W 100: KONTRA (25 pts extra)

What You Need

Purpose

To see the basics of Web vulnerabilities, including the source code.

W 100.1: SQL Injection (5 pts)

In a Web browser, go to:

https://application.security/free-application-security-training/owas-top-10-sql-injection

Follow the instructions to step through the exercise. Near the end, find the screen shown below.

Find the text covered by the green box in the image below. That's the flag.

W 100.2: Command Injection (5 pts)

In a Web browser, go to:

https://application.security/free-application-security-training/owasp-top-10-command-injection

Follow the instructions to step through the exercise. Near the end, find the screen shown below.

Find the text covered by the green box in the image below. That's the flag.

W 100.3: Directory Traversal (5 pts)

In a Web browser, go to:

https://application.security/free-application-security-training/owasp-top-10-directory-traversal

Follow the instructions to step through the exercise. Near the end, find the screen shown below.

Find the text covered by the green box in the image below. That's the flag.

W 100.4: Header Injection (5 pts)

In a Web browser, go to:

https://application.security/free-application-security-training/owasp-top-10-host-header-injection

Follow the instructions to step through the exercise. Near the end, find the screen shown below.

Find the text covered by the green box in the image below. That's the flag.

W 100.5: Cross Site Request Forgery (5 pts)

In a Web browser, go to:

https://application.security/free-application-security-training/owasp-top-10-cross-site-request-forgery

Follow the instructions to step through the exercise. Near the end, find the screen shown below.

Find the text covered by the green box in the image below. That's the flag.


Thanks to Irvin Lemus for showing me this site in a Pacific Hackers workshop!

Posted 3-13-21 by Sam Bowne