Swiss Cyber Storm Cargame Challenge

Swiss Cyber Storm 3 is having a online January CarGame challenge. It is a Pen-testing wargame that you have to gain access into a vulnerable web application. Try to solve this challenge and win a new car.

Challenge Description
In Hacking-Lab, it provides a vulnerable web application - and somewhere on the web server you will be able to disclose a backend server DB connection properties file including hostname, IP, username and password. It is your goal to disclose this DB property file and then get a SQL connection to the database server. This DB server is vulnerable too! Please gain interactive access on the database server and proof your access by sending a screenshot of having access, some server info you gather with commands like "hostname" or similar.

Goal
Gain interactive access to the database server. Proof you are able to access the box.

Details
You must be authenticated and registered for the January 2011 CarGame Challenge in Hacking-Lab to see the full details of this wargame!

More details - http://www.hacking-lab.com/cases/7025-database-hijack-cargame-challenge/index.html

Challenge Registration - http://www.hacking-lab.com/events/registerform.html?eventid=137

Watch Intro video (on how to participate)

Official Swiss Cyber Storm 3 website

Web Security Challenge Revealed

I had created a series of Security Challenge for my Sectester team several months back. It was for the team to learn and share our knowledge.

The first challenge is on "Script Obfuscation".



Description:
Code obfuscation are commonly used by malware writer to bypass Anti Virus detection and reverse engineering. Many Obfuscated javascript were injected into innocent websites to run exploits and shellcodes to compromised systems. Others using "Drive by download" techniques to download malicious malware.

Objective:
With this challenge, you will learn the basic of analysing a script from a webpage. I have recommended some basic tools (under the technical resources) for beginners to pick up the fundamental of script analysis. There are many tools and ways you can analysed a script/code. You may find some useful tools in the Internet.

Environment:
The challenge was created with simple HTML and some javascript.
The URL: Email me if you interested

Rules:
* No particular rules. It is a code challenge, crack the code not the server.

Technical resources:
http://en.wikipedia.org/wiki/Obfuscated_code
- Some readup on code obfuscation

http://noscript.net/
- Useful tools to stop scripts on webpage before you start analysing them

http://getfirebug.com/
- Useful tool to inspect and debug scripts running on a webpage

Some real malicious obfuscated javascript from my research blog. http://labs-werew01f.sectester.net/

Feel free to provide comments on this challenge.

Web Security Challenge 2

The Web Security Challenge on "Encoding attacks for Web applications".



Description:
Web application commonly uses "GET" method to send user request to the webserver. They are commonly used for search, query and for bookmarking. The data in these requests can be easily extracted and manipulated from the address bar.

Objective:
This challenge is a very simple challenge. You are required to extract the "password" from the simulated user login and verify the capture password by logging in with it. For this challenge, You will learn and understand on how application uses "GET" method to send request to the server. This will be the fundamental for further challenges on code injection. You don't really require any tools to complete this challenge.

Environment:
The challenge was created with simple HTML and PHP.
The URL: Email me if you interested

Rules:
* Do not extract the password from the source code. You are suppose to extract it from the request.
* It is a code challenge, extract the data not crack the server.

Technical resources:
http://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol
- Some readup on HTTP and Request methods

Feel free to give comments on the challenge.

Web Security Challenge 3

Another challenge on "Encoding attacks for Web applications".



Description:
Many web sites do not use SSL encryption for their web application (including login pages). You can easily extract or manipulate data during the communication between the client and the server.

Objective:
This challenge is a simple challenge. You are required to extract the "password" from the simulated user login and verify the capture password by logging in with it. For this challenge, You will learn and understand on how to capture web communication between the client and the server. This will be the fundamental for further challenges on code injection.

Environment:
The challenge was created with simple HTML and PHP.
The URL: Email me if you interested

Rules:
* Do not extract the password from the source code. You are suppose to extract it from the communication.
* It is a code challenge, extract the data not crack the server.

Technical resources:
http://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol
- Some readup on HTTP and Request methods

http://www.owasp.org/index.php/Category:OWASP_WebScarab_Project
- WebScarab, a good tool by OWASP

http://www.parosproxy.org/
- Another good web security tools

- Previously did a video on extracting user's credential on unsecured website
http://werew01f.blogspot.com/2009/05/how-secure-is-your-forum-login.html

Feel free to provide comments on this challenge.

Web Security Challenge 4

Web Security Challenge on "Data Manipulation attacks for Web applications".



Description:
Many web sites do not use SSL encryption for their web application (including login pages). You can easily extract or manipulate data during the communication between the client and server. Some web application does their computation on the client system and submit back to the server. One of my first few hack was changing my score in the online games many years back.

Objective:
This challenge is a simple challenge. You are required to change the price of a online shopping item to $2. For this challenge, You will learn to manipulate data send between the client and the server. This will be the fundamental for further challenges on code injection.

Environment:
The challenge was created with simple HTML and PHP.
The URL: Email me if you interested

Rules:
* Do not change the source code. You are suppose to manipulate it during the communication.
* It is a code challenge, manipulate the data not crack the server.

Technical resources:
http://www.owasp.org/index.php/Category:OWASP_WebScarab_Project
- WebScarab, a good tool by OWASP

http://www.parosproxy.org/
- Another good web security tools

Feel free to provide comments on this challenge.

Web Security Challenge 5

Web Security Challenge on "XSS attacks for Web applications".



Description:
Many web sites these days are prone to XSS (Cross Site Scripting) attacks. Some web applications uses simple XSS filters to protect against XSS attack. But there are many ways to bypass those filters.

Objective:
This challenge is a simple XSS challenge. You are required to inject a simple alert to display "sectester rocks". For this challenge, You will learn to launch XSS attack and bypass simple XSS filters. This will be the fundamental for tougher challenge in future.

Environment:
The challenge was created with simple HTML and PHP.
The URL: Email me if you interested

Rules:
* Do not change the source code. You are suppose to inject script.
* It is a code challenge, manipulate the data not crack the server.

Technical resources:
http://en.wikipedia.org/wiki/Cross-site_scripting
- Basic on Cross Site Scripting

Feel free to provide comments on this challenge.