5 ms·

Pwn.college

339 points by throwaway_7718 7y ago

saagarjha 7y ago
Great work, Yan and Connor! It's interesting that the solutions are not made publicly available. Is this intended towards educators to use in their cybersecurity classes?
joshschreuder 7y ago
See also: - Wechall - OverTheWire - SmashTheStack.org - CryptoPals.com - Google Gruyere appspot
- cjbprime 7y ago
  And: - https://pwnable.tw https://pwnable.tw - https://pwnable.xyz https://pwnable.xyz
  - saagarjha 7y ago
    https://microcorruption.com/ https://microcorruption.com/ is also quite fun!
- travmatt 7y ago
  I've been working through https://guyinatuxedo.github.io/ https://guyinatuxedo.github.io/ while reading "The Shellcoder's Handbook" and Sam Bowne's class notes (https://samsclass.info/127/127_F19.shtml https://samsclass.info/127/127_F19.shtml). Highly recommended
- strictfp 7y ago
  http://www.try2hack.nl/ http://www.try2hack.nl/
- larsnystrom 7y ago
  In my youth I learnt a thing or two from hackthissite.org.
- thde 7y ago
  And https://www.hacking-lab.com/ https://www.hacking-lab.com/
- hakmad 7y ago
  And: https://github.com/zardus/wargame-nexus https://github.com/zardus/wargame-nexus
deevnullx 7y ago
Great job getting this in front of people as soon as possible, this is a very polished product for a beta. Nothing worse than sitting on something waiting for it to be perfect or "complete". Excited to see where you go with this!
numlock86 7y ago
Looking forward to the collection of modules. Right now I'd say it's a bit too linux centric. Especially when it comes to bringing cypersecurity concepts to new people I think it's usually better to start with basic stuff like SQL injection ('bobby tables') or ARP spoofing. They even state it's aimed at white belts, yet have slides about the different rings in a linux kernel. But maybe that's just my perception. Great anyway!
- saagarjha 7y ago
  CTF exploiting challenges tend to be overwhelmingly biased towards Linux, so I'm sure this is just a reflection of that.
- bashwizard 7y ago
  A beginner in offensive cyber security/infosec is better off learning Burp and common web app vulnerabilities. In my opinion that is.
  - numlock86 7y ago
    That's exactly my point, yes.
gyanchawdhary 7y ago
Check out: https://blog.ret2.io/2018/09/11/scalable-security-education/ https://blog.ret2.io/2018/09/11/scalable-security-education/ These guys have built an epic b0f research education platform - could be also sold as a cloud-based research platform for vuln developers Another one is https://www.youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w/videos https://www.youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w/vid... for mostly C/C++ overflow type education
- movedx 7y ago
  > could be also sold as a cloud-based research platform for vuln developers You'd have a tough time getting any public Cloud provider to allow you to run known vulnerable software, on purpose, on their network and then exposing it to the Internet. If you kept it under a decent amount of network security and heavily restricted access it might work. I would suspect you'd need permission to set this up, though.
  - gyanchawdhary 7y ago
    True. I think the biggest buyer of this would be gov institutions that are constantly looking for building their offensive capabilities (mainly around exploit dev) but find it hard to get new recruits trained up. The alternatives are mostly instructor-led training which is good but combined with this type of platform + remote assistance via chat etc could scale things up.
    - movedx 7y ago
      Yeah. I'm just in the beginning phases of learning pen testing. I want to move from DevOps to DevSecOps to PT. I'm keen to see what labs exist out there already and how I can build my own complex labs (consisting of complete virtual networks) that I can hack against. A real wargame.
badrabbit 7y ago
Another software exploit thing that appears to be entirely Linux centered. Nothing against it but this doesn't even touch "core cybersecurity concepts". As crappy as it is, a security+ will teach you more infosec than knowing how to write kernel rootkits and create rop gadgets in your sleep. Case in point: most "advanced" attackers (except the "equation group" lol) very very rarely use a zero day, A majority of attacks by these guys does not even see new exploits out of known public vulns. As easy and comfy as Linux is to hacker, try doing this in Windows land. You will gain a broader perspective. Just my $0.02c ,I am still glad to see more content like this.
- gyanchawdhary 7y ago
  spot on !!
- TACIXAT 7y ago
  We must have a different definition of advanced attackers because I can think of numerous countries that use zero days. A handful more that use COTS malware (i.e. NSO) that employs zero days.
  - stedaniels 7y ago
    There are far more advanced hacking groups than there are nation states. There are likely more criminal hacking groups in each individual country than there are nation states.
    - TACIXAT 7y ago
      There are many criminal groups, but few are advanced. It takes investment and large teams to get full chain zero days. Most criminal groups will implement n days, but they are not coming up with Eternal Blue, you know? They are just grabbing it and hitting unpatched machines. It is skilled for sure, but it is not my definition of advanced threats. If you have some examples of criminal groups using zero days in hard targets, I'm very interested. From what I see, no one's mobile phones are getting hit with ransomware via fresh vulns. That behavior is generally reserved for nation states with the ability (financial and legal) to purchase the exploits.
_JC_Denton 7y ago
Cool stuff. Does anyone know of a similar program for web security?
- kdbg 7y ago
  Not exactly the same but https://portswigger.net/web-security https://portswigger.net/web-security has several good lessons and labs about specific attacks.
thenewnewguy 7y ago
Cannot connect to https://pwn.college/ https://pwn.college/ (only works on HTTPS with www subdomain) - somewhat of a problem for sharing this website.
earenndil 7y ago
Ironically, a website centred around security doesn't support ed25519 ssh keys.
fybe 7y ago
Looks good but if I may add a suggestion is to remove the slides from google docs. Maybe let us download them locally? 1. Corp VPN's will block google docs very regularly 2. Some people refuse to use google services 3. It shouldn't take you to a different domain to read the learning material
toyg 7y ago
Gotta be a bit less cheap and solve your ssl problems if you want people to take you seriously when it comes to security... Use cloudflare or routepath.app.
timwis 7y ago
This is awesome. I’d definitely watch the videos!!

Great work, Yan and Connor! It's interesting that the solutions are not made publicly available. Is this intended towards educators to use in their cybersecurity classes?

joshschreuder 7y ago

See also: - Wechall - OverTheWire - SmashTheStack.org - CryptoPals.com - Google Gruyere appspot

cjbprime 7y ago
And: - https://pwnable.tw https://pwnable.tw - https://pwnable.xyz https://pwnable.xyz
- saagarjha 7y ago
  https://microcorruption.com/ https://microcorruption.com/ is also quite fun!
travmatt 7y ago
I've been working through https://guyinatuxedo.github.io/ https://guyinatuxedo.github.io/ while reading "The Shellcoder's Handbook" and Sam Bowne's class notes (https://samsclass.info/127/127_F19.shtml https://samsclass.info/127/127_F19.shtml). Highly recommended
strictfp 7y ago
http://www.try2hack.nl/ http://www.try2hack.nl/
larsnystrom 7y ago
In my youth I learnt a thing or two from hackthissite.org.
thde 7y ago
And https://www.hacking-lab.com/ https://www.hacking-lab.com/
hakmad 7y ago
And: https://github.com/zardus/wargame-nexus https://github.com/zardus/wargame-nexus

deevnullx 7y ago

Great job getting this in front of people as soon as possible, this is a very polished product for a beta. Nothing worse than sitting on something waiting for it to be perfect or "complete". Excited to see where you go with this!

numlock86 7y ago

Looking forward to the collection of modules. Right now I'd say it's a bit too linux centric. Especially when it comes to bringing cypersecurity concepts to new people I think it's usually better to start with basic stuff like SQL injection ('bobby tables') or ARP spoofing. They even state it's aimed at white belts, yet have slides about the different rings in a linux kernel. But maybe that's just my perception. Great anyway!

saagarjha 7y ago
CTF exploiting challenges tend to be overwhelmingly biased towards Linux, so I'm sure this is just a reflection of that.
bashwizard 7y ago
A beginner in offensive cyber security/infosec is better off learning Burp and common web app vulnerabilities. In my opinion that is.
- numlock86 7y ago
  That's exactly my point, yes.

gyanchawdhary 7y ago

Check out: https://blog.ret2.io/2018/09/11/scalable-security-education/ https://blog.ret2.io/2018/09/11/scalable-security-education/ These guys have built an epic b0f research education platform - could be also sold as a cloud-based research platform for vuln developers Another one is https://www.youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w/videos https://www.youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w/vid... for mostly C/C++ overflow type education

movedx 7y ago
> could be also sold as a cloud-based research platform for vuln developers You'd have a tough time getting any public Cloud provider to allow you to run known vulnerable software, on purpose, on their network and then exposing it to the Internet. If you kept it under a decent amount of network security and heavily restricted access it might work. I would suspect you'd need permission to set this up, though.
- gyanchawdhary 7y ago
  True. I think the biggest buyer of this would be gov institutions that are constantly looking for building their offensive capabilities (mainly around exploit dev) but find it hard to get new recruits trained up. The alternatives are mostly instructor-led training which is good but combined with this type of platform + remote assistance via chat etc could scale things up.
  - movedx 7y ago
    Yeah. I'm just in the beginning phases of learning pen testing. I want to move from DevOps to DevSecOps to PT. I'm keen to see what labs exist out there already and how I can build my own complex labs (consisting of complete virtual networks) that I can hack against. A real wargame.

badrabbit 7y ago

Another software exploit thing that appears to be entirely Linux centered. Nothing against it but this doesn't even touch "core cybersecurity concepts". As crappy as it is, a security+ will teach you more infosec than knowing how to write kernel rootkits and create rop gadgets in your sleep. Case in point: most "advanced" attackers (except the "equation group" lol) very very rarely use a zero day, A majority of attacks by these guys does not even see new exploits out of known public vulns. As easy and comfy as Linux is to hacker, try doing this in Windows land. You will gain a broader perspective. Just my $0.02c ,I am still glad to see more content like this.

gyanchawdhary 7y ago
spot on !!
TACIXAT 7y ago
We must have a different definition of advanced attackers because I can think of numerous countries that use zero days. A handful more that use COTS malware (i.e. NSO) that employs zero days.
- stedaniels 7y ago
  There are far more advanced hacking groups than there are nation states. There are likely more criminal hacking groups in each individual country than there are nation states.
  - TACIXAT 7y ago
    There are many criminal groups, but few are advanced. It takes investment and large teams to get full chain zero days. Most criminal groups will implement n days, but they are not coming up with Eternal Blue, you know? They are just grabbing it and hitting unpatched machines. It is skilled for sure, but it is not my definition of advanced threats. If you have some examples of criminal groups using zero days in hard targets, I'm very interested. From what I see, no one's mobile phones are getting hit with ransomware via fresh vulns. That behavior is generally reserved for nation states with the ability (financial and legal) to purchase the exploits.

_JC_Denton 7y ago

Cool stuff. Does anyone know of a similar program for web security?

kdbg 7y ago
Not exactly the same but https://portswigger.net/web-security https://portswigger.net/web-security has several good lessons and labs about specific attacks.

thenewnewguy 7y ago

Cannot connect to https://pwn.college/ https://pwn.college/ (only works on HTTPS with www subdomain) - somewhat of a problem for sharing this website.

earenndil 7y ago

Ironically, a website centred around security doesn't support ed25519 ssh keys.

fybe 7y ago

Looks good but if I may add a suggestion is to remove the slides from google docs. Maybe let us download them locally? 1. Corp VPN's will block google docs very regularly 2. Some people refuse to use google services 3. It shouldn't take you to a different domain to read the learning material

toyg 7y ago

Gotta be a bit less cheap and solve your ssl problems if you want people to take you seriously when it comes to security... Use cloudflare or routepath.app.

timwis 7y ago

This is awesome. I’d definitely watch the videos!!