lab2 Security

Task1)
Configuring secure SSL connection
    -sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/ssl/private/apache-selfsigned.key -  out /etc/ssl/certs/apache-selfsigned.crt
    -sudo nano /etc/apache2/conf-available/ssl-params.conf
        SSLCipherSuite EECDH+AESGCM:EDH+AESGCM
        # Requires Apache 2.4.36 & OpenSSL 1.1.1
        SSLProtocol -all +TLSv1.3 +TLSv1.2
        SSLOpenSSLConfCmd Curves X25519:secp521r1:secp384r1:prime256v1
        # Older versions
        # SSLProtocol All -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
        SSLHonorCipherOrder On
        # Disable preloading HSTS for now.  You can use the commented out header line that includes
        # the "preload" directive if you understand the implications.
        # Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
        Header always set X-Frame-Options DENY
        Header always set X-Content-Type-Options nosniff
        # Requires Apache >= 2.4
        SSLCompression off
        SSLUseStapling on
        SSLStaplingCache "shmcb:logs/stapling-cache(150000)"
        # Requires Apache >= 2.4.11
        SSLSessionTickets Off
    -sudo cp /etc/apache2/sites-available/default-ssl.conf /etc/apache2/sites-available/default-ssl.conf.bak
    -sudo nano /etc/apache2/sites-available/default-ssl.conf
                ServerAdmin odteam12@gmail.com
                ServerName omarosh.com
        SSLCertificateFile      /etc/ssl/certs/apache-selfsigned.crt
                SSLCertificateKeyFile /etc/ssl/private/apache-selfsigned.key
    -sudo nano /etc/apache2/sites-available/000-default.conf
        <VirtualHost *:80>
            Redirect "/" "https://omarosh.com/"
                </VirtualHost>
    -sudo systemctl restart apache2
activate ssl
    -sudo a2enmod ssl
    -sudo a2enmod headers
use default config file:
    -sudo a2ensite default-ssl
To activate the new configuration, you need to run:
    -sudo systemctl reload apache2
    -sudo a2enconf ssl-params
test config and restart
    -sudo apache2ctl configtest
    -sudo systemctl restart apache2

TASK2) USING sqlmap to test SQL Injection

sudo apt install sqlmap
sqlmap -u http://testphp.vulnweb.com/listproducts.php?cat=1 --dbs