Elvis Wiki - User contributions [en]

OverTheWire CTF Wargames

2024-12-18T21:17:24Z

KSzepannek:

The community-based project OverTheWire offers Capture-The-Flag (CTF) wargames for IT-Security enthusiasts and learners. The wargames all focus on different aspects of IT-security or computer sciences like for example Linux systems, cryptography or serverside web application security. The official website OverTheWire.org lists 13 available wargames as of december 2024, with only one of them being available for offline use. The other 12 games are accessed via either SSH or in the case of the serverside web application security focused wargame “Natas” , via a web browser and other tools. As usual for CTF Games in IT-Security, the goal of each level in the wargames is to obtain the password for entering the next one, in this case for accessing the SSH user. The website offers little guidance to beat the challenges posed by the wargames but being around for much over 10 years, a lot of blog entries and YouTube walkthroughs on the wargames have emerged.

== Summary ==

This documentation will help to get started with solving the OverTheWire wargames.

== Requirements ==

* Operating system: Any, that can run a SSH Shell.
* SSH Shell: For example Putty on Windows or Unix based operating systems.
* Packages: Additional Packages may be required for some wargames.

== General Tips ==

To connect to a SSH wargame you will find the SSH hostname and port on each games own site. If you are connecting with Putty you may find it helpful to save the hostname and port in a session like seen in the picture below, for the wargame Bandit:
[[file:putty_stored_session.png]]

This is useful because after completing the challenge you may have to close the session and enter again.

Also, save the passwords (captured flags) you have obtained because if you loose the current one you will have to start again! The passwords change from time to time so you probably also won't find them online.

== Bandit ==

Bandit is the easiest wargame and the first one in the suggested order to play them. It is about basic Linux filesystems. You may find it helpful to first read the following [https://manpages.ubuntu.com/manpages/noble/man1/intro.1.html manpage] if you have never worked with a Linux machine before (highly unlikely i know).

To connect to the Bandit Wargame use the following hostname and port:

=== Level 0 ===

Login as bandit0 with password bandit0.

[[file:Bandit_Login2.png]]

Then try the "ls" command to list all files and directories. To read a file use the "cat" command.

[[file:Bandit_Level0.png]]

The password is found in the read file "readme".
=== Level 1 ===

Login as bandit1 with the password from the level 1.

Try entering the command "ls" and then to read the strangely named file "-" you will find. As you will see, you can't read it by simply typing its name. Use "./" before the filename now.

[[file:Bandit_Level1.png]]

=== Level 2 ===

Login as bandit2 with the password from the level 2.

For this wargame try putting the filename in brackets.

=== Level 3 ===

Login as bandit3 with the password from the level 3.

Use "ls" to find the directory. You can move to the directory with the cd command.

Try to find the file containing the password

== References ==

* https://OverTheWire.org

[[Category:Documentation]]

File:Bandit Level1.png

2024-12-18T20:59:15Z

KSzepannek:

File:Bandit Level0.png

2024-12-18T20:58:52Z

KSzepannek:

File:Bandit Login2.png

2024-12-18T20:58:31Z

KSzepannek:

File:Bandit Login.png

2024-12-18T20:58:00Z

KSzepannek:

File:Putty stored session.png

2024-12-18T20:57:16Z

KSzepannek:

OverTheWire CTF Wargames

2024-12-18T20:55:32Z

KSzepannek:

The community-based project OverTheWire offers Capture-The-Flag (CTF) wargames for IT-Security enthusiasts and learners. The wargames all focus on different aspects of IT-security or computer sciences like for example Linux systems, cryptography or serverside web application security. The official website OverTheWire.org lists 13 available wargames as of december 2024, with only one of them being available for offline use. The other 12 games are accessed via either SSH or in the case of the serverside web application security focused wargame “Natas” , via a web browser and other tools. As usual for CTF Games in IT-Security, the goal of each level in the wargames is to obtain the password for entering the next one, in this case for accessing the SSH user. The website offers little guidance to beat the challenges posed by the wargames but being around for much over 10 years, a lot of blog entries and YouTube walkthroughs on the wargames have emerged.

== Summary ==

This documentation will help to get started with solving the OverTheWire wargames.

== Requirements ==

* Operating system: Any, that can run a SSH Shell.
* SSH Shell: For example Putty on Windows or Unix based operating systems.
* Packages: Additional Packages may be required for some wargames.

== General Tips ==

To connect to a SSH wargame you will find the SSH hostname and port on each games own site. If you are connecting with Putty you may find it helpful to save the hostname and port in a session like seen in the picture below, for the wargame Bandit:

This is useful because after completing the challenge you may have to close the session and enter again.

Also, save the passwords (captured flags) you have obtained because if you loose the current one you will have to start again. The passwords change from time to time so you probably also won't find them online.

== Bandit ==

This wargame is about basic Linux filesystems. You may find it helpful to first read the following [https://manpages.ubuntu.com/manpages/noble/man1/intro.1.html manpage].

To connect to the Bandit Wargame use the following hostname and port:

=== Level 0 ===

Login as bandit0 with password bandit0.

=== Level 1 ===

Login as bandit1 with the password from the level 1.

=== Level 2 ===

Login as bandit2 with the password from the level 2.

=== Level 3 ===

Login as bandit3 with the password from the level 3.

== References ==

* https://OverTheWire.org

[[Category:Documentation]]

OWASP Top 10

2024-12-18T19:50:44Z

KSzepannek:

The OWASP Top 10 is a globally recognized standard that identifies the ten most critical security risks to web applications. Published by the Open Web Application Security Project (OWASP), a non-profit organization dedicated to improving software security, the OWASP Top 10 serves as an important resource for developers, security professionals, and organizations aiming to secure web applications and protect sensitive data from attacks.
== Purpose and Objectives ==
The primary goal of the OWASP Top 10 is to raise awareness of web application security vulnerabilities and provide guidance for mitigating these risks. By highlighting the most common and impactful threats, the list helps developers to write secure code, security teams to focus on critical areas and organisations to integrate those practices into their development.

The OWASP Top 10 not only serves as an educational resource but also as a benchmark for compliance standards and as a good foundation for secure coding policies in enterprises. Its purpose is to help collaboration between development and security teams, ensuring that security becomes an integral part of the software development process.
By providing detailed explanations, real-world examples, and guidance, the OWASP Top 10 helps organizations to understand security risks and implement measures to prevent them.
== History and Evolution ==

=== Formation and Early Development ===
The OWASP Top 10 was first published in 2003 by the OWASP Foundation, which was founded by Mark Curphey and a team of volunteers. The original list was created to address the growing need for standardized guidance on web application security, as the internet became more connected to business operations. At the time, awareness of web application vulnerabilities was low, and there were only a few resources available for developers and security professionals to learn about them.
The OWASP Foundation was established with the mission of creating free and open resources for improving application security. The Top 10 list quickly became one of its flagship projects, gaining widespread adoption due to its format and practical advice.

=== Evolution of Methods ===
The methods used to create the OWASP Top 10 have improved a lot over the years to make them more accurate and fair. Earlier versions focused on a small set of known vulnerabilities and relied heavily on expert opinions. In 2017, OWASP introduced a more structured process, using incidence rates to measure how many applications had at least one instance of a vulnerability. This approach gave a clearer picture of risks across many applications, rather than just counting the number of issues found. By 2021, the process expanded to analyze nearly 400 vulnerabilities (CWEs) and included scores for how easy vulnerabilities were to exploit and their impact. Community surveys were also added to capture new threats and insights from security experts. These changes have made the OWASP Top 10 a strong and reliable guide for dealing with modern security risks.
=== Major Updates Over the Years ===
The OWASP Top 10 has had many updates to reflect changing threats and technologies and shifts in attacker behavior. Each update has been built on feedback from security practitioners, data from real-world breach reports, and insights from academic research. Key updates include:

• '''2003''': The first list identified issues like "Buffer Overflows," "Cross-Site Scripting (XSS)," and "SQL Injection."

• '''2007''': This update had a more structured approach to categorize risks and included vulnerabilities like "Insecure Communications" and "Failure to Restrict URL Access."

• '''2010''': As web applications became more complex, the 2010 version focused on risks like "Security Misconfiguration" and "Insufficient Transport Layer Protection." This edition also highlighted the importance of secure session management.

• '''2013''': This update reflected a growing dependence on third-party components and added a category "Using Components with Known Vulnerabilities" but also authentication and authorization issues.

• '''2017''': The 2017 list introduced modern risks like "XML External Entities (XXE)" and "Insufficient Logging and Monitoring." The addition of these categories reflected trends such as the rise of APIs and the importance of detecting attacks in real time.

• '''2021''': The most recent update prioritized risks like "Insecure Design" and "Software and Data Integrity Failures."

Each iteration of the OWASP Top 10 comes with detailed documentation, including explanations of the methods used to compile the list, descriptions of each risk, and recommended mitigation strategies.

== OWASP Top 10 Categories ==

An OWASP Top 10 category is made up of a group of related vulnerabilities (CWEs) that share a common root cause or theme. Each category focuses on the underlying issue, such as "Cryptographic Failures" or "Misconfigurations," rather than just the symptoms like "Sensitive Data Exposure." On average, a category includes about 19 CWEs, though some have as few as one (like Server-Side Request Forgery) or as many as 40 (like Insecure Design). Categories are also ranked based on factors like how often vulnerabilities occur in real-world applications, how easy they are to exploit, and the impact they can have if exploited. This structure helps developers and organizations focus on fixing the core problems that lead to security issues.

== References ==

* https://owasp.org
* https://owasp.org/top10
* https://owasp.org/www-project-top-ten/2017/
* https://owasp.org/Top10/A00_2021_Introduction/
* https://github.com/OWASP/Top10/blob/master/2017-2003_Comparison/OWASP_Top_Ten_-_Comparison_of_2003%2C2004%2C2007%2C2010%2C2013_and_2017_Releases.docx

[[Category:Documentation]]

OWASP Top 10

2024-12-18T17:17:28Z

KSzepannek:

The OWASP Top 10 is a globally recognized standard that identifies the ten most critical security risks to web applications. Published by the Open Web Application Security Project (OWASP), a non-profit organization dedicated to improving software security, the OWASP Top 10 serves as an important resource for developers, security professionals, and organizations aiming to secure web applications and protect sensitive data from attacks.
== Purpose and Objectives ==
The primary goal of the OWASP Top 10 is to raise awareness of web application security vulnerabilities and provide guidance for mitigating these risks. By highlighting the most common and impactful threats, the list helps developers to write secure code, security teams to focus on critical areas and organisations to integrate those practices into their development.

The OWASP Top 10 not only serves as an educational resource but also as a benchmark for compliance standards and as a good foundation for secure coding policies in enterprises. Its purpose is to help collaboration between development and security teams, ensuring that security becomes an integral part of the software development process.
By providing detailed explanations, real-world examples, and guidance, the OWASP Top 10 helps organizations to understand security risks and implement measures to prevent them.
== History and Evolution ==
=== Formation and Early Development ===
The OWASP Top 10 was first published in 2003 by the OWASP Foundation, which was founded by Mark Curphey and a team of volunteers. The original list was created to address the growing need for standardized guidance on web application security, as the internet became more connected to business operations. At the time, awareness of web application vulnerabilities was low, and there were only a few resources available for developers and security professionals to learn about them.
The OWASP Foundation was established with the mission of creating free and open resources for improving application security. The Top 10 list quickly became one of its flagship projects, gaining widespread adoption due to its format and practical advice.
=== Major Updates Over the Years ===
The OWASP Top 10 has had many updates to reflect changing threats and technologies and shifts in attacker behavior. Each update has been built on feedback from security practitioners, data from real-world breach reports, and insights from academic research. Key updates include:

• '''2003''': The first list identified issues like "Buffer Overflows," "Cross-Site Scripting (XSS)," and "SQL Injection."

• '''2007''': This update had a more structured approach to categorize risks and included vulnerabilities like "Insecure Communications" and "Failure to Restrict URL Access."

• '''2010''': As web applications became more complex, the 2010 version focused on risks like "Security Misconfiguration" and "Insufficient Transport Layer Protection." This edition also highlighted the importance of secure session management.

• '''2013''': This update reflected a growing dependence on third-party components and added a category "Using Components with Known Vulnerabilities" but also authentication and authorization issues.

• '''2017''': The 2017 list introduced modern risks like "XML External Entities (XXE)" and "Insufficient Logging and Monitoring." The addition of these categories reflected trends such as the rise of APIs and the importance of detecting attacks in real time.

• '''2021''': The most recent update prioritized risks like "Insecure Design" and "Software and Data Integrity Failures."

Each iteration of the OWASP Top 10 comes with detailed documentation, including explanations of the methods used to compile the list, descriptions of each risk, and recommended mitigation strategies.

== Description of the Categories ==

=== Step 1 ===

+++

== References ==

* https://owasp.org
* https://owasp.org/top10
* https://owasp.org/www-project-top-ten/2017/
* https://github.com/OWASP/Top10/blob/master/2017-2003_Comparison/OWASP_Top_Ten_-_Comparison_of_2003%2C2004%2C2007%2C2010%2C2013_and_2017_Releases.docx

[[Category:Documentation]]

OWASP Top 10

2024-12-18T14:58:58Z

KSzepannek: Initial Creation

== Summary ==

OWASP and OWASP Top 10

== Requirements ==

* Operating system: Ubuntu 18.04 bionic amd64
* Packages: git emacs

In order to complete these steps, you must have followed [[Some Other Documentation]] before.

== Description ==

=== Step 1 ===

Enter these commands in the shell

echo foo
echo bar

=== Step 2 ===

Make sure to read

* War and Peace
* Lord of the Rings
* The Baroque Cycle

== Used Hardware ==

[[Device to be used with this documentation]]
[[Maybe another device to be used with this documentation]]

== Courses ==

* [[A course where this documentation was used]] (2017, 2018)
* [[Another one]] (2018)

== References ==

* https://wikipedia.org
* https://google.com

[[Category:Documentation]]

OverTheWire CTF Wargames

2024-12-18T12:20:12Z

KSzepannek: Created page with "== Summary == The community-based project OverTheWire offers Capture-The-Flag (CTF) wargames for IT-Security enthusiasts and learners. The wargames all focus on different aspects of IT-security or computer sciences like for example Linux systems, cryptography or serverside web application security. The official website OverTheWire.org lists 13 available wargames as of december 2024, with only one of them being available for offline use. The other 12 games are accessed..."

== Summary ==

The community-based project OverTheWire offers Capture-The-Flag (CTF) wargames for IT-Security enthusiasts and learners. The wargames all focus on different aspects of IT-security or computer sciences like for example Linux systems, cryptography or serverside web application security. The official website OverTheWire.org lists 13 available wargames as of december 2024, with only one of them being available for offline use. The other 12 games are accessed via either SSH or in the case of the serverside web application security focused wargame “Natas” , via a web browser and other tools. As usual for CTF Games in IT-Security, the goal of each level in the wargames is to obtain the password for entering the next one, in this case for accessing the SSH user. The website offers little guidance to beat the challenges posed by the wargames but being around for much over 10 years, a lot of blog entries and YouTube walkthroughs on the wargames have emerged.

== Requirements ==

* Operating system: Any, that can run a SSH Shell.
* SSH Shell: For example Putty on Windows or Unix based operating systems.
* Packages: Additional Packages may be required for some wargames.

== References ==

* https://OverTheWire.org

[[Category:Documentation]]