missing don in irc 

I can't help with GWAPT exam experience, but as Kris mentions, that books is a great resource.

you should check out OWASP broken web applications http://code.google.com/p/owaspbwa/ It has the apps you've listed aswell as some old versions of web apps that were vulnerable.

that last one is rad sil!

how's about using a 2d barcode somewhere?

not sure this is going to solve this, but it mentions using print_line instead of puts in this doc:

http://www.metasploit.com/redmine/projects/framework/repository/revisions/9745/entry/HACKING

EDIT: that doesn't work, totally wrong context!

put works as apollo says

Looks like someone solved the first cipher puzzle, wasn't as simple as it may have seemed!

Phew - found & finished the real challenge

Hi Folks,

Just wanted to let those of you based in the UK, looks like registration is open for the UK Cyber Security Challenge.
https://cybersecuritychallenge.org.uk/

There are different options to register for

SANS Institute and Sophos Security Treasure Hunt
    *  Multiple choice questions that test their overall knowledge of the sector
    * A series of questions focused on how to discover flaws in a dummy website full of vulnerabilities that they must identify themselves
https://cybersecuritychallenge.org.uk/competitions/treasure-hunt.html

QinetiQ Network Defence
    *  Stage one – critical assessment of a fictional business scenario and accompanying network diagram.
    * Stage two (Top two teams from each category only) – Face-to-face challenge at “The Portal” hosted at QinetiQ’s Headquarters in Farnborough. Teams must support and defend their network against attacks from cyber security professionals.
https://cybersecuritychallenge.org.uk/competitions/network-defence.html

DC3 Digital Forensics Challenge
    * The competition consists of approximately 25 different challenges forwarded to all participants, ranging from basic digital forensics techniques to advanced tool development.
https://cybersecuritychallenge.org.uk/competitions/forensics.html

There's a cipher page for a fun little intro challenge. https://cybersecuritychallenge.org.uk/cipher.html

The QinetiQ network defence sounds particularly good!

Seems like a good way to get your foot in the door, there are some good prizes to be had! I wonder if Ed Skoudis had anything to do with the treasure hunt?

Anyone signing up?


Oops, registration might not officially open until tomorrow...

write-ups online: http://www.information-security-training.com/news/hsiyf-2-for-charity-solutions/

Well, this was quite a tricky challenge, for me at least. I did manage to get one of the 5 machines, which was quite an easy linux stack bof for an app called vuln which they provided the source code for. I guarantee everyone on the scoreboard got that one!

Congrats to the winners!
See the scoreboard http://scoreboard.information-security-training.com/scoreboard/

In the course of the 48 hours 4 of the 5 machines were compromised, with the exception of the deadcow, which I spent way too long poking.



Really looking forward to seeing any write-ups!

wow, nice offer, maybe you should do some kind of book swap or something and start a new trend

sure, it's just just flash, just make sure you are fully up to date

Depends on the scope of the pentest, are they interested it you can root a box that doesn't do much? Maybe there are much bigger concerns. I'd say pivot, pass the hash etc, then report once you get something juicy, but all depends on what you have already compromised.

    My order:
    * Install useful tools (backdoor, tunnels, etc)
    * Enumerate users
    * Escalate privileges
    * Look for interesting files containing database login credentials, sensitive data, etc
    * Scan other machines from this host
    * Use it as a pivot to attack internal networks


Is erasing traces really necessary in a pentest?

just me!? ketchup?

I would definitely recommend going through the videos and exercises on http://pentest.cryptocity.net/ to get an idea of which particular area interests you the most.

Each piece of the jigsaw is an art in itself and finding an area in which you stand out is definitely going to help you in the future.

awesome giveaway!

EDIT: does it look bad that 5 minutes after seeing this, i've added 25% to my post count?

registration is open!

http://www.information-security-training.com/events/hsiyf-for-charity-registration-page/


Remember - it's for a good cause http://www.hackersforcharity.org/