A recap of XSS and SQL injection, plus command injection and the AP Skill 1.D documentation format.
🧭 Recap & Application
Your cyber team has been called in to investigate a series of suspected attacks. Three network captures are waiting for you, each hiding one exploit. Two of them, you already know how to find:
The third is new: command injection. A page offering a "free ping" tool actually passes your input straight into a real system command — meaning an adversary can tack on extra commands the page was never meant to run.
For each exploit you find, you'll document it in a specific format:
Notice this format ends differently than the one from 1.2.5 and 2.2.4 — it ends in evaluating cost-benefit, not implementing a fix. This is AP Skill 1 (Analyze Risk), not Skill 2.
What you will do in this project
- Apply your Wireshark and packet analysis skills to find real exploits hidden in captured traffic.
- Learn command injection — an attack that runs unauthorized commands through a web form.
- Document each finding in AP Skill 1.D format: identify, explain, determine risk, evaluate cost-benefit.
- Reflect on which Cybersecurity Lifecycle stages a penetration test actually covers.
- Discuss why authorized penetration testing is ethical, even though it uses the same skills as an attacker.
Why it matters
This documentation format is direct AP FRQ practice — and the project closes with a real discussion of what makes penetration testing an ethical use of skills that, in the wrong hands, are attacks.
✅ Self-Check Before You Roll On
Check off each item as you get there. These are not grades — they are your own signal.