May06-11: ISEAGE Attack Tool Repository and Player Jeremy Brotherton, Timothy Hilby, Brett Mastbergen, Jasen Stoeker

Agenda Problem introduction Basic solution architecture Technology considerations Detailed design

Project Introduction Problem Growing dependency on computer technology Auditing systems is complex and time consuming Solution Central repository of exploit code Searchable through web interface Launch attacks from web interface

Design Objectives Web based user interface Searchable database of attack tools Attack player Attack download capability Database update tools

Basic Solution Architecture

Database Technologies Considered PostgreSQL Oracle SQL Server 2005 MySQL

SQL Server 2005 Pros Best integration of any solution. Most extensive tools. Fast and scalable. Large amount of prewritten functions and objects. Interacts well with the Visual Studio IDE.

SQL Server 2005 Cons Microsoft licensing issues. Future release date. New release means additional likelihood of major bugs. Database tied to Microsoft platforms.

MySQL Pros Large amount of online examples and a large online user community. Current version mature and well tested. Open source license will be easiest to work with. Able to be used on most major platforms. Relatively easy to learn.

MySQL Cons Not as much code comes with the database as with SQL Server Not as well integrated with other products as SQL Server 2005 is with.Net products.

Web Technologies ASP.NET 2005 PHP

ASP.NET 2005 Pros Extremely well integrated with SQL Server Ability to drag and drop graphical web interface. Large MSDN documentation library. Very large amount of built in objects and functions. Excellent IDE and graphical debugger.

ASP.NET 2005 Cons Microsoft licensing issues. Future release date. New release means additional likelihood of major bugs. A server for ASP.NET would be tied to Microsoft platforms. Already decided against SQL Server 2005.

PHP Pros Current version well tested. Many online examples. No licensing issues. Cross platform. Fast code execution Easy to learn

PHP Cons Not as well integrated as ASP.NET. No graphical debugger/IDE. No ability to drag and drop interfaces.

Final Technology Selections MySQL PHP Apache

Application Homepage

Application Search Page

Application Search Results

Attack Launch Page

Database Administration

Questions Any questions or comments?