By default, when the docker command is executed on a host, an API call to the docker daemon is made via a non-networked UNIX socket located at /var/run/docker.sock. This socket file is the main API to control any of the... Read more about The Danger of Exposing Docker.Sock
Running the challenge docker run -p 5050:80 -e SECRET_KEY="YourSecretKey" -e SITE_KEY="YourSiteKey" dejandayoff/nobots Using a browser, visit http://localhost:5050 (do not visit 127.0.0.1:5050, the domain must be localhost) The SECRETKEY and SITEKEY are required if you want to run the second challenge... Read more about NoBots - AppSec USA 2018 CTF Solution
Running the challenge All of the challenges in RCE Cornucopia is designed to run in docker. Each challenge runs in it’s own container to prevent one RCE affecting the stability of the other challenges. During a CTF, these containers were... Read more about RCE Cornucopia - AppSec USA 2018 CTF Solution
TL;DR Customers can utilize AWS' DNS infrastructure in VPCs (enabled by default). Traffic destined to the AmazonProvidedDNS is traffic bound for AWS management infrastructure and does not egress via the same network links as standard customer traffic and is not... Read more about Using DNS to Break Out of Isolated Networks in a AWS Cloud Environment
This year my colleagues and I hosted a CTF at AppSec USA in Orlando, Florida and CactusCon in Phoenix, Arizona. I developed two of the challenges for the CTF. In this post, I will give you the source code and... Read more about CactusCon and AppSec USA CTF Challenges and Walkthrough
I did a talk at CactusCon 2017 about HTTP Route Busting. Here is the slides if you would like a copy: HTTP Route Busting Apparently there were more questions that just didn’t load so I will get to them in... Read more about HTTP Route Busting
Commonly during pentests I might be stuck on getting a file over to a system with only a limited shell. To be honest, this problem has mostly occurred to me on Windows so the solutions below will all work on... Read more about 4 Ways to Transfer Files With a Limited Shell
On March 15th 2017 I received my Offensive Security Certified Professional (OSCP) Certificate. Well I guess I have yet to receive the physical certificate (they say it could take 60 days), but I have received confirmation that I have passed... Read more about OSCP Review - Felt the Pain and Suffered through it
This year our CTF team (Savage Submarine) took first place in CMD+CTRL at DEF CON 24! This is my review of the CTF challenges and scoreboard and the overall experience. I will not be providing any walkthroughs or answers since... Read more about CMD+CTRL CTF at DEF CON 24 Review
So, you’ve competed in the YoBlog Root-the-box challenge and you want to know the official answer? Well you’ve come to the right place! I am the creator of the YoBlog challenge and here is the official walkthrough. You can run... Read more about YoBlog CactusCon CTF Walkthrough
Natas 17 takes us back to Natas 15: Lets look at the source to see if we can find whats changed: <html> <head> <!-- This stuff in the header has nothing to do with the level --> <link rel="stylesheet" type="text/css"... Read more about Natas Level17 - Level18
Natas 16 looks similar to the earlier challenges where we were got to search for a word in a flat document. However this time it says "For security reasons, we now filter even more on certain characters": Lets open up... Read more about Natas Level16 - Level17
Natas 15 looks like it is going to be fun! When I first get to the page, I am greeted by a simple User name search: The page will then respond with: Lets take a look at the source: <html>... Read more about Natas Level15 - Level16
This looks intresting! I assume that when you login, that the password for the next challenge will be there: Lets look at the source: <html> <head> <!-- This stuff in the header has nothing to do with the level -->... Read more about Natas Level14 - Level15
Natas 13 looks very similar to natas12. Let look at the source to see if we can find any differences: <html> <head> <!-- This stuff in the header has nothing to do with the level --> <link rel="stylesheet" type="text/css" href="http://natas.labs.overthewire.org/css/level.css">... Read more about Natas Level13 - Level14
Natas12 seems to be a file upload page: Lets try it out with the image we got from natas2 <screemshot> If we follow the link we get the image we just uploaded. The URL tells me this is a php... Read more about Natas Level12 - Level13
Natas11 seems to be a new kind of challenge. Let look at what it does: Looks like you can change the background color. Just to try it lets change the background to black (#000000): Nothing vulnerable sticks out. Lets take... Read more about Natas Level11 - Level12
Natas10 looks exactly the same as natas9 except that it warns us that: For security reasons, we now filter on certain characters Intresting... Let's take a look at the source and see what they do differently: <html> <head> <!-- This... Read more about Natas Level10 - Level11
Natas9 looks like a new type of challenge. The only thing on the screen is a text box and a search button. To try it out, I searched for the string "test" and got the following output: And it looks... Read more about Natas Level9 - Level10
Looks like natas8 is another "secret input" challenge. We'll start by jumping right into the source code. <html> <head> <!-- This stuff in the header has nothing to do with the level --> <link rel="stylesheet" type="text/css" href="http://natas.labs.overthewire.org/css/level.css"> <link rel="stylesheet" href="http://natas.labs.overthewire.org/css/jquery-ui.css"... Read more about Natas Level8 - Level9
Natas7 contains only 2 links, Home and About. The Home page contains: and the About page contains: While clicking through it I noticed that the URL changes: This makes me think that I have to mess with the URL. A... Read more about Natas Level7 - Level8
Natas6 includes a text box for us to input a "secret" into. I assume if we enter in the proper secret, the password for natas7 will be outputted. I first tried to enter in some gibberish and see what I... Read more about Natas Level6 - Level7
Natas5 starts me out with another "Access Denied" page. To see what is going on, I decide to capture the requests. The first request I capture contains some interesting information: Looking at the Cookies header, I notice one of the... Read more about Natas Level5 - Level6
I was greeted to a "Access disallowed" page for natas4. However, they seem to give you a bit too much information: I noticed that the error says that I am coming from "". I assume they are using the HTTP... Read more about Natas Level4 - Level5
Looks like natas3 contains the same message as natas2: " There is nothing on this page " Again I start by inspecting the element. Instead of a picture, this time we get a hint in the HTML: This is obviously... Read more about Natas Level3 - Level4
The page says: "There is nothing on this page" hmmm... First I start with inspecting the element. I saw that there was a random image. Lets navigate to that image: As it says in the name, the image is just... Read more about Natas Level2 - Level3
The pages says: "You can find the password for the next level on this page, but rightclicking has been blocked!" However, in the version of Iceweasel that I am using it looks like that is not true: But to make... Read more about Natas Level1 - Level2
Login into http://natas0.natas.labs.overthewire.org/ with the username and pass found on the home page: Username: natas0 Password: natas0 All I had to do was view the source and the username and password was right there: Answer: gtVrDuiDfck831PqWsLEZy5gyDz1clto Read more about Natas Level0 - Level1