|
| 1 | +# Resources from JCTF |
| 2 | +* Backend Web Code |
| 3 | +* Some Speaker Notes |
| 4 | + |
| 5 | +## Backend Web Code |
| 6 | +<!-- Written up and developed by AOrps --> |
| 7 | +* All Web Site Server services used Nginx |
| 8 | + |
| 9 | +```txt |
| 10 | +insp3ctor -> jerseyctf.xyz |
| 11 | +post-up -> jerseyctf.info |
| 12 | +clientside -> jerseyctf.live |
| 13 | +reDirector -> jerseyctf.net |
| 14 | +``` |
| 15 | +### Startup Dependency Script |
| 16 | +```bash |
| 17 | +#!/bin/bash |
| 18 | + |
| 19 | +# All the Dependecies needed |
| 20 | +sudo apt install nginx golang-go python3 -y |
| 21 | +``` |
| 22 | + |
| 23 | +### inspector Server |
| 24 | +* [Golang Server](https://github.com/njitacm/jerseyctf-registration-site/blob/main/serve.go) |
| 25 | +* Nginx Config |
| 26 | + ```nginx |
| 27 | + server { |
| 28 | + server_name jerseyctf.xyz www.jerseyctf.xyz; |
| 29 | +
|
| 30 | + root /home/acm/inspector; |
| 31 | + index index.html; |
| 32 | +
|
| 33 | + location / { |
| 34 | + proxy_pass http://localhost:9990; |
| 35 | + } |
| 36 | + } |
| 37 | + ``` |
| 38 | +### postup Server |
| 39 | +* Golang Server Backend |
| 40 | + ```go |
| 41 | + package main |
| 42 | +
|
| 43 | + import ( |
| 44 | + "fmt" |
| 45 | + "log" |
| 46 | + "net/http" |
| 47 | + ) |
| 48 | +
|
| 49 | + func getFlag(w http.ResponseWriter, r *http.Request) { |
| 50 | +
|
| 51 | + if r.Method != http.MethodPost { |
| 52 | + fmt.Fprintf(w, "POST UP BROTENDO\n") |
| 53 | + return |
| 54 | + } |
| 55 | +
|
| 56 | + fmt.Fprintf(w, "jctf{P0st_M3th0ds_4re_c0ol_broTendo}\n") |
| 57 | +
|
| 58 | + } |
| 59 | +
|
| 60 | + func main() { |
| 61 | + http.HandleFunc("/", getFlag) |
| 62 | +
|
| 63 | + if err := http.ListenAndServe(":9990", nil); err != nil { |
| 64 | + log.Fatal(err) |
| 65 | + } |
| 66 | +
|
| 67 | + } |
| 68 | + ``` |
| 69 | +
|
| 70 | +* Nginx Config |
| 71 | + ```nginx |
| 72 | + server { |
| 73 | + server_name jerseyctf.info www.jerseyctf.info; |
| 74 | +
|
| 75 | + location / { |
| 76 | + proxy_pass http://localhost:9990; |
| 77 | + } |
| 78 | + ``` |
| 79 | +
|
| 80 | +
|
| 81 | +### clientside Server |
| 82 | +* [Golang Server](https://github.com/njitacm/jerseyctf-registration-site/blob/main/serve.go) |
| 83 | +* Nginx Config |
| 84 | + ```nginx |
| 85 | + server { |
| 86 | + server_name jerseyctf.live www.jerseyctf.live; |
| 87 | +
|
| 88 | + root /home/acm/clientside; |
| 89 | + index index.html; |
| 90 | +
|
| 91 | + location / { |
| 92 | + proxy_pass http://localhost:9990; |
| 93 | + } |
| 94 | + } |
| 95 | + ``` |
| 96 | +
|
| 97 | +### redirector Server |
| 98 | +* [Python Tutorial with uWSGI](https://www.digitalocean.com/community/tutorials/how-to-serve-flask-applications-with-uswgi-and-nginx-on-ubuntu-18-04) |
| 99 | +* Nginx Config |
| 100 | + ```nginx |
| 101 | + server { |
| 102 | + listen 80; |
| 103 | + server_name jerseyctf.net www.jerseyctf.net; |
| 104 | +
|
| 105 | + location / { |
| 106 | + include uwsgi_params; |
| 107 | + uwsgi_pass unix:/home/acm/redirector/redirector.sock; |
| 108 | + } |
| 109 | + } |
| 110 | + ``` |
| 111 | +
|
| 112 | +--- |
| 113 | +
|
| 114 | +## Speaker Resources |
| 115 | +<!-- Report Done by DatGuy000 --> |
| 116 | +
|
| 117 | +### Gabrielle Botbol |
| 118 | +* Physical Intrusion |
| 119 | + * “Code name 23-00” |
| 120 | + * https://gabrielleb.fr/blog/2020/06/13/code-name-23-00-nom-de-code-23-00/ |
| 121 | +* Pentest Report |
| 122 | + * https://gabrielleb.fr/blog/2021/02/14/how-to-write-a-pentest-report/ |
| 123 | +* Vulnerabilities?? |
| 124 | + * XSS: https://owasp.org/www-community/attacks/xss/ |
| 125 | + * SQLI: https://owasp.org/www-community/attacks/SQL_Injection |
| 126 | + * Directory traversal: https://owasp.org/www-community/attacks/Path_Traversal |
| 127 | +* More resources and advice on my blog: |
| 128 | + * https://gabrielleb.fr/blog/2018/09/16/ressources-resources/ |
| 129 | + * https://gabrielleb.fr/blog/2020/10/18/how-to-get-started-with-pentesting/ |
| 130 | +* Hacking tools: |
| 131 | + * Tryhackme: https://tryhackme.com/ (more beginner-friendly) |
| 132 | + * Hackthebox: https://www.hackthebox.eu/ (steeper learning curve) |
| 133 | +* Contact Info |
| 134 | + * Twitter: @Gabrielle_BGB |
| 135 | + * Linkedin: /in/gabriellebotbol |
| 136 | + * [Blog](https://gabrielleb.fr/blog) |
| 137 | + * Feel free to connect: https://www.linkedin.com/in/gabriellebotbol/ |
| 138 | +
|
| 139 | +
|
| 140 | +### Seth Kirschner |
| 141 | +* Speaker for big4 cyber currently at MUFG Securities Americas leading application and data security |
| 142 | + * https://www.linkedin.com/in/sethkirschner |
| 143 | +
|
| 144 | +### Ilan Ponimansky |
| 145 | +* [Github Presentation](https://github.com/iloveicedgreentea/jerseyctf-presentation) |
| 146 | +* [LinkedIn](https://www.linkedin.com/in/ilanponimansky/) |
| 147 | +
|
| 148 | +### Jon Helmus |
| 149 | +* [LinkedIn](https://www.linkedin.com/in/jon-helmus-474146103/) |
| 150 | +* [HTB Seattle Discord Link](https://discord.gg/XduZrTBp) |
| 151 | +
|
| 152 | +### William Price |
| 153 | +* [Presentation Slides](https://docs.google.com/presentation/d/1mkUdhZDPWkiOZ4BITrBfLOzFGB0ZgDno7MmwHkopylc/edit?usp=sharing) |
| 154 | +
|
| 155 | +### John Jackson |
| 156 | +* Resources: |
| 157 | + * TryHackMe [Friendly & Flexible] |
| 158 | + * HackTheBox [More Difficult] |
| 159 | + * Vulnhub [Wide Range, Hard to Vet] |
| 160 | + * CTF Events [Haystack, For-fun, Least Flexible] |
| 161 | +* https://any.run/ |
| 162 | +* https://github.com/projectdiscovery/nuclei |
| 163 | +* https://github.com/OJ/gobuster |
| 164 | +* Books |
| 165 | + * Penetration Testing: A Hands-On Introduction to Hacking, _Georgia Weidman_ |
| 166 | + * Advanced Penetration Testing: Hacking the World's Most Secure Networks _WIL ALLSOPP_ |
| 167 | + * AWS Penetration Testing: Beginner's guide to hacking AWS with tools such as Kali Linux, Metasploit, and Nmap _Jonathan Helmus_ |
| 168 | + * Corporate CyberSecurity: Identifying Risks and The Bug Bounty Program _John Jackson_ |
| 169 | +--- |
0 commit comments