Skip to content

Commit de66bf9

Browse files
committed
resources and renamed sponker to keep all the challenge dirs in some consecutive order
1 parent 55f39ec commit de66bf9

File tree

2 files changed

+169
-0
lines changed

2 files changed

+169
-0
lines changed

| resources/README.md

+169
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,169 @@
1+
# Resources from JCTF
2+
* Backend Web Code
3+
* Some Speaker Notes
4+
5+
## Backend Web Code
6+
<!-- Written up and developed by AOrps -->
7+
* All Web Site Server services used Nginx
8+
9+
```txt
10+
insp3ctor -> jerseyctf.xyz
11+
post-up -> jerseyctf.info
12+
clientside -> jerseyctf.live
13+
reDirector -> jerseyctf.net
14+
```
15+
### Startup Dependency Script
16+
```bash
17+
#!/bin/bash
18+
19+
# All the Dependecies needed
20+
sudo apt install nginx golang-go python3 -y
21+
```
22+
23+
### inspector Server
24+
* [Golang Server](https://github.com/njitacm/jerseyctf-registration-site/blob/main/serve.go)
25+
* Nginx Config
26+
```nginx
27+
server {
28+
server_name jerseyctf.xyz www.jerseyctf.xyz;
29+
30+
root /home/acm/inspector;
31+
index index.html;
32+
33+
location / {
34+
proxy_pass http://localhost:9990;
35+
}
36+
}
37+
```
38+
### postup Server
39+
* Golang Server Backend
40+
```go
41+
package main
42+
43+
import (
44+
"fmt"
45+
"log"
46+
"net/http"
47+
)
48+
49+
func getFlag(w http.ResponseWriter, r *http.Request) {
50+
51+
if r.Method != http.MethodPost {
52+
fmt.Fprintf(w, "POST UP BROTENDO\n")
53+
return
54+
}
55+
56+
fmt.Fprintf(w, "jctf{P0st_M3th0ds_4re_c0ol_broTendo}\n")
57+
58+
}
59+
60+
func main() {
61+
http.HandleFunc("/", getFlag)
62+
63+
if err := http.ListenAndServe(":9990", nil); err != nil {
64+
log.Fatal(err)
65+
}
66+
67+
}
68+
```
69+
70+
* Nginx Config
71+
```nginx
72+
server {
73+
server_name jerseyctf.info www.jerseyctf.info;
74+
75+
location / {
76+
proxy_pass http://localhost:9990;
77+
}
78+
```
79+
80+
81+
### clientside Server
82+
* [Golang Server](https://github.com/njitacm/jerseyctf-registration-site/blob/main/serve.go)
83+
* Nginx Config
84+
```nginx
85+
server {
86+
server_name jerseyctf.live www.jerseyctf.live;
87+
88+
root /home/acm/clientside;
89+
index index.html;
90+
91+
location / {
92+
proxy_pass http://localhost:9990;
93+
}
94+
}
95+
```
96+
97+
### redirector Server
98+
* [Python Tutorial with uWSGI](https://www.digitalocean.com/community/tutorials/how-to-serve-flask-applications-with-uswgi-and-nginx-on-ubuntu-18-04)
99+
* Nginx Config
100+
```nginx
101+
server {
102+
listen 80;
103+
server_name jerseyctf.net www.jerseyctf.net;
104+
105+
location / {
106+
include uwsgi_params;
107+
uwsgi_pass unix:/home/acm/redirector/redirector.sock;
108+
}
109+
}
110+
```
111+
112+
---
113+
114+
## Speaker Resources
115+
<!-- Report Done by DatGuy000 -->
116+
117+
### Gabrielle Botbol
118+
* Physical Intrusion
119+
* “Code name 23-00”
120+
* https://gabrielleb.fr/blog/2020/06/13/code-name-23-00-nom-de-code-23-00/
121+
* Pentest Report
122+
* https://gabrielleb.fr/blog/2021/02/14/how-to-write-a-pentest-report/
123+
* Vulnerabilities??
124+
* XSS: https://owasp.org/www-community/attacks/xss/
125+
* SQLI: https://owasp.org/www-community/attacks/SQL_Injection
126+
* Directory traversal: https://owasp.org/www-community/attacks/Path_Traversal
127+
* More resources and advice on my blog:
128+
* https://gabrielleb.fr/blog/2018/09/16/ressources-resources/
129+
* https://gabrielleb.fr/blog/2020/10/18/how-to-get-started-with-pentesting/
130+
* Hacking tools:
131+
* Tryhackme: https://tryhackme.com/ (more beginner-friendly)
132+
* Hackthebox: https://www.hackthebox.eu/ (steeper learning curve)
133+
* Contact Info
134+
* Twitter: @Gabrielle_BGB
135+
* Linkedin: /in/gabriellebotbol
136+
* [Blog](https://gabrielleb.fr/blog)
137+
* Feel free to connect: https://www.linkedin.com/in/gabriellebotbol/
138+
139+
140+
### Seth Kirschner
141+
* Speaker for big4 cyber currently at MUFG Securities Americas leading application and data security
142+
* https://www.linkedin.com/in/sethkirschner
143+
144+
### Ilan Ponimansky
145+
* [Github Presentation](https://github.com/iloveicedgreentea/jerseyctf-presentation)
146+
* [LinkedIn](https://www.linkedin.com/in/ilanponimansky/)
147+
148+
### Jon Helmus
149+
* [LinkedIn](https://www.linkedin.com/in/jon-helmus-474146103/)
150+
* [HTB Seattle Discord Link](https://discord.gg/XduZrTBp)
151+
152+
### William Price
153+
* [Presentation Slides](https://docs.google.com/presentation/d/1mkUdhZDPWkiOZ4BITrBfLOzFGB0ZgDno7MmwHkopylc/edit?usp=sharing)
154+
155+
### John Jackson
156+
* Resources:
157+
* TryHackMe [Friendly & Flexible]
158+
* HackTheBox [More Difficult]
159+
* Vulnhub [Wide Range, Hard to Vet]
160+
* CTF Events [Haystack, For-fun, Least Flexible]
161+
* https://any.run/
162+
* https://github.com/projectdiscovery/nuclei
163+
* https://github.com/OJ/gobuster
164+
* Books
165+
* Penetration Testing: A Hands-On Introduction to Hacking, _Georgia Weidman_
166+
* Advanced Penetration Testing: Hacking the World's Most Secure Networks _WIL ALLSOPP_
167+
* AWS Penetration Testing: Beginner's guide to hacking AWS with tools such as Kali Linux, Metasploit, and Nmap _Jonathan Helmus_
168+
* Corporate CyberSecurity: Identifying Risks and The Bug Bounty Program _John Jackson_
169+
---
File renamed without changes.

0 commit comments

Comments
 (0)