Defend The Web - Revision history

Ikramer at 17:36, 12 March 2024

2024-03-12T17:36:54Z

← Older revision		Revision as of 17:36, 12 March 2024
Line 78:		Line 78:
	* https://www.root-me.org		* https://www.root-me.org
	* https://www.hackthebox.com		* https://www.hackthebox.com

			[[Category:Documentation]]

MBasta: /* Root Me */

2024-01-06T13:04:45Z

Root Me

← Older revision		Revision as of 13:04, 6 January 2024
Line 59:		Line 59:

	=== Root Me ===		=== Root Me ===
	The CTF platform [~~https://www.root-me.org~~ Root Me] has established only two years after Defend The Web in 2010, but offers already more than 540 challenges. <ref name="rmchallenges"/>		The CTF platform [[Root_Me\|Root Me]] has established only two years after Defend The Web in 2010, but offers already more than 540 challenges. <ref name="rmchallenges"/>

	=== Hack The Box ===		=== Hack The Box ===

MBasta at 13:03, 6 January 2024

2024-01-06T13:03:12Z

← Older revision		Revision as of 13:03, 6 January 2024
Line 1:		Line 1:
	[[File:DefendTheWebNetLogo.png\|thumb\|Logo of DefendTheWeb.net<ref name="logo"/>]]		[[File:DefendTheWebNetLogo.png\|thumb\|Logo of DefendTheWeb.net<ref name="logo"/>]]
	'''Defend The Web''' is a Capture the Flag Website that teaches topic about Cyber Security and offers users on-hand-training for their theoretical skills. A free account is needed to access every section of the website. This can be either done by registering a new one from scratch or by using one of the available Single Sign On Providers (SSO Providers) Twitter (aka X), Google or GitHub. After logging in, the user gets redirected to a dashboard that offers information about new content in the articles and community sections as well as the progress in solving CTFs and the user's current level. Every user can earn medals by finishing challenges, participating in the community, writing articles and other actions on the website.		'''Defend The Web''' is a Capture the Flag Website that teaches topic about Cyber Security and offers users on-hand-training for their theoretical skills. A free account is needed to access every section of the website. This can be either done by registering a new one from scratch or by using one of the available Single Sign On Providers (SSO Providers) Twitter (aka X), Google or GitHub. After logging in, the user gets redirected to a dashboard that offers information about new content in the articles and community sections as well as the progress in solving CTFs and the user's current level. Every user can earn medals by finishing challenges, participating in the community, writing articles and other actions on the website. <ref name="dtw"/>

	== Overview ==		== Overview ==
Line 66:		Line 66:
	== References ==		== References ==
	<references>		<references>
			<ref name="dtw">https://defendtheweb.net</ref>
	<ref name="logo">https://www.facebook.com/defendtheweb/photos/a.163821580333961/2395529793829784/</ref>		<ref name="logo">https://www.facebook.com/defendtheweb/photos/a.163821580333961/2395529793829784/</ref>
	<ref name="chatworkaround">https://defendtheweb.net/discussion/83648-irc-chat</ref>		<ref name="chatworkaround">https://defendtheweb.net/discussion/83648-irc-chat</ref>

MBasta at 13:02, 6 January 2024

2024-01-06T13:02:02Z

← Older revision		Revision as of 13:02, 6 January 2024
Line 48:		Line 48:
	</syntaxhighlight>		</syntaxhighlight>

	As we suspect a similar query to be used in the background of the challenge, we use ambiguous characters to get more information. Using the username "~~username~~" and the password <code>'</code> (a single quote), we get back the error message <code>"Syntax error: SELECT * FROM users WHERE username = 'user' AND password = <nowiki>'''</nowiki>"</code>. We can now see the used query and that the single quote invalidated it.		As we suspect a similar query to be used in the background of the challenge, we use ambiguous characters to get more information. Using the username "silvie" and the password <code>'</code> (a single quote), we get back the error message <code>"Syntax error: SELECT * FROM users WHERE username = 'user' AND password = <nowiki>'''</nowiki>"</code>. We can now see the used query and that the single quote invalidated it.

	[[File:DefendTheWebNetSqlInjectionB.png\|600px\|Screenshot of the SQLInjection challenge error page the failed execution as stated in the paragraph above]]		[[File:DefendTheWebNetSqlInjectionB.png\|600px\|Screenshot of the SQLInjection challenge error page the failed execution as stated in the paragraph above]]
Line 72:		Line 72:
	<ref name="htbchallenges">https://www.hackthebox.com/about-us</ref>		<ref name="htbchallenges">https://www.hackthebox.com/about-us</ref>
	</references>		</references>

			* https://defendtheweb.net
			* https://owasp.org/www-project-top-ten/
			* https://www.root-me.org
			* https://www.hackthebox.com

MBasta at 12:58, 6 January 2024

2024-01-06T12:58:44Z

← Older revision		Revision as of 12:58, 6 January 2024
Line 48:		Line 48:
	</syntaxhighlight>		</syntaxhighlight>

	As we suspect a similar query to be used in the background of the challenge, we use ambiguous characters to get more information. Using the username "username" and the password "'" (a ~~simple~~ quote), we get back the error message "Syntax error: SELECT * FROM users WHERE username = 'user' AND password = '''". We can now see the used query and that the single quote invalidated it.		As we suspect a similar query to be used in the background of the challenge, we use ambiguous characters to get more information. Using the username "username" and the password <code>'</code> (a single quote), we get back the error message <code>"Syntax error: SELECT * FROM users WHERE username = 'user' AND password = <nowiki>'''</nowiki>"</code>. We can now see the used query and that the single quote invalidated it.

	[[File:DefendTheWebNetSqlInjectionB.png\|600px\|Screenshot of the SQLInjection challenge error page the failed execution as stated in the paragraph above]]		[[File:DefendTheWebNetSqlInjectionB.png\|600px\|Screenshot of the SQLInjection challenge error page the failed execution as stated in the paragraph above]]

	For the exploit itself we can now use any username, as the script will not check this anyway after our changes, and the password "' OR 1=1;". The query will be rendered in the background to "SELECT * FROM users WHERE username = 'silvie' AND password = '' OR 1=1;'". The query now evaluates two parts, the one before the OR and the other after. The first one will probably fail because the user may not exist or even if it does, the password will probably not be empty. The second part will always be true, because 1 equals 1. The single quote at the end will be ignored, because we added a semicolon at the end that finishes the query.		For the exploit itself we can now use any username, as the script will not check this anyway after our changes, and the password <code>"' OR 1=1;"</code>. The query will be rendered in the background to <code>"SELECT * FROM users WHERE username = 'silvie' AND password = '' OR 1=1;'"</code>. The query now evaluates two parts, the one before the OR and the other after. The first one will probably fail because the user may not exist or even if it does, the password will probably not be empty. The second part will always be true, because 1 equals 1. The single quote at the end will be ignored, because we added a semicolon at the end that finishes the query.

	[[File:DefendTheWebNetSqlInjectionC.png\|~~600px~~\|Screenshot of the SQLInjection challenge succeeded]]		[[File:DefendTheWebNetSqlInjectionC.png\|400px\|Screenshot of the SQLInjection challenge succeeded]]

			== Alternatives ==

			=== Root Me ===
			The CTF platform [https://www.root-me.org Root Me] has established only two years after Defend The Web in 2010, but offers already more than 540 challenges. <ref name="rmchallenges"/>

			=== Hack The Box ===
			Another alternative is [https://www.hackthebox.com Hack The Box], which offers over 500 challenges <ref name="htbchallenges"/> but also attracts by doing community events all over the world. <ref name="htbcommunityevents"/>

	== References ==		== References ==
Line 60:		Line 68:
	<ref name="logo">https://www.facebook.com/defendtheweb/photos/a.163821580333961/2395529793829784/</ref>		<ref name="logo">https://www.facebook.com/defendtheweb/photos/a.163821580333961/2395529793829784/</ref>
	<ref name="chatworkaround">https://defendtheweb.net/discussion/83648-irc-chat</ref>		<ref name="chatworkaround">https://defendtheweb.net/discussion/83648-irc-chat</ref>
			<ref name="htbcommunityevents">https://www.hackthebox.com/events</ref>
			<ref name="rmchallenges">https://www.root-me.org/en/Challenges/</ref>
			<ref name="htbchallenges">https://www.hackthebox.com/about-us</ref>
	</references>		</references>

MBasta at 12:38, 6 January 2024

2024-01-06T12:38:58Z

← Older revision		Revision as of 12:38, 6 January 2024
Line 30:		Line 30:
	To show how the website works we will play one challenge from start to end. For this demonstration, we chose the challenge 'SQLi 1 / SQLi', which is a SQL injection CTF. As most challenges, we are facing a login screen with a short description of the objective. In this case we have to 'Gain access to any users account' by providing an username and a password or by exploiting the site. We can also observe that more than 19,000 users have completed this challenge and that only 52\% of the users that attempted this challenge have actually completed it.		To show how the website works we will play one challenge from start to end. For this demonstration, we chose the challenge 'SQLi 1 / SQLi', which is a SQL injection CTF. As most challenges, we are facing a login screen with a short description of the objective. In this case we have to 'Gain access to any users account' by providing an username and a password or by exploiting the site. We can also observe that more than 19,000 users have completed this challenge and that only 52\% of the users that attempted this challenge have actually completed it.

	[[File:DefendTheWebNetSqlInjectionA.png\|~~600px~~\|Screenshot of the SQLInjection challenge page showing username and password field]]		[[File:DefendTheWebNetSqlInjectionA.png\|800px\|Screenshot of the SQLInjection challenge page showing username and password field]]

	To solve this challenge we need some knowledge about SQL injections in general. Before frameworks made it easier and safer to write SQL statements, they were mostly written as strings and the variables were replaced by the script engine. This way an attacker could insert malicious symbols that change the way the query works. The following PHP code snippet uses unchecked user input and inserts it in a SQL query string.		To solve this challenge we need some knowledge about SQL injections in general. Before frameworks made it easier and safer to write SQL statements, they were mostly written as strings and the variables were replaced by the script engine. This way an attacker could insert malicious symbols that change the way the query works. The following PHP code snippet uses unchecked user input and inserts it in a SQL query string.
Line 48:		Line 48:
	</syntaxhighlight>		</syntaxhighlight>

			As we suspect a similar query to be used in the background of the challenge, we use ambiguous characters to get more information. Using the username "username" and the password "'" (a simple quote), we get back the error message "Syntax error: SELECT * FROM users WHERE username = 'user' AND password = '''". We can now see the used query and that the single quote invalidated it.

			[[File:DefendTheWebNetSqlInjectionB.png\|600px\|Screenshot of the SQLInjection challenge error page the failed execution as stated in the paragraph above]]

			For the exploit itself we can now use any username, as the script will not check this anyway after our changes, and the password "' OR 1=1;". The query will be rendered in the background to "SELECT * FROM users WHERE username = 'silvie' AND password = '' OR 1=1;'". The query now evaluates two parts, the one before the OR and the other after. The first one will probably fail because the user may not exist or even if it does, the password will probably not be empty. The second part will always be true, because 1 equals 1. The single quote at the end will be ignored, because we added a semicolon at the end that finishes the query.

			[[File:DefendTheWebNetSqlInjectionC.png\|600px\|Screenshot of the SQLInjection challenge succeeded]]

	== References ==		== References ==

MBasta at 12:32, 6 January 2024

2024-01-06T12:32:05Z

@@ Line 1: / Line 1: @@
-[[File:DefendTheWebNetLogo.png|thumb|Logo of DefendTheWeb.net]]
+[[File:DefendTheWebNetLogo.png|thumb|Logo of DefendTheWeb.net<ref name="logo"/>]]
 '''Defend The Web''' is a Capture the Flag Website that teaches topic about Cyber Security and offers users on-hand-training for their theoretical skills. A free account is needed to access every section of the website. This can be either done by registering a new one from scratch or by using one of the available Single Sign On Providers (SSO Providers) Twitter (aka X), Google or GitHub. After logging in, the user gets redirected to a dashboard that offers information about new content in the articles and community sections as well as the progress in solving CTFs and the user's current level. Every user can earn medals by finishing challenges, participating in the community, writing articles and other actions on the website.
@@ Line 11: / Line 11: @@
 * '''Hacking''' (21)
 * '''Privacy''' (2)
-* Encryption and Steganography (9)
+* Encryption and [https://en.wikipedia.org/wiki/Steganography Steganography] (9)
-* Lock Picking (2)
+* [https://en.wikipedia.org/wiki/Lock_picking Lock Picking] (2)
 * Network security (7)
-* Phreaking (1)
+* [https://en.wikipedia.org/wiki/Phreaking Phreaking] (1)
 * Talks / videos (11)
 * Miscellaneous (13)
 === Playground ===
-The Playground contains the challenges itself and provides the user with an overview of the next challenges and the ones that are already completed.
+When navigating to the playground, the user is greeted with a list of all levels as well as a recommendation of the next level that may suit the current experience level. The challenges can be filtered using 12 categories.
 === Community ===
-A forum and Chat function can be found in the community section as well as a function to exchange private messages between users.
+A forum and Chat function can be found in the community section as well as a function to exchange private messages between users. At the time of writing, the chat function was not working, but a workaround was mentioned in the forum. <ref name="chatworkaround"/>

MBasta at 11:56, 6 January 2024

2024-01-06T11:56:58Z

← Older revision		Revision as of 11:56, 6 January 2024
Line 3:		Line 3:

	== Overview ==		== Overview ==
			The landing page after logging in is the dashboard which consists of three main parts A) Articles, B) Playground and C) Community.

			=== Articles ===
			The article section consists of nine topics. Each article has a read time that depends on the length of the text as well as a counter of how many people have read it. The following list contains the topics and the number of articles within each topic at the time of writing. Topics in bold are directly accessible through the sidebar navigation within the dashboard.

			* '''Coding''' (11)
			* '''Hacking''' (21)
			* '''Privacy''' (2)
			* Encryption and Steganography (9)
			* Lock Picking (2)
			* Network security (7)
			* Phreaking (1)
			* Talks / videos (11)
			* Miscellaneous (13)

			=== Playground ===
			The Playground contains the challenges itself and provides the user with an overview of the next challenges and the ones that are already completed.

			=== Community ===
			A forum and Chat function can be found in the community section as well as a function to exchange private messages between users.

MBasta at 11:35, 6 January 2024

2024-01-06T11:35:22Z

← Older revision		Revision as of 11:35, 6 January 2024
Line 1:		Line 1:
	~~empty~~		[[File:DefendTheWebNetLogo.png\|thumb\|Logo of DefendTheWeb.net]]
			'''Defend The Web''' is a Capture the Flag Website that teaches topic about Cyber Security and offers users on-hand-training for their theoretical skills. A free account is needed to access every section of the website. This can be either done by registering a new one from scratch or by using one of the available Single Sign On Providers (SSO Providers) Twitter (aka X), Google or GitHub. After logging in, the user gets redirected to a dashboard that offers information about new content in the articles and community sections as well as the progress in solving CTFs and the user's current level. Every user can earn medals by finishing challenges, participating in the community, writing articles and other actions on the website.

			== Overview ==

MBasta: Create the page

2024-01-06T11:10:23Z

Create the page

New page

empty