Launched an updated version of the website. The previous version was version 5 which used custom HTML along with Hugo Go generated HTML. The transition to Version 5 happened in 2018.

Version 6

I’ve recently been encourgaed to go back to blogging and felt it was time to move to pure Hugo. Hence, the birth of version 6. Version 6 is purely Hugo Go generated and used the BeautifulHugo theme.

Previous posts were also migrated over from version 5 of the blogs section which were initially deployed using Google Blogger. Version 6 is a huge jump from the last post about 5-years ago.

Damn Vulnerable Web Application (DVWA)

DVWA is a web application which uses PHP and MySQL and implements a number of common web application vulnerabilities. For more information visit http://www.dvwa.co.uk/ and https://github.com/digininja/DVWA.

Installation - vagrant up

Using the Vagrantfile in the penetration testing lab directory in the git repo at https://github.com/kushfj/pentesting, spin up a DVWA VM in virtual box.

The virtual machines has two virtual network adapters, the first adapter is connected to the default NAT network. The NAT network is required during the initial setup to download and install updates and packages. The second adapter is connected the default intnet internal network. The intnet internal network is used for the penetration testing. Note, you must disable or disconnect the NAT interface as soon as the machine is ready.

Sorted all challenges by difficult so that I could attempt and learn from the easier ones.

Easy

Misc

Practice Flag - 20pts

Try inputting the flag: flag{CTFLearn_is_awesome}

• Submitted: CTFLearn{CTFLearn_is_awesome}

Wikipedia - 30pts

Not much to go off here, but it�s all you need: Wikipedia and 128.125.52.138.

• Navigated to wikipedia site https://www.wikipedia.org/
• Searched for 128.125.52.138 and found page on Flag. Searched within page for CTF and found reference to CTF flgs
• Submitted: CTFlearn{cNi76bV2IVERlh97hP}

QR Code - 30pts

Do you remember something known as QR Code? Simple. Here for you :
https://mega.nz/#!eGYlFa5Z!8mbiqg3kosk93qJCP-DBxIilHH2rf7iIVY-kpwyrx-0

Misc Challenges

This blog page is for the Misc challenges on the CTF page and is likely to be updated as the new challenges are added to the CTF.

WARNING: Like all my CTF notes, this contains spoilers.

Chuck Norris - 30pts

It’s Chuck Norris

flag syntax: flag{insertflaghere}

• Downloaded the chuck.pcap file from https://ctf.qutwhitehats.club/files/06159f05f2fec53ca602559bf422cd30/chuck.pcap?token=eyJ1c2VyX2lkIjoxMCwidGVhbV9pZCI6bnVsbCwiZmlsZV9pZCI6Mn0.XosP0g.C-a6_prdNYuWZMKwJ_KZHrF7UE4
• Opened the file in wireshark
• Manually reviewed the conversations, Statistics -> Conversations
• Noticed single conversation with internal host 10.0.85.10, all other conversations were to external hosts, i.e. not the reversed ranged
• Applied as filter ip.addr==10.0.75.102 && ip.addr==10.0.85.10
• Manually reviewed the HTTP response data
• Found: Hey this is a flag FLAG-GehFMsqCeNvof5szVpB2Dmjx
• Submitted: flag{FLAG-GehFMsqCeNvof5szVpB2Dmjx}

Mr_Elliot - 100pts

Bonsoir Elliot

Introduction

0x03 Shells session presented by the UQ Cyber Squad. Access via OpenVPN connection. OpenVPN configuration bundle provided during the workshop.

Challenge 1 - Family Binding Time - 10pts

Let’s bind together at 192.168.57.11:8297

nc 192.168.57.11 8297
id
uid=1002(user) gid=1002(user) groups=1002(user)
pwd
/home/user
ls -las
total 60
 4 drwxr-xr-x 3 user    user  4096 Mar 27 06:02 .
 4 drwxr-xr-x 4 root    root  4096 Mar 24 02:13 ..
 4 -rw------- 1 user    user  1584 Mar 26 01:26 .bash_history
 4 -rw------- 1 user    user   105 Mar 26 00:50 .lesshst
 4 -rw------- 1 user    user     5 Mar 24 03:38 .python_history
 4 drwxr-xr-x 2 user    user  4096 Mar 26 00:59 .ssh
 8 -rw------- 1 user    user  5066 Mar 27 06:01 .viminfo
 4 -r-xr-xr-x 1 root    user   892 Mar 27 06:02 init_shell.py
20 -rwsr-xr-x 1 richard root 16728 Mar 26 00:54 read_secret_message
 4 -rw-r--r-- 1 user    user    24 Mar 24 02:14 user.txt
cat user.txt	
flag{n1c3_b0nd1ng_t1m3}

Challenge 2 - shhhhhhhh - 20pts

How do I ssshhhhh? How do I know how to?

Introduction

This is a second (recommended) in series of Over the Wire CTF, hosted at https://overthewire.org/wargames/natas/. The series is focused on basic server-side security of web applications. The challenges are accessible as web URLs via http://natasX.natas.labs.overthewire.org, where X is the level number.

WARNING: These are my own notes and contain actual flags.

Natas Level 0

Username: natas0 Password: natas0 URL: http://natas0.natas.labs.overthewire.org

Walkthrough

curl -n -u natas0:natas0 http://natas0.natas.labs.overthewire.org/
<html>
<head>
<!-- This stuff in the header has nothing to do with the level -->
<link rel="stylesheet" type="text/css" href="http://natas.labs.overthewire.org/css/level.css">
<link rel="stylesheet" href="http://natas.labs.overthewire.org/css/jquery-ui.css" />
<link rel="stylesheet" href="http://natas.labs.overthewire.org/css/wechall.css" />
<script src="http://natas.labs.overthewire.org/js/jquery-1.9.1.js"></script>
<script src="http://natas.labs.overthewire.org/js/jquery-ui.js"></script>
<script src=http://natas.labs.overthewire.org/js/wechall-data.js></script><script src="http://natas.labs.overthewire.org/js/wechall.js"></script>
<script>var wechallinfo = { "level": "natas0", "pass": "natas0" };</script></head>
<body>
<h1>natas0</h1>
<div id="content">
You can find the password for the next level on this page.

<!--The password for natas1 is gtVrDuiDfck831PqWsLEZy5gyDz1clto -->
</div>
</body>
</html>

Natas Level 0 ? Level 1

Username: natas1 URL: http://natas1.natas.labs.overthewire.org

Introduction

Details about the challenges may be found at https://overthewire.org/wargames/bandit/. The game is played over SSH over port 2220 so firewalls may need to be adjusted to allow outbound traffic to connect to the game. The game has 34 levels. The levels are chained, so that to get to the next level you need to complete/finish/beat the previous level.

WARNING: These are my own notes and contain actual flags.

Bandit Level 0

Level Goal

The goal of this level is for you to log into the game using SSH. The host to which you need to connect is bandit.labs.overthewire.org, on port 2220. The username is bandit0 and the password is bandit0. Once logged in, go to the Level 1 page to find out how to beat Level 1.

Introduction

Found the UQ Cyber Squad site at https://cybersquad.uqcloud.net/index.html. Signed up for their CTF on https://ctf.uqcloud.net/

0x01 Introduction to Linux

This was identical to the QUT Whitehats Week 2 for challenges 1 through to 8. The writeup was already done at https://kush.com.fj/blog/posts/2020-02-28_qut_wh_wk2/.

No place like index.html - 10pts

There’s no clues or hints for this but it was pretty obvious.

• Navigated to https://cybersquad.uqcloud.net/index.html
• Manually reviewed the page source and searched for flag
• Found flag on line #30 of the source
• Submitted: flag{w0ah_n1c3_f1nd}

Machines

The machines challenges were named machines because they provided virtual machines for a traditional boot-to-root.

Introduction

Hacker101 CTF seems to be a new CTF setup by HackerOne, the bug bountry program. Flag formats are meant to be similar to ^FLAG^37ae568362f974017fa575f08cd215044cd6bb395c3f5e5e293ee5324ba6769c$FLAG$. Requires a HackerOne account to login. Additional instruction can be found at https://docs.hackerone.com/hackers/hacker101.html.

The challenge difficulty ranking is done using trivial, easy, moderate, hard, and expert. Points are allocated according to difficulty and range from 1 point for trivial to 9 points for expert. Each challeneg may have multiple flag indicated by the completion. The minimum number of flags per challenge was 1, with a maximum of 7 for the Postbook challenge.

Week_3

WARNING: Like all my CTF notes, this contains spoilers.

3x01 - 10pts

https://crypto.qutwhitehats.club/ch1

For simplicity sake, to be able to easily attempt this weeks challenges, please navigate to: https://www.katacoda.com/0xollie/scenarios/0x01 sign up/sign in and click onto the terminal.

INPUT: apt install httpie -y wait approx 1 minute for it to install.

obtain ciphertext by running the following command: http get https://crypto.qutwhitehats.club/ch1

To input an answer run the following command: http post https://crypto.qutwhitehats.club/ch1 answer=“answerhere”