OWASP Security Shepherd Project - My Practice & Solutions

-

    Security Shepherd is a Flagship project of OWASP. It is made as a web and mobile application security training platform.
    As it is a famous framework for Web Application Pen Testing Traing, I want to start to write down my practice & solutions on the lessons and challenges of Security Shepherd for tracking.

    The Official website: https://www.owasp.org/index.php/OWASP_Security_Shepherd

My Practice & Solutions

========================================================================
My Practice: 
SQL Injection Lesson
Injection Challenge
    - NoSQL Injection One
    - SQL Injection 1
    - SQL Injection 2
    - SQL Injection 3
    - SQL Injection 4
    - SQL Injection 5
    - SQL Injection 6
    - SQL Injection 7
    - SQL Injection Escaping
    - SQL Injection Stored Procedure
Mitigation Suggestions:
SQL Injection Prevention Cheat Sheet
========================================================================

========================================================================
OWASP Development Guide - Data Validation
My Practice:
Poor Data Validation Lesson
Poor Data Validation Challenge
    - Poor Data Validation 1
    - Poor Data Validation 2
========================================================================

========================================================================
My Practice:
Cross Site Scripting Lesson
XSS Challenge
    - Cross Site Scripting 1
    - Cross Site Scripting 2
    - Cross Site Scripting 3
    - Cross Site Scripting 4
    - Cross Site Scripting 5
    - Cross Site Scripting 6
Mitigation Suggestions:
========================================================================

========================================================================
My Practice:
Insecure Direct Object Reference Lesson
Insecure Direct Object Reference Challenge
    - Insecure Direct Object Reference Bank
    - Insecure Direct Object Reference Challenge 1
    - Insecure Direct Object Reference Challenge 2
Mitigation Suggestions:
========================================================================

========================================================================
My Practice:
Security Misconfiguration Lesson
Security Misconfiguration Challenge
    - Security Misconfig Cookie Flag
Mitigation Suggestions:

========================================================================

========================================================================
My Practice:
Insecure Cryptographic Storage Lesson
Insecure Cryptographic Storage Challenge
    - Insecure Cryptographic Storage Challenge 1
    - Insecure Cryptographic Storage Challenge 2
    - Insecure Cryptographic Storage Challenge 3
    - Insecure Cryptographic Storage Challenge 4
Mitigation Suggestions:
========================================================================

======================================================================== 
Top 10-2017 A5-Broken Access Control
My Practice:
Failure to Restrict URL Access Lesson
Failure to Restrict URL Access Challenge
    - Failure to Restrict URL Access 1
    - Failure to Restrict URL Access 2
    - Failure to Restrict URL Access 3
Mitigation Suggestions:
Authentication Cheat Sheet
Access Control Cheat Sheet
========================================================================

========================================================================
My Practice:
Cross Site Request Forgery Lesson
CSRF Challenge
    - CSRF 1
    - CSRF 2
    - CSRF 3
    - CSRF 4
    - CSRF 5
    - CSRF 6
    - CSRF 7
    - CSRF JSON
Mitigation Suggestions:
========================================================================

========================================================================
My Practice:
Unvalidated Redirects and Forwards Lesson
Mitigation Suggestions:
========================================================================

Others:
How to create another user in OWASP Security Shepherd?

Reference

留言

  1. 匿名2020年10月4日 凌晨4:22

    I need to know how to do SQL Injection Escaping

    回覆刪除
  2. Unknown2021年9月17日 凌晨12:06

    Pleaae can you make solution of sql injection challenge 5,6,7 because which i found here not right the challenge 5 is coupon

    回覆刪除

張貼留言

Welcome to share your comments or questions : -)
Enjoy life!

The Hottest Articles

OSCP回顧 & 準備建議

-
圖片
緣起         去年, 2017年, 我完成了一趟學習上的奇妙旅程, 獲得了OSCP認證. 一開始很擔心自己的程度是不是足夠? 能不能花足夠多的時間在學習與練習? 幸運的是家人、朋友們都很支持我, 使我能在最後通過了長達24小時的認證考試.         寫這篇文章, 一方面是因為想回顧一下自己的學習歷程, 另一方面是我發現很少有中文的Review去介紹和給與準備考OSCP的人們一些建議, 所以希望由我自己開始, 為想要學習資訊安全的人們提供一個起始點 : -) Offensive Security & OSCP         Offensive Security是一家享譽業界的認證機構，其中最為人所知的便是Offensive Security是Kali Linux的製作與維護團隊。OSCP則是Offensive Security的旗艦級認證，可以說是講到Offensive Security就會想到OSCP。         OSCP因為它的考試是以24小時，獨立突破5台機器的實做模式聞名，也因此廣泛的被業界認可。擁有這張證照的成員，一般被認為有能力可以獨立進行滲透測試。 OSCP: https://www.offensive-security.com/information-security-certifications/oscp-offensive-security-certified-professional/ PWK(OSCP training course): https://www.offensive-security.com/information-security-training/penetration-testing-training-kali-linux/ 報名OSCP的資格         很多人會疑惑說，什麼樣的人有資格去報名OSCP課程？我是不是準備好了？甚至有網路上的文章說，OSCP是給資深高手的，菜鳥還是去考CEH好了！以我個人的經驗來說，我認為這些都不是值得擔心的事情。唯一的問題是你到底有多想學會？你是不是能在一次一次的失敗中，仍然堅持尋找解答？         首先談談我自己的背景，我從清華大學資訊工程學系畢業，後來到美國的哥倫比亞大學，讀了電腦安全的碩士。大家可能會認為我學了很多關於資安，我想某
Read Full Article »

OWASP Security Shepherd Project - SQL Injection 3 (Injection Challenge)

-
圖片
Challenge Solution     First step, let's try to input Mary Martin .     Then, let's try 1'or'1'='1 .     Well, maybe that's because 1 isn't a valid character for Name? Let's try a'or'a'='a .     Not bad, we get the user list. However, our purpose is to get credit card number. We must try to UNION SELECT the credit card number field!     The first thing comes to my mind is how can I get the table name and column names of this application database.     Try ' UNION SELECT TABLE_NAME FROM INFORMATION_SCHEMA.TABLES WHERE '1'='1 =>     Try ' UNION SELECT COLUMN_NAME FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_NAME='customer =>     Now, we are sure that the application doesn't have the privilege to access information_schema... Try to use GROUP BY to guess column name. Input ' group by name having '1'='1   => An error was detected! com.mysql.jdbc.exceptions.jdbc4
Read Full Article »