

Tools to consider
* [http://www.ssfnet.org/homePage.html SSFNet]
* [http://www.omnetpp.org/ OMNeT++]

Additional resources
* [http://www.ssfnet.org/Exchange/gallery/index.html SSFNet module gallery]
* [http://code.google.com/p/omnet-httptools/ omnet-httptools]

=== Lab 8 ===
==== OMNet++ (Free for academic use only) ====
====== Install OMNeT++ ======
# Compile OMNet++ using these instructions: http://omnetpp.org/doc/omnetpp41/InstallGuide.pdf
# Run omnetpp IDE
# Choose Tutorials->Tic-toc tutorial from welcome page to open Tutorial documentation. Welcome page can be accessed from Help menu if You have accidentally closed it.
# Choose Go to workbench
# Click on tictoc in "Project Explorer" (on left hand pane)
# Choose Project->Open Project
# Choose Project->Build All

====== Install OMNeT++ INET framework ======
# Download https://github.com/downloads/inet-framework/inet/inet-20100723-src.tgz
# Create a directory named omnetpp-workspace and unpack inet-20100723-src.tgz in that directory.
# Switch Eclipse workspace to the newly-created directory: File -> Switch Workspace and select omnetpp-workspace.
# Follow instructions in omnetpp-workspace/inet/INSTALL file in the "If you are using the IDE" section

==== NS-3 (GPL Licensed) ====
Install all dependencies according to instructions [http://www.nsnam.org/wiki/index.php/Installation here] and [http://www.nsnam.org/wiki/index.php/PyViz here]

'''NB! Do not clone or compile anything yet'''

Clone NS-3 repositories
hg clone http://code.nsnam.org/ns-3-allinone
cd ns-3-allinone
./download.py -n gjc/ns-3.9-pyviz

Build NS-3
./build.py

Read the introduction slides during the build :)
* http://www.nsnam.org/tutorials/geni-tutorial-part1.pdf
* http://www.nsnam.org/tutorials.html

If You are unable to install the stuff, You may get an
Ubuntu VM with all of the stuff preinstalled from

http://www.tud.ttu.ee/~anttix/lab8/ubuntu10.04-omnetpp_ns3.vdi

Run Example visualizations
cd ns-3.9-pyviz
./waf --pyrun examples/flowmon/wifi-olsr-flowmon.py
./waf --run "examples/wireless/wifi-wired-bridging --viz=1"
./waf --run "examples/wireless/wifi-ap --viz=1"

Get itx8080 samples from:
http://www.tud.ttu.ee/~anttix/lab8/ns3-tty-v2.tar.gz

Run the samples
./waf --run examples/tty/lecture1
./waf --run "examples/tty/lecture2 --vis=1"
./waf --run examples/tty/lecture2

Look at the generated files: wantraffic*

Now create a new simulation that uses TCP networking instead of UDP. Refer to examples in examples/tcp.

== Scenario 9 ==

Simulate a DDoS attack against a network of web servers.

* 2 types of attacks
** SYN Flood
** "AB" style attack

Assumptions:
* 1000 "infected" hosts performing the attack
* 10 web servers, located in 5 locations
* The infected host only attacks one server
* The target to attack is selected randomly
* Assume that servers can keep up with the flood
* Data transferred during each connection is about 500kb

Objectives:
* Assess the bandwidth these attacks consume in each location

You can only implement a subset of constraints and assumptions.
Do as much as You can, maybe others have done even less :D

ITX8080

2010-12-03T16:26:51Z

Anttix: /* Lab 8 */

= General Information =
== Schedule ==

Lecture TH 12:00 - 13:30

Practice FR 14:00 - 17:30

== Communication ==

Discussinons will be held at: itx8080 atatat googlegroups.com

Send e-mail to hannesa at-no-spam-please gmail.com for an invitation.

The lecturers can be reached via the course coordinator:

antti.andreimann only-people-please eesti.ee

== Points awarded so far ==

Arnis : 3 points - ab testing solution, best countermeasure proposed for scenario 4, best snort rules proposed for scenario 6

Igor : 3 points - wordpress virtualization solution, lab 3 report, IDS testing solution

Kaarel : 2 points - lab 1 report and conclusions, lab 3 solution

Märt : 3 points - wordpress testing procedure, best wordpress optimization (wp-cache + php-apc), best lab 2 report.

Roland: 2 points - best Lab 4 report, IDS testing solution

Hannes: 1 point - best lab 6 report

Siim: 1 point - most popular scenario 7 solution

Urmas: 2 points - lab 5 report, the set of viruses used in lab 7

Martti: 1 point - best lab 7 report

Stefan: 1 point - best solution developed during lab 8

= Scenarios =

== Scenario 1 ==
There is a Wordpress based blog.

The client is worried: How many visitors can they handle before they die.

Establish a baseline: How many page displays per second AT LEAST we can handle.
Disruption of the site operation is NOT acceptable.

Minimal budget!

Be as detailed and technical as You possibly can.

Post to the discussion group the following information:

# Detailed description of the simulation of the site. eg. if You're going to virtualize it then how? If You are running it as a process, then how You separate it from the real machine?
# Detailed description of the attack / benchmark tools picked. Where You are going to run them? What tools? How many copies? How you are going to collect the results?!!!

=== Proposals ===
Benchmarking:
* AB - Discussed in lecture
* http://tsung.erlang-projects.org - Jérémy
* wget + AB - Arnis
* http://jakarta.apache.org/jmeter/ - Roland, Jérémy
* http://grinder.sourceforge.net/ - Märt
* http://httpd.apache.org/test/flood/ - Hannes
* Normal monitoring software on live server - Urmas

Simulation of the system:
* VirtualBox - Roland, Jérémy
* VMWare ESX - Igor
* VMWare Player - Marina
* Amazon EC2 - Märt
* KVM - Siim
* Original hardware - Hannes

=== Lab 1 ===
We will need to create two different virtual machines, one is going to be the wordpress server and the 2nd one is the client which is used to attack the server. It's probably easiest to install only one image and then clone it.

Hard disk image cloning is best done with

Linux:
VBoxManage clonehd FirstUbuntu.vdi SecondUbuntu.vdi

Windows:
"C:\Program Files\Oracle\VirtualBox\VBoxManage.exe" clonehd FirstUbuntu.vdi SecondUbuntu.vdi

After cloning the image create another virtual machine and attach the 2nd disk to that machine. As the result there will be two different virtual machines with two different virtual hard disks.

To be able to connect between the two virtual machines, You need to add an
additional network adapter to both hosts. It can be either "Host Only" or
"Internal" type.

To enable the new adapters in Ubuntu edit the file: /etc/network/interfaces

== Scenario 2 ==
Design a method for evaluating any speedup solutions for the wordpress.
A repeatable process to evaluate the claims.
Whatever optimizations.
The process must be detailed enough so that somebody else can get the same results when applying that.
The "other person" is expected to have IT knowledge sufficient to install and run a Linux desktop.
The method must specify the level performance
at which the site is considered DEAD.
Budget requirements: Low - Dedicated machine + dedicated tester.

=== Lab 2 ===
* Get Virtual machine disk image and instructions from: http://www.tud.ttu.ee/~anttix/lab2/ '''NB! DO NOT DOWNLOAD IMAGE FROM THE LINK NOTED IN INSTRUCTIONS PDF, IT WILL BE SLOW'''
* Fix bug in image (see below)
* Measure the effect of these wordpress plugins:
** [http://wordpress.org/extend/plugins/wp-super-cache/ WP Super Cache]
** [http://wordpress.org/extend/plugins/wp-cache/ WP-Cache]
* Devise Your own optimizations for the site

Bug in image: the ip address of the VM is saved in WP database as 192.168.56.3
It is advised tu run the Target VM first and run the "sudo dhclient" command first in Target VM.
Then check active IP of target by command "ifconfig". If it is not 192.168.56.3, then situation can be fixed by running:

In Target VM: "sudo ifconfig eth2 192.168.56.3"
In Client VM: "sudo ifconfig eth2 192.168.56.4"

==== A note to Windows users ====
Use this command line to access VBoxManage program

"C:\Program Files\Oracle\VirtualBox\VBoxManage.exe"

==== Wordpress Admin access ====
Username: admin
Password: QIaTemvskSeM

==== Note to Ubuntu users ====
VirtualBox with WiFi Does NOT work properly http://ubuntuforums.org/showthread.php?t=782936

== Scenario 3 ==
Your client is worried about some stuff posted on a blog. They ask You to take care of it.
They have a throwaway "script kiddie" in a third world country, who will mount the attack
so You don't need to worry about hiding the attackers identity.

Devise a way to attack a wordpress (default installation) based site to render it
unusable (page view times over 60 seconds).

Attack resources: one PC, a script kiddie, internet connection of 2Mbit/s.

How are we going to evaluate the solutions?
* Easy to use instructions
* The most efficient use of available resources

Defacing will count, IF it works for the latest version of wordpress.

=== Lab 3 ===
Possible attacks:

* Brute force overload (AB or other benchmark), bang the slowest page possible.
* Connection flood (slowloris)
* SYN Flood (eg. with hping)
* Banging expensive operations (eg. adding big comments)
* etc.

== Scenario 4 ==
Develop countermeasures for the attacks simulated in Lab 3.

Limitations:
* No additional hardware
* No reactive measures

=== Lab 4 ===

Evaluate the countermeasures against attacks.
The countermeasures must not have negative effects
on "normal usage pattern".

Normal usage pattern is defined as:
* Bursts of 10 connections per IP address in 1 second
* Page load times not over 20 seconds

== Scenario 5 ==
Create a solution and instructions for testing IDS
systems against the wordpress site and attacks
tried in lab 3.

A repeatable process to evaluate vendor claims.
Whatever passive IDS system delivered as a VM or a dedicated box.

Creating the IDS system itself is out of scope.

The process must be detailed enough so that somebody else can get the same results when applying that.
The "other person" is expected to have IT knowledge sufficient to install and run a Linux desktop.

Budget requirements: Modest - 2 Dedicated machines + dedicated tester + networking equipment to connect these together.

The process must test at least the following:
* Port scan
* SYN flood
* slowloris/pyloris
* Ab overwhelming attack

=== Lab 5 ===
Instructions for installing Snort IDS and its web GUI called 'acidbase': https://help.ubuntu.com/community/SnortIDS

== Scenario 6 ==

Develop/download/find/whatever a SNORT configuration (rulesets, preprocessors, whatever)
that performs better than the default configuration in lab 5 tests.
By better we mean:
* Less false positives
* Less false negatives
* The objectives are contradictory so the rule of thumb is one false negative per 10 false positives eg. solution with 10 false positives and 2 false negatives is better than the solution with 100 false positives and 1 false negatives, but the solution with 10 false positives and 1 false negative is better than the solution with 1 false positive and 2 false negatives.
* Attack is defined by a single invocation of the test script.

== Scenario 7 ==

There is a new remote vulnerability in Windows.
You became aware of a new virus that targets this vulnerability at 7 PM.
The antivirus vendor has released an updated virus database, but it's probably not installed
on all of the computers yet. Your company has 500 employees, with half of them running on laptops. You have to decide in 12 hours, if You need to collect all the employee's laptops in the morning.

Collecting the laptops has a high cost in lost employee productivity: There will be a queue of laptops waiting to be inspected. You can assume that all of the laptops can be inspected in half a day.

Limits: You can not mitigate the risk by changing the network configuration, You do not know how many laptops are still in the building. You can not take the servers offline.

Resources: 5 workers, some networking equipment, real servers (you can not disrupt those), "samples" of existing systems: a few spare workstations, a few spare laptops,

What do You know about the virus?
* It disables antivirus software
* It disables automatic software updates
* It can be cleaned up only manually in about 1 manhour

You need to develop an action plan:
* What You test in those scarce 12 hours?
* How?
* How do You weigh the results to make the decision?
* The plan itself must be short and easy to understand so You can write it on a whiteboard.
* Justifications for the specific actions go to a separate file/document.

=== Lab 7 ===
* Get viruses and XP install ISO-s from http://www.tud.ttu.ee/~anttix/lab7/
** Password for the protected zip: doomsday
* Alternatively, get Siims image
* Set up 5 VMS and connect them to a private network (or Host-Only network if You can't configure private nets):
** Plain old XP without any virus scanner (clean)
** Plain old XP with a virus scanner eg Avast (clean)
** Windows XP SP3, no virus scanner (clean)
** Plain old XP without any virus scanner (infected)
** Ubuntu Linux with tcpdump running
* If You have enogh time You can either:
** Find some more Worms and unleash them on Your virtual network (thanx to Urmas for those links)
*** http://vx.netlux.org/
*** http://www.excellentcontent.com/xbart/cbezels/
*** http://hacker-mc.blogspot.com/2008/12/pacoto-hacker.html
*** http://www.rohitab.com/discuss/oldfiles/
** Try to install Windows XP while it is connected to the infected network and see if You manage to install patches or antivirus before getting infected.

Measure the time it takes for the virus to penetrate the machines.
Note if virus scanner was able to catch the virus even if the underlying flaw in
windows wasn't patched.
Test if the SP3 version is immune to attacks originating from the network,
even when virus scanner is not installed.

== Scenario 8 ==

Find a solution to simulate a network of 300 PC-s in a single corporate environment, accessing a software update service at once.

Determine the load on primary internet connection and the router.
Assume that updates server will be able to keep up.

Tools to consider
* [http://www.ssfnet.org/homePage.html SSFNet]
* [http://www.omnetpp.org/ OMNeT++]

Additional resources
* [http://www.ssfnet.org/Exchange/gallery/index.html SSFNet module gallery]
* [http://code.google.com/p/omnet-httptools/ omnet-httptools]

=== Lab 8 ===
==== OMNet++ (Free for academic use only) ====
====== Install OMNeT++ ======
# Compile OMNet++ using these instructions: http://omnetpp.org/doc/omnetpp41/InstallGuide.pdf
# Run omnetpp IDE
# Choose Tutorials->Tic-toc tutorial from welcome page to open Tutorial documentation. Welcome page can be accessed from Help menu if You have accidentally closed it.
# Choose Go to workbench
# Click on tictoc in "Project Explorer" (on left hand pane)
# Choose Project->Open Project
# Choose Project->Build All

====== Install OMNeT++ INET framework ======
# Download https://github.com/downloads/inet-framework/inet/inet-20100723-src.tgz
# Create a directory named omnetpp-workspace and unpack inet-20100723-src.tgz in that directory.
# Switch Eclipse workspace to the newly-created directory: File -> Switch Workspace and select omnetpp-workspace.
# Follow instructions in omnetpp-workspace/inet/INSTALL file in the "If you are using the IDE" section

==== NS-3 (GPL Licensed) ====
Install all dependencies according to instructions [http://www.nsnam.org/wiki/index.php/Installation here] and [http://www.nsnam.org/wiki/index.php/PyViz here]

'''NB! Do not clone or compile anything yet'''

Clone NS-3 repositories
hg clone http://code.nsnam.org/ns-3-allinone
cd ns-3-allinone
./download.py -n gjc/ns-3.9-pyviz

Build NS-3
./build.py

Read the introduction slides during the build :)
* http://www.nsnam.org/tutorials/geni-tutorial-part1.pdf
* http://www.nsnam.org/tutorials.html

Run Example visualizations
cd ns-3.9-pyviz
./waf --pyrun examples/flowmon/wifi-olsr-flowmon.py
./waf --run "examples/wireless/wifi-wired-bridging --viz=1"
./waf --run "examples/wireless/wifi-ap --viz=1"

Get Lab samples from:
http://www.tud.ttu.ee/~anttix/lab8/ns3-lecture1.tar.gz

Run the first sample
./waf --run examples/tty/lecture1

If You are unable to install the stuff, You may get an
Ubuntu VM with all of the stuff preinstalled from

http://www.tud.ttu.ee/~anttix/lab8/ubuntu10.04-omnetpp_ns3.vdi

== Scenario 9 ==

Simulate a DDoS attack against a network of web servers.

* 2 types of attacks
** SYN Flood
** "AB" style attack

Assumptions:
* 1000 "infected" hosts performing the attack
* 10 web servers, located in 5 locations
* The infected host only attacks one server
* The target to attack is selected randomly
* Assume that servers can keep up with the flood
* Data transferred during each connection is about 500kb

Objectives:
* Assess the bandwidth these attacks consume in each location

You can only implement a subset of constraints and assumptions.
Do as much as You can, maybe others have done even less :D

ITX8080

2010-12-03T15:41:11Z

Anttix:

= General Information =
== Schedule ==

Lecture TH 12:00 - 13:30

Practice FR 14:00 - 17:30

== Communication ==

Discussinons will be held at: itx8080 atatat googlegroups.com

Send e-mail to hannesa at-no-spam-please gmail.com for an invitation.

The lecturers can be reached via the course coordinator:

antti.andreimann only-people-please eesti.ee

== Points awarded so far ==

Arnis : 3 points - ab testing solution, best countermeasure proposed for scenario 4, best snort rules proposed for scenario 6

Igor : 3 points - wordpress virtualization solution, lab 3 report, IDS testing solution

Kaarel : 2 points - lab 1 report and conclusions, lab 3 solution

Märt : 3 points - wordpress testing procedure, best wordpress optimization (wp-cache + php-apc), best lab 2 report.

Roland: 2 points - best Lab 4 report, IDS testing solution

Hannes: 1 point - best lab 6 report

Siim: 1 point - most popular scenario 7 solution

Urmas: 2 points - lab 5 report, the set of viruses used in lab 7

Martti: 1 point - best lab 7 report

Stefan: 1 point - best solution developed during lab 8

= Scenarios =

== Scenario 1 ==
There is a Wordpress based blog.

The client is worried: How many visitors can they handle before they die.

Establish a baseline: How many page displays per second AT LEAST we can handle.
Disruption of the site operation is NOT acceptable.

Minimal budget!

Be as detailed and technical as You possibly can.

Post to the discussion group the following information:

# Detailed description of the simulation of the site. eg. if You're going to virtualize it then how? If You are running it as a process, then how You separate it from the real machine?
# Detailed description of the attack / benchmark tools picked. Where You are going to run them? What tools? How many copies? How you are going to collect the results?!!!

=== Proposals ===
Benchmarking:
* AB - Discussed in lecture
* http://tsung.erlang-projects.org - Jérémy
* wget + AB - Arnis
* http://jakarta.apache.org/jmeter/ - Roland, Jérémy
* http://grinder.sourceforge.net/ - Märt
* http://httpd.apache.org/test/flood/ - Hannes
* Normal monitoring software on live server - Urmas

Simulation of the system:
* VirtualBox - Roland, Jérémy
* VMWare ESX - Igor
* VMWare Player - Marina
* Amazon EC2 - Märt
* KVM - Siim
* Original hardware - Hannes

=== Lab 1 ===
We will need to create two different virtual machines, one is going to be the wordpress server and the 2nd one is the client which is used to attack the server. It's probably easiest to install only one image and then clone it.

Hard disk image cloning is best done with

Linux:
VBoxManage clonehd FirstUbuntu.vdi SecondUbuntu.vdi

Windows:
"C:\Program Files\Oracle\VirtualBox\VBoxManage.exe" clonehd FirstUbuntu.vdi SecondUbuntu.vdi

After cloning the image create another virtual machine and attach the 2nd disk to that machine. As the result there will be two different virtual machines with two different virtual hard disks.

To be able to connect between the two virtual machines, You need to add an
additional network adapter to both hosts. It can be either "Host Only" or
"Internal" type.

To enable the new adapters in Ubuntu edit the file: /etc/network/interfaces

== Scenario 2 ==
Design a method for evaluating any speedup solutions for the wordpress.
A repeatable process to evaluate the claims.
Whatever optimizations.
The process must be detailed enough so that somebody else can get the same results when applying that.
The "other person" is expected to have IT knowledge sufficient to install and run a Linux desktop.
The method must specify the level performance
at which the site is considered DEAD.
Budget requirements: Low - Dedicated machine + dedicated tester.

=== Lab 2 ===
* Get Virtual machine disk image and instructions from: http://www.tud.ttu.ee/~anttix/lab2/ '''NB! DO NOT DOWNLOAD IMAGE FROM THE LINK NOTED IN INSTRUCTIONS PDF, IT WILL BE SLOW'''
* Fix bug in image (see below)
* Measure the effect of these wordpress plugins:
** [http://wordpress.org/extend/plugins/wp-super-cache/ WP Super Cache]
** [http://wordpress.org/extend/plugins/wp-cache/ WP-Cache]
* Devise Your own optimizations for the site

Bug in image: the ip address of the VM is saved in WP database as 192.168.56.3
It is advised tu run the Target VM first and run the "sudo dhclient" command first in Target VM.
Then check active IP of target by command "ifconfig". If it is not 192.168.56.3, then situation can be fixed by running:

In Target VM: "sudo ifconfig eth2 192.168.56.3"
In Client VM: "sudo ifconfig eth2 192.168.56.4"

==== A note to Windows users ====
Use this command line to access VBoxManage program

"C:\Program Files\Oracle\VirtualBox\VBoxManage.exe"

==== Wordpress Admin access ====
Username: admin
Password: QIaTemvskSeM

==== Note to Ubuntu users ====
VirtualBox with WiFi Does NOT work properly http://ubuntuforums.org/showthread.php?t=782936

== Scenario 3 ==
Your client is worried about some stuff posted on a blog. They ask You to take care of it.
They have a throwaway "script kiddie" in a third world country, who will mount the attack
so You don't need to worry about hiding the attackers identity.

Devise a way to attack a wordpress (default installation) based site to render it
unusable (page view times over 60 seconds).

Attack resources: one PC, a script kiddie, internet connection of 2Mbit/s.

How are we going to evaluate the solutions?
* Easy to use instructions
* The most efficient use of available resources

Defacing will count, IF it works for the latest version of wordpress.

=== Lab 3 ===
Possible attacks:

* Brute force overload (AB or other benchmark), bang the slowest page possible.
* Connection flood (slowloris)
* SYN Flood (eg. with hping)
* Banging expensive operations (eg. adding big comments)
* etc.

== Scenario 4 ==
Develop countermeasures for the attacks simulated in Lab 3.

Limitations:
* No additional hardware
* No reactive measures

=== Lab 4 ===

Evaluate the countermeasures against attacks.
The countermeasures must not have negative effects
on "normal usage pattern".

Normal usage pattern is defined as:
* Bursts of 10 connections per IP address in 1 second
* Page load times not over 20 seconds

== Scenario 5 ==
Create a solution and instructions for testing IDS
systems against the wordpress site and attacks
tried in lab 3.

A repeatable process to evaluate vendor claims.
Whatever passive IDS system delivered as a VM or a dedicated box.

Creating the IDS system itself is out of scope.

The process must be detailed enough so that somebody else can get the same results when applying that.
The "other person" is expected to have IT knowledge sufficient to install and run a Linux desktop.

Budget requirements: Modest - 2 Dedicated machines + dedicated tester + networking equipment to connect these together.

The process must test at least the following:
* Port scan
* SYN flood
* slowloris/pyloris
* Ab overwhelming attack

=== Lab 5 ===
Instructions for installing Snort IDS and its web GUI called 'acidbase': https://help.ubuntu.com/community/SnortIDS

== Scenario 6 ==

Develop/download/find/whatever a SNORT configuration (rulesets, preprocessors, whatever)
that performs better than the default configuration in lab 5 tests.
By better we mean:
* Less false positives
* Less false negatives
* The objectives are contradictory so the rule of thumb is one false negative per 10 false positives eg. solution with 10 false positives and 2 false negatives is better than the solution with 100 false positives and 1 false negatives, but the solution with 10 false positives and 1 false negative is better than the solution with 1 false positive and 2 false negatives.
* Attack is defined by a single invocation of the test script.

== Scenario 7 ==

There is a new remote vulnerability in Windows.
You became aware of a new virus that targets this vulnerability at 7 PM.
The antivirus vendor has released an updated virus database, but it's probably not installed
on all of the computers yet. Your company has 500 employees, with half of them running on laptops. You have to decide in 12 hours, if You need to collect all the employee's laptops in the morning.

Collecting the laptops has a high cost in lost employee productivity: There will be a queue of laptops waiting to be inspected. You can assume that all of the laptops can be inspected in half a day.

Limits: You can not mitigate the risk by changing the network configuration, You do not know how many laptops are still in the building. You can not take the servers offline.

Resources: 5 workers, some networking equipment, real servers (you can not disrupt those), "samples" of existing systems: a few spare workstations, a few spare laptops,

What do You know about the virus?
* It disables antivirus software
* It disables automatic software updates
* It can be cleaned up only manually in about 1 manhour

You need to develop an action plan:
* What You test in those scarce 12 hours?
* How?
* How do You weigh the results to make the decision?
* The plan itself must be short and easy to understand so You can write it on a whiteboard.
* Justifications for the specific actions go to a separate file/document.

=== Lab 7 ===
* Get viruses and XP install ISO-s from http://www.tud.ttu.ee/~anttix/lab7/
** Password for the protected zip: doomsday
* Alternatively, get Siims image
* Set up 5 VMS and connect them to a private network (or Host-Only network if You can't configure private nets):
** Plain old XP without any virus scanner (clean)
** Plain old XP with a virus scanner eg Avast (clean)
** Windows XP SP3, no virus scanner (clean)
** Plain old XP without any virus scanner (infected)
** Ubuntu Linux with tcpdump running
* If You have enogh time You can either:
** Find some more Worms and unleash them on Your virtual network (thanx to Urmas for those links)
*** http://vx.netlux.org/
*** http://www.excellentcontent.com/xbart/cbezels/
*** http://hacker-mc.blogspot.com/2008/12/pacoto-hacker.html
*** http://www.rohitab.com/discuss/oldfiles/
** Try to install Windows XP while it is connected to the infected network and see if You manage to install patches or antivirus before getting infected.

Measure the time it takes for the virus to penetrate the machines.
Note if virus scanner was able to catch the virus even if the underlying flaw in
windows wasn't patched.
Test if the SP3 version is immune to attacks originating from the network,
even when virus scanner is not installed.

== Scenario 8 ==

Find a solution to simulate a network of 300 PC-s in a single corporate environment, accessing a software update service at once.

Determine the load on primary internet connection and the router.
Assume that updates server will be able to keep up.

Tools to consider
* [http://www.ssfnet.org/homePage.html SSFNet]
* [http://www.omnetpp.org/ OMNeT++]

Additional resources
* [http://www.ssfnet.org/Exchange/gallery/index.html SSFNet module gallery]
* [http://code.google.com/p/omnet-httptools/ omnet-httptools]

=== Lab 8 ===
==== OMNet++ (Free for academic use only) ====
====== Install OMNeT++ ======
# Compile OMNet++ using these instructions: http://omnetpp.org/doc/omnetpp41/InstallGuide.pdf
# Run omnetpp IDE
# Choose Tutorials->Tic-toc tutorial from welcome page to open Tutorial documentation. Welcome page can be accessed from Help menu if You have accidentally closed it.
# Choose Go to workbench
# Click on tictoc in "Project Explorer" (on left hand pane)
# Choose Project->Open Project
# Choose Project->Build All

====== Install OMNeT++ INET framework ======
# Download https://github.com/downloads/inet-framework/inet/inet-20100723-src.tgz
# Create a directory named omnetpp-workspace and unpack inet-20100723-src.tgz in that directory.
# Switch Eclipse workspace to the newly-created directory: File -> Switch Workspace and select omnetpp-workspace.
# Follow instructions in omnetpp-workspace/inet/INSTALL file in the "If you are using the IDE" section

==== NS-3 (GPL Licensed) ====
Install all dependencies according to instructions [http://www.nsnam.org/wiki/index.php/Installation here] and [http://www.nsnam.org/wiki/index.php/PyViz here]

'''NB! Do not clone or compile anything yet'''

Clone NS-3 repositories
hg clone http://code.nsnam.org/ns-3-allinone
cd ns-3-allinone
./download.py -n gjc/ns-3.9-pyviz

Build NS-3
./build.py

Read the introduction slides during the build :)
* http://www.nsnam.org/tutorials/geni-tutorial-part1.pdf
* http://www.nsnam.org/tutorials.html

Run Example visualization
cd ns-3.9-pyviz
./waf --pyrun examples/flowmon/wifi-olsr-flowmon.py

Get Lab samples from:
http://www.tud.ttu.ee/~anttix/lab8/ns3-lecture1.tar.gz

Run the first sample
./waf --run examples/tty/lecture1

If You are unable to install the stuff, You may get an
Ubuntu VM with all of the stuff preinstalled from

http://www.tud.ttu.ee/~anttix/lab8/ubuntu10.04-omnetpp_ns3.vdi

== Scenario 9 ==

Simulate a DDoS attack against a network of web servers.

* 2 types of attacks
** SYN Flood
** "AB" style attack

Assumptions:
* 1000 "infected" hosts performing the attack
* 10 web servers, located in 5 locations
* The infected host only attacks one server
* The target to attack is selected randomly
* Assume that servers can keep up with the flood
* Data transferred during each connection is about 500kb

Objectives:
* Assess the bandwidth these attacks consume in each location

You can only implement a subset of constraints and assumptions.
Do as much as You can, maybe others have done even less :D

ITX8080

2010-11-26T18:58:26Z

Anttix: /* Points awarded so far */

= General Information =
== Schedule ==

Lecture TH 12:00 - 13:30

Practice FR 14:00 - 17:30

== Communication ==

Discussinons will be held at: itx8080 atatat googlegroups.com

Send e-mail to hannesa at-no-spam-please gmail.com for an invitation.

The lecturers can be reached via the course coordinator:

antti.andreimann only-people-please eesti.ee

== Points awarded so far ==

Arnis : 3 points - ab testing solution, best countermeasure proposed for scenario 4, best snort rules proposed for scenario 6

Igor : 3 points - wordpress virtualization solution, lab 3 report, IDS testing solution

Kaarel : 2 points - lab 1 report and conclusions, lab 3 solution

Märt : 3 points - wordpress testing procedure, best wordpress optimization (wp-cache + php-apc), best lab 2 report.

Roland: 2 points - best Lab 4 report, IDS testing solution

Hannes: 1 point - best lab 6 report

Siim: 1 point - most popular scenario 7 solution

Urmas: 2 points - lab 5 report, the set of viruses used in lab 7

Martti: 1 point - best lab 7 report

Stefan: 1 point - best solution developed during lab 8

= Scenarios =

== Scenario 1 ==
There is a Wordpress based blog.

The client is worried: How many visitors can they handle before they die.

Establish a baseline: How many page displays per second AT LEAST we can handle.
Disruption of the site operation is NOT acceptable.

Minimal budget!

Be as detailed and technical as You possibly can.

Post to the discussion group the following information:

# Detailed description of the simulation of the site. eg. if You're going to virtualize it then how? If You are running it as a process, then how You separate it from the real machine?
# Detailed description of the attack / benchmark tools picked. Where You are going to run them? What tools? How many copies? How you are going to collect the results?!!!

=== Proposals ===
Benchmarking:
* AB - Discussed in lecture
* http://tsung.erlang-projects.org - Jérémy
* wget + AB - Arnis
* http://jakarta.apache.org/jmeter/ - Roland, Jérémy
* http://grinder.sourceforge.net/ - Märt
* http://httpd.apache.org/test/flood/ - Hannes
* Normal monitoring software on live server - Urmas

Simulation of the system:
* VirtualBox - Roland, Jérémy
* VMWare ESX - Igor
* VMWare Player - Marina
* Amazon EC2 - Märt
* KVM - Siim
* Original hardware - Hannes

=== Lab 1 ===
We will need to create two different virtual machines, one is going to be the wordpress server and the 2nd one is the client which is used to attack the server. It's probably easiest to install only one image and then clone it.

Hard disk image cloning is best done with

Linux:
VBoxManage clonehd FirstUbuntu.vdi SecondUbuntu.vdi

Windows:
"C:\Program Files\Oracle\VirtualBox\VBoxManage.exe" clonehd FirstUbuntu.vdi SecondUbuntu.vdi

After cloning the image create another virtual machine and attach the 2nd disk to that machine. As the result there will be two different virtual machines with two different virtual hard disks.

To be able to connect between the two virtual machines, You need to add an
additional network adapter to both hosts. It can be either "Host Only" or
"Internal" type.

To enable the new adapters in Ubuntu edit the file: /etc/network/interfaces

== Scenario 2 ==
Design a method for evaluating any speedup solutions for the wordpress.
A repeatable process to evaluate the claims.
Whatever optimizations.
The process must be detailed enough so that somebody else can get the same results when applying that.
The "other person" is expected to have IT knowledge sufficient to install and run a Linux desktop.
The method must specify the level performance
at which the site is considered DEAD.
Budget requirements: Low - Dedicated machine + dedicated tester.

=== Lab 2 ===
* Get Virtual machine disk image and instructions from: http://www.tud.ttu.ee/~anttix/lab2/ '''NB! DO NOT DOWNLOAD IMAGE FROM THE LINK NOTED IN INSTRUCTIONS PDF, IT WILL BE SLOW'''
* Fix bug in image (see below)
* Measure the effect of these wordpress plugins:
** [http://wordpress.org/extend/plugins/wp-super-cache/ WP Super Cache]
** [http://wordpress.org/extend/plugins/wp-cache/ WP-Cache]
* Devise Your own optimizations for the site

Bug in image: the ip address of the VM is saved in WP database as 192.168.56.3
It is advised tu run the Target VM first and run the "sudo dhclient" command first in Target VM.
Then check active IP of target by command "ifconfig". If it is not 192.168.56.3, then situation can be fixed by running:

In Target VM: "sudo ifconfig eth2 192.168.56.3"
In Client VM: "sudo ifconfig eth2 192.168.56.4"

==== A note to Windows users ====
Use this command line to access VBoxManage program

"C:\Program Files\Oracle\VirtualBox\VBoxManage.exe"

==== Wordpress Admin access ====
Username: admin
Password: QIaTemvskSeM

==== Note to Ubuntu users ====
VirtualBox with WiFi Does NOT work properly http://ubuntuforums.org/showthread.php?t=782936

== Scenario 3 ==
Your client is worried about some stuff posted on a blog. They ask You to take care of it.
They have a throwaway "script kiddie" in a third world country, who will mount the attack
so You don't need to worry about hiding the attackers identity.

Devise a way to attack a wordpress (default installation) based site to render it
unusable (page view times over 60 seconds).

Attack resources: one PC, a script kiddie, internet connection of 2Mbit/s.

How are we going to evaluate the solutions?
* Easy to use instructions
* The most efficient use of available resources

Defacing will count, IF it works for the latest version of wordpress.

=== Lab 3 ===
Possible attacks:

* Brute force overload (AB or other benchmark), bang the slowest page possible.
* Connection flood (slowloris)
* SYN Flood (eg. with hping)
* Banging expensive operations (eg. adding big comments)
* etc.

== Scenario 4 ==
Develop countermeasures for the attacks simulated in Lab 3.

Limitations:
* No additional hardware
* No reactive measures

=== Lab 4 ===

Evaluate the countermeasures against attacks.
The countermeasures must not have negative effects
on "normal usage pattern".

Normal usage pattern is defined as:
* Bursts of 10 connections per IP address in 1 second
* Page load times not over 20 seconds

== Scenario 5 ==
Create a solution and instructions for testing IDS
systems against the wordpress site and attacks
tried in lab 3.

A repeatable process to evaluate vendor claims.
Whatever passive IDS system delivered as a VM or a dedicated box.

Creating the IDS system itself is out of scope.

The process must be detailed enough so that somebody else can get the same results when applying that.
The "other person" is expected to have IT knowledge sufficient to install and run a Linux desktop.

Budget requirements: Modest - 2 Dedicated machines + dedicated tester + networking equipment to connect these together.

The process must test at least the following:
* Port scan
* SYN flood
* slowloris/pyloris
* Ab overwhelming attack

=== Lab 5 ===
Instructions for installing Snort IDS and its web GUI called 'acidbase': https://help.ubuntu.com/community/SnortIDS

== Scenario 6 ==

Develop/download/find/whatever a SNORT configuration (rulesets, preprocessors, whatever)
that performs better than the default configuration in lab 5 tests.
By better we mean:
* Less false positives
* Less false negatives
* The objectives are contradictory so the rule of thumb is one false negative per 10 false positives eg. solution with 10 false positives and 2 false negatives is better than the solution with 100 false positives and 1 false negatives, but the solution with 10 false positives and 1 false negative is better than the solution with 1 false positive and 2 false negatives.
* Attack is defined by a single invocation of the test script.

== Scenario 7 ==

There is a new remote vulnerability in Windows.
You became aware of a new virus that targets this vulnerability at 7 PM.
The antivirus vendor has released an updated virus database, but it's probably not installed
on all of the computers yet. Your company has 500 employees, with half of them running on laptops. You have to decide in 12 hours, if You need to collect all the employee's laptops in the morning.

Collecting the laptops has a high cost in lost employee productivity: There will be a queue of laptops waiting to be inspected. You can assume that all of the laptops can be inspected in half a day.

Limits: You can not mitigate the risk by changing the network configuration, You do not know how many laptops are still in the building. You can not take the servers offline.

Resources: 5 workers, some networking equipment, real servers (you can not disrupt those), "samples" of existing systems: a few spare workstations, a few spare laptops,

What do You know about the virus?
* It disables antivirus software
* It disables automatic software updates
* It can be cleaned up only manually in about 1 manhour

You need to develop an action plan:
* What You test in those scarce 12 hours?
* How?
* How do You weigh the results to make the decision?
* The plan itself must be short and easy to understand so You can write it on a whiteboard.
* Justifications for the specific actions go to a separate file/document.

=== Lab 7 ===
* Get viruses and XP install ISO-s from http://www.tud.ttu.ee/~anttix/lab7/
** Password for the protected zip: doomsday
* Alternatively, get Siims image
* Set up 5 VMS and connect them to a private network (or Host-Only network if You can't configure private nets):
** Plain old XP without any virus scanner (clean)
** Plain old XP with a virus scanner eg Avast (clean)
** Windows XP SP3, no virus scanner (clean)
** Plain old XP without any virus scanner (infected)
** Ubuntu Linux with tcpdump running
* If You have enogh time You can either:
** Find some more Worms and unleash them on Your virtual network (thanx to Urmas for those links)
*** http://vx.netlux.org/
*** http://www.excellentcontent.com/xbart/cbezels/
*** http://hacker-mc.blogspot.com/2008/12/pacoto-hacker.html
*** http://www.rohitab.com/discuss/oldfiles/
** Try to install Windows XP while it is connected to the infected network and see if You manage to install patches or antivirus before getting infected.

Measure the time it takes for the virus to penetrate the machines.
Note if virus scanner was able to catch the virus even if the underlying flaw in
windows wasn't patched.
Test if the SP3 version is immune to attacks originating from the network,
even when virus scanner is not installed.

== Scenario 8 ==

Find a solution to simulate a network of 300 PC-s in a single corporate environment, accessing a software update service at once.

Determine the load on primary internet connection and the router.
Assume that updates server will be able to keep up.

Tools to consider
* [http://www.ssfnet.org/homePage.html SSFNet]
* [http://www.omnetpp.org/ OMNeT++]

Additional resources
* [http://www.ssfnet.org/Exchange/gallery/index.html SSFNet module gallery]
* [http://code.google.com/p/omnet-httptools/ omnet-httptools]

=== Lab 8 ===
==== OMNet++ (Free for academic use only) ====
====== Install OMNeT++ ======
# Compile OMNet++ using these instructions: http://omnetpp.org/doc/omnetpp41/InstallGuide.pdf
# Run omnetpp IDE
# Choose Tutorials->Tic-toc tutorial from welcome page to open Tutorial documentation. Welcome page can be accessed from Help menu if You have accidentally closed it.
# Choose Go to workbench
# Click on tictoc in "Project Explorer" (on left hand pane)
# Choose Project->Open Project
# Choose Project->Build All

====== Install OMNeT++ INET framework ======
# Download https://github.com/downloads/inet-framework/inet/inet-20100723-src.tgz
# Create a directory named omnetpp-workspace and unpack inet-20100723-src.tgz in that directory.
# Switch Eclipse workspace to the newly-created directory: File -> Switch Workspace and select omnetpp-workspace.
# Follow instructions in omnetpp-workspace/inet/INSTALL file in the "If you are using the IDE" section

==== NS-3 (GPL Licensed) ====
Install all dependencies according to instructions [http://www.nsnam.org/wiki/index.php/Installation here] and [http://www.nsnam.org/wiki/index.php/PyViz here]

'''NB! Do not clone or compile anything yet'''

Clone NS-3 repositories
hg clone http://code.nsnam.org/ns-3-allinone
cd ns-3-allinone
./download.py -n gjc/ns-3.9-pyviz

Build NS-3
./build.py

Read the introduction slides during the build :)
* http://www.nsnam.org/tutorials/geni-tutorial-part1.pdf
* http://www.nsnam.org/tutorials.html

Run Example visualization
cd ns-3.9-pyviz
./waf --pyrun examples/flowmon/wifi-olsr-flowmon.py

== Scenario 9 ==

Simulate a DDoS attack against a network of web servers.

* 2 types of attacks
** SYN Flood
** "AB" style attack

Assumptions:
* 1000 "infected" hosts performing the attack
* 10 web servers, located in 5 locations
* The infected host only attacks one server
* The target to attack is selected randomly
* Assume that servers can keep up with the flood
* Data transferred during each connection is about 500kb

Objectives:
* Assess the bandwidth these attacks consume in each location

You can only implement a subset of constraints and assumptions.
Do as much as You can, maybe others have done even less :D

ITX8080

2010-11-26T17:10:29Z

Anttix: /* NS-3 (GPL Licensed) */

= General Information =
== Schedule ==

Lecture TH 12:00 - 13:30

Practice FR 14:00 - 17:30

== Communication ==

Discussinons will be held at: itx8080 atatat googlegroups.com

Send e-mail to hannesa at-no-spam-please gmail.com for an invitation.

The lecturers can be reached via the course coordinator:

antti.andreimann only-people-please eesti.ee

== Points awarded so far ==

Arnis : 3 points - ab testing solution, best countermeasure proposed for scenario 4, best snort rules proposed for scenario 6

Igor : 3 points - wordpress virtualization solution, lab 3 report, IDS testing solution

Kaarel : 2 points - lab 1 report and conclusions, lab 3 solution

Märt : 3 points - wordpress testing procedure, best wordpress optimization (wp-cache + php-apc), best lab 2 report.

Roland: 2 points - best Lab 4 report, IDS testing solution

Hannes: 1 point - best lab 6 report

Siim: 1 point - most popular scenario 7 solution

Urmas: 2 points - lab 5 report, the set of viruses used in lab 7

Martti: 1 point - best lab 7 report

= Scenarios =

== Scenario 1 ==
There is a Wordpress based blog.

The client is worried: How many visitors can they handle before they die.

Establish a baseline: How many page displays per second AT LEAST we can handle.
Disruption of the site operation is NOT acceptable.

Minimal budget!

Be as detailed and technical as You possibly can.

Post to the discussion group the following information:

# Detailed description of the simulation of the site. eg. if You're going to virtualize it then how? If You are running it as a process, then how You separate it from the real machine?
# Detailed description of the attack / benchmark tools picked. Where You are going to run them? What tools? How many copies? How you are going to collect the results?!!!

=== Proposals ===
Benchmarking:
* AB - Discussed in lecture
* http://tsung.erlang-projects.org - Jérémy
* wget + AB - Arnis
* http://jakarta.apache.org/jmeter/ - Roland, Jérémy
* http://grinder.sourceforge.net/ - Märt
* http://httpd.apache.org/test/flood/ - Hannes
* Normal monitoring software on live server - Urmas

Simulation of the system:
* VirtualBox - Roland, Jérémy
* VMWare ESX - Igor
* VMWare Player - Marina
* Amazon EC2 - Märt
* KVM - Siim
* Original hardware - Hannes

=== Lab 1 ===
We will need to create two different virtual machines, one is going to be the wordpress server and the 2nd one is the client which is used to attack the server. It's probably easiest to install only one image and then clone it.

Hard disk image cloning is best done with

Linux:
VBoxManage clonehd FirstUbuntu.vdi SecondUbuntu.vdi

Windows:
"C:\Program Files\Oracle\VirtualBox\VBoxManage.exe" clonehd FirstUbuntu.vdi SecondUbuntu.vdi

After cloning the image create another virtual machine and attach the 2nd disk to that machine. As the result there will be two different virtual machines with two different virtual hard disks.

To be able to connect between the two virtual machines, You need to add an
additional network adapter to both hosts. It can be either "Host Only" or
"Internal" type.

To enable the new adapters in Ubuntu edit the file: /etc/network/interfaces

== Scenario 2 ==
Design a method for evaluating any speedup solutions for the wordpress.
A repeatable process to evaluate the claims.
Whatever optimizations.
The process must be detailed enough so that somebody else can get the same results when applying that.
The "other person" is expected to have IT knowledge sufficient to install and run a Linux desktop.
The method must specify the level performance
at which the site is considered DEAD.
Budget requirements: Low - Dedicated machine + dedicated tester.

=== Lab 2 ===
* Get Virtual machine disk image and instructions from: http://www.tud.ttu.ee/~anttix/lab2/ '''NB! DO NOT DOWNLOAD IMAGE FROM THE LINK NOTED IN INSTRUCTIONS PDF, IT WILL BE SLOW'''
* Fix bug in image (see below)
* Measure the effect of these wordpress plugins:
** [http://wordpress.org/extend/plugins/wp-super-cache/ WP Super Cache]
** [http://wordpress.org/extend/plugins/wp-cache/ WP-Cache]
* Devise Your own optimizations for the site

Bug in image: the ip address of the VM is saved in WP database as 192.168.56.3
It is advised tu run the Target VM first and run the "sudo dhclient" command first in Target VM.
Then check active IP of target by command "ifconfig". If it is not 192.168.56.3, then situation can be fixed by running:

In Target VM: "sudo ifconfig eth2 192.168.56.3"
In Client VM: "sudo ifconfig eth2 192.168.56.4"

==== A note to Windows users ====
Use this command line to access VBoxManage program

"C:\Program Files\Oracle\VirtualBox\VBoxManage.exe"

==== Wordpress Admin access ====
Username: admin
Password: QIaTemvskSeM

==== Note to Ubuntu users ====
VirtualBox with WiFi Does NOT work properly http://ubuntuforums.org/showthread.php?t=782936

== Scenario 3 ==
Your client is worried about some stuff posted on a blog. They ask You to take care of it.
They have a throwaway "script kiddie" in a third world country, who will mount the attack
so You don't need to worry about hiding the attackers identity.

Devise a way to attack a wordpress (default installation) based site to render it
unusable (page view times over 60 seconds).

Attack resources: one PC, a script kiddie, internet connection of 2Mbit/s.

How are we going to evaluate the solutions?
* Easy to use instructions
* The most efficient use of available resources

Defacing will count, IF it works for the latest version of wordpress.

=== Lab 3 ===
Possible attacks:

* Brute force overload (AB or other benchmark), bang the slowest page possible.
* Connection flood (slowloris)
* SYN Flood (eg. with hping)
* Banging expensive operations (eg. adding big comments)
* etc.

== Scenario 4 ==
Develop countermeasures for the attacks simulated in Lab 3.

Limitations:
* No additional hardware
* No reactive measures

=== Lab 4 ===

Evaluate the countermeasures against attacks.
The countermeasures must not have negative effects
on "normal usage pattern".

Normal usage pattern is defined as:
* Bursts of 10 connections per IP address in 1 second
* Page load times not over 20 seconds

== Scenario 5 ==
Create a solution and instructions for testing IDS
systems against the wordpress site and attacks
tried in lab 3.

A repeatable process to evaluate vendor claims.
Whatever passive IDS system delivered as a VM or a dedicated box.

Creating the IDS system itself is out of scope.

The process must be detailed enough so that somebody else can get the same results when applying that.
The "other person" is expected to have IT knowledge sufficient to install and run a Linux desktop.

Budget requirements: Modest - 2 Dedicated machines + dedicated tester + networking equipment to connect these together.

The process must test at least the following:
* Port scan
* SYN flood
* slowloris/pyloris
* Ab overwhelming attack

=== Lab 5 ===
Instructions for installing Snort IDS and its web GUI called 'acidbase': https://help.ubuntu.com/community/SnortIDS

== Scenario 6 ==

Develop/download/find/whatever a SNORT configuration (rulesets, preprocessors, whatever)
that performs better than the default configuration in lab 5 tests.
By better we mean:
* Less false positives
* Less false negatives
* The objectives are contradictory so the rule of thumb is one false negative per 10 false positives eg. solution with 10 false positives and 2 false negatives is better than the solution with 100 false positives and 1 false negatives, but the solution with 10 false positives and 1 false negative is better than the solution with 1 false positive and 2 false negatives.
* Attack is defined by a single invocation of the test script.

== Scenario 7 ==

There is a new remote vulnerability in Windows.
You became aware of a new virus that targets this vulnerability at 7 PM.
The antivirus vendor has released an updated virus database, but it's probably not installed
on all of the computers yet. Your company has 500 employees, with half of them running on laptops. You have to decide in 12 hours, if You need to collect all the employee's laptops in the morning.

Collecting the laptops has a high cost in lost employee productivity: There will be a queue of laptops waiting to be inspected. You can assume that all of the laptops can be inspected in half a day.

Limits: You can not mitigate the risk by changing the network configuration, You do not know how many laptops are still in the building. You can not take the servers offline.

Resources: 5 workers, some networking equipment, real servers (you can not disrupt those), "samples" of existing systems: a few spare workstations, a few spare laptops,

What do You know about the virus?
* It disables antivirus software
* It disables automatic software updates
* It can be cleaned up only manually in about 1 manhour

You need to develop an action plan:
* What You test in those scarce 12 hours?
* How?
* How do You weigh the results to make the decision?
* The plan itself must be short and easy to understand so You can write it on a whiteboard.
* Justifications for the specific actions go to a separate file/document.

=== Lab 7 ===
* Get viruses and XP install ISO-s from http://www.tud.ttu.ee/~anttix/lab7/
** Password for the protected zip: doomsday
* Alternatively, get Siims image
* Set up 5 VMS and connect them to a private network (or Host-Only network if You can't configure private nets):
** Plain old XP without any virus scanner (clean)
** Plain old XP with a virus scanner eg Avast (clean)
** Windows XP SP3, no virus scanner (clean)
** Plain old XP without any virus scanner (infected)
** Ubuntu Linux with tcpdump running
* If You have enogh time You can either:
** Find some more Worms and unleash them on Your virtual network (thanx to Urmas for those links)
*** http://vx.netlux.org/
*** http://www.excellentcontent.com/xbart/cbezels/
*** http://hacker-mc.blogspot.com/2008/12/pacoto-hacker.html
*** http://www.rohitab.com/discuss/oldfiles/
** Try to install Windows XP while it is connected to the infected network and see if You manage to install patches or antivirus before getting infected.

Measure the time it takes for the virus to penetrate the machines.
Note if virus scanner was able to catch the virus even if the underlying flaw in
windows wasn't patched.
Test if the SP3 version is immune to attacks originating from the network,
even when virus scanner is not installed.

== Scenario 8 ==

Find a solution to simulate a network of 300 PC-s in a single corporate environment, accessing a software update service at once.

Determine the load on primary internet connection and the router.
Assume that updates server will be able to keep up.

Tools to consider
* [http://www.ssfnet.org/homePage.html SSFNet]
* [http://www.omnetpp.org/ OMNeT++]

Additional resources
* [http://www.ssfnet.org/Exchange/gallery/index.html SSFNet module gallery]
* [http://code.google.com/p/omnet-httptools/ omnet-httptools]

=== Lab 8 ===
==== OMNet++ (Free for academic use only) ====
====== Install OMNeT++ ======
# Compile OMNet++ using these instructions: http://omnetpp.org/doc/omnetpp41/InstallGuide.pdf
# Run omnetpp IDE
# Choose Tutorials->Tic-toc tutorial from welcome page to open Tutorial documentation. Welcome page can be accessed from Help menu if You have accidentally closed it.
# Choose Go to workbench
# Click on tictoc in "Project Explorer" (on left hand pane)
# Choose Project->Open Project
# Choose Project->Build All

====== Install OMNeT++ INET framework ======
# Download https://github.com/downloads/inet-framework/inet/inet-20100723-src.tgz
# Create a directory named omnetpp-workspace and unpack inet-20100723-src.tgz in that directory.
# Switch Eclipse workspace to the newly-created directory: File -> Switch Workspace and select omnetpp-workspace.
# Follow instructions in omnetpp-workspace/inet/INSTALL file in the "If you are using the IDE" section

==== NS-3 (GPL Licensed) ====
Install all dependencies according to instructions [http://www.nsnam.org/wiki/index.php/Installation here] and [http://www.nsnam.org/wiki/index.php/PyViz here]

'''NB! Do not clone or compile anything yet'''

Clone NS-3 repositories
hg clone http://code.nsnam.org/ns-3-allinone
cd ns-3-allinone
./download.py -n gjc/ns-3.9-pyviz

Build NS-3
./build.py

Read the introduction slides during the build :)
* http://www.nsnam.org/tutorials/geni-tutorial-part1.pdf
* http://www.nsnam.org/tutorials.html

Run Example visualization
cd ns-3.9-pyviz
./waf --pyrun examples/flowmon/wifi-olsr-flowmon.py

== Scenario 9 ==

Simulate a DDoS attack against a network of web servers.

* 2 types of attacks
** SYN Flood
** "AB" style attack

Assumptions:
* 1000 "infected" hosts performing the attack
* 10 web servers, located in 5 locations
* The infected host only attacks one server
* The target to attack is selected randomly
* Assume that servers can keep up with the flood
* Data transferred during each connection is about 500kb

Objectives:
* Assess the bandwidth these attacks consume in each location

You can only implement a subset of constraints and assumptions.
Do as much as You can, maybe others have done even less :D

ITX8080

2010-11-26T17:01:49Z

Anttix: /* OMNet++ (Free for academic use only) */

= General Information =
== Schedule ==

Lecture TH 12:00 - 13:30

Practice FR 14:00 - 17:30

== Communication ==

Discussinons will be held at: itx8080 atatat googlegroups.com

Send e-mail to hannesa at-no-spam-please gmail.com for an invitation.

The lecturers can be reached via the course coordinator:

antti.andreimann only-people-please eesti.ee

== Points awarded so far ==

Arnis : 3 points - ab testing solution, best countermeasure proposed for scenario 4, best snort rules proposed for scenario 6

Igor : 3 points - wordpress virtualization solution, lab 3 report, IDS testing solution

Kaarel : 2 points - lab 1 report and conclusions, lab 3 solution

Märt : 3 points - wordpress testing procedure, best wordpress optimization (wp-cache + php-apc), best lab 2 report.

Roland: 2 points - best Lab 4 report, IDS testing solution

Hannes: 1 point - best lab 6 report

Siim: 1 point - most popular scenario 7 solution

Urmas: 2 points - lab 5 report, the set of viruses used in lab 7

Martti: 1 point - best lab 7 report

= Scenarios =

== Scenario 1 ==
There is a Wordpress based blog.

The client is worried: How many visitors can they handle before they die.

Establish a baseline: How many page displays per second AT LEAST we can handle.
Disruption of the site operation is NOT acceptable.

Minimal budget!

Be as detailed and technical as You possibly can.

Post to the discussion group the following information:

# Detailed description of the simulation of the site. eg. if You're going to virtualize it then how? If You are running it as a process, then how You separate it from the real machine?
# Detailed description of the attack / benchmark tools picked. Where You are going to run them? What tools? How many copies? How you are going to collect the results?!!!

=== Proposals ===
Benchmarking:
* AB - Discussed in lecture
* http://tsung.erlang-projects.org - Jérémy
* wget + AB - Arnis
* http://jakarta.apache.org/jmeter/ - Roland, Jérémy
* http://grinder.sourceforge.net/ - Märt
* http://httpd.apache.org/test/flood/ - Hannes
* Normal monitoring software on live server - Urmas

Simulation of the system:
* VirtualBox - Roland, Jérémy
* VMWare ESX - Igor
* VMWare Player - Marina
* Amazon EC2 - Märt
* KVM - Siim
* Original hardware - Hannes

=== Lab 1 ===
We will need to create two different virtual machines, one is going to be the wordpress server and the 2nd one is the client which is used to attack the server. It's probably easiest to install only one image and then clone it.

Hard disk image cloning is best done with

Linux:
VBoxManage clonehd FirstUbuntu.vdi SecondUbuntu.vdi

Windows:
"C:\Program Files\Oracle\VirtualBox\VBoxManage.exe" clonehd FirstUbuntu.vdi SecondUbuntu.vdi

After cloning the image create another virtual machine and attach the 2nd disk to that machine. As the result there will be two different virtual machines with two different virtual hard disks.

To be able to connect between the two virtual machines, You need to add an
additional network adapter to both hosts. It can be either "Host Only" or
"Internal" type.

To enable the new adapters in Ubuntu edit the file: /etc/network/interfaces

== Scenario 2 ==
Design a method for evaluating any speedup solutions for the wordpress.
A repeatable process to evaluate the claims.
Whatever optimizations.
The process must be detailed enough so that somebody else can get the same results when applying that.
The "other person" is expected to have IT knowledge sufficient to install and run a Linux desktop.
The method must specify the level performance
at which the site is considered DEAD.
Budget requirements: Low - Dedicated machine + dedicated tester.

=== Lab 2 ===
* Get Virtual machine disk image and instructions from: http://www.tud.ttu.ee/~anttix/lab2/ '''NB! DO NOT DOWNLOAD IMAGE FROM THE LINK NOTED IN INSTRUCTIONS PDF, IT WILL BE SLOW'''
* Fix bug in image (see below)
* Measure the effect of these wordpress plugins:
** [http://wordpress.org/extend/plugins/wp-super-cache/ WP Super Cache]
** [http://wordpress.org/extend/plugins/wp-cache/ WP-Cache]
* Devise Your own optimizations for the site

Bug in image: the ip address of the VM is saved in WP database as 192.168.56.3
It is advised tu run the Target VM first and run the "sudo dhclient" command first in Target VM.
Then check active IP of target by command "ifconfig". If it is not 192.168.56.3, then situation can be fixed by running:

In Target VM: "sudo ifconfig eth2 192.168.56.3"
In Client VM: "sudo ifconfig eth2 192.168.56.4"

==== A note to Windows users ====
Use this command line to access VBoxManage program

"C:\Program Files\Oracle\VirtualBox\VBoxManage.exe"

==== Wordpress Admin access ====
Username: admin
Password: QIaTemvskSeM

==== Note to Ubuntu users ====
VirtualBox with WiFi Does NOT work properly http://ubuntuforums.org/showthread.php?t=782936

== Scenario 3 ==
Your client is worried about some stuff posted on a blog. They ask You to take care of it.
They have a throwaway "script kiddie" in a third world country, who will mount the attack
so You don't need to worry about hiding the attackers identity.

Devise a way to attack a wordpress (default installation) based site to render it
unusable (page view times over 60 seconds).

Attack resources: one PC, a script kiddie, internet connection of 2Mbit/s.

How are we going to evaluate the solutions?
* Easy to use instructions
* The most efficient use of available resources

Defacing will count, IF it works for the latest version of wordpress.

=== Lab 3 ===
Possible attacks:

* Brute force overload (AB or other benchmark), bang the slowest page possible.
* Connection flood (slowloris)
* SYN Flood (eg. with hping)
* Banging expensive operations (eg. adding big comments)
* etc.

== Scenario 4 ==
Develop countermeasures for the attacks simulated in Lab 3.

Limitations:
* No additional hardware
* No reactive measures

=== Lab 4 ===

Evaluate the countermeasures against attacks.
The countermeasures must not have negative effects
on "normal usage pattern".

Normal usage pattern is defined as:
* Bursts of 10 connections per IP address in 1 second
* Page load times not over 20 seconds

== Scenario 5 ==
Create a solution and instructions for testing IDS
systems against the wordpress site and attacks
tried in lab 3.

A repeatable process to evaluate vendor claims.
Whatever passive IDS system delivered as a VM or a dedicated box.

Creating the IDS system itself is out of scope.

The process must be detailed enough so that somebody else can get the same results when applying that.
The "other person" is expected to have IT knowledge sufficient to install and run a Linux desktop.

Budget requirements: Modest - 2 Dedicated machines + dedicated tester + networking equipment to connect these together.

The process must test at least the following:
* Port scan
* SYN flood
* slowloris/pyloris
* Ab overwhelming attack

=== Lab 5 ===
Instructions for installing Snort IDS and its web GUI called 'acidbase': https://help.ubuntu.com/community/SnortIDS

== Scenario 6 ==

Develop/download/find/whatever a SNORT configuration (rulesets, preprocessors, whatever)
that performs better than the default configuration in lab 5 tests.
By better we mean:
* Less false positives
* Less false negatives
* The objectives are contradictory so the rule of thumb is one false negative per 10 false positives eg. solution with 10 false positives and 2 false negatives is better than the solution with 100 false positives and 1 false negatives, but the solution with 10 false positives and 1 false negative is better than the solution with 1 false positive and 2 false negatives.
* Attack is defined by a single invocation of the test script.

== Scenario 7 ==

There is a new remote vulnerability in Windows.
You became aware of a new virus that targets this vulnerability at 7 PM.
The antivirus vendor has released an updated virus database, but it's probably not installed
on all of the computers yet. Your company has 500 employees, with half of them running on laptops. You have to decide in 12 hours, if You need to collect all the employee's laptops in the morning.

Collecting the laptops has a high cost in lost employee productivity: There will be a queue of laptops waiting to be inspected. You can assume that all of the laptops can be inspected in half a day.

Limits: You can not mitigate the risk by changing the network configuration, You do not know how many laptops are still in the building. You can not take the servers offline.

Resources: 5 workers, some networking equipment, real servers (you can not disrupt those), "samples" of existing systems: a few spare workstations, a few spare laptops,

What do You know about the virus?
* It disables antivirus software
* It disables automatic software updates
* It can be cleaned up only manually in about 1 manhour

You need to develop an action plan:
* What You test in those scarce 12 hours?
* How?
* How do You weigh the results to make the decision?
* The plan itself must be short and easy to understand so You can write it on a whiteboard.
* Justifications for the specific actions go to a separate file/document.

=== Lab 7 ===
* Get viruses and XP install ISO-s from http://www.tud.ttu.ee/~anttix/lab7/
** Password for the protected zip: doomsday
* Alternatively, get Siims image
* Set up 5 VMS and connect them to a private network (or Host-Only network if You can't configure private nets):
** Plain old XP without any virus scanner (clean)
** Plain old XP with a virus scanner eg Avast (clean)
** Windows XP SP3, no virus scanner (clean)
** Plain old XP without any virus scanner (infected)
** Ubuntu Linux with tcpdump running
* If You have enogh time You can either:
** Find some more Worms and unleash them on Your virtual network (thanx to Urmas for those links)
*** http://vx.netlux.org/
*** http://www.excellentcontent.com/xbart/cbezels/
*** http://hacker-mc.blogspot.com/2008/12/pacoto-hacker.html
*** http://www.rohitab.com/discuss/oldfiles/
** Try to install Windows XP while it is connected to the infected network and see if You manage to install patches or antivirus before getting infected.

Measure the time it takes for the virus to penetrate the machines.
Note if virus scanner was able to catch the virus even if the underlying flaw in
windows wasn't patched.
Test if the SP3 version is immune to attacks originating from the network,
even when virus scanner is not installed.

== Scenario 8 ==

Find a solution to simulate a network of 300 PC-s in a single corporate environment, accessing a software update service at once.

Determine the load on primary internet connection and the router.
Assume that updates server will be able to keep up.

Tools to consider
* [http://www.ssfnet.org/homePage.html SSFNet]
* [http://www.omnetpp.org/ OMNeT++]

Additional resources
* [http://www.ssfnet.org/Exchange/gallery/index.html SSFNet module gallery]
* [http://code.google.com/p/omnet-httptools/ omnet-httptools]

=== Lab 8 ===
==== OMNet++ (Free for academic use only) ====
====== Install OMNeT++ ======
# Compile OMNet++ using these instructions: http://omnetpp.org/doc/omnetpp41/InstallGuide.pdf
# Run omnetpp IDE
# Choose Tutorials->Tic-toc tutorial from welcome page to open Tutorial documentation. Welcome page can be accessed from Help menu if You have accidentally closed it.
# Choose Go to workbench
# Click on tictoc in "Project Explorer" (on left hand pane)
# Choose Project->Open Project
# Choose Project->Build All

====== Install OMNeT++ INET framework ======
# Download https://github.com/downloads/inet-framework/inet/inet-20100723-src.tgz
# Create a directory named omnetpp-workspace and unpack inet-20100723-src.tgz in that directory.
# Switch Eclipse workspace to the newly-created directory: File -> Switch Workspace and select omnetpp-workspace.
# Follow instructions in omnetpp-workspace/inet/INSTALL file in the "If you are using the IDE" section

==== NS-3 (GPL Licensed) ====
Install all dependencies according to instructions [http://www.nsnam.org/wiki/index.php/Installation here] and [http://www.nsnam.org/wiki/index.php/PyViz here]

'''NB! Do not clone or compile anything yet'''

Clone NS-3 repositories
hg clone http://code.nsnam.org/ns-3-allinone
cd ns-3-allinone
./download.py -n gjc/ns-3.9-pyviz

Build NS-3
./build.py

Read the introduction slides during the build :)
* http://www.nsnam.org/tutorials/geni-tutorial-part1.pdf
* http://www.nsnam.org/tutorials.html

== Scenario 9 ==

Simulate a DDoS attack against a network of web servers.

* 2 types of attacks
** SYN Flood
** "AB" style attack

Assumptions:
* 1000 "infected" hosts performing the attack
* 10 web servers, located in 5 locations
* The infected host only attacks one server
* The target to attack is selected randomly
* Assume that servers can keep up with the flood
* Data transferred during each connection is about 500kb

Objectives:
* Assess the bandwidth these attacks consume in each location

You can only implement a subset of constraints and assumptions.
Do as much as You can, maybe others have done even less :D

ITX8080

2010-11-26T16:59:24Z

Anttix: /* Install OMNeT++ INET framework */

= General Information =
== Schedule ==

Lecture TH 12:00 - 13:30

Practice FR 14:00 - 17:30

== Communication ==

Discussinons will be held at: itx8080 atatat googlegroups.com

Send e-mail to hannesa at-no-spam-please gmail.com for an invitation.

The lecturers can be reached via the course coordinator:

antti.andreimann only-people-please eesti.ee

== Points awarded so far ==

Arnis : 3 points - ab testing solution, best countermeasure proposed for scenario 4, best snort rules proposed for scenario 6

Igor : 3 points - wordpress virtualization solution, lab 3 report, IDS testing solution

Kaarel : 2 points - lab 1 report and conclusions, lab 3 solution

Märt : 3 points - wordpress testing procedure, best wordpress optimization (wp-cache + php-apc), best lab 2 report.

Roland: 2 points - best Lab 4 report, IDS testing solution

Hannes: 1 point - best lab 6 report

Siim: 1 point - most popular scenario 7 solution

Urmas: 2 points - lab 5 report, the set of viruses used in lab 7

Martti: 1 point - best lab 7 report

= Scenarios =

== Scenario 1 ==
There is a Wordpress based blog.

The client is worried: How many visitors can they handle before they die.

Establish a baseline: How many page displays per second AT LEAST we can handle.
Disruption of the site operation is NOT acceptable.

Minimal budget!

Be as detailed and technical as You possibly can.

Post to the discussion group the following information:

# Detailed description of the simulation of the site. eg. if You're going to virtualize it then how? If You are running it as a process, then how You separate it from the real machine?
# Detailed description of the attack / benchmark tools picked. Where You are going to run them? What tools? How many copies? How you are going to collect the results?!!!

=== Proposals ===
Benchmarking:
* AB - Discussed in lecture
* http://tsung.erlang-projects.org - Jérémy
* wget + AB - Arnis
* http://jakarta.apache.org/jmeter/ - Roland, Jérémy
* http://grinder.sourceforge.net/ - Märt
* http://httpd.apache.org/test/flood/ - Hannes
* Normal monitoring software on live server - Urmas

Simulation of the system:
* VirtualBox - Roland, Jérémy
* VMWare ESX - Igor
* VMWare Player - Marina
* Amazon EC2 - Märt
* KVM - Siim
* Original hardware - Hannes

=== Lab 1 ===
We will need to create two different virtual machines, one is going to be the wordpress server and the 2nd one is the client which is used to attack the server. It's probably easiest to install only one image and then clone it.

Hard disk image cloning is best done with

Linux:
VBoxManage clonehd FirstUbuntu.vdi SecondUbuntu.vdi

Windows:
"C:\Program Files\Oracle\VirtualBox\VBoxManage.exe" clonehd FirstUbuntu.vdi SecondUbuntu.vdi

After cloning the image create another virtual machine and attach the 2nd disk to that machine. As the result there will be two different virtual machines with two different virtual hard disks.

To be able to connect between the two virtual machines, You need to add an
additional network adapter to both hosts. It can be either "Host Only" or
"Internal" type.

To enable the new adapters in Ubuntu edit the file: /etc/network/interfaces

== Scenario 2 ==
Design a method for evaluating any speedup solutions for the wordpress.
A repeatable process to evaluate the claims.
Whatever optimizations.
The process must be detailed enough so that somebody else can get the same results when applying that.
The "other person" is expected to have IT knowledge sufficient to install and run a Linux desktop.
The method must specify the level performance
at which the site is considered DEAD.
Budget requirements: Low - Dedicated machine + dedicated tester.

=== Lab 2 ===
* Get Virtual machine disk image and instructions from: http://www.tud.ttu.ee/~anttix/lab2/ '''NB! DO NOT DOWNLOAD IMAGE FROM THE LINK NOTED IN INSTRUCTIONS PDF, IT WILL BE SLOW'''
* Fix bug in image (see below)
* Measure the effect of these wordpress plugins:
** [http://wordpress.org/extend/plugins/wp-super-cache/ WP Super Cache]
** [http://wordpress.org/extend/plugins/wp-cache/ WP-Cache]
* Devise Your own optimizations for the site

Bug in image: the ip address of the VM is saved in WP database as 192.168.56.3
It is advised tu run the Target VM first and run the "sudo dhclient" command first in Target VM.
Then check active IP of target by command "ifconfig". If it is not 192.168.56.3, then situation can be fixed by running:

In Target VM: "sudo ifconfig eth2 192.168.56.3"
In Client VM: "sudo ifconfig eth2 192.168.56.4"

==== A note to Windows users ====
Use this command line to access VBoxManage program

"C:\Program Files\Oracle\VirtualBox\VBoxManage.exe"

==== Wordpress Admin access ====
Username: admin
Password: QIaTemvskSeM

==== Note to Ubuntu users ====
VirtualBox with WiFi Does NOT work properly http://ubuntuforums.org/showthread.php?t=782936

== Scenario 3 ==
Your client is worried about some stuff posted on a blog. They ask You to take care of it.
They have a throwaway "script kiddie" in a third world country, who will mount the attack
so You don't need to worry about hiding the attackers identity.

Devise a way to attack a wordpress (default installation) based site to render it
unusable (page view times over 60 seconds).

Attack resources: one PC, a script kiddie, internet connection of 2Mbit/s.

How are we going to evaluate the solutions?
* Easy to use instructions
* The most efficient use of available resources

Defacing will count, IF it works for the latest version of wordpress.

=== Lab 3 ===
Possible attacks:

* Brute force overload (AB or other benchmark), bang the slowest page possible.
* Connection flood (slowloris)
* SYN Flood (eg. with hping)
* Banging expensive operations (eg. adding big comments)
* etc.

== Scenario 4 ==
Develop countermeasures for the attacks simulated in Lab 3.

Limitations:
* No additional hardware
* No reactive measures

=== Lab 4 ===

Evaluate the countermeasures against attacks.
The countermeasures must not have negative effects
on "normal usage pattern".

Normal usage pattern is defined as:
* Bursts of 10 connections per IP address in 1 second
* Page load times not over 20 seconds

== Scenario 5 ==
Create a solution and instructions for testing IDS
systems against the wordpress site and attacks
tried in lab 3.

A repeatable process to evaluate vendor claims.
Whatever passive IDS system delivered as a VM or a dedicated box.

Creating the IDS system itself is out of scope.

The process must be detailed enough so that somebody else can get the same results when applying that.
The "other person" is expected to have IT knowledge sufficient to install and run a Linux desktop.

Budget requirements: Modest - 2 Dedicated machines + dedicated tester + networking equipment to connect these together.

The process must test at least the following:
* Port scan
* SYN flood
* slowloris/pyloris
* Ab overwhelming attack

=== Lab 5 ===
Instructions for installing Snort IDS and its web GUI called 'acidbase': https://help.ubuntu.com/community/SnortIDS

== Scenario 6 ==

Develop/download/find/whatever a SNORT configuration (rulesets, preprocessors, whatever)
that performs better than the default configuration in lab 5 tests.
By better we mean:
* Less false positives
* Less false negatives
* The objectives are contradictory so the rule of thumb is one false negative per 10 false positives eg. solution with 10 false positives and 2 false negatives is better than the solution with 100 false positives and 1 false negatives, but the solution with 10 false positives and 1 false negative is better than the solution with 1 false positive and 2 false negatives.
* Attack is defined by a single invocation of the test script.

== Scenario 7 ==

There is a new remote vulnerability in Windows.
You became aware of a new virus that targets this vulnerability at 7 PM.
The antivirus vendor has released an updated virus database, but it's probably not installed
on all of the computers yet. Your company has 500 employees, with half of them running on laptops. You have to decide in 12 hours, if You need to collect all the employee's laptops in the morning.

Collecting the laptops has a high cost in lost employee productivity: There will be a queue of laptops waiting to be inspected. You can assume that all of the laptops can be inspected in half a day.

Limits: You can not mitigate the risk by changing the network configuration, You do not know how many laptops are still in the building. You can not take the servers offline.

Resources: 5 workers, some networking equipment, real servers (you can not disrupt those), "samples" of existing systems: a few spare workstations, a few spare laptops,

What do You know about the virus?
* It disables antivirus software
* It disables automatic software updates
* It can be cleaned up only manually in about 1 manhour

You need to develop an action plan:
* What You test in those scarce 12 hours?
* How?
* How do You weigh the results to make the decision?
* The plan itself must be short and easy to understand so You can write it on a whiteboard.
* Justifications for the specific actions go to a separate file/document.

=== Lab 7 ===
* Get viruses and XP install ISO-s from http://www.tud.ttu.ee/~anttix/lab7/
** Password for the protected zip: doomsday
* Alternatively, get Siims image
* Set up 5 VMS and connect them to a private network (or Host-Only network if You can't configure private nets):
** Plain old XP without any virus scanner (clean)
** Plain old XP with a virus scanner eg Avast (clean)
** Windows XP SP3, no virus scanner (clean)
** Plain old XP without any virus scanner (infected)
** Ubuntu Linux with tcpdump running
* If You have enogh time You can either:
** Find some more Worms and unleash them on Your virtual network (thanx to Urmas for those links)
*** http://vx.netlux.org/
*** http://www.excellentcontent.com/xbart/cbezels/
*** http://hacker-mc.blogspot.com/2008/12/pacoto-hacker.html
*** http://www.rohitab.com/discuss/oldfiles/
** Try to install Windows XP while it is connected to the infected network and see if You manage to install patches or antivirus before getting infected.

Measure the time it takes for the virus to penetrate the machines.
Note if virus scanner was able to catch the virus even if the underlying flaw in
windows wasn't patched.
Test if the SP3 version is immune to attacks originating from the network,
even when virus scanner is not installed.

== Scenario 8 ==

Find a solution to simulate a network of 300 PC-s in a single corporate environment, accessing a software update service at once.

Determine the load on primary internet connection and the router.
Assume that updates server will be able to keep up.

Tools to consider
* [http://www.ssfnet.org/homePage.html SSFNet]
* [http://www.omnetpp.org/ OMNeT++]

Additional resources
* [http://www.ssfnet.org/Exchange/gallery/index.html SSFNet module gallery]
* [http://code.google.com/p/omnet-httptools/ omnet-httptools]

=== Lab 8 ===
==== OMNet++ (Free for academic use only) ====
====== Install OMNeT++ ======
# Compile OMNet++ using these instructions: http://omnetpp.org/doc/omnetpp41/InstallGuide.pdf
# Run omnetpp IDE
# Choose Tutorials->Tic-toc tutorial from welcome page to open Tutorial documentation. Welcome page can be accessed from Help menu if You have accidentally closed it.
# Choose Go to workbench
# Click on tictoc in "Project Explorer" (on left hand pane)
# Choose Project->Open Project
# Choose Project->Build All

====== Install OMNeT++ INET framework ======
# Download https://github.com/downloads/inet-framework/inet/inet-20100723-src.tgz
# Create a directory named omnetpp-workspace and unpack inet-20100723-src.tgz in that directory.
# Switch Eclipse workspace to the newly-created directory: File -> Switch Workspace and select omnetpp-workspace.
# Follow instructions in omnetpp-workspace/inet/INSTALL file in the "If you are using the IDE" section

====== Install OMNeT++ HttpTools framework ======
# Follow the instructions: http://code.google.com/p/omnet-httptools/wiki/buildAndInstall

==== NS-3 (GPL Licensed) ====
Install all dependencies according to instructions [http://www.nsnam.org/wiki/index.php/Installation here] and [http://www.nsnam.org/wiki/index.php/PyViz here]

'''NB! Do not clone or compile anything yet'''

Clone NS-3 repositories
hg clone http://code.nsnam.org/ns-3-allinone
cd ns-3-allinone
./download.py -n gjc/ns-3.9-pyviz

Build NS-3
./build.py

Read the introduction slides during the build :)
* http://www.nsnam.org/tutorials/geni-tutorial-part1.pdf
* http://www.nsnam.org/tutorials.html

== Scenario 9 ==

Simulate a DDoS attack against a network of web servers.

* 2 types of attacks
** SYN Flood
** "AB" style attack

Assumptions:
* 1000 "infected" hosts performing the attack
* 10 web servers, located in 5 locations
* The infected host only attacks one server
* The target to attack is selected randomly
* Assume that servers can keep up with the flood
* Data transferred during each connection is about 500kb

Objectives:
* Assess the bandwidth these attacks consume in each location

You can only implement a subset of constraints and assumptions.
Do as much as You can, maybe others have done even less :D

ITX8080

2010-11-26T16:41:16Z

Anttix: /* Install OMNeT++ HttpTools framework */

= General Information =
== Schedule ==

Lecture TH 12:00 - 13:30

Practice FR 14:00 - 17:30

== Communication ==

Discussinons will be held at: itx8080 atatat googlegroups.com

Send e-mail to hannesa at-no-spam-please gmail.com for an invitation.

The lecturers can be reached via the course coordinator:

antti.andreimann only-people-please eesti.ee

== Points awarded so far ==

Arnis : 3 points - ab testing solution, best countermeasure proposed for scenario 4, best snort rules proposed for scenario 6

Igor : 3 points - wordpress virtualization solution, lab 3 report, IDS testing solution

Kaarel : 2 points - lab 1 report and conclusions, lab 3 solution

Märt : 3 points - wordpress testing procedure, best wordpress optimization (wp-cache + php-apc), best lab 2 report.

Roland: 2 points - best Lab 4 report, IDS testing solution

Hannes: 1 point - best lab 6 report

Siim: 1 point - most popular scenario 7 solution

Urmas: 2 points - lab 5 report, the set of viruses used in lab 7

Martti: 1 point - best lab 7 report

= Scenarios =

== Scenario 1 ==
There is a Wordpress based blog.

The client is worried: How many visitors can they handle before they die.

Establish a baseline: How many page displays per second AT LEAST we can handle.
Disruption of the site operation is NOT acceptable.

Minimal budget!

Be as detailed and technical as You possibly can.

Post to the discussion group the following information:

# Detailed description of the simulation of the site. eg. if You're going to virtualize it then how? If You are running it as a process, then how You separate it from the real machine?
# Detailed description of the attack / benchmark tools picked. Where You are going to run them? What tools? How many copies? How you are going to collect the results?!!!

=== Proposals ===
Benchmarking:
* AB - Discussed in lecture
* http://tsung.erlang-projects.org - Jérémy
* wget + AB - Arnis
* http://jakarta.apache.org/jmeter/ - Roland, Jérémy
* http://grinder.sourceforge.net/ - Märt
* http://httpd.apache.org/test/flood/ - Hannes
* Normal monitoring software on live server - Urmas

Simulation of the system:
* VirtualBox - Roland, Jérémy
* VMWare ESX - Igor
* VMWare Player - Marina
* Amazon EC2 - Märt
* KVM - Siim
* Original hardware - Hannes

=== Lab 1 ===
We will need to create two different virtual machines, one is going to be the wordpress server and the 2nd one is the client which is used to attack the server. It's probably easiest to install only one image and then clone it.

Hard disk image cloning is best done with

Linux:
VBoxManage clonehd FirstUbuntu.vdi SecondUbuntu.vdi

Windows:
"C:\Program Files\Oracle\VirtualBox\VBoxManage.exe" clonehd FirstUbuntu.vdi SecondUbuntu.vdi

After cloning the image create another virtual machine and attach the 2nd disk to that machine. As the result there will be two different virtual machines with two different virtual hard disks.

To be able to connect between the two virtual machines, You need to add an
additional network adapter to both hosts. It can be either "Host Only" or
"Internal" type.

To enable the new adapters in Ubuntu edit the file: /etc/network/interfaces

== Scenario 2 ==
Design a method for evaluating any speedup solutions for the wordpress.
A repeatable process to evaluate the claims.
Whatever optimizations.
The process must be detailed enough so that somebody else can get the same results when applying that.
The "other person" is expected to have IT knowledge sufficient to install and run a Linux desktop.
The method must specify the level performance
at which the site is considered DEAD.
Budget requirements: Low - Dedicated machine + dedicated tester.

=== Lab 2 ===
* Get Virtual machine disk image and instructions from: http://www.tud.ttu.ee/~anttix/lab2/ '''NB! DO NOT DOWNLOAD IMAGE FROM THE LINK NOTED IN INSTRUCTIONS PDF, IT WILL BE SLOW'''
* Fix bug in image (see below)
* Measure the effect of these wordpress plugins:
** [http://wordpress.org/extend/plugins/wp-super-cache/ WP Super Cache]
** [http://wordpress.org/extend/plugins/wp-cache/ WP-Cache]
* Devise Your own optimizations for the site

Bug in image: the ip address of the VM is saved in WP database as 192.168.56.3
It is advised tu run the Target VM first and run the "sudo dhclient" command first in Target VM.
Then check active IP of target by command "ifconfig". If it is not 192.168.56.3, then situation can be fixed by running:

In Target VM: "sudo ifconfig eth2 192.168.56.3"
In Client VM: "sudo ifconfig eth2 192.168.56.4"

==== A note to Windows users ====
Use this command line to access VBoxManage program

"C:\Program Files\Oracle\VirtualBox\VBoxManage.exe"

==== Wordpress Admin access ====
Username: admin
Password: QIaTemvskSeM

==== Note to Ubuntu users ====
VirtualBox with WiFi Does NOT work properly http://ubuntuforums.org/showthread.php?t=782936

== Scenario 3 ==
Your client is worried about some stuff posted on a blog. They ask You to take care of it.
They have a throwaway "script kiddie" in a third world country, who will mount the attack
so You don't need to worry about hiding the attackers identity.

Devise a way to attack a wordpress (default installation) based site to render it
unusable (page view times over 60 seconds).

Attack resources: one PC, a script kiddie, internet connection of 2Mbit/s.

How are we going to evaluate the solutions?
* Easy to use instructions
* The most efficient use of available resources

Defacing will count, IF it works for the latest version of wordpress.

=== Lab 3 ===
Possible attacks:

* Brute force overload (AB or other benchmark), bang the slowest page possible.
* Connection flood (slowloris)
* SYN Flood (eg. with hping)
* Banging expensive operations (eg. adding big comments)
* etc.

== Scenario 4 ==
Develop countermeasures for the attacks simulated in Lab 3.

Limitations:
* No additional hardware
* No reactive measures

=== Lab 4 ===

Evaluate the countermeasures against attacks.
The countermeasures must not have negative effects
on "normal usage pattern".

Normal usage pattern is defined as:
* Bursts of 10 connections per IP address in 1 second
* Page load times not over 20 seconds

== Scenario 5 ==
Create a solution and instructions for testing IDS
systems against the wordpress site and attacks
tried in lab 3.

A repeatable process to evaluate vendor claims.
Whatever passive IDS system delivered as a VM or a dedicated box.

Creating the IDS system itself is out of scope.

The process must be detailed enough so that somebody else can get the same results when applying that.
The "other person" is expected to have IT knowledge sufficient to install and run a Linux desktop.

Budget requirements: Modest - 2 Dedicated machines + dedicated tester + networking equipment to connect these together.

The process must test at least the following:
* Port scan
* SYN flood
* slowloris/pyloris
* Ab overwhelming attack

=== Lab 5 ===
Instructions for installing Snort IDS and its web GUI called 'acidbase': https://help.ubuntu.com/community/SnortIDS

== Scenario 6 ==

Develop/download/find/whatever a SNORT configuration (rulesets, preprocessors, whatever)
that performs better than the default configuration in lab 5 tests.
By better we mean:
* Less false positives
* Less false negatives
* The objectives are contradictory so the rule of thumb is one false negative per 10 false positives eg. solution with 10 false positives and 2 false negatives is better than the solution with 100 false positives and 1 false negatives, but the solution with 10 false positives and 1 false negative is better than the solution with 1 false positive and 2 false negatives.
* Attack is defined by a single invocation of the test script.

== Scenario 7 ==

There is a new remote vulnerability in Windows.
You became aware of a new virus that targets this vulnerability at 7 PM.
The antivirus vendor has released an updated virus database, but it's probably not installed
on all of the computers yet. Your company has 500 employees, with half of them running on laptops. You have to decide in 12 hours, if You need to collect all the employee's laptops in the morning.

Collecting the laptops has a high cost in lost employee productivity: There will be a queue of laptops waiting to be inspected. You can assume that all of the laptops can be inspected in half a day.

Limits: You can not mitigate the risk by changing the network configuration, You do not know how many laptops are still in the building. You can not take the servers offline.

Resources: 5 workers, some networking equipment, real servers (you can not disrupt those), "samples" of existing systems: a few spare workstations, a few spare laptops,

What do You know about the virus?
* It disables antivirus software
* It disables automatic software updates
* It can be cleaned up only manually in about 1 manhour

You need to develop an action plan:
* What You test in those scarce 12 hours?
* How?
* How do You weigh the results to make the decision?
* The plan itself must be short and easy to understand so You can write it on a whiteboard.
* Justifications for the specific actions go to a separate file/document.

=== Lab 7 ===
* Get viruses and XP install ISO-s from http://www.tud.ttu.ee/~anttix/lab7/
** Password for the protected zip: doomsday
* Alternatively, get Siims image
* Set up 5 VMS and connect them to a private network (or Host-Only network if You can't configure private nets):
** Plain old XP without any virus scanner (clean)
** Plain old XP with a virus scanner eg Avast (clean)
** Windows XP SP3, no virus scanner (clean)
** Plain old XP without any virus scanner (infected)
** Ubuntu Linux with tcpdump running
* If You have enogh time You can either:
** Find some more Worms and unleash them on Your virtual network (thanx to Urmas for those links)
*** http://vx.netlux.org/
*** http://www.excellentcontent.com/xbart/cbezels/
*** http://hacker-mc.blogspot.com/2008/12/pacoto-hacker.html
*** http://www.rohitab.com/discuss/oldfiles/
** Try to install Windows XP while it is connected to the infected network and see if You manage to install patches or antivirus before getting infected.

Measure the time it takes for the virus to penetrate the machines.
Note if virus scanner was able to catch the virus even if the underlying flaw in
windows wasn't patched.
Test if the SP3 version is immune to attacks originating from the network,
even when virus scanner is not installed.

== Scenario 8 ==

Find a solution to simulate a network of 300 PC-s in a single corporate environment, accessing a software update service at once.

Determine the load on primary internet connection and the router.
Assume that updates server will be able to keep up.

Tools to consider
* [http://www.ssfnet.org/homePage.html SSFNet]
* [http://www.omnetpp.org/ OMNeT++]

Additional resources
* [http://www.ssfnet.org/Exchange/gallery/index.html SSFNet module gallery]
* [http://code.google.com/p/omnet-httptools/ omnet-httptools]

=== Lab 8 ===
==== OMNet++ (Free for academic use only) ====
====== Install OMNeT++ ======
# Compile OMNet++ using these instructions: http://omnetpp.org/doc/omnetpp41/InstallGuide.pdf
# Run omnetpp IDE
# Choose Tutorials->Tic-toc tutorial from welcome page to open Tutorial documentation. Welcome page can be accessed from Help menu if You have accidentally closed it.
# Choose Go to workbench
# Click on tictoc in "Project Explorer" (on left hand pane)
# Choose Project->Open Project
# Choose Project->Build All

====== Install OMNeT++ INET framework ======
# Download https://github.com/downloads/inet-framework/inet/inet-20100723-src.tgz
# Create a directory named omnetpp-workspace and unpack inet-20100723-src.tgz in that directory.
# Switch Eclipse workspace to the newly-created directory: File -> Switch Workspace and select omnetpp-workspace.
# Follow instructions in omnetpp-workspace/inet/INSTALL file

====== Install OMNeT++ HttpTools framework ======
# Follow the instructions: http://code.google.com/p/omnet-httptools/wiki/buildAndInstall

==== NS-3 (GPL Licensed) ====
Install all dependencies according to instructions [http://www.nsnam.org/wiki/index.php/Installation here] and [http://www.nsnam.org/wiki/index.php/PyViz here]

'''NB! Do not clone or compile anything yet'''

Clone NS-3 repositories
hg clone http://code.nsnam.org/ns-3-allinone
cd ns-3-allinone
./download.py -n gjc/ns-3.9-pyviz

Build NS-3
./build.py

Read the introduction slides during the build :)
* http://www.nsnam.org/tutorials/geni-tutorial-part1.pdf
* http://www.nsnam.org/tutorials.html

== Scenario 9 ==

Simulate a DDoS attack against a network of web servers.

* 2 types of attacks
** SYN Flood
** "AB" style attack

Assumptions:
* 1000 "infected" hosts performing the attack
* 10 web servers, located in 5 locations
* The infected host only attacks one server
* The target to attack is selected randomly
* Assume that servers can keep up with the flood
* Data transferred during each connection is about 500kb

Objectives:
* Assess the bandwidth these attacks consume in each location

You can only implement a subset of constraints and assumptions.
Do as much as You can, maybe others have done even less :D

ITX8080

2010-11-26T16:40:09Z

Anttix: /* OMNet++ (Free for academic use only) */

= General Information =
== Schedule ==

Lecture TH 12:00 - 13:30

Practice FR 14:00 - 17:30

== Communication ==

Discussinons will be held at: itx8080 atatat googlegroups.com

Send e-mail to hannesa at-no-spam-please gmail.com for an invitation.

The lecturers can be reached via the course coordinator:

antti.andreimann only-people-please eesti.ee

== Points awarded so far ==

Arnis : 3 points - ab testing solution, best countermeasure proposed for scenario 4, best snort rules proposed for scenario 6

Igor : 3 points - wordpress virtualization solution, lab 3 report, IDS testing solution

Kaarel : 2 points - lab 1 report and conclusions, lab 3 solution

Märt : 3 points - wordpress testing procedure, best wordpress optimization (wp-cache + php-apc), best lab 2 report.

Roland: 2 points - best Lab 4 report, IDS testing solution

Hannes: 1 point - best lab 6 report

Siim: 1 point - most popular scenario 7 solution

Urmas: 2 points - lab 5 report, the set of viruses used in lab 7

Martti: 1 point - best lab 7 report

= Scenarios =

== Scenario 1 ==
There is a Wordpress based blog.

The client is worried: How many visitors can they handle before they die.

Establish a baseline: How many page displays per second AT LEAST we can handle.
Disruption of the site operation is NOT acceptable.

Minimal budget!

Be as detailed and technical as You possibly can.

Post to the discussion group the following information:

# Detailed description of the simulation of the site. eg. if You're going to virtualize it then how? If You are running it as a process, then how You separate it from the real machine?
# Detailed description of the attack / benchmark tools picked. Where You are going to run them? What tools? How many copies? How you are going to collect the results?!!!

=== Proposals ===
Benchmarking:
* AB - Discussed in lecture
* http://tsung.erlang-projects.org - Jérémy
* wget + AB - Arnis
* http://jakarta.apache.org/jmeter/ - Roland, Jérémy
* http://grinder.sourceforge.net/ - Märt
* http://httpd.apache.org/test/flood/ - Hannes
* Normal monitoring software on live server - Urmas

Simulation of the system:
* VirtualBox - Roland, Jérémy
* VMWare ESX - Igor
* VMWare Player - Marina
* Amazon EC2 - Märt
* KVM - Siim
* Original hardware - Hannes

=== Lab 1 ===
We will need to create two different virtual machines, one is going to be the wordpress server and the 2nd one is the client which is used to attack the server. It's probably easiest to install only one image and then clone it.

Hard disk image cloning is best done with

Linux:
VBoxManage clonehd FirstUbuntu.vdi SecondUbuntu.vdi

Windows:
"C:\Program Files\Oracle\VirtualBox\VBoxManage.exe" clonehd FirstUbuntu.vdi SecondUbuntu.vdi

After cloning the image create another virtual machine and attach the 2nd disk to that machine. As the result there will be two different virtual machines with two different virtual hard disks.

To be able to connect between the two virtual machines, You need to add an
additional network adapter to both hosts. It can be either "Host Only" or
"Internal" type.

To enable the new adapters in Ubuntu edit the file: /etc/network/interfaces

== Scenario 2 ==
Design a method for evaluating any speedup solutions for the wordpress.
A repeatable process to evaluate the claims.
Whatever optimizations.
The process must be detailed enough so that somebody else can get the same results when applying that.
The "other person" is expected to have IT knowledge sufficient to install and run a Linux desktop.
The method must specify the level performance
at which the site is considered DEAD.
Budget requirements: Low - Dedicated machine + dedicated tester.

=== Lab 2 ===
* Get Virtual machine disk image and instructions from: http://www.tud.ttu.ee/~anttix/lab2/ '''NB! DO NOT DOWNLOAD IMAGE FROM THE LINK NOTED IN INSTRUCTIONS PDF, IT WILL BE SLOW'''
* Fix bug in image (see below)
* Measure the effect of these wordpress plugins:
** [http://wordpress.org/extend/plugins/wp-super-cache/ WP Super Cache]
** [http://wordpress.org/extend/plugins/wp-cache/ WP-Cache]
* Devise Your own optimizations for the site

Bug in image: the ip address of the VM is saved in WP database as 192.168.56.3
It is advised tu run the Target VM first and run the "sudo dhclient" command first in Target VM.
Then check active IP of target by command "ifconfig". If it is not 192.168.56.3, then situation can be fixed by running:

In Target VM: "sudo ifconfig eth2 192.168.56.3"
In Client VM: "sudo ifconfig eth2 192.168.56.4"

==== A note to Windows users ====
Use this command line to access VBoxManage program

"C:\Program Files\Oracle\VirtualBox\VBoxManage.exe"

==== Wordpress Admin access ====
Username: admin
Password: QIaTemvskSeM

==== Note to Ubuntu users ====
VirtualBox with WiFi Does NOT work properly http://ubuntuforums.org/showthread.php?t=782936

== Scenario 3 ==
Your client is worried about some stuff posted on a blog. They ask You to take care of it.
They have a throwaway "script kiddie" in a third world country, who will mount the attack
so You don't need to worry about hiding the attackers identity.

Devise a way to attack a wordpress (default installation) based site to render it
unusable (page view times over 60 seconds).

Attack resources: one PC, a script kiddie, internet connection of 2Mbit/s.

How are we going to evaluate the solutions?
* Easy to use instructions
* The most efficient use of available resources

Defacing will count, IF it works for the latest version of wordpress.

=== Lab 3 ===
Possible attacks:

* Brute force overload (AB or other benchmark), bang the slowest page possible.
* Connection flood (slowloris)
* SYN Flood (eg. with hping)
* Banging expensive operations (eg. adding big comments)
* etc.

== Scenario 4 ==
Develop countermeasures for the attacks simulated in Lab 3.

Limitations:
* No additional hardware
* No reactive measures

=== Lab 4 ===

Evaluate the countermeasures against attacks.
The countermeasures must not have negative effects
on "normal usage pattern".

Normal usage pattern is defined as:
* Bursts of 10 connections per IP address in 1 second
* Page load times not over 20 seconds

== Scenario 5 ==
Create a solution and instructions for testing IDS
systems against the wordpress site and attacks
tried in lab 3.

A repeatable process to evaluate vendor claims.
Whatever passive IDS system delivered as a VM or a dedicated box.

Creating the IDS system itself is out of scope.

The process must be detailed enough so that somebody else can get the same results when applying that.
The "other person" is expected to have IT knowledge sufficient to install and run a Linux desktop.

Budget requirements: Modest - 2 Dedicated machines + dedicated tester + networking equipment to connect these together.

The process must test at least the following:
* Port scan
* SYN flood
* slowloris/pyloris
* Ab overwhelming attack

=== Lab 5 ===
Instructions for installing Snort IDS and its web GUI called 'acidbase': https://help.ubuntu.com/community/SnortIDS

== Scenario 6 ==

Develop/download/find/whatever a SNORT configuration (rulesets, preprocessors, whatever)
that performs better than the default configuration in lab 5 tests.
By better we mean:
* Less false positives
* Less false negatives
* The objectives are contradictory so the rule of thumb is one false negative per 10 false positives eg. solution with 10 false positives and 2 false negatives is better than the solution with 100 false positives and 1 false negatives, but the solution with 10 false positives and 1 false negative is better than the solution with 1 false positive and 2 false negatives.
* Attack is defined by a single invocation of the test script.

== Scenario 7 ==

There is a new remote vulnerability in Windows.
You became aware of a new virus that targets this vulnerability at 7 PM.
The antivirus vendor has released an updated virus database, but it's probably not installed
on all of the computers yet. Your company has 500 employees, with half of them running on laptops. You have to decide in 12 hours, if You need to collect all the employee's laptops in the morning.

Collecting the laptops has a high cost in lost employee productivity: There will be a queue of laptops waiting to be inspected. You can assume that all of the laptops can be inspected in half a day.

Limits: You can not mitigate the risk by changing the network configuration, You do not know how many laptops are still in the building. You can not take the servers offline.

Resources: 5 workers, some networking equipment, real servers (you can not disrupt those), "samples" of existing systems: a few spare workstations, a few spare laptops,

What do You know about the virus?
* It disables antivirus software
* It disables automatic software updates
* It can be cleaned up only manually in about 1 manhour

You need to develop an action plan:
* What You test in those scarce 12 hours?
* How?
* How do You weigh the results to make the decision?
* The plan itself must be short and easy to understand so You can write it on a whiteboard.
* Justifications for the specific actions go to a separate file/document.

=== Lab 7 ===
* Get viruses and XP install ISO-s from http://www.tud.ttu.ee/~anttix/lab7/
** Password for the protected zip: doomsday
* Alternatively, get Siims image
* Set up 5 VMS and connect them to a private network (or Host-Only network if You can't configure private nets):
** Plain old XP without any virus scanner (clean)
** Plain old XP with a virus scanner eg Avast (clean)
** Windows XP SP3, no virus scanner (clean)
** Plain old XP without any virus scanner (infected)
** Ubuntu Linux with tcpdump running
* If You have enogh time You can either:
** Find some more Worms and unleash them on Your virtual network (thanx to Urmas for those links)
*** http://vx.netlux.org/
*** http://www.excellentcontent.com/xbart/cbezels/
*** http://hacker-mc.blogspot.com/2008/12/pacoto-hacker.html
*** http://www.rohitab.com/discuss/oldfiles/
** Try to install Windows XP while it is connected to the infected network and see if You manage to install patches or antivirus before getting infected.

Measure the time it takes for the virus to penetrate the machines.
Note if virus scanner was able to catch the virus even if the underlying flaw in
windows wasn't patched.
Test if the SP3 version is immune to attacks originating from the network,
even when virus scanner is not installed.

== Scenario 8 ==

Find a solution to simulate a network of 300 PC-s in a single corporate environment, accessing a software update service at once.

Determine the load on primary internet connection and the router.
Assume that updates server will be able to keep up.

Tools to consider
* [http://www.ssfnet.org/homePage.html SSFNet]
* [http://www.omnetpp.org/ OMNeT++]

Additional resources
* [http://www.ssfnet.org/Exchange/gallery/index.html SSFNet module gallery]
* [http://code.google.com/p/omnet-httptools/ omnet-httptools]

=== Lab 8 ===
==== OMNet++ (Free for academic use only) ====
====== Install OMNeT++ ======
# Compile OMNet++ using these instructions: http://omnetpp.org/doc/omnetpp41/InstallGuide.pdf
# Run omnetpp IDE
# Choose Tutorials->Tic-toc tutorial from welcome page to open Tutorial documentation. Welcome page can be accessed from Help menu if You have accidentally closed it.
# Choose Go to workbench
# Click on tictoc in "Project Explorer" (on left hand pane)
# Choose Project->Open Project
# Choose Project->Build All

====== Install OMNeT++ INET framework ======
# Download https://github.com/downloads/inet-framework/inet/inet-20100723-src.tgz
# Create a directory named omnetpp-workspace and unpack inet-20100723-src.tgz in that directory.
# Switch Eclipse workspace to the newly-created directory: File -> Switch Workspace and select omnetpp-workspace.
# Follow instructions in omnetpp-workspace/inet/INSTALL file

====== Install OMNeT++ HttpTools framework ======
# Follow instructions in http://code.google.com/p/omnet-httptools/#Get_the_source

==== NS-3 (GPL Licensed) ====
Install all dependencies according to instructions [http://www.nsnam.org/wiki/index.php/Installation here] and [http://www.nsnam.org/wiki/index.php/PyViz here]

'''NB! Do not clone or compile anything yet'''

Clone NS-3 repositories
hg clone http://code.nsnam.org/ns-3-allinone
cd ns-3-allinone
./download.py -n gjc/ns-3.9-pyviz

Build NS-3
./build.py

Read the introduction slides during the build :)
* http://www.nsnam.org/tutorials/geni-tutorial-part1.pdf
* http://www.nsnam.org/tutorials.html

== Scenario 9 ==

Simulate a DDoS attack against a network of web servers.

* 2 types of attacks
** SYN Flood
** "AB" style attack

Assumptions:
* 1000 "infected" hosts performing the attack
* 10 web servers, located in 5 locations
* The infected host only attacks one server
* The target to attack is selected randomly
* Assume that servers can keep up with the flood
* Data transferred during each connection is about 500kb

Objectives:
* Assess the bandwidth these attacks consume in each location

You can only implement a subset of constraints and assumptions.
Do as much as You can, maybe others have done even less :D

ITX8080

2010-11-26T16:39:42Z

Anttix: /* Install INET framework */

= General Information =
== Schedule ==

Lecture TH 12:00 - 13:30

Practice FR 14:00 - 17:30

== Communication ==

Discussinons will be held at: itx8080 atatat googlegroups.com

Send e-mail to hannesa at-no-spam-please gmail.com for an invitation.

The lecturers can be reached via the course coordinator:

antti.andreimann only-people-please eesti.ee

== Points awarded so far ==

Arnis : 3 points - ab testing solution, best countermeasure proposed for scenario 4, best snort rules proposed for scenario 6

Igor : 3 points - wordpress virtualization solution, lab 3 report, IDS testing solution

Kaarel : 2 points - lab 1 report and conclusions, lab 3 solution

Märt : 3 points - wordpress testing procedure, best wordpress optimization (wp-cache + php-apc), best lab 2 report.

Roland: 2 points - best Lab 4 report, IDS testing solution

Hannes: 1 point - best lab 6 report

Siim: 1 point - most popular scenario 7 solution

Urmas: 2 points - lab 5 report, the set of viruses used in lab 7

Martti: 1 point - best lab 7 report

= Scenarios =

== Scenario 1 ==
There is a Wordpress based blog.

The client is worried: How many visitors can they handle before they die.

Establish a baseline: How many page displays per second AT LEAST we can handle.
Disruption of the site operation is NOT acceptable.

Minimal budget!

Be as detailed and technical as You possibly can.

Post to the discussion group the following information:

# Detailed description of the simulation of the site. eg. if You're going to virtualize it then how? If You are running it as a process, then how You separate it from the real machine?
# Detailed description of the attack / benchmark tools picked. Where You are going to run them? What tools? How many copies? How you are going to collect the results?!!!

=== Proposals ===
Benchmarking:
* AB - Discussed in lecture
* http://tsung.erlang-projects.org - Jérémy
* wget + AB - Arnis
* http://jakarta.apache.org/jmeter/ - Roland, Jérémy
* http://grinder.sourceforge.net/ - Märt
* http://httpd.apache.org/test/flood/ - Hannes
* Normal monitoring software on live server - Urmas

Simulation of the system:
* VirtualBox - Roland, Jérémy
* VMWare ESX - Igor
* VMWare Player - Marina
* Amazon EC2 - Märt
* KVM - Siim
* Original hardware - Hannes

=== Lab 1 ===
We will need to create two different virtual machines, one is going to be the wordpress server and the 2nd one is the client which is used to attack the server. It's probably easiest to install only one image and then clone it.

Hard disk image cloning is best done with

Linux:
VBoxManage clonehd FirstUbuntu.vdi SecondUbuntu.vdi

Windows:
"C:\Program Files\Oracle\VirtualBox\VBoxManage.exe" clonehd FirstUbuntu.vdi SecondUbuntu.vdi

After cloning the image create another virtual machine and attach the 2nd disk to that machine. As the result there will be two different virtual machines with two different virtual hard disks.

To be able to connect between the two virtual machines, You need to add an
additional network adapter to both hosts. It can be either "Host Only" or
"Internal" type.

To enable the new adapters in Ubuntu edit the file: /etc/network/interfaces

== Scenario 2 ==
Design a method for evaluating any speedup solutions for the wordpress.
A repeatable process to evaluate the claims.
Whatever optimizations.
The process must be detailed enough so that somebody else can get the same results when applying that.
The "other person" is expected to have IT knowledge sufficient to install and run a Linux desktop.
The method must specify the level performance
at which the site is considered DEAD.
Budget requirements: Low - Dedicated machine + dedicated tester.

=== Lab 2 ===
* Get Virtual machine disk image and instructions from: http://www.tud.ttu.ee/~anttix/lab2/ '''NB! DO NOT DOWNLOAD IMAGE FROM THE LINK NOTED IN INSTRUCTIONS PDF, IT WILL BE SLOW'''
* Fix bug in image (see below)
* Measure the effect of these wordpress plugins:
** [http://wordpress.org/extend/plugins/wp-super-cache/ WP Super Cache]
** [http://wordpress.org/extend/plugins/wp-cache/ WP-Cache]
* Devise Your own optimizations for the site

Bug in image: the ip address of the VM is saved in WP database as 192.168.56.3
It is advised tu run the Target VM first and run the "sudo dhclient" command first in Target VM.
Then check active IP of target by command "ifconfig". If it is not 192.168.56.3, then situation can be fixed by running:

In Target VM: "sudo ifconfig eth2 192.168.56.3"
In Client VM: "sudo ifconfig eth2 192.168.56.4"

==== A note to Windows users ====
Use this command line to access VBoxManage program

"C:\Program Files\Oracle\VirtualBox\VBoxManage.exe"

==== Wordpress Admin access ====
Username: admin
Password: QIaTemvskSeM

==== Note to Ubuntu users ====
VirtualBox with WiFi Does NOT work properly http://ubuntuforums.org/showthread.php?t=782936

== Scenario 3 ==
Your client is worried about some stuff posted on a blog. They ask You to take care of it.
They have a throwaway "script kiddie" in a third world country, who will mount the attack
so You don't need to worry about hiding the attackers identity.

Devise a way to attack a wordpress (default installation) based site to render it
unusable (page view times over 60 seconds).

Attack resources: one PC, a script kiddie, internet connection of 2Mbit/s.

How are we going to evaluate the solutions?
* Easy to use instructions
* The most efficient use of available resources

Defacing will count, IF it works for the latest version of wordpress.

=== Lab 3 ===
Possible attacks:

* Brute force overload (AB or other benchmark), bang the slowest page possible.
* Connection flood (slowloris)
* SYN Flood (eg. with hping)
* Banging expensive operations (eg. adding big comments)
* etc.

== Scenario 4 ==
Develop countermeasures for the attacks simulated in Lab 3.

Limitations:
* No additional hardware
* No reactive measures

=== Lab 4 ===

Evaluate the countermeasures against attacks.
The countermeasures must not have negative effects
on "normal usage pattern".

Normal usage pattern is defined as:
* Bursts of 10 connections per IP address in 1 second
* Page load times not over 20 seconds

== Scenario 5 ==
Create a solution and instructions for testing IDS
systems against the wordpress site and attacks
tried in lab 3.

A repeatable process to evaluate vendor claims.
Whatever passive IDS system delivered as a VM or a dedicated box.

Creating the IDS system itself is out of scope.

The process must be detailed enough so that somebody else can get the same results when applying that.
The "other person" is expected to have IT knowledge sufficient to install and run a Linux desktop.

Budget requirements: Modest - 2 Dedicated machines + dedicated tester + networking equipment to connect these together.

The process must test at least the following:
* Port scan
* SYN flood
* slowloris/pyloris
* Ab overwhelming attack

=== Lab 5 ===
Instructions for installing Snort IDS and its web GUI called 'acidbase': https://help.ubuntu.com/community/SnortIDS

== Scenario 6 ==

Develop/download/find/whatever a SNORT configuration (rulesets, preprocessors, whatever)
that performs better than the default configuration in lab 5 tests.
By better we mean:
* Less false positives
* Less false negatives
* The objectives are contradictory so the rule of thumb is one false negative per 10 false positives eg. solution with 10 false positives and 2 false negatives is better than the solution with 100 false positives and 1 false negatives, but the solution with 10 false positives and 1 false negative is better than the solution with 1 false positive and 2 false negatives.
* Attack is defined by a single invocation of the test script.

== Scenario 7 ==

There is a new remote vulnerability in Windows.
You became aware of a new virus that targets this vulnerability at 7 PM.
The antivirus vendor has released an updated virus database, but it's probably not installed
on all of the computers yet. Your company has 500 employees, with half of them running on laptops. You have to decide in 12 hours, if You need to collect all the employee's laptops in the morning.

Collecting the laptops has a high cost in lost employee productivity: There will be a queue of laptops waiting to be inspected. You can assume that all of the laptops can be inspected in half a day.

Limits: You can not mitigate the risk by changing the network configuration, You do not know how many laptops are still in the building. You can not take the servers offline.

Resources: 5 workers, some networking equipment, real servers (you can not disrupt those), "samples" of existing systems: a few spare workstations, a few spare laptops,

What do You know about the virus?
* It disables antivirus software
* It disables automatic software updates
* It can be cleaned up only manually in about 1 manhour

You need to develop an action plan:
* What You test in those scarce 12 hours?
* How?
* How do You weigh the results to make the decision?
* The plan itself must be short and easy to understand so You can write it on a whiteboard.
* Justifications for the specific actions go to a separate file/document.

=== Lab 7 ===
* Get viruses and XP install ISO-s from http://www.tud.ttu.ee/~anttix/lab7/
** Password for the protected zip: doomsday
* Alternatively, get Siims image
* Set up 5 VMS and connect them to a private network (or Host-Only network if You can't configure private nets):
** Plain old XP without any virus scanner (clean)
** Plain old XP with a virus scanner eg Avast (clean)
** Windows XP SP3, no virus scanner (clean)
** Plain old XP without any virus scanner (infected)
** Ubuntu Linux with tcpdump running
* If You have enogh time You can either:
** Find some more Worms and unleash them on Your virtual network (thanx to Urmas for those links)
*** http://vx.netlux.org/
*** http://www.excellentcontent.com/xbart/cbezels/
*** http://hacker-mc.blogspot.com/2008/12/pacoto-hacker.html
*** http://www.rohitab.com/discuss/oldfiles/
** Try to install Windows XP while it is connected to the infected network and see if You manage to install patches or antivirus before getting infected.

Measure the time it takes for the virus to penetrate the machines.
Note if virus scanner was able to catch the virus even if the underlying flaw in
windows wasn't patched.
Test if the SP3 version is immune to attacks originating from the network,
even when virus scanner is not installed.

== Scenario 8 ==

Find a solution to simulate a network of 300 PC-s in a single corporate environment, accessing a software update service at once.

Determine the load on primary internet connection and the router.
Assume that updates server will be able to keep up.

Tools to consider
* [http://www.ssfnet.org/homePage.html SSFNet]
* [http://www.omnetpp.org/ OMNeT++]

Additional resources
* [http://www.ssfnet.org/Exchange/gallery/index.html SSFNet module gallery]
* [http://code.google.com/p/omnet-httptools/ omnet-httptools]

=== Lab 8 ===
==== OMNet++ (Free for academic use only) ====
# Compile OMNet++ using these instructions: http://omnetpp.org/doc/omnetpp41/InstallGuide.pdf
# Run omnetpp IDE
# Choose Tutorials->Tic-toc tutorial from welcome page to open Tutorial documentation. Welcome page can be accessed from Help menu if You have accidentally closed it.
# Choose Go to workbench
# Click on tictoc in "Project Explorer" (on left hand pane)
# Choose Project->Open Project
# Choose Project->Build All

====== Install OMNeT++ INET framework ======
# Download https://github.com/downloads/inet-framework/inet/inet-20100723-src.tgz
# Create a directory named omnetpp-workspace and unpack inet-20100723-src.tgz in that directory.
# Switch Eclipse workspace to the newly-created directory: File -> Switch Workspace and select omnetpp-workspace.
# Follow instructions in omnetpp-workspace/inet/INSTALL file

====== Install OMNeT++ HttpTools framework ======
# Follow instructions in http://code.google.com/p/omnet-httptools/#Get_the_source

==== NS-3 (GPL Licensed) ====
Install all dependencies according to instructions [http://www.nsnam.org/wiki/index.php/Installation here] and [http://www.nsnam.org/wiki/index.php/PyViz here]

'''NB! Do not clone or compile anything yet'''

Clone NS-3 repositories
hg clone http://code.nsnam.org/ns-3-allinone
cd ns-3-allinone
./download.py -n gjc/ns-3.9-pyviz

Build NS-3
./build.py

Read the introduction slides during the build :)
* http://www.nsnam.org/tutorials/geni-tutorial-part1.pdf
* http://www.nsnam.org/tutorials.html

== Scenario 9 ==

Simulate a DDoS attack against a network of web servers.

* 2 types of attacks
** SYN Flood
** "AB" style attack

Assumptions:
* 1000 "infected" hosts performing the attack
* 10 web servers, located in 5 locations
* The infected host only attacks one server
* The target to attack is selected randomly
* Assume that servers can keep up with the flood
* Data transferred during each connection is about 500kb

Objectives:
* Assess the bandwidth these attacks consume in each location

You can only implement a subset of constraints and assumptions.
Do as much as You can, maybe others have done even less :D

ITX8080

2010-11-26T16:33:59Z

Anttix: /* OMNet++ (Free for academic use only) */

= General Information =
== Schedule ==

Lecture TH 12:00 - 13:30

Practice FR 14:00 - 17:30

== Communication ==

Discussinons will be held at: itx8080 atatat googlegroups.com

Send e-mail to hannesa at-no-spam-please gmail.com for an invitation.

The lecturers can be reached via the course coordinator:

antti.andreimann only-people-please eesti.ee

== Points awarded so far ==

Arnis : 3 points - ab testing solution, best countermeasure proposed for scenario 4, best snort rules proposed for scenario 6

Igor : 3 points - wordpress virtualization solution, lab 3 report, IDS testing solution

Kaarel : 2 points - lab 1 report and conclusions, lab 3 solution

Märt : 3 points - wordpress testing procedure, best wordpress optimization (wp-cache + php-apc), best lab 2 report.

Roland: 2 points - best Lab 4 report, IDS testing solution

Hannes: 1 point - best lab 6 report

Siim: 1 point - most popular scenario 7 solution

Urmas: 2 points - lab 5 report, the set of viruses used in lab 7

Martti: 1 point - best lab 7 report

= Scenarios =

== Scenario 1 ==
There is a Wordpress based blog.

The client is worried: How many visitors can they handle before they die.

Establish a baseline: How many page displays per second AT LEAST we can handle.
Disruption of the site operation is NOT acceptable.

Minimal budget!

Be as detailed and technical as You possibly can.

Post to the discussion group the following information:

# Detailed description of the simulation of the site. eg. if You're going to virtualize it then how? If You are running it as a process, then how You separate it from the real machine?
# Detailed description of the attack / benchmark tools picked. Where You are going to run them? What tools? How many copies? How you are going to collect the results?!!!

=== Proposals ===
Benchmarking:
* AB - Discussed in lecture
* http://tsung.erlang-projects.org - Jérémy
* wget + AB - Arnis
* http://jakarta.apache.org/jmeter/ - Roland, Jérémy
* http://grinder.sourceforge.net/ - Märt
* http://httpd.apache.org/test/flood/ - Hannes
* Normal monitoring software on live server - Urmas

Simulation of the system:
* VirtualBox - Roland, Jérémy
* VMWare ESX - Igor
* VMWare Player - Marina
* Amazon EC2 - Märt
* KVM - Siim
* Original hardware - Hannes

=== Lab 1 ===
We will need to create two different virtual machines, one is going to be the wordpress server and the 2nd one is the client which is used to attack the server. It's probably easiest to install only one image and then clone it.

Hard disk image cloning is best done with

Linux:
VBoxManage clonehd FirstUbuntu.vdi SecondUbuntu.vdi

Windows:
"C:\Program Files\Oracle\VirtualBox\VBoxManage.exe" clonehd FirstUbuntu.vdi SecondUbuntu.vdi

After cloning the image create another virtual machine and attach the 2nd disk to that machine. As the result there will be two different virtual machines with two different virtual hard disks.

To be able to connect between the two virtual machines, You need to add an
additional network adapter to both hosts. It can be either "Host Only" or
"Internal" type.

To enable the new adapters in Ubuntu edit the file: /etc/network/interfaces

== Scenario 2 ==
Design a method for evaluating any speedup solutions for the wordpress.
A repeatable process to evaluate the claims.
Whatever optimizations.
The process must be detailed enough so that somebody else can get the same results when applying that.
The "other person" is expected to have IT knowledge sufficient to install and run a Linux desktop.
The method must specify the level performance
at which the site is considered DEAD.
Budget requirements: Low - Dedicated machine + dedicated tester.

=== Lab 2 ===
* Get Virtual machine disk image and instructions from: http://www.tud.ttu.ee/~anttix/lab2/ '''NB! DO NOT DOWNLOAD IMAGE FROM THE LINK NOTED IN INSTRUCTIONS PDF, IT WILL BE SLOW'''
* Fix bug in image (see below)
* Measure the effect of these wordpress plugins:
** [http://wordpress.org/extend/plugins/wp-super-cache/ WP Super Cache]
** [http://wordpress.org/extend/plugins/wp-cache/ WP-Cache]
* Devise Your own optimizations for the site

Bug in image: the ip address of the VM is saved in WP database as 192.168.56.3
It is advised tu run the Target VM first and run the "sudo dhclient" command first in Target VM.
Then check active IP of target by command "ifconfig". If it is not 192.168.56.3, then situation can be fixed by running:

In Target VM: "sudo ifconfig eth2 192.168.56.3"
In Client VM: "sudo ifconfig eth2 192.168.56.4"

==== A note to Windows users ====
Use this command line to access VBoxManage program

"C:\Program Files\Oracle\VirtualBox\VBoxManage.exe"

==== Wordpress Admin access ====
Username: admin
Password: QIaTemvskSeM

==== Note to Ubuntu users ====
VirtualBox with WiFi Does NOT work properly http://ubuntuforums.org/showthread.php?t=782936

== Scenario 3 ==
Your client is worried about some stuff posted on a blog. They ask You to take care of it.
They have a throwaway "script kiddie" in a third world country, who will mount the attack
so You don't need to worry about hiding the attackers identity.

Devise a way to attack a wordpress (default installation) based site to render it
unusable (page view times over 60 seconds).

Attack resources: one PC, a script kiddie, internet connection of 2Mbit/s.

How are we going to evaluate the solutions?
* Easy to use instructions
* The most efficient use of available resources

Defacing will count, IF it works for the latest version of wordpress.

=== Lab 3 ===
Possible attacks:

* Brute force overload (AB or other benchmark), bang the slowest page possible.
* Connection flood (slowloris)
* SYN Flood (eg. with hping)
* Banging expensive operations (eg. adding big comments)
* etc.

== Scenario 4 ==
Develop countermeasures for the attacks simulated in Lab 3.

Limitations:
* No additional hardware
* No reactive measures

=== Lab 4 ===

Evaluate the countermeasures against attacks.
The countermeasures must not have negative effects
on "normal usage pattern".

Normal usage pattern is defined as:
* Bursts of 10 connections per IP address in 1 second
* Page load times not over 20 seconds

== Scenario 5 ==
Create a solution and instructions for testing IDS
systems against the wordpress site and attacks
tried in lab 3.

A repeatable process to evaluate vendor claims.
Whatever passive IDS system delivered as a VM or a dedicated box.

Creating the IDS system itself is out of scope.

The process must be detailed enough so that somebody else can get the same results when applying that.
The "other person" is expected to have IT knowledge sufficient to install and run a Linux desktop.

Budget requirements: Modest - 2 Dedicated machines + dedicated tester + networking equipment to connect these together.

The process must test at least the following:
* Port scan
* SYN flood
* slowloris/pyloris
* Ab overwhelming attack

=== Lab 5 ===
Instructions for installing Snort IDS and its web GUI called 'acidbase': https://help.ubuntu.com/community/SnortIDS

== Scenario 6 ==

Develop/download/find/whatever a SNORT configuration (rulesets, preprocessors, whatever)
that performs better than the default configuration in lab 5 tests.
By better we mean:
* Less false positives
* Less false negatives
* The objectives are contradictory so the rule of thumb is one false negative per 10 false positives eg. solution with 10 false positives and 2 false negatives is better than the solution with 100 false positives and 1 false negatives, but the solution with 10 false positives and 1 false negative is better than the solution with 1 false positive and 2 false negatives.
* Attack is defined by a single invocation of the test script.

== Scenario 7 ==

There is a new remote vulnerability in Windows.
You became aware of a new virus that targets this vulnerability at 7 PM.
The antivirus vendor has released an updated virus database, but it's probably not installed
on all of the computers yet. Your company has 500 employees, with half of them running on laptops. You have to decide in 12 hours, if You need to collect all the employee's laptops in the morning.

Collecting the laptops has a high cost in lost employee productivity: There will be a queue of laptops waiting to be inspected. You can assume that all of the laptops can be inspected in half a day.

Limits: You can not mitigate the risk by changing the network configuration, You do not know how many laptops are still in the building. You can not take the servers offline.

Resources: 5 workers, some networking equipment, real servers (you can not disrupt those), "samples" of existing systems: a few spare workstations, a few spare laptops,

What do You know about the virus?
* It disables antivirus software
* It disables automatic software updates
* It can be cleaned up only manually in about 1 manhour

You need to develop an action plan:
* What You test in those scarce 12 hours?
* How?
* How do You weigh the results to make the decision?
* The plan itself must be short and easy to understand so You can write it on a whiteboard.
* Justifications for the specific actions go to a separate file/document.

=== Lab 7 ===
* Get viruses and XP install ISO-s from http://www.tud.ttu.ee/~anttix/lab7/
** Password for the protected zip: doomsday
* Alternatively, get Siims image
* Set up 5 VMS and connect them to a private network (or Host-Only network if You can't configure private nets):
** Plain old XP without any virus scanner (clean)
** Plain old XP with a virus scanner eg Avast (clean)
** Windows XP SP3, no virus scanner (clean)
** Plain old XP without any virus scanner (infected)
** Ubuntu Linux with tcpdump running
* If You have enogh time You can either:
** Find some more Worms and unleash them on Your virtual network (thanx to Urmas for those links)
*** http://vx.netlux.org/
*** http://www.excellentcontent.com/xbart/cbezels/
*** http://hacker-mc.blogspot.com/2008/12/pacoto-hacker.html
*** http://www.rohitab.com/discuss/oldfiles/
** Try to install Windows XP while it is connected to the infected network and see if You manage to install patches or antivirus before getting infected.

Measure the time it takes for the virus to penetrate the machines.
Note if virus scanner was able to catch the virus even if the underlying flaw in
windows wasn't patched.
Test if the SP3 version is immune to attacks originating from the network,
even when virus scanner is not installed.

== Scenario 8 ==

Find a solution to simulate a network of 300 PC-s in a single corporate environment, accessing a software update service at once.

Determine the load on primary internet connection and the router.
Assume that updates server will be able to keep up.

Tools to consider
* [http://www.ssfnet.org/homePage.html SSFNet]
* [http://www.omnetpp.org/ OMNeT++]

Additional resources
* [http://www.ssfnet.org/Exchange/gallery/index.html SSFNet module gallery]
* [http://code.google.com/p/omnet-httptools/ omnet-httptools]

=== Lab 8 ===
==== OMNet++ (Free for academic use only) ====
# Compile OMNet++ using these instructions: http://omnetpp.org/doc/omnetpp41/InstallGuide.pdf
# Run omnetpp IDE
# Choose Tutorials->Tic-toc tutorial from welcome page to open Tutorial documentation. Welcome page can be accessed from Help menu if You have accidentally closed it.
# Choose Go to workbench
# Click on tictoc in "Project Explorer" (on left hand pane)
# Choose Project->Open Project
# Choose Project->Build All

====== Install INET framework ======
# Download https://github.com/downloads/inet-framework/inet/inet-20100723-src.tgz
# Create a directory named omnetpp-workspace and unpack inet-20100723-src.tgz in that directory.
# Switch Eclipse workspace to the newly-created directory: File -> Switch Workspace and select omnetpp-workspace.
# Follow instructions in omnetpp-workspace/inet/INSTALL file

==== NS-3 (GPL Licensed) ====
Install all dependencies according to instructions [http://www.nsnam.org/wiki/index.php/Installation here] and [http://www.nsnam.org/wiki/index.php/PyViz here]

'''NB! Do not clone or compile anything yet'''

Clone NS-3 repositories
hg clone http://code.nsnam.org/ns-3-allinone
cd ns-3-allinone
./download.py -n gjc/ns-3.9-pyviz

Build NS-3
./build.py

Read the introduction slides during the build :)
* http://www.nsnam.org/tutorials/geni-tutorial-part1.pdf
* http://www.nsnam.org/tutorials.html

== Scenario 9 ==

Simulate a DDoS attack against a network of web servers.

* 2 types of attacks
** SYN Flood
** "AB" style attack

Assumptions:
* 1000 "infected" hosts performing the attack
* 10 web servers, located in 5 locations
* The infected host only attacks one server
* The target to attack is selected randomly
* Assume that servers can keep up with the flood
* Data transferred during each connection is about 500kb

Objectives:
* Assess the bandwidth these attacks consume in each location

You can only implement a subset of constraints and assumptions.
Do as much as You can, maybe others have done even less :D