5 / 3 / 2026

Deekshith A | CSE | Batch 28’

Task 1: Introduction to Version Control and Git Basics

Task Overview

This task focused on understanding version control fundamentals and exploring Git through hands-on practice. Key activities included Git installation, repository management, branching, conflict resolution, and remote repository integration with AI-assisted cheatsheet creation.

Theory of Version Control

Version control tracks and manages file changes over time, enabling collaboration, history tracking, and error recovery. Version Control Types:

• Local VCS: Single computer tracking
• Centralized VCS: Central server (SVN) - single point of failure
• Distributed VCS: Complete local copies (Git) - best for collaboration Git Benefits: Complete local history, powerful branching, offline work, and industry-standard adoption.

Git Installation and Configuration

git --version
git config --global user.name "Your Name"
git config --global user.email "your.email@example.com"

Hands-on Git Commands

Basic Workflow

# Initialize repository
git init
echo "# Project" > README.md
git add .
git commit -m "Initial commit"
# Check status and history
git status
git log --oneline

Branching and Merging

# Create feature branch
git checkout -b feature-navbar
echo "Menu" > navbar.html
git add navbar.html
git commit -m "Add navbar"
# Merge to main
git checkout main
git merge feature-navbar

Merge Conflicts

# Create conflict, resolve manually, then:
git add resolved-file.txt
git commit -m "Resolve conflict"

Git Revert (Undo Mistakes)

echo "Bug" > bug.js
git add bug.js
git commit -m "Buggy feature"
git revert HEAD  # Safely undo

Cherry-Pick (Selective Commits)

git checkout -b experimental
# Multiple commits...
git checkout main
git cherry-pick   # Apply specific commit only

Remote Repository Interaction

# Connect to GitHub/GitLab
git remote add origin https://github.com/username/repo.git
git push -u origin main
# Clone and pull
git clone https://github.com/username/repo.git
git pull origin main

Git Commands Cheatsheet (AI-Assisted)

A comprehensive cheatsheet covering 100+ Git commands was created using AI assistance, organized by categories with practical examples.

• Access Cheatsheet:* Git Commands Cheatsheet

Learning Outcome

Skills Achieved:

• Mastered Git installation and configuration
• Proficient in basic workflow (add, commit, push, pull)
• Successfully managed branches and resolved conflicts
• Applied git revert for safe rollbacks
• Used git cherry-pick for selective integration
• Integrated local and remote repositories

TASK 3: Create an Application on EC2 Instance

Overview of Amazon EC2

Amazon EC2 (Elastic Compute Cloud) provides scalable virtual servers in the cloud. It allows users to run applications with full control over the operating system, networking, and storage. EC2 supports a wide range of use cases, including web applications, APIs, and backend services.

Steps Performed

1. Launching an EC2 Instance

• Logged in to the AWS Management Console
• Navigated to EC2 → Instances
• Launched a new instance with the following configuration:
  • Instance Type: t2.micro
  • AMI: Amazon Linux
  • Key Pair: Configured for secure SSH access
  • Network: Default VPC

The instance was successfully launched and reached the Running state.

2. Connecting to the EC2 Instance

• Connected to the EC2 instance using SSH
• Verified terminal access to the instance
  This allowed full control of the server through the command line.

3. Installing Required Software

• Updated system packages
• Installed Python and required dependencies
• Installed Flask to create a dynamic web application
  This prepared the EC2 instance to host a web-based application.

4. Creating a Dynamic Application

A simple dynamic web application was created using Python and Flask.
The application responds to HTTP requests, confirming that it is running on an EC2 instance. Key characteristics:

• Runs on port 80
• Binds to 0.0.0.0 for public accessibility
• Handles dynamic HTTP requests

5. Running the Application in the Background

The application was started in the background using the nohup command:

nohup python3 app.py > app.log 2>&1 &

This ensured the application continued running even after closing the terminal session.

6. Configuring Security (Firewall)

• Identified the Security Group attached to the EC2 instance
• Opened port 80 for inbound HTTP traffic using AWS CLI
• Allowed access from 0.0.0.0/0
  This enabled external access to the application via the public IP.

7. Verifying the Application

• Verified locally using:

curl http://localhost

• Verified externally using:

curl http://

The application responded successfully in both cases.

Result

The dynamic application was successfully deployed and executed on an Amazon EC2 instance. The instance was configured securely, and the application was accessible over the internet.

Conclusion

This task demonstrated how Amazon EC2 can be used to build and run virtually any dynamic application. By launching and configuring an EC2 instance, managing security settings, and deploying an application, a complete cloud-based deployment was achieved.

TASK 4: AWS CloudFront – Serve Content from Multiple S3 Buckets

Overview of Amazon CloudFront

Amazon CloudFront is a global content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to users worldwide with low latency and high transfer speeds. CloudFront works by caching content at edge locations close to users, reducing load on the origin server.

Overview of Amazon S3

Amazon Simple Storage Service (Amazon S3) is a scalable object storage service designed for high availability, durability, and security. It is commonly used to store static assets such as images, videos, HTML files, and application data.

Architecture Overview

• Multiple Amazon S3 buckets act as content origins
• Amazon CloudFront distribution is created
• CloudFront edge locations cache and serve content globally
• End users access content via the CloudFront distribution URL This architecture improves performance, scalability, and reliability.

Steps Performed

1. Creating Amazon S3 Buckets

• Created multiple S3 buckets to store web content
• Uploaded sample static and dynamic content files
• Configured appropriate bucket permissions and policies

2. Configuring S3 for CloudFront Access

• Disabled public access where applicable
• Used CloudFront Origin Access Control (OAC) or Origin Access Identity (OAI)
• Ensured secure access between CloudFront and S3

3. Creating a CloudFront Distribution

• Navigated to CloudFront → Create Distribution
• Selected Amazon S3 buckets as origins
• Configured default cache behavior
• Enabled HTTP and HTTPS access
• Selected global edge locations

4. Enabling Dynamic Content Delivery

• Configured cache behaviors for dynamic content
• Forwarded query strings and headers where required
• Set appropriate TTL (Time To Live) values This ensured dynamic content is served correctly while maintaining performance.

5. Testing the CloudFront Distribution

• Accessed content using the CloudFront distribution domain name
• Verified content delivery from different S3 buckets
• Observed reduced latency and faster response times

Result

The CloudFront distribution was successfully configured to serve content from multiple Amazon S3 buckets. Content was delivered securely and efficiently to users through global edge locations.

Conclusion

This task demonstrated how Amazon CloudFront can be used in conjunction with Amazon S3 to deliver content efficiently across the globe. By setting up a dynamic content distribution, CloudFront enhanced performance, security, and scalability while serving content from multiple S3 buckets.

TASK 5: Penetration Testing Report with Kali

Introduction

Kali Linux is a Debian-based Linux distribution designed for penetration testing, ethical hacking, and digital forensics. This report documents the complete process of setting up a penetration testing lab using Oracle VirtualBox, installing Kali Linux, and performing a Web Application Penetration Test against a deliberately vulnerable web application.

Objective

The objectives were:

• To understand virtualization using Oracle VirtualBox
• To install and configure Kali Linux
• To gain hands-on experience with web application penetration testing
• To identify security vulnerabilities in a web application
• To document findings with proof of concept and remediation strategies

Scope of Assessment

Application Details

Virtualization Overview

Virtualization enables multiple operating systems to run on a single physical host. Oracle VirtualBox was used to safely deploy Kali Linux without impacting the host operating system. Benefits include:

• Isolated testing environment
• Snapshot and rollback capability
• Safe exploitation testing

Oracle VirtualBox Installation

Downloading VirtualBox

1. Visit https://www.virtualbox.org
2. Download VirtualBox for your host OS
3. Download the VirtualBox Extension Pack

Installing VirtualBox

1. Run the installer
2. Accept license agreement
3. Allow network drivers
4. Complete installation

Kali Linux Installation

Download Kali Linux ISO

• URL: https://www.kali.org
• Version: Installer (64-bit)

Create Kali VM

• Type: Linux
• Version: Debian (64-bit)
• RAM: 4–8 GB
• CPU: 2–4 cores
• Storage: 20–40 GB
  

Install Kali Linux

• Select Graphical Install
• Configure language, region, keyboard
• Create user credentials
• Complete installation and reboot

Web Penetration Testing Methodology

The assessment followed a Black Box Web Application Security Testing approach:

1. Reconnaissance
2. Input Validation Testing
3. Injection Testing
4. Authentication Testing
5. Client-Side Testing
6. Risk Analysis
7. Reporting

Web Application Penetration Testing Report

Summary

A total of 6 vulnerabilities were identified during the assessment.

Vulnerability : SQL Injection

CWE ID: CWE-89
Risk Rating: High
Tools Used: Browser, SQLmap

Description

SQL Injection was identified in a GET parameter allowing attackers to extract database information.

Vulnerable URL

http://testphp.vulnweb.com/artists.php?artist=1

Impact

Attackers can retrieve sensitive user information including credentials and personal data.

Recommendation

• Use prepared statements
• Input validation
• Least privilege
• Deploy WAF Proof of Concept

Vulnerability : Reflected Cross-Site Scripting (XSS)

CWE ID: CWE-79
Risk Rating: Medium

Description

JavaScript input was reflected and executed in the browser.

Impact

Session hijacking, credential theft

Recommendation

• Input filtering
• Output encoding
• Content Security Policy Proof of Concept

Vulnerability : Stored XSS

CWE ID: CWE-79 Risk Rating: High

Description

Malicious JavaScript input was stored in the application profile section.

Impact

Persistent client-side attacks affecting all users. Proof of Concept

Vulnerability : Broken Authentication

CWE ID: CWE-287
Risk Rating: High

Description

Authentication bypass using SQL logic in login fields. Proof of Concept

Vulnerability : HTML Injection

CWE ID: CWE-80
Risk Rating: Low
Proof of Concept

Vulnerability : Clickjacking

CWE ID: CWE-1021 Risk Rating: Low
Proof of Concept

Risk Classification

Github