hacking lab: guide to getting started · submit your solution on hacking lab ! you can attach files...
TRANSCRIPT
Network Security HS 2015
Hacking Lab: Guide to Getting Started Steve Matsumoto
NSHS08H8353226 ETH Zurich, Adrian Perrig Network Security HS 2015 2
Registering for Hacking Lab
§ In the next week you will receive a link of the form https://www.hacking-lab.com/events/registerform.html?eventid=XX&uk=YY
§ Follow this link to access the Hacking Lab event for the course
§ You must log in to access the event § If you do not have an account, you will have the chance to
create one § You must use your ETH email address
NSHS08H8353226 ETH Zurich, Adrian Perrig Network Security HS 2015 3
Hacking Lab Support
§ See “How it Works” for getting started
NSHS08H8353226 ETH Zurich, Adrian Perrig Network Security HS 2015 4
VM Setup
§ You will need a copy of VirtualBox or VMWare if you don’t have one already (VirtualBox is free)
§ The LiveCD has all necessary functions set up § Whenever you log in using your Hacking Lab credentials,
use your email address (not username) and password § Use OpenVPN to connect to the Hacking Lab network
§ You are free to configure OpenVPN on your machine if you prefer (but you are on your own for setup)
NSHS08H8353226 ETH Zurich, Adrian Perrig Network Security HS 2015 5
Sample Challenge: Bypassing Authorization
§ Step-by-step (SBS) or Wargame (WG) challenges
NSHS08H8353226 ETH Zurich, Adrian Perrig Network Security HS 2015 6
Sample Challenge: Bypassing Authorization
§ For each challenge, you need to submit: § Vulnerability: what is the security problem? § Exploit: proof that you solved the challenge § Mitigation: how to fix the vulnerability
§ Caution: VM lifetime § VMs reset every 3 hours, at 0:00, 3:00, 6:00, etc. § Challenges providing Docker images have a maximum
lifetime of 60 minutes § Be sure to save and backup your work
NSHS08H8353226 ETH Zurich, Adrian Perrig Network Security HS 2015 7
Sample Challenge: Bypassing Authorization
Use the given username/password combination (hacker10:compass or hacker11:compass, ...). Edit your profile. Try to circumvent the profile's authorization scheme without re-authentication with another user. Try to find the profile of hacker12 if you are authenticated as hacker10.Try to read/edit other users’ profiles.
NSHS08H8353226 ETH Zurich, Adrian Perrig Network Security HS 2015 8
Sample Challenge: Bypassing Authorization
NSHS08H8353226 ETH Zurich, Adrian Perrig Network Security HS 2015 9
Sample Challenge: Bypassing Authorization
NSHS08H8353226 ETH Zurich, Adrian Perrig Network Security HS 2015 10
Sample Challenge: Bypassing Authorization
What happens if we change pid?
NSHS08H8353226 ETH Zurich, Adrian Perrig Network Security HS 2015 11
Sample Challenge: Bypassing Authorization
NSHS08H8353226 ETH Zurich, Adrian Perrig Network Security HS 2015 12
Scoring
§ Submit your solution on Hacking Lab § You can attach files as well
§ Lecturers and TAs can see/grade your solution § Grading is for feedback only § We provide a deadline after which we won’t give feedback
§ SBS challenges help to get a sense of basic techniques, but WG challenges will test your skills