Dos Estudos em Laboratório a Aplicação Prática em Análise Não Invasiva de Segurança

Abstract

This article integrates three workstreams developed throughout the academic activity: a simplified report on practical studies, a supplementary technical report on the case study, and the set of objective evidence collected during the analysis. The objective is to demonstrate not only which topics were studied but, more importantly, what was gained from these studies regarding a non-invasive analysis of the UFMS certificate system. The training phase involved network reconnaissance using Nmap, request interception and analysis with Burp Suite, the study of XSS and IDOR vulnerabilities, hash cracking with John the Ripper, and the review of alerts and logs within a monitoring environment. Based on this background, a low-impact evidence-gathering process regarding SICERT was structured, focusing on HTTP headers, session cookies, browser behavior, a local proof-of-concept for clickjacking, and logout verification using the evaluator's own session. The results showed that the primary outcome of the studies was the ability to transform laboratory content into a reproducible procedure for observation, classification, and technical recommendation, underpinned by real-world evidence and well-defined ethical boundaries. The most relevant commands and code snippets have been compiled at the end of the document in technical appendices supplementary to the main body of the article.