CTF365 Security Shepherd Walkthrough - No Spoilers Just Hints

hopefully, lets try to do all of the CTF365 Security Shepherd lessons and challenges, and help everybody with all they need but no spoilers.

that doens't meant you don't need to do your learning, if i didn't write something, that means (a) learn the topic (b) read instructions.

simple way to work through is installing burp-suite CE and make it work with ssl, but i'll try to also teach, where possible, you can use other tools.

LESSONS
*any lession with a asterisk [*] in its name means that it would have been easier with burp, just altering the request. [need to install cert. etc.]


Broken Session Management*
the session is managed via cookies, can be changed via
Chrome Dev Tools (F12) -> Application tab -> Storage -> Cookies.
(maybe you must click the button 1st)

 Cross-Site Request Forgery
after putting a value in the box and submitting, right-click and Inspect-Element the image.
you must put a full url i.e. https://.....
try put a funny image from google search.

Cross Site Scripting (XSS)
if you miss the answer itself written in-front of your eyes, time to learn some html and javascript.

Failure to Restrict URL Access
here you need to learn to research the html itself of the page(s) to see more content(s).
click F12, or right click and either Inspect Element or View Source.
*tip - learn the "display" css property and its values.

Insecure Cryptographic Storage
any online tool

Insecure Direct Object References*
looking at the html source we can see the ajax request and manually send it altered.

Poor Data Validation*
same as last one.

Security Misconfiguration
admin:password. make sure you're not on CAPS LOCK.

SQL Injection
the target db is mysql, so comment is "#". after 3 tries you get a hint, which is really the answer.

Untrusted Input
maybe one day i'll install the Mobile Machine

Unvalidated Redirects and Forwards
you must put a full url i.e. https://security-shepherd.ctf365.com/.... both times....
and user can start with a dash [-] like "-13245678"






















Comments

Post a Comment

Popular posts from this blog

OverTheWire[.com] Natas Walkthrough - JUST HINT, NO SPOILERS

game portal: http://overthewire.org/wargames/natas/ PASSWORDS for each level are stored in /etc/natas_webpass/natasX I made this walkthrough for people like me, i needed some help, but didnt want the spoiler, so here i will give you all the information needed to pass each level, yet not the solution. For levels needed custom web request i made a different post for powershell and javascript  with how-to's, since is a piece of learning for itself, and also for those of us that play at work and have only powershell at their hands. Although its not a complete spoiler there, its quite most of the solution so try yourself 1st. Natas The Natas game is from basic to advances web hacking. Every few levels is about whole new exploitation (with some harder ones doing comeback later), so a lot of learning. If you're new, you're the reason i am writing so much even for the 1st level, just please google EVERY topic you see, since in the following levels i assume you know the
Read more

SOLVED The item could not be indexed successfully because the item failed in the indexing subsystem

if you got an error like this The item could not be indexed successfully because the item failed in the indexing subsystem. ( The item could not be indexed successfully because the item failed in the indexing subsystem.; Failed to recover content group; Aborting insert of item in Link Database because it was not inserted to the Search Index.; ; SearchID = 04081656-B51B-4DCD-96D4-6DB2D2CEEEE7 ) as well as these: The item could not be indexed successfully because the item failed in the indexing subsystem. ( The item could not be indexed successfully because the item failed in the indexing subsystem.; Caught exception when preparing generation GID[7]: (Previous generation (last=GID[6], curr=GID[7]) is still active. Cannot open GID[7]); Aborting insert of item in Link Database because it was not inserted to the Search Index.; ; SearchID = 92EB0180-C086-4853-BED8-F4878D9748AD ) the solution for me was to clear configuration cache (PS)  and then restart SP Search Services. THX to m
Read more

Asp.Net Ending Response options, Response.End() vs CompleteRequest()

this blog is for any1 who get the ThreadAbortException when caling Response.End(), and then tried the other options such as HttpContext.Current.ApplicationInstance.CompleteRequest() and found out that there was no replacement. i'll start with the bottom line: if you want to stop right now your response and send it as is you dont have any other option other than Response.End(), period and it's the right thing to throw that EX in that case. the answer is its because there is the "HTTP pipeline" and the "Asp.Net pipeline", and CompleteRequest() cuts the HTTP pipeline but not the Asp.Net one so everything that is from handlers forwars (including all page events) continues but your part, the asp one, stays in your hands so that no information will be lost, so ur suppose to manage your code currectly, since information lost is really a bad thing, although in most cases we use Response.End() we know what we are losing and we want it. see this short article ab
Read more