Information Security Journey

Interactive website to learn:

SQL Injection

Clickjacking

Session Fixation

Cross-Site Scripting

Weak Session IDs

Reflected XSS

Dom-Based XSS

Cross-Site Request Forgery

File Upload Vulnerability

XML Bombs

Open Directs

User Enumeration

Broken Access Control

Unencrypted Communication

XML External Entities

Information Leakage

Password Mismanagement

Privilege Escalation

 Command Execution

In level 7, we get a page with error 404 - page not found, with the following text: 

“f00 not found Something is not right here??? btw...bounty $70″

Level 6 ask us to download sharkfin.pcap which means it is probably some network traffic that we have to analyse. The filename - sharkfin - hinted that we may need to use wireshark to analyse the file.  

These are the following steps i like to do when i have a pcap file:

statistics --> captured file properties

file --> export objects --> http 

right click follow --> TCP/UDP stream

For level 5, we get a page with an infinite pop-up that says “hacker!!”.

After disabling the pop-up, we inspect the source and found a hidden image - aliens.jpg.

For a bounty of $40, level 4 shows a very cute cookie monster image with the text “HTTP means Hypertext Transfer Protocol”. On hovering the image, it gives a pop-up text “stop poking me”.

Combining HTTP and cookie monster, the hint is probably to look at the cookie of the page. 

In level 3, we see a QR code with a progress bar for a bounty of $30. 

At first thought, the hint to where the flag is hidden would be inside the QR code. However, we were sidetracked by the progress bar after getting negative results from running the QR code through a conventional QR code scanner. Big mistake! :X After checking the progress bar, it seems to be a distraction with nothing unusual. 

In this level, we see a broken image with accompany text “It seems like the image is broken..can you check the file?”.

By opening the image in a new tab, it displays the image in this link. 

When we first enter level 1, it shows us a yoda with the following text “May the source be with you!”.

The hint in this case, is to simply look at the page source. 

Infosec Institute provides an entry-level CTF for beginners to learn and play. 

The first one is n00bz while the second is Practical Web Hacking. In the next few posts, i will be writing on the methods I used to solve the exercises. Regardless, these are some of the sample writeups to the exercises that fellow players have shared:

1. http://resources.infosecinstitute.com/n00bs-ctf-labs-solutions/#article

2. http://cmattoon.com/infosec-institute-ctf-level-4/

3. http://kectf.blogspot.sg/2015/03/n00bs-ctf-labs.html