owasp/securityshepherd

Web and mobile application security training platform

securityshepherd's Issues

Fix XSS detector to detect HTML encoded URI attacks

Implement Way better Shepherd Logging

Support IP tracking and detecting "forwardedBy" HTTP headers in the Log4j logs

AllFutureDevInMarksHouse

Implement ActionBarSherlock on Android Apps

Compile a list of keys for Mobile APKs

Make Admin Setup More Intuative

always getting pings from people who skip the read me .txt

Eradicate hard coded values

Broken Crypto

Simplified, chat application, "encrypted" chat, key in chat.

Redesign CTF Mode

Make the next level stuff easier!

Weak Server Side Controls

-Implement Google Volley for more efficient/readable code.

-Decide on what the challenge will entail.

Remove admin function disclosure from JS scripts

Also Make a level about this issue

Reverse Engineer 3

The key isn't stored in a string, the key is generated with a generateKey() function which the attacker has to copy in order to get the key.

Improove XSS Scanner

To be addressed when resources allow

Idea for Client Side Injection 3

Different type of bad filtering?

Different goal?

XML Injection?

Fix CSRF Lesson URL Sanitisation

Currently this is done with a filter. Going to change the approach so it is a sanitised URL encoded for HTML

Solve SQL Cipher Bug

SQLCipher based APKs will not install on anything but an emulator. Find out why:

-Check Imported JARS

-Rebuild new SQLCipher APK from scratch

-Check libs folder

Rename CSRF Challenge 3 to Challenge 6

Test Vulnerable APKs on rooted AndroVM

Do not use Eclipse Emulator (It's terrible). Do this in a way where players only have APK files for challenges I want them to reverse.

Connect an APK to Shepherd

-Create API

-Exposed DB Connection

-Android JSON/Volley Communication

CSRF Challenge 4

CSRF Nonces that seems random but is infact there are only 5, hashed in MD5

Fix XSS black list filters to stop URI attacks and to kill http vectors

Test APKs on Android VM

Update moduleCreate proc to always generate a unique identifer

Generate notification if Apk tampered with.

Generate new Security Shepherd lesson/challenge pages for Mobile Levels

CSRF Challenge 5

Strong CSRF projection with pseudorandom values used as nonces. However a getNonce function can be manipulated to recover a user's nonce value. Function will also be vulnerable to enumeration, and all CSRF nonces (For the challenge) can be recovered in a single request.

Create new XSS scanner to detect valid attacks in latest XSS challenge

New CSRF Challenge 3

A CSRF Challenge that uses nonces, but any valid nonce will succeed.

Nonces will be very short (5 possibilities)

Create Bad Santisication cross site scripting level

Fix Import Issue

Create Three new SQLi Web App Levels

Change Unintended Data Leakage 2

Current issue is not prevalent enough and too easy to pass.

Assess Flow of Levels

Last thing we do - Organise the levels in how the user gets them

Information Disclosure Challenge

Inspecting logcat output.

Create new random string generator

This isn't critical, But easy to achieve.

Create White List cross site scripting level

Session Management Level 4

Session identifies are very weak. The admin's sesssion will be session number 1000004, base64'd

Replace Deprecated Functions in Data Leakage APK

Move Mobile Shepherd levels into Shepherd Server

Move existing levels into Security Shepherd

Failure to restrict URL access Challenge 2

Obfusticated javascript describes Admin functions

Fix "Create new module Wiki"

Bad Crypto Challenge

A crypto level

result key is XORd with a secret server key.

The user can use the same cipher to encrypt their own text to try brute force the key. However the actual vulnerability in the crypto is that the XOR function will not account for spaces, and will reveal the server key. The ciphertext can then be XORd with the key to recover the plain text.

This was an issue discovered in shepherd's user specific keys that was addressed.

Remove Challenge Builder from code

Challenge builder is awful and needs to be completely redesigned for a scalable solution

Cosmetics!

Custom Buttons, change background. Review dimensions of images.

InsecureData 3

Hard coded Database Password - encrypted database

Generate Random Strings for DB Passwords

Create new Session Management Levels

Create New Failure To Restrict URL Access Level

Based on Admin URL Disclosure bug

Create Bad Escaping cross site scripting level

Create Hybrid Mobile/Web app level issues to be completed