Project 2 Rough Guidance

This project is designed to invite you into the world of web app pen testing, CTFs, and a hand's-on familiarity with today's most important web exploits.

I call it OWASP bingo, and it's a choose your own adventure path through mastering various skills.

I have made the following spreadsheet that you should copy and start to fill out:

https://docs.google.com/spreadsheets/d/1l4yE2nxRpKvpmxRLRAhuVViurbPOiM8tmR88Q7KfVfg/edit?usp=sharing

It has 11 fillable rows, 1 each for the OWASP top-ten and 1 extra for other interesting exploits not covered by the top 10.

You will get points by solving CTF puzzles that exploit one of the known weaknesses.

But the flag alone is not enough, I want you to make a video of you pulling off the exploit.

Use Zoom or OBS or something, and record to cloud or screen capture a video walk-through teaching the exploit.

Each video you make is worth between 1 and 11 points, your job is to get at least 50 points but no more than 10 points per row/category.

Here are the rules for points:

• Each row can be worth up to 10 points. So you must cover at least 5 distinct types of exploit.
• You can demo an exploit of a known vulnerable security service with existing write-ups on the web.
• In that case (the internet has a write-up out there) you will get 1-2 points based on the challenge level of the service.
• You can also get a bonus 1 point in a row if one of your video walkthroughs in that row uses a cool tool like burpsuite or zap
• If you design a CTF problem that highlights a vulnerability and host it and make your walkthrough, that is worth 10 points
• If you participate in a LIVE CTF (there are some every day) you can get between 5 and 10 points for solving a live one.
• Solving a live CTF is high-risk high-reward unless you've been training.
• If the problem gets many solves it's worth less points to this project.
• You'll probably need to wrestle with the correct category for each vulnerability you exploit.
• Put a URL in each box that you make a video walkthrough for, I should be able to click that link and watch your video.
• TEST the permissions of those links.
• Be aware that UD does not hold your cloud recordings forever, but I think you can tweak the settings.
• Imagine using these videos to teach future generations or even in a future job interview.

Probably the best strategy is to train on some recent problems, go through the write-ups, then jump in on live CTFs each weekend.

This is not a project that lends itself well to procrastinating, you will struggle if you put this off as you'll get stuck making 50 videos and not 5.

When done this SHOULD level you up in a ton of areas and make you feel quite competent, if you're not leveling up in the experience talk to me.