Web Hackers Handbook labs?

Viewing 33 reply threads
  • Author
    Posts
    • #7149
      Sinco98
      Participant

      I am wondering if anyone has used the web hackers handbook labs from mdsec.net

    • #44616
      Anonymous
      Participant

      Hi

      No I have the book but I think the labs are too expensive when there are ways to test for free like webgoat,DVWA so on..

      If the labs were a one off payment for a certain amount of time like $50 for a month then I would be more tempted to use them.

    • #44617
      Sinco98
      Participant

      yes that was my thinking $7 an hour (£5) seems to bit expensive when like you stated DVWA is available.

      Thanks,

    • #44618
      Anonymous
      Participant

      yah don’t get me wrong I sure there labs are amazing and I sure they making lots money from companies who can afford $7 an hour but for someone new to the industry trying to work you way in with no money it just crazy

    • #44619
      alucian
      Participant

      I plan to buy 10 hours of lab time. I know that thery are expensive compared to eLS or even OS*P. But, the best way of learning is by studying and doing.

      In my opinion, if someone will go through the most of the labs he will be extremelly skilled. Also, consider the fact that the book is about 40$ plus 100 hours lab time is 740$. A lot, but a SANS course is more than 3000$.

      I did SANS GWAPT, eLS and I have the book. Soon I will do a comparison between them.

      I also think that paying by the hour will make you sweat more.  🙂
      Consider the following analogy: having a girfriend (pay monthly access) and “renting” a wh*re by the hour. In which case will you “give your best” and want the best ROI??  ::)

    • #44620
      hayabusa
      Participant

        That’s quite the analogy, alucian!  😉

    • #44621
      Anonymous
      Participant

      That is fair comment and yes compared to most courses run by sans its really good value. I personally would rather read the book use free alternatives and the money I save by not going into the labs spend on another course that would help me develop in another area.

      I guess if you want to be amazing at web apps then spending the money on it like a course would be beneficial.

    • #44622
      Sinco98
      Participant

      I suppose there is one good thing about it. You can follow it through with the book and all the examples in the book are relevant to the prac on the website.

    • #44623
      Anonymous
      Participant

      Yah I think if you just wanted to learn web apps then may you could do it as course buy the book spend rest on the labs but more pen tester have to be skilled in many area I personally would buy the book use the free apps then spend other money on networking security course.

    • #44624
      alucian
      Participant

      @Jamie
      I think that you are wrong. For example you have the chapter about session management and how to test the tokens. Then you have three labs where you can practice. Like this you’ll apply what you’ve just read, and you’ll better understand and remember.

      I plan to do at least a lab from each category. If I a do OK I’ll move on, otherwise I’ll do another one.

      If you’ll read the book, and then read one about network secutiry, then wireless… you’ll be cabbage. Honestly. 

      At the beggining I was upset about the fact that they only give hourly access (I still think that it is too expensive). But, for lazy guys like me this will be a motivation to really use that hour.

      I think that they are loosing money by putting a price so high on the lab. It is like the horses you can find in the malls. I will not pay 1$ for my kids to play 2 minutes, but I will pay 50 cents (maybe I will have them play 3 times).

      I will keep you informed about the quality of the labs.

    • #44625
      Anonymous
      Participant

      I agree with you that the price and book make sense if you look at it as a course. However IMO I would not pay for the labs as I think there are lots of free alternatives where you can practice most if not all the vulnerabilities in the book.

      And I think one best way to lean web security is to build your own web applications and then break them.

      IMO I think the price is too high and I think they would make more if it was more affordable.

    • #44626
      Seen
      Participant

      Has anyone gone through all the Coliseum labs for elearnsecurity?  How do those compare?  Are there any other online labs that are perhaps a better value than the WAHH ones?

    • #44627
      lorddicranius
      Participant

      I thought the eLS Coliseum Labs were great.  They really helped me learn and remember the techniques that were taught during the course, and actually seeing what happens when you exploit a vuln helped a lot as well.  The stories that went along with each battle made it fun too.

      I haven’t done the WAHH labs though, so I can’t compare the two.  But I can say that the eLS Labs are definitely worth it.

      eLS = $99 for a month access
      WAHH – At $7/hr, 2 hours a night, you’ll get to $98 spent by the end of one week.

    • #44628
      Seen
      Participant

      I think there were 10-20 eLS labs when I went through it during my course, I was just wondering how many there are now if anyone knows.

    • #44629
      Seen
      Participant

      Never mind, I found a description on the website, looks to be a few new labs from when I did it.

    • #44630
      n3r
      Participant

      Hi, just my feedback about the mdsec lab.
      As i’ve bought the book 3 month ago i’ve decided for this new year to buy 5 hours of training lab.

      Right now i’ve spent only two hours in the lab and i have done the 3 first modules, Mapping the Application, Using Automation and Bypassing Client Side Controls.

      You have to read the book first because there is no explanation in the lab, only exercises, exercises and exercises…
      One negative point is that there is no answer so if you don’t find how to do it then you can’t have any advices from the lab but on the other hand it makes you working harder to find the solution.

      The 3 modules i’ve done aren’t so difficult and you can find a lot of advices in the WAHH, i don’t know if it’s gonna be the same thing for the other one.

      n3r

    • #44631
      Seen
      Participant

      Thanks n3r.  From what you say, it seems like the labs might not be as expensive as I thought.  I’m planning to try the labs once I finish the book (but I just started), so let me know your overall thoughts once you finish them all.

    • #44632
      ggeorge
      Participant

      Hi All!

      I interested in web application security.
      I try to do MDSec labs. But I can’t find solution for specific exersices.
      Does anyone help me?

      P.S. I can help you too.

      Thanks!

    • #44633
      MaXe
      Participant

      @ggeorge wrote:

      Does anyone help me?

      Yes, Google and e.g., SecurityTube  🙂 No offense intended of course ;D

      Update: I also just saw the demo. It says the examples from the book works there too, so I recommend you use the book.

    • #44634
      dynamik
      Participant

      Also, it helps if you have specific questions. i.e. “In this scenario, how could I leverage this vulnerability to do x, y, and z.”

      On a relate note, I purchased this book the other day, and I intend to go through all the labs. I’ll definitely post a review once I’m done, but it may be six weeks or so with everything else I have going on :-

    • #44635
      ggeorge
      Participant

      Yes.
      I have problem with all three cases in “incomplete validation of credentials”.
      I try removing last character, changing the case of a charater and add special characters – such as .$)(/.But I can’t find any problem with validation of password.

    • #44636
      MaXe
      Participant

      @ggeorge wrote:

      Yes.
      I have problem with all three cases in “incomplete validation of credentials”.
      I try removing last character, changing the case of a charater and add special characters – such as .$)(/.But I can’t find any problem with validation of password.

      Did you try the examples from the book? The website says they will work there, so I guess they should.

    • #44637
      ggeorge
      Participant

      Did you try the examples from the book? The website says they will work there, so I guess they should

      Hmmm…I can’t find any examples in my book.

    • #44638
      MaXe
      Participant

      Did you read the entire Web Application Hacker’s Handbook first and second edition?  ;D

      Note: If you did, you may be required to “think outside the box”, which e.g., vulnerability researchers have to do when they sometimes discover 0days within functions that seems secure at first look.

    • #44639
      tturner
      Participant

      For those who have done the labs and read all of WAHHv2, how much lab time would you recommend? I’m getting ready to buy some but won’t be able to buy more if I run out.

    • #44640
      MaXe
      Participant

      @tturner wrote:

      For those who have done the labs and read all of WAHHv2, how much lab time would you recommend? I’m getting ready to buy some but won’t be able to buy more if I run out.

      If you’re asking me, no idea sorry  ;D But generally speaking, depending on how many challenges are available, 30-60 minutes per challenge if they’re not like super easy, is probably what I’d recommend. If you’re good, you can probably do most of the challenges in 15-30 min., or less, but as I haven’t done their labs yet, not sure.

      I guess that I could attempt to do them for fun, and see how far I can get, just to try it out  🙂

    • #44641
      dynamik
      Participant

      I bought 8 hours the other day, but I haven’t had a chance to do anything with them yet. I’ll poke around a bit this weekend and see if I can estimate how much it would take total.

    • #44642
      dynamik
      Participant

      @tturner wrote:

      For those who have done the labs and read all of WAHHv2, how much lab time would you recommend? I’m getting ready to buy some but won’t be able to buy more if I run out.

      Here’s a breakdown of the labs. The number in parenthesis is the number of objectives in that lab, and some of those are further divided in multiple sub-objectives.

      01 – Mapping the application (4)
      02 – Using automation (4)
      03 – Bypassing client-side controls (3)
      04 – Attacking authentication (8 )
      05 – Attacking session management (3)
      06 – Attacking access controls (3)
      07 – Basic SQL injection (2)
      08 – More SQL injection (8 )
      09 – Attacking data stores (14)
      10 – Attacking back-end components (12)
      11 – Logic flaws (4)
      12 – Cross-site scripting (7)
      13 – Attacking other users (23)

      Keep these few caveats in mind:

      • The amount of time it takes to go through an exercise will obviously vary a great deal based on experience
      • With some exercises, there’s no obvious way to know that it’s been completed. It’s possible for you to feel pretty good about where you’re at but then discover another interesting item 15 minutes later
      • You need to use your allotted time in one-hour increments. You may not feel like moving on to the next item with only 5-10 minutes remaining, so you might want to factor in a few extra hours for padding

      Based on what I saw while browsing through the exercises, I think most people are going to average over one-hour for each section. 15-20 hours would probably be a fairly aggressive pace for most people, and many will probably be the most comfortable in the 20-30 hour range, if not higher.

      Alternatively, more advanced users may want to get a smaller block of hours (i.e. 10) and skip the exercises they don’t feel would be worth their time. You can pick-and-choose what to do; you don’t need to go in order.

      I’m personally expecting to put 25-30 hours into this because I have OCD and want to be thorough. I’m competent with most web technologies, but I haven’t spent a great deal of time focusing on offensive tools and techniques.

      I assume you only have one shot at purchasing hours because your company is paying for it and you need to get a PO issued. For people that aren’t required to purchase everything thing at once, there’s no penalty for purchasing hours in small increments. Most people would probably be more comfortable with purchasing 3-5 hours at a time.

      If I had to purchase everything at once, I’d go for a little more than I was expecting to use. At $7/hr, you’re not going to waste a significant amount of money unless your estimate ridiculously off.

      HTH

    • #44643
      Seen
      Participant

      Thanks ajohnson, your post was very informative.  I’m planning on starting the labs after I finish the entire book.  I’m almost finished with chapter 5 so that might be a while.

    • #44644
      tturner
      Participant

      Thanks dynamik, that’s exactly what I needed.

    • #44645
      DragonGorge
      Participant

      @ajohnson wrote:

      With some exercises, there’s no obvious way to know that it’s been completed. It’s possible for you to feel pretty good about where you’re at but then discover another interesting item 15 minutes later

      Great writeup. Regarding the above – are the objectives for each exercise clearly defined? I’ve seen some labs where the goals are somewhat ambiguous but the answer is not.

    • #44646
      dynamik
      Participant

      @DragonGorge wrote:

      Great writeup. Regarding the above – are the objectives for each exercise clearly defined? I’ve seen some labs where the goals are somewhat ambiguous but the answer is not.

      It varies based on the objective. Doing things like bypassing client-side controls or SQLi are going to be pretty obvious because they either work or they don’t. On the other hand, tasks like manually mapping the application are really only limited by your imagination and can take awhile before you feel like you’ve gone through all the possible avenues. While they do provide a few hints to guide you along, I didn’t see any sort of scoring or grading that lets you know how well you did.

      Keep in mind that was my experience after only an hour; I may be totally off with my time estimates. I’ll definitely write a full review once I’ve gone through everything, but that will probably be towards the end of March. I have my OSWP scheduled for 3/11, so my WAHH2 progress will be slow until that is done.

    • #44647
      MaXe
      Participant

      I would recommend using at least 5 hours on the first 4 labs. (Use them in hourly sessions, take a break after 1 hour.) Some of the tasks in these, can be quite time consuming, and if you don’t have infinite credits I suggest making a “max time spent”-rule on the different objectives, e.g, 10-30 minutes each, as you can easily use more with some of them. (I wouldn’t suggest using more than 60 minutes on one objective (within a specific lab), not even on the hard ones, which you can always come back to later on.)

      Currently I’m also going through the labs, while taking notes, including how much time I spend. If you get stuck on one objective for a longer period, move to the next and try that instead.

      The first two labs, can be completed in a relatively short amount of time, but lab 3 and 4, requires a bit more work, especially if you haven’t tried out all the features in Burp Suite (free) yet, such as bruteforcing which I hardly ever do. I did learn something new, which I had to “instant-research”, which was ViewState.

      I had seen it before, but I didn’t know exactly how it worked as I’ve mostly tested PHP sites where it doesn’t exist. (So in that sense, it was interesting, especially to test ASP(x) scripts which is not something I do often. Of course the attack methodologies are almost the same, but there are a few key differences that are important.)

      Note / Edit: Keep in mind there’s ~330 objectives in total. At least from what I read, didn’t count it myself. So if you plan on using 10 minutes on each objective, that’s 3300 minutes, aka 55 hours. I would like to note, that some tasks will be very easy (e.g., 1-5 minutes), and others will be a lot harder (e.g., 10-15 minutes or more, there’s a few I didn’t finish as I was unsure whether my answers were right or not).  🙂

    • #44648
      DragonGorge
      Participant

      @xXxKrisxXx wrote:

      Hi Cotica,

      Welcome to EthicalHacker.net. The solutions can actually be found below for edition 2:
      Spoiler Alert.

      If you were interested in labs where you can practice the material that is in the book itself, look into http://www.mdsec.net. There’s an active thread here about it.

      Anyone else having difficulties with the WAHH/MDSec.net website?

      Seems like anything you do there either leads to the “Buy Training Lab Credits” or “Page cannot be found”.

      Edit: Never mind – it turned out to be something weird with the site & Google Chrome.

Viewing 33 reply threads
  • You must be logged in to reply to this topic.

Copyright ©2020 Caendra, Inc.

Contact Us

Thoughts, suggestions, issues? Send us an email, and we'll get back to you.

Sending

Sign in with Caendra

Forgot password?Sign up

Forgot your details?