3 ms·

Thanks for putting this together. Was very educational working through each level (and felt great to capture the flag). Loved that it was spread out across node

Thanks for putting this together. Was very educational working through each level (and felt great to capture the flag). Loved that it was spread out across node.js/python/ruby/php/javascript. Were any unexpected security vulnerabilities found (or patched mid-game by you) in the overall infrastructure? Not sure if this was intentionally left open-ended but for example in Level 6 I exploited a Ruby session/cookie bug to gain access to the target user, before realizing that the easier way was just a simpler JavaScript XSS vulnerability.

timo614 14y ago
There was an issue where a user could steal the nickname of other users. https://twitter.com/homakov/status/239061158043213824 https://twitter.com/homakov/status/239061158043213824 https://twitter.com/homakov/status/239107933290520576 https://twitter.com/homakov/status/239107933290520576 It looks like homakov had a little fun with it (the guy who griefed github a bit half a year ago with their whitelisted attributes vulnerability and got the rails core team to put whitelisting on by default).
gdb 14y ago
There were a few unintentional vulnerabilities in the levels. Only one actually made the levels significantly easy enough that it was worth patching -- namely, the session cookie bug you reference (it actually affected three levels). There was also a bug in the CTF architecture where you could set your user's URL to a javascript: URL. But to my knowledge no one has found vulnerabilities in the rest of the infrastructure :).
- ryan-c 14y ago
  I was one of the ones who went through those three levels with the session cookie bug. How many people reported it? Do you have a problem with me posting a write-up on the bug somewhere (now that it's fixed)?
  - gdb 14y ago
    We fixed it as soon as it was reported, and have probably gotten four or five independent reports at this point. Feel free to post away!
  - qwertyz 14y ago
    I also used that bug for the three levels. At that time I was more concerned in catching up (I started late) and the thought of it being an unintentional bug never crossed my mind. Though hours later I thought it was a bit strange that all three levels had to be solved in a similar way.
  - brown9-2 14y ago
    I'd love to read a write-up of this bug if you get a chance.
- scoot 14y ago
  And the ruby regex newline vulnerability that featured in one of the later XSS levels was also present in an earlier level, but wasn't necessary for the intended vector, so I wondered if it was an unintentional oversight, or left as an alternate exploit, or just a red-herring? (being intentionally vague so as not to spoil it for anyone...)
  - gdb 14y ago
    Actually, it wasn't supposed to be there in any of the levels :).
- borski 14y ago
  There was the unintended XSS on level02 - granted, you could only XSS yourself, but having a space in the filename you could inject whatever you wanted. :)

timo614 14y ago

There was an issue where a user could steal the nickname of other users. https://twitter.com/homakov/status/239061158043213824 https://twitter.com/homakov/status/239061158043213824 https://twitter.com/homakov/status/239107933290520576 https://twitter.com/homakov/status/239107933290520576 It looks like homakov had a little fun with it (the guy who griefed github a bit half a year ago with their whitelisted attributes vulnerability and got the rails core team to put whitelisting on by default).

gdb 14y ago

There were a few unintentional vulnerabilities in the levels. Only one actually made the levels significantly easy enough that it was worth patching -- namely, the session cookie bug you reference (it actually affected three levels). There was also a bug in the CTF architecture where you could set your user's URL to a javascript: URL. But to my knowledge no one has found vulnerabilities in the rest of the infrastructure :).

ryan-c 14y ago
I was one of the ones who went through those three levels with the session cookie bug. How many people reported it? Do you have a problem with me posting a write-up on the bug somewhere (now that it's fixed)?
- gdb 14y ago
  We fixed it as soon as it was reported, and have probably gotten four or five independent reports at this point. Feel free to post away!
- qwertyz 14y ago
  I also used that bug for the three levels. At that time I was more concerned in catching up (I started late) and the thought of it being an unintentional bug never crossed my mind. Though hours later I thought it was a bit strange that all three levels had to be solved in a similar way.
- brown9-2 14y ago
  I'd love to read a write-up of this bug if you get a chance.
scoot 14y ago
And the ruby regex newline vulnerability that featured in one of the later XSS levels was also present in an earlier level, but wasn't necessary for the intended vector, so I wondered if it was an unintentional oversight, or left as an alternate exploit, or just a red-herring? (being intentionally vague so as not to spoil it for anyone...)
- gdb 14y ago
  Actually, it wasn't supposed to be there in any of the levels :).
borski 14y ago
There was the unintended XSS on level02 - granted, you could only XSS yourself, but having a space in the filename you could inject whatever you wanted. :)