Recent Discussions
Why I don't like: Find the Flaw
After done almost all "Find the Flaw" labs I'm trying to give a feedback about this mode. On one hand it's quite handy and nice, to see and define flaws and link them to the corresponding CWE. But sometimes it takes time... very long time (for 20 pts!). Here's an example, I want to share which I'm struggling with and which does not makes sense for me - and there are many FtF labs like this which are forcing me to do try and error. Let's take "Find the Flaw: Rust – Identification and Authentication Failures". You'll have a code like (for brevity I've shortend it a little bit): ... #[derive(Deserialize)] struct PasswordForm { token: String, password: String, } #[derive(Deserialize)] struct UserIdQuery { user_id: String, } async fn reset_password( Query(user_id_query): Query<UserIdQuery>, pool: axum::extract::Extension<SqlitePool>, Form(form): Form<PasswordForm>, ) -> Html<String> { let user_id = user_id_query.user_id; let token = form.token; let password = form.password; if password.len() < 8 || !password.chars().any(|c| c.is_lowercase()) { return Html("Password must be at least 8 characters long and contain at least one lowercase letter.".to_string()); } let hashed_password = sha256(password.as_bytes()); let hashed_password_hex = hex::encode(hashed_password); let pool = pool.0; let result = query("SELECT user_id FROM password_resets WHERE token = ?").bind(token) .fetch_optional(&pool) .await; match result { Ok(Some(_)) => { let update_result = query( "UPDATE users SET password = ? WHERE id = ?") .bind(hashed_password_hex) .bind(user_id) .execute(&pool) .await; ... } pub async fn main() -> Result<(), std::io::Error> { ... .route("/reset_password", post(reset_password)) ... so, on the first glimpse you'll notice: let result = query("SELECT user_id FROM password_resets WHERE token = ?").bind(token) .fetch_optional(&pool) .await; and you think: cool, as long as I have a valid token I can reset ANY password, because the UserIdQuery holds the user_id from the query parameters. That must be the error. And it's clearly CWE-640 - Weak Password Recovery Mechanism for Forgotten Password. Boom! But lab says: "Correct Vulnerability but Incorrect Line" Then you say, ok.. something might be missing... or too much. you'll remove lines, 3... 2.. 1.. nothing. maybe I need to add the update password procedure? so let's click the lines on: let result = query("SELECT user_id FROM password_resets WHERE token = ?") .bind(token) .fetch_optional(&pool) .await; and... ? "Correct Vulnerability but Incorrect Line" now you start clicking on 1 up to 7 lines in all different combinations (no .await, but .bind) but: "Correct Vulnerability but Incorrect Line" You add another part of the code, which could make sense like: let user_id = user_id_query.user_id; let token = form.token; let password = form.password; Again here you start shuffling all the options (now you click between 1 up to 10 lines in all different variations) but all you get is this "Correct Vulnerability but Incorrect Line". You read again the hint you've got with the wrong answer: "Consider how the password is being reset". Yes I did, really! All the time! and so on and so on... probably I've clicked now hundreds of different combinations and so on and I start believing there's a bug in the lab (would not be the first one on this collection). So, how is it for you those "Find the flaw" labs? You like them? You struggle with them? greetings -steven ps: If you have the solution or any other hint for this one, ping me :)CSM Tip – Annual Review Season Is Here! Remember To Grab Your Personal Reports from the Immersive platform to bring to the conversation.
Annual Review Season Is Here! Remember To Grab Your Personal Reports from the Immersive platform to bring to the conversation. Are you ready to share with your manager the progress you made towards your personal upskill goals? Want to pull reports to share in your year end review? Remember, you can pull several reports to bring to these conversations. Simply head to your profile (Initials) in the upper right of the header, in the dropdown, click settings, select the report tab, select activity report, and voila! Have you done this in the past?The Human Connection Challenge: S1E3 - 1 Week To Go!
Don't Forget! There is only 1 week left to complete the third lab of the Human Connection Challenge if you want to be in with a shout of winning an exclusive digital badges, physical challenge coins, swag and prizes. If you are yet to complete it, you have until midnight on Sunday 26th January 2025! To read more about the challenge click here. To find it in the Immersive Labs Platform, Click Exercise > Challenges & Scenarios > The Human Connection Challenge: Season 1 Don’t forget to Follow The Community Blog to get a notification whenever a new Challenge Lab is released! Good Luck!This Week In The Human Connection Community
Introducing our newest members JG Kygore Markus pronto04 Johnie111smith Subham404 athletikntel CrouchS LSatSTEWART WilliamsJ122 leonard Martin Dark_Knight666 kevindevine Jurr SlippinJimmy LastSonOfKrypton JanWF Heather0ng ✨ 👋 🚀 In case you missed it, here’s a selection of our favourite content within The Human Connection: Expert Guidance & Product Updates This month we're delighted to spotlight the new Lab Builder feature! Hear from MattParven, Immersive's Product Manager for Lab Builder, Principal Security Engineer AND Cloud Security SME as he shares this week's updates to the feature in his blog Feature Focus: Introducing Drag and Drop, Free Text Questions, and Instructional Tasks in the Lab Builder. For more on Lab Builder, see Matt's previous blog, Feature Focus: Introducing Lab Builder. Make sure to review January 2025 Release Notes provided by NathanAlder Hear from our in-house Cyber Threat Research experts KevBreen BenMcCarthy and benhopkins as they share their notes on all 10 vulnerabilities picked up in Microsoft's January Patch Tuesday. Community Events Today we announced another Valentine's special Virtual Crisis Sim! They're back by popular demand - reserve your seat to join ClemCraven & TomBoyle for #LoveHacked Virtual Crisis Sim LIVE on 14th February. Community Updates If you're new here, or just want to get the best out of this community, check out our getting started guides to help you get the most out of your membership as well as our Help Forum to get help and give help. And if you haven't already, please take a few minutes to fill in our End of Year Community Survey. Your feedback will help us to shape the future of this community. Don’t Miss A Beat - we’ll be sharing new content week on week! Hit “follow” on the blogs you love to receive a notification when new pieces drop.Welcome to this week's new members!
Please join me in welcoming all of the new members who joined us this week! SheRa Mroxana redreturn Chicanery mysterylie Loganmf SBF00 jspiegelbe sidi7 Nick_The_Grey kikasudo Matt1234545 Monika1 peter Palaract MrReaper sammy It's great to have you all here and we hope that you are enjoying everything that this community has to offer. As a starting point, be sure to check out our getting started guides to help you get the most out of your membership. And if you haven't already, please take a few minutes to fill in our End of Year Community Survey. Your feedback will help us to shape the future of this community.Welcome to all of our new members!
Please join me in welcoming all of the new users who joined us over the holiday season! CyberSailing PL3IADES Marieox Eliseu_Lucas ifeanyiukadike GeoffereyOfori audeyisaacscba BigLight BigLight66 CyberPUNK mwatkins Sidharth4u 👋 It's great to have you all here and we hope that you are enjoying everything that this community has to offer. As a starting point, be sure to check out our getting started guides to help you get the most out of your membership. If you have any questions, just comment below 👇🚨 Calling all CISOs and Program Managers! 🚨
We’re looking to connect with security leaders who are passionate about team readiness and resilience. DaveSpencer and our user researcher PamelaSmith are exploring how organisations exercise and prepare their teams for evolving cyber threats. We’re developing a new cyber drills concept and would love to get your insights and feedback. If you're open to having a brief chat to share how you approach team exercises and provide your perspective on our ideas, your input would be invaluable. 👉 Interested or know someone who might be? Get in touch via email or comment below.Phishing != Security Awareness
Dear IL Community, I wanted to express some thoughts about the challenge that organizations may face if they want to establish a cybersecurity culture, especially when individuals within an organization do not prioritize or care about cybersecurity. From my perspective, one of the main reasons it's tough to get a cybersecurity culture going is that people just don't see the potential consequences of cyber threats. They often don't realize how much of an impact a security breach can have or how important it is for them to protect sensitive information. This lack of interest can create a big vulnerability in an organization's security defenses. Would love to get your view and discuss the following things: How can we make cybersecurity feel relevant to every employee? What innovative approaches have you seen in creating a security-minded culture? Are current training methods truly effective, or do we need a radical rethink? Is it about the missing Leadership commitment? Do we struggle to demonstrate the tangible business impacts of cybersecurity? It would be very appreciated if you can share your thoughts and experiences! All the best - NerminHow many 'small' events are there?
Was reviewing Cyber News Live and am amazed at the number of 'small' events out there. They go under the radar and don't make the news. But impact people and their lives every day. Makes me happy to be part of the solution!!! (13) Cyber News Live | December 2024 | Week 49 | LinkedInHappy Holidays from Immersive Labs
To all the community, we would like to wish you all a warm and wonderful holiday season and a happy new year. 2024 has been a whirlwind of growth, connection and collaboration, and we're so grateful that you've helped us build such an awesome community - high-five to you! We're excited to share all of the plans we have for 2025 and for the things we'll achieve together. Oh, and welcome to our newest members: secdan TrinityWarrior Whateve Ethanhuang33 skocherhan hanzawhtun chanthuli binoy SJSUNDE AbdulM Com_Anba ivansilva luffynpc Jordan darkmacheken ryanolearynorm jeffreywilliamson DanielJakobsson cw lrob Dillon miclib carlosgalvis pagepeterson ZCostello JoelD BSingh4 Gxnnelle MichL Teno Dirge ZK shreyasjoshi CL willr rusio mikep55 AbdulR JS L33465 taruniverse ShayOX talnet23 emomartin 👋 Happy holidays everyone ✨
