Monday, May 10, 2010

Web Security Challenge Revealed

I had created a series of Security Challenge for my Sectester team several months back. It was for the team to learn and share our knowledge.

The first challenge is on "Script Obfuscation".

Code obfuscation are commonly used by malware writer to bypass Anti Virus detection and reverse engineering. Many Obfuscated javascript were injected into innocent websites to run exploits and shellcodes to compromised systems. Others using "Drive by download" techniques to download malicious malware.

With this challenge, you will learn the basic of analysing a script from a webpage. I have recommended some basic tools (under the technical resources) for beginners to pick up the fundamental of script analysis. There are many tools and ways you can analysed a script/code. You may find some useful tools in the Internet.

The challenge was created with simple HTML and some javascript.
The URL: Email me if you interested

* No particular rules. It is a code challenge, crack the code not the server.

Technical resources:
- Some readup on code obfuscation
- Useful tools to stop scripts on webpage before you start analysing them
- Useful tool to inspect and debug scripts running on a webpage

Some real malicious obfuscated javascript from my research blog.

Feel free to provide comments on this challenge.

No comments: