diff --git a/TopDog.pdf b/TopDog.pdf
index e4ee629552858e6c4d7e5c58802d338555f41502..b32b8ef1ac1a91eb470df7c6cc4d3707ff7353c2 100644
Binary files a/TopDog.pdf and b/TopDog.pdf differ
diff --git a/TopDog.tex b/TopDog.tex
index a4a51e1620d638d023ce47cf6c2be1afc4e7b65b..422ec5d1ebc58692dc8b9ce2a41a95a3aebc68dc 100644
--- a/TopDog.tex
+++ b/TopDog.tex
@@ -26,7 +26,7 @@
\tcbuselibrary{listingsutf8,breakable,theorems,skins}
\usepackage{textcomp}
\savesymbol{pdfbookmark}
-\usepackage[pdfborder={0 0 0}]{hyperref}
+\usepackage[colorlinks=true,linkcolor=blue,urlcolor=blue,citecolor=blue]{hyperref}
\usepackage{comment}
\usepackage{lmodern}
\usepackage[style=numeric-comp,url=false,backend=biber,%
@@ -60,38 +60,16 @@ maxbibnames=10
\begin{document}
\date{\today}
-\author{Jonathan Jogenfors\\
- \href{mailto:jonathan.jogenfors@liu.se}{\texttt{\small{jonathan.jogenfors@liu.se}}}\\
+\author{Jonathan Jogenfors\\Niklas Johansson\\ Guilherme Xavier\\
+ %\href{mailto:jonathan.jogenfors@liu.se}{\texttt{\small{jonathan.jogenfors@liu.se}}}\\
\small{Information Coding Group}\\\small{Department of Electrical
Engineering, Linköping University}
}
-\title{LiU TopDog Challenge 2017\\~\\ \large{TSIT01, TSIT02
+\title{LiU TopDog Hacking Challenge \\~\\ \large{TSIT01, TSIT02
Computer Security\\ Linköping University}}
\maketitle
-\section*{About this document}
-This lab memo is intended for the computer security courses \texttt{TSIT01} and
-\texttt{TSIT02} for Master-level students at Linköping University.
-\section*{Changelog}
-\begin{description}
- \item[2017] Revised for the 2017 course.
- \item[2016] Initial version.
-\end{description}
-\section*{Acknowledgements}
-This lab owes its existence to Anders Märak Leffler who brought this software to
-my attention back in 2015. I also want to thank the OWASP Foundation and the
-OWASP chapter in Gothenburg for help with getting started. Thanks to the LiU IT
-department who was willing to set up and support a web application server that,
-contrary to all common sense and in violation of
-probably a dozen IT policies, contains all kinds of web vulnerabilities. Also
-thanks to Niklas Johansson for helping me get all the lab details straight and,
-of course, prof. Jan-Åke Larsson, who gave us the go-ahead to build what is
-probably going to be a very interesting lab course.
-\bigskip
-\noindent
-Linköping, November 2016\\
-\emph{Jonathan Jogenfors}
\tableofcontents
\chapter{Introduction}
Have you ever taken a computer security course and wanted to learn more? Tired
@@ -103,7 +81,7 @@ with the goal of breaking into them and/or make the application perform tasks
that it was not designed for.
\section{Overview}
-In the LiU TopDog 2017 challenge you will practice
+In the LiU TopDog Hacking Challenge you will practice
penetration testing. Using a set of increasingly difficult assignments, you will
gradually learn the basics of how an adversary might exploit badly designed
applications and security systems. The goal is to give you the basics in
@@ -111,45 +89,39 @@ practical security work and understand some common pitfalls when developing web
applications. After the lab you should be well-equipped to avoid these security
issues whenever you develop your own web application.
-\section{Lab organization}
-This lab will run for the entire duration of the course, from the start of the
-lab to the end of the exam period. The lab system is
+\section{Lab organization}\label{sec:lab_organization}
+This lab will run from the starting date to the end of the exam period. The lab system is
publicly available and you can work on the assignments in your own time on the
lab computers or your personal laptops. The progress will be stored on the
server so you can come back at any time.
-There are scheduled sessions, but the idea is that you try to solve as much as
-possible on your own and if you get stuck you can book yourself up for a
-sessions. In other words you should think of theses session as time-slots where
-the assistant is available for questions, and not as sessions where you go and
-perform the lab from start to finish. In order to
-get the most out of these coaching sessions, make sure you prepare well for the
-sessions. The coaching session will be attended by a large number of students,
-so the lab assistant won't be able to spend too much time giving individual
-help. Instead, prepare some questions that you bring, for instance if you are
-stuck in a module and need a hint. You register for the coaching session in
-Lisam.
-The coaching sessions are not compulsory!
-
-\section{Deadline}\label{sec:deadline}
-The lab server opens up for registration on November 8th at 17:00. The lab must
-be finished before the end of the exam period. Shortly after, the TopDog server
-will be shut down, so you can't do the lab after this date. If you don't
-complete the assignments before the deadline, you will have to do the lab next
-year.
+There are scheduled sessions where the assistant will be available at his or her
+office to provide assistance. Plan carefully, because time will be limited for
+each student. Assistance will be provided at a first come, first served basis.
+Think drop-in, so no booking is required.
+
+For other questions please see \cref{sec:contact}.
+
+\section{Deadlines}\label{sec:deadline}
+The lab must be finished before the end
+of the exam period. Shortly after, the TopDog server will be shut down, so you
+can't do the lab after this date. If you don't complete the assignments before
+the deadline, you will have to do the lab next year.
+
+Winner of the competition
+will be the leader of the scoreboard by 5 pm the day before the (first) guest lecture (the scoreboard will lock at this point).
\section{Disciplinary stuff}
-You are expected to do the lab in your own in groups of two. Co-operation
-between groups is allowed, but remember that pentesting is best learned when you
-try it for yourselves. You are not allowed to copy answers from other groups, and you
-are expected to understand and follow the university-wide rules for disciplinary
-matters. As for any other examination you are not allowed to cheat.
+You are expected to do the lab in your own.
+Co-operation is allowed and encouraged. You are expected to understand and
+follow the university-wide rules for disciplinary matters, as for any other
+examination you are not allowed to cheat.
\section{Ethics}
This lab and what you learn is for educational purposes only. Do not attempt to
use these techniques without authorization. If you are caught engaging in
-unauthorized hacking, most companies will take legal action. Claiming that you
-were doing security research will not protect you.
+unauthorized hacking, most companies will take legal action. \textbf{Claiming that you
+were doing security research will not protect you.}
\section{Contact information}\label{sec:contact}
To get in touch with the lab assistant, please send e-mail to the e-mail address
@@ -169,66 +141,65 @@ latest version of this document, so be sure to check it out regularly.
\end{description}
\chapter{Preparing for the lab}
-Begin by reading through the entire lab PM. Remember to regularly check the
+\textbf{Begin by reading through the entire lab PM}. Remember to regularly check the
course homepage to see if we updated the PM, as we continuously improve the lab.
+%
+%\section{Lab group}
+%First, you need to find a partner to work with. All students are expected to
+%work in groups of two. If this is not possible, please contact the lab
+%assistant. When you have somebody to work with you will need to choose a
+%username and password to use on the TopDog server. Each group of two
+%will have an account, so you will need to choose a username and password for the
+%group. Please note the following:
+%\begin{enumerate}
+% \item Your username (not password) is public and will be shown to to the
+% entire university on the scoreboard (which is shown on monitors around
+% the campus).
+% \item We reserve the right to ban stupid and/or offensive usernames for any
+% reason.
+% \item Both of you will have the password, so choose a password you don't use
+% anywhere else.
+% \item The password storage in TopDog is hashed and salted, however do not
+% use a password that you care about.
+%\end{enumerate}
+%Tip: Generate a random password
+%and write it down on a note in your wallet, or use a password manager!
+
+\section{User accounts}\label{sec:register}
+If you are register to the course, you will automatically have an account. If you are not registered, you need to contact a \href{https://www.lith.liu.se/studievagledning?l=en\&sc=true}{study chancellor}.
-\section{Lab group}
-First, you need to find a partner to work with. All students are expected to
-work in groups of two. If this is not possible, please contact the lab
-assistant. When you have somebody to work with you will need to choose a
-username and password to use on the TopDog server. Each group of two
-will have an account, so you will need to choose a username and password for the
-group. Please note the following:
-\begin{enumerate}
- \item Your username (not password) is public and will be shown to to the
- entire university on the scoreboard (which is shown on monitors around
- the campus).
- \item We reserve the right to ban stupid and/or offensive usernames for any
- reason.
- \item Both of you will have the password, so choose a password you don't use
- anywhere else.
- \item The password storage in TopDog is hashed and salted, however do not
- use a password that you care about.
-\end{enumerate}
-Tip: Generate a random password
-and write it down on a note in your wallet, or use a password manager!
-
-\section{User account registration}\label{sec:register}
Now go to
-\href{http://snickerboa.it.liu.se/register.jsp}{http://snickerboa.it.liu.se/register.jsp} and
-register an account, see \cref{fig:login}. Note that the registration link is
-hidden and must be typed just like that. The registration screen is shown in
-\cref{fig:register}. Note that registration requires you to type in the correct
-\texttt{passcode}, which is found in Lisam. The passcode is to discourage people
-outside the course to do the lab and appear on the scoreboard. Please do not
-share the passcode.
-\begin{figure}
- \centering
- \includegraphics[width=.9\linewidth]{register.png}
- \caption{The TopDog registration page.\label{fig:register}}
-\end{figure}
-
-Next, return to the login screen and login with your credentials. If you
-succeeded, you will be greeted with \enquote{Let's get
-started!}. This means you logged in. If the login fails, please double-check the
-login username and password before contacting us (see \cref{sec:contact}).
-
-\begin{figure}
- \centering
- \includegraphics[width=.9\linewidth]{login.png}
- \caption{The TopDog login page.\label{fig:login}}
-\end{figure}
+\href{http://snickerboa.it.liu.se}{http://snickerboa.it.liu.se} and click on "login via SAML" and login with your LiU-id. If you don't wish your LiU-id to show on the scoreboard, you can change to a name of your choosing (at first login, if you want to change it again you need to contact us). However, we reserve the right to ban stupid and/or offensive user names for any reason.
+%register an account, see \cref{fig:login}. Note that the registration link is
+%hidden and must be typed just like that. The registration screen is shown in
+%\cref{fig:register}. Note that registration requires you to type in the correct
+%\texttt{passcode}, which is found in Lisam. The passcode is to discourage people
+%outside the course to do the lab and appear on the scoreboard. Please do not
+%share the passcode.
+%\begin{figure}
+% \centering
+% \includegraphics[width=.9\linewidth]{register.png}
+% \caption{The TopDog registration page.\label{fig:register}}
+%\end{figure}
+%
+%Next, return to the login screen and login with your credentials. If you
+%succeeded, you will be greeted with \enquote{Let's get
+%started!}. This means you logged in. If the login fails, please double-check the
+%login username and password before contacting us (see \cref{sec:contact}).
+%
+%\begin{figure}
+% \centering
+% \includegraphics[width=.9\linewidth]{login.png}
+% \caption{The TopDog login page.\label{fig:login}}
+%\end{figure}
\chapter{Performing the Lab}
TopDog contains a number of modules that cover different topics in
-web pentesting. It also offers a number of lessons that give a gentle
-introduction to the topic on hand.
-
-
+web pentesting.
\section{Assignments}\label{sec:assignments}
-In order to pass the lab, you are required to finish all 21 assignments. In
+In order to pass the lab, you are required to finish all 21 assignments (see \cref{sec:list_of_ass}). In
order to prepare yourself for the assignments, there are also lessons which give
a gentle introduction to the topic at hand. You can solve the assignments in any
order you want.
@@ -247,7 +218,7 @@ the module the format of the result key can vary, but it might look something
like the following:
\commandline{resultkey.txt}
-\begin{figure}
+\begin{figure}[b]
\centering
\includegraphics[width=.8\linewidth]{resultkey.png}
\caption{Example of result key and where to paste it.}\label{fig:resultkey}
@@ -256,15 +227,6 @@ like the following:
Whenever you receive a result key, paste it to the \enquote{Submit Result Key
Here} box on the top of the screen.
-\section{Finishing the lab}
-You are done with the lab when you have finished the 21 required assignments.
-When this is done, make sure you have signed the lab attendance list (available
-at the lectures and the coaching sessions) and then send an email to the
-\textbf{Lab E-mail} (see \cref{sec:contact}) and we will then check that you
-have done everything required of you. If you have passed we will reply with an
-OK. Check \cref{sec:deadline} for information on when the deadline is. The
-deadline is strict and the server will be taken offline afterwards!
-
\section{Best Practices}
It is a good idea to keep notes of how you pass each challenge. While your
progress on the server is backed up frequently we can never be too sure. Save
@@ -274,14 +236,13 @@ server failure.
\section{Scoreboard}
Whenever you finish a lesson, assignment, or challenge, it will show up on the
LiU TopDog scoreboard. The scoreboard is public, and anybody can see the
-progress of the different groups. In addition, the scoreboard will be displayed
-on monitors around the campus, so the whole University will see how well you are
-doing.
+progress of the participants. In addition, the scoreboard will be displayed
+on monitors around café java.
The scoreboard is just for fun, and in order to pass you are only required to
finish the assignments. If you have finished the assignments and want more
points, you are welcome to try the challenges. Again: the scoreboard has nothing
-do do with your grade! See \cref{fig:scoreboard} for an example of what the
+do with your grade! See \cref{fig:scoreboard} for an example of what the
scoreboard looks like. For each completed lesson, assignment, or challenge you
will receive points, so the more challenges you finish, the more bragging rights
you have. Also, harder challenges give more points.
@@ -292,7 +253,7 @@ finish a given lesson or challenge in the form of medals. A gold medal is
awarded to a group who finishes a lesson or challenge nobody else has finished
yet. A silver medal is given to the second one, and bronze to the third. In the
scoreboard there will therefore be users with medals in addition to the normal
-point score. These medals give extra points to the scoreboard!
+point score. These medals are not worth any points, but will be used as tiebreakers!
But remember, the scoreboard is just for fun. It has nothing to do with actually
passing the lab.
@@ -320,15 +281,13 @@ The following lessons are available:
\item[Unvalidated Redirects and Forwards]
\end{description}
-\section{List of assignments}
+\section{List of assignments}\label{sec:list_of_ass}
Below are the required assignments (there are hidden hints!):
\begin{description}
\item[Session Management Challenge 1]
{\color{white}Try replacing \enquote{user} with
\enquote{administrator}. But where?}
\item[Poor Data Validation 1]
- {\color{white}The \enquote{troll} here means the third
- image, i.e.\ a \enquote{trollface}. Google it if you are unsure.}
\item[Cross Site Scripting 1]
\item[Session Management Challenge 2]
{\color{white}Try attacking the password reset.}
@@ -377,9 +336,27 @@ Below are the required assignments (there are hidden hints!):
See \cref{sec:faq-bank} if there's not enough money anywhere!}
\end{description}
+\chapter{Contributing to the lab}
+We think the CTF lab is a great way to teach, and want to encourage you to submit your ideas and feedback to us. Do visit our \href{https://gitlab.liu.se/topdog/ctf-lab-pm}{internal project page}, where you can help us out! This is the LiU GitLab server, and you can file an issue by clicking on the issues link shown in \cref{fig:issues}.
+
+
+ \begin{figure}
+ \centering
+ \includegraphics[width=.9\linewidth]{issues.png}
+ \caption{Click on Issues to file an issue report.}
+ \label{fig:issues}
+ \end{figure}
+
+
+
+
\chapter{Frequently Asked Questions (FAQ)}
This section will be updated with frequently asked questions about the lab.
+\section{I'm stuck, what should I do?}
+First make sure you have read through the whole lab PM. Second, consult and discuss with a friend (this is the best way of getting new ideas). Lastly, use the assistances drop-in time slot (see \cref{sec:lab_organization}).
+
+
\section{There is something wrong with the server!}
First check that your Internet connection is working and that your attack proxy
isn't giving you problems. If the TopDog server is unavailable, or if there's some
@@ -392,10 +369,12 @@ If the server is still down and there's nothing on Lisam saying it's a planned
outage, the server might be down. Please send an e-mail to the lab assistant,
see \cref{sec:contact}.
-\section{How do I create a TopDog account?}
-See \cref{sec:register}.
+%\section{How do I create a TopDog account?}
+%
+%
+%See \cref{sec:register}.
-\section{How can I get bonus points for the exam?}
+\section{Can I get bonus points for the exam?}
The scoreboard and its points, bonus points, and medals is for fun only. They
have absolutely nothing to do with passing the lab or with the examination of
the course. The lab assistant can see how many assignments you have finished,
@@ -428,19 +407,37 @@ It can happen that the total amount of money is too small to pass the lab. In
this case, contact us at \cref{sec:contact} and we'll fill up bank with some
more money to steal :)
-\section{I found a typo or have a suggestion for this lab PM!}
-We constantly work on getting the lab and this document as good as possible. If
-you have a suggestion, don't hesitate to contact us (see \cref{sec:contact}).
-
\section{I love computer security and I am looking for thesis work!}
-Check out Jonathan's list of thesis
-projects\footnote{http://people.isy.liu.se/icg/jonfo33/supervision/proposals.html}
-or the list at the Information Coding
-Group\footnote{http://www.icg.isy.liu.se/exjobb/}. Also, if you like crypto we
+Don't hesitate to contact us at the Information Coding Group\footnote{https://liu.se/en/organisation/liu/isy/icg}. Also, if you like crypto we
highly recommend the course TSIT03
Cryptology\footnote{http://www.icg.isy.liu.se/courses/tsit03/} that is given in
HT1 every year.
+\section*{About this document}
+This lab memo is intended for students of the computer security courses \texttt{TSIT01} and
+\texttt{TSIT02} at Linköping University.
+\section*{Changelog}
+\begin{description}
+ \item[2019] Adaption to the new registration procedure.
+ \item[2017] Revised for the 2017 course.
+ \item[2016] Initial version.
+\end{description}
+\section*{Acknowledgements}
+This lab owes its existence to Anders Märak Leffler who brought this software to
+my attention back in 2015. I also want to thank the OWASP Foundation and the
+OWASP chapter in Gothenburg for help with getting started. Thanks to the LiU IT
+department who was willing to set up and support a web application server that,
+contrary to all common sense and in violation of
+probably a dozen IT policies, contains all kinds of web vulnerabilities. Also
+thanks to Niklas Johansson for helping me get all the lab details straight and,
+of course, prof. Jan-Åke Larsson, who gave us the go-ahead to build what is
+probably going to be a very interesting lab course.
+\bigskip
+
+\noindent
+Linköping, November 2016\\
+\emph{Jonathan Jogenfors}
+
\appendix
\chapter{Tools}\label{sec:tools}
Penetration testing requires you to have a large and diverse toolbox. In this
@@ -632,4 +629,6 @@ who finish first.
If you found this lab course interesting and want more CTF challenges, check out
this list: \url{https://captf.com/practice-ctf/}.
+
+
\end{document}
diff --git a/images/gitlab.png b/images/gitlab.png
new file mode 100644
index 0000000000000000000000000000000000000000..1437faec05999fd3cdedcc025e6fadfb8f543c5c
Binary files /dev/null and b/images/gitlab.png differ
diff --git a/images/issues.png b/images/issues.png
new file mode 100644
index 0000000000000000000000000000000000000000..6e446ee27b6d47ca651617e62729e31ef5b1ffd3
Binary files /dev/null and b/images/issues.png differ