A getting started guide for defensive coding and ethical hacking.
Newbie guide to ethical hacking.
Monterey Bay Aquarium

ellievsbear

romaâ
occasionally subtle
he wasn't even looking at me and he found me
"I'm Dorothy Gale from Kansas"
đŞź

tannertan36
tumblr dot com
we're not kids anymore.
Claire Keane
ojovivo
Jules of Nature
No title available
PUT YOUR BEARD IN MY MOUTH
taylor price
I'd rather be in outer space đ¸

Origami Around
hello vonnie
Misplaced Lens Cap

seen from Hong Kong SAR China
seen from Canada
seen from United Kingdom
seen from United States

seen from United States

seen from United States
seen from Malaysia

seen from United States
seen from Venezuela

seen from Argentina

seen from United States
seen from United States
seen from Japan

seen from Indonesia
seen from United States

seen from United States

seen from Germany
seen from Australia

seen from United States
seen from China
@informationsecurityjourney
A getting started guide for defensive coding and ethical hacking.
Newbie guide to ethical hacking.
Crowdsourced security solutions. Bugcrowd delivers fully managed bug bounties on on all-in-one vulnerability disclosure platform powered by the worldâs largest crowd of security researchers.
Platform where companies can post rewards for bug hunters to uncover vulnerabilities.
Over 2016 and 2017, we will be releasing a sequence of publicly available courses in cyber security, under the banner of the sec.edu 'Security Engineeri...
Online Security Engineering course by UNSW Australia.
The best defense against hackers is a well-informed development team. Our interactive exercises can teach your team about today's most common security vulnerabilities.
Interactive website to learn:
SQL Injection
Clickjacking
Session Fixation
Cross-Site Scripting
Weak Session IDs
Reflected XSS
Dom-Based XSS
Cross-Site Request Forgery
File Upload Vulnerability
XML Bombs
Open Directs
User Enumeration
Broken Access Control
Unencrypted Communication
XML External Entities
Information Leakage
Password Mismanagement
Privilege Escalation
 Command Execution
Directory Traversal
n00bz Level 7
In level 7, we get a page with error 404 - page not found, with the following text:Â
âf00 not found Something is not right here??? btw...bounty $70âł
Interestingly, the page is named 404.php, which also correspond to the hint that it should be in the http header. Remembering that the previous page naming follows the flow âlevelone.phpâ ... âlevelsix.phpâ, we decided to try our luck with changing "404.phpâ to âlevelseven.phpâ. By checking the http header, we get the following text âaW5mb3NlY19mbGFnaXNfeW91Zm91bmRpdA==â. Again, double equals means its a base64 decode. Decoding it, we get â infosec_flagis_youfounditâ.
n00bz Level 6
Level 6 ask us to download sharkfin.pcap which means it is probably some network traffic that we have to analyse. The filename - sharkfin - hinted that we may need to use wireshark to analyse the file. Â
These are the following steps i like to do when i have a pcap file:
statistics --> captured file properties
file --> export objects --> httpÂ
right click follow --> TCP/UDP stream
By following UDP stream 0, we get the following â696e666f7365635f666c616769735f736e6966666564âł which is a hexadecimal. Through conversion, we get âinfosec_flagis_sniffedâ.
n00bz Level 5
For level 5, we get a page with an infinite pop-up that says âhacker!!â.
After disabling the pop-up, we inspect the source and found a hidden image - aliens.jpg.
With an image, we would like to run it through a steganography decoder. Many recommend steghide, but we used an online tool, and we get the following output â01101001011011100110011001101111011100110110010101100011010111110110011001101100011000010110011101101001011100110101111101110011011101000110010101100111011000010110110001101001011001010110111001110011âł. This is clearly a binary code, and we decode it to get âinfosec_flagis_stegaliensâ.
n00bz Level 4
For a bounty of $40, level 4 shows a very cute cookie monster image with the text âHTTP means Hypertext Transfer Protocolâ. On hovering the image, it gives a pop-up text âstop poking meâ.
Combining HTTP and cookie monster, the hint is probably to look at the cookie of the page.Â
The only thing that stands out is this fusrodah which is a move used in a game - skyrim. This seems like a sort of string that is decrypted. We tried our luck with ROT13 and got âINFOSEC_FLAGIS_WELOVECOOKIESâ. There we have it~ :)
n00bz Level 3
In level 3, we see a QR code with a progress bar for a bounty of $30.Â
At first thought, the hint to where the flag is hidden would be inside the QR code. However, we were sidetracked by the progress bar after getting negative results from running the QR code through a conventional QR code scanner. Big mistake! :X After checking the progress bar, it seems to be a distraction with nothing unusual.Â
We decided to read up a little on the workings of QR code, and figure out to use a QR code decoder instead. Viola! It return us a raw text â.. -. ..-. --- ... . -.-. ..-. .-.. .- --. .. ... -- --- .-. ... .. -. --.â which is actually a string written in morse code. Running through a morse code translator, we get âINFOSECFLAGISMORSINGâ.
n00bz Level 2
In this level, we see a broken image with accompany text âIt seems like the image is broken..can you check the file?â.
By opening the image in a new tab, it displays the image in this link.Â
Since it donât seem like a valid image, we downloaded the image and open it in a text editor, and find the string âaW5mb3NlY19mbGFnaXNfd2VhcmVqdXN0c3RhcnRpbmc=â. Since there is a â=â tagged to the end of the string, it is most likely a base64 encoding. Going through a base64 decoder, it gives us the flag âinfosec_flagis_wearejuststartingâ.
n00bz Level 1
When we first enter level 1, it shows us a yoda with the following text âMay the source be with you!â.
The hint in this case, is to simply look at the page source.Â
There we have it, the flag is âinfosec_flagis_welcomeâ.
A list of publicly available pcap files / network traces that can be downloaded for free
Compiled list of pcap files mainly used for CTF.
Compiled list of sample pcap files.
Infosec Institute CTF
Infosec Institute provides an entry-level CTF for beginners to learn and play.Â
The first one is n00bz while the second is Practical Web Hacking. In the next few posts, i will be writing on the methods I used to solve the exercises. Regardless, these are some of the sample writeups to the exercises that fellow players have shared:
1. http://resources.infosecinstitute.com/n00bs-ctf-labs-solutions/#article
2. http://cmattoon.com/infosec-institute-ctf-level-4/
3. http://kectf.blogspot.sg/2015/03/n00bs-ctf-labs.html
4. http://shellnux.in/2015/03/level-6/
CTF or Capture the Flag is a traditional competition or war game in any hacker conferences like DEFCON, ROOTCON, HITB and some hackathons. CTF games are us
Compiled resources of tools to download for the respective analysis of vulnerabilities and the different sources of CTF available.