3 ms·

Over the Wire [0] is also great if you're curious about this sort of thing. The webapp challenges became one of my initial exposures to SQL -- as well as to inj

Over the Wire [0] is also great if you're curious about this sort of thing. The webapp challenges became one of my initial exposures to SQL -- as well as to injections as a concept -- and later became the basis for a whole rabbit hole on Web scraping that I haven't fully gotten out of haha The CLI ones are also how I learned (among other things) to run single commands over ssh, which I ended up needing to kill stuck browser processes on my dev box at a previous job. Hilariously, I ran across this (as well as a reason to use it) a week after a boss of mine told me it wasn't an effective use of my off time There's a tip-of-my-tongue one I keep hoping would crop up again here, but I haven't been able to find since: it was something about a site that showed example exploits inspired by high-profile breaches that happened IRL. It's unfortunate, bc that sounded fascinating [0] https://overthewire.org/ https://overthewire.org/

lknuth 2y ago
This perhaps? https://application.security/free/owasp-top-10 https://application.security/free/owasp-top-10
- chaosharmonic 2y ago
  Not quite, it was less just about common vulns and more inclusive of context for where you might have heard about them in the news, even as a layperson. Details like, say, "this technique was used in the Equifax hack"
michaelmdresser 2y ago
Over the Wire's "Bandit" game was my tool of choice for teaching the introduction to shell for my university's Cybersecurity Club a few semesters in a row. It didn't feel like a chore because of the gamification and the go-your-own-pace approach -- the hints are also a nice touch. I highly recommend it to build some shell muscles and maybe learn something you didn't already know. For something more advanced with less help available, I recommend Hack The Box [1] which frequently rotates challenge "boxes" with new combinations of configuration and vulnerability. I haven't touched it in a few years, so take that with a grain of salt. It used to be the case that you had to "hack" the website (very easy) in order to sign up for an account, but it appears that that may no longer be the case :( [1] https://www.hackthebox.com/ https://www.hackthebox.com/

lknuth 2y ago

This perhaps? https://application.security/free/owasp-top-10 https://application.security/free/owasp-top-10

chaosharmonic 2y ago
Not quite, it was less just about common vulns and more inclusive of context for where you might have heard about them in the news, even as a layperson. Details like, say, "this technique was used in the Equifax hack"

michaelmdresser 2y ago

Over the Wire's "Bandit" game was my tool of choice for teaching the introduction to shell for my university's Cybersecurity Club a few semesters in a row. It didn't feel like a chore because of the gamification and the go-your-own-pace approach -- the hints are also a nice touch. I highly recommend it to build some shell muscles and maybe learn something you didn't already know. For something more advanced with less help available, I recommend Hack The Box [1] which frequently rotates challenge "boxes" with new combinations of configuration and vulnerability. I haven't touched it in a few years, so take that with a grain of salt. It used to be the case that you had to "hack" the website (very easy) in order to sign up for an account, but it appears that that may no longer be the case :( [1] https://www.hackthebox.com/ https://www.hackthebox.com/