Hi, just my feedback about the mdsec lab.
As i've bought the book 3 month ago i've decided for this new year to buy 5 hours of training lab.

Right now i've spent only two hours in the lab and i have done the 3 first modules, Mapping the Application, Using Automation and Bypassing Client Side Controls.

You have to read the book first because there is no explanation in the lab, only exercises, exercises and exercises...
One negative point is that there is no answer so if you don't find how to do it then you can't have any advices from the lab but on the other hand it makes you working harder to find the solution.

The 3 modules i've done aren't so difficult and you can find a lot of advices in the WAHH, i don't know if it's gonna be the same thing for the other one.

n3r

Hi All!

I interested in web application security.
I try to do MDSec labs. But I can't find solution for specific exersices.
Does anyone help me?

P.S. I can help you too.

Thanks!

Also, it helps if you have specific questions. i.e. "In this scenario, how could I leverage this vulnerability to do x, y, and z."

On a relate note, I purchased this book the other day, and I intend to go through all the labs. I'll definitely post a review once I'm done, but it may be six weeks or so with everything else I have going on

Did you try the examples from the book? The website says they will work there, so I guess they should.

Did you read the entire Web Application Hacker's Handbook first and second edition?  

Note: If you did, you may be required to "think outside the box", which e.g., vulnerability researchers have to do when they sometimes discover 0days within functions that seems secure at first look.

If you're asking me, no idea sorry  But generally speaking, depending on how many challenges are available, 30-60 minutes per challenge if they're not like super easy, is probably what I'd recommend. If you're good, you can probably do most of the challenges in 15-30 min., or less, but as I haven't done their labs yet, not sure.

I guess that I could attempt to do them for fun, and see how far I can get, just to try it out 

Here's a breakdown of the labs. The number in parenthesis is the number of objectives in that lab, and some of those are further divided in multiple sub-objectives.

01 - Mapping the application (4)
02 - Using automation (4)
03 - Bypassing client-side controls (3)
04 - Attacking authentication (8 )
05 - Attacking session management (3)
06 - Attacking access controls (3)
07 - Basic SQL injection (2)
08 - More SQL injection (8 )
09 - Attacking data stores (14)
10 - Attacking back-end components (12)
11 - Logic flaws (4)
12 - Cross-site scripting (7)
13 - Attacking other users (23)

Keep these few caveats in mind:

• The amount of time it takes to go through an exercise will obviously vary a great deal based on experience
• With some exercises, there's no obvious way to know that it's been completed. It's possible for you to feel pretty good about where you're at but then discover another interesting item 15 minutes later
• You need to use your allotted time in one-hour increments. You may not feel like moving on to the next item with only 5-10 minutes remaining, so you might want to factor in a few extra hours for padding

Based on what I saw while browsing through the exercises, I think most people are going to average over one-hour for each section. 15-20 hours would probably be a fairly aggressive pace for most people, and many will probably be the most comfortable in the 20-30 hour range, if not higher.

Alternatively, more advanced users may want to get a smaller block of hours (i.e. 10) and skip the exercises they don't feel would be worth their time. You can pick-and-choose what to do; you don't need to go in order.

I'm personally expecting to put 25-30 hours into this because I have OCD and want to be thorough. I'm competent with most web technologies, but I haven't spent a great deal of time focusing on offensive tools and techniques.

I assume you only have one shot at purchasing hours because your company is paying for it and you need to get a PO issued. For people that aren't required to purchase everything thing at once, there's no penalty for purchasing hours in small increments. Most people would probably be more comfortable with purchasing 3-5 hours at a time.

If I had to purchase everything at once, I'd go for a little more than I was expecting to use. At $7/hr, you're not going to waste a significant amount of money unless your estimate ridiculously off.

HTH

Thanks dynamik, that's exactly what I needed.