application security

43 Topics

Trick or Treat on Specter Street: Morphy’s Mansion
Any solution for last Task. Struck on this. It’s a buffer overflow vulnerability
immervivesolver
2 days ago Place Help
218Views
0likes
4Comments
Trick or Treat on Specter Street: Manor of Madness
Any hints for Manor of Madness last task. I have been trying from hours and got struck at last task
Solved
immervivesolver
11 days ago Place Help
270Views
0likes
8Comments
PHP – Beginner PHP: SQL Injection
hi I cannot work out how to pass the checks for using a prepared statement. I've looked at various guides and examples and the code I am submitting looks okay to me, but it will not pass the "Working" check.
MartinWard
12 days ago Place Help
4Views
0likes
0Comments
Trick or Treat: Manor of Madness
Any hints or close payloads for last task
Solved
immervivesolver
16 days ago Place Help
111Views
0likes
4Comments
Lab 9: Macro Polo
Hello all, I am working on the new 3 labs from October 20th however I am not a really good coding person haha, I tried to analyze the macro_polo.nim and I was able to find a few flags but all of them wrong. In case anyone has already completed it, would you mind sharing a hint? Thanks!
edgarloredo
21 days ago Place Help
168Views
2likes
7Comments
CVE-2021-22205 (GitLab) – Defensive
Hello, I'm going through some old labs I haven't managed to complete. This one's a bit of a beast. I can get a reverse shell, I can see I am git. however I cannot for the life of me Identify the NGINX log files. this doesn't return anything from the shell or when I am shh'd into the gitlab server find / -type f -name "gitlab_access.log" 2>/dev/null and this isn't returning anything from either the shell or ssh session iml-user@defsec:~/Desktop$ sigmac -t grep sigma.yml grep -P -i '^(?:.*(?=.*POST)(?=.*499))' any clues gratefully received ;)
Solved
GusC
2 months ago Place Help
48Views
0likes
2Comments
Burp Suite Basics: Intruder - Stuck on missing password.txt
Hello community, I'm stuck in lab https://mercedes-benz.immersivelabs.online/v2/labs/burp-basics-intruder/series/burp-suite. The attack to carry out is about a brute-force guess on mfogg1's password using the intruder. The briefing states: Brute force the login page using the password.txt list against the user mfogg1. I'm missing that password.txt file, where the heck is it? I carried out an intruder attack (Cluster bomb) using well known passwords from /usr/share/wordlists/metasploit/burnet_top_1024.txt without success. Even worse, testing those 200 attacks (there are only 200 passwords in that file), tooks quite a considerable time. I must have missed something about the location of that obscure password.txt file. I'm stuck. Perhaps someone can shed a light on this. Thanks in advance, Wolfgang
Solved
wh81752
2 months ago Place Help
61Views
0likes
1Comment
Stuck On Secure Spring Developer (Beginner) URL Parameters Challenge
The lab is around trying to mediate a vulnerability by changing a GET request to a POST request in order to keep sensitive login information out of the URL params. But basically I don't know how I need to go about changing the code(apart from changing "GET" to "POST" on the login form and in a backend method). I'm at a total loss on this one so I'd really appreciate some guidance or an example. I wasn't sure if I should also be making changes to the mapping on the controller (although this isn't mentioned in the lab). These are the changes I have made so far <form th:action="@{/login}" method="POST"> protected LoginProcessingFilter(AuthenticationManager authenticationManager) { super(new AntPathRequestMatcher("/login", "POST")); setAuthenticationManager(authenticationManager); setAuthenticationSuccessHandler(new SimpleUrlAuthenticationSuccessHandler("/home")); } Thanks in advance for any assistance
Solved
joneill
2 months ago Place Help
47Views
0likes
2Comments
Advanced CTF Challenge: Serial Maze
Need hint on Serial Maze. Have gone through html & javascript, couldn't find the token. Using dirb found one endpoint "http://10.102.17.87/2257", its response "What a pickle... You need the secret to continue." No sure how to proceed form here. Thanks, Sabil
Solved
sabil10
3 months ago Place Help
185Views
0likes
3Comments
Python: Expert Challenge 3
There are three Credentials provided, Colin, Bob, and Adam. Only Bob can login. Is this part of the challenge or something wrong with the lab?
Solved
lchenliang
3 months ago Place Help
86Views
0likes
5Comments