Final exam

• saturday, 27th april
• 3 hours (1pm - 4pm)
• worth 50%

whats in it

• everything is assessable™
• not just stuff from wargames
• submit a short writeup explaination
• there’s also a shortish devsecops question

how2hack

• my biggest tip is try not to stress out
• + practice, practice, practice
• start with recon before you write payloads

CVEs

Common Vulnerability Enumerations

It’s really important that the security community works together

where to find em

Application Security Testing

SAST vs DAST tools

• SAST: full access to source-code (white box)
• DAST: just have the application (black box)
• IAST: runtime specific (e.g. only specific times)

who’d be dumb enough to…

me lol (it’s not a pub-key…)

top 10 images taken moments before after disaster

maybe check your old projects to see if you’ve made similar dumb mistakes?

The fundamentals

• Availability 💰
• Reliability 💰
• Scalability 💰
• Security 🙈 🙉 🙊

At a high level

• UX/UI (e.g. meme meme2)
• load speed
• load balancing

not doing this

Supply chain attacks

dependency stuffs

Trusting code we didn’t write ourselves

• npm
• pip/pypi
• pacman/aur
• cargo

Vulnerabilities

• log4j (2 billion devices!!!)

• pac-resolver (3 million weekly downloads)

Malicious developers

• node-ipc / lovenotwar

Dependency confusion

• npm install xyz
• how does it resolve xyz
• public & private version of xyz
• higher version number

read more

Typosquatting

• pip install falsk
• package named falsk:

read more

Vulnerability in the package manager

I don’t have an example 🤷

CI/CD

keeping it secure

• github actions (ramble)
• pre-commit hooks
• .gitignore
• not this

what to keep secure

• tokens
• keys
• .env
• .git

basically just ~secrets~

dumb projects idk

• git-blame
• hello-world.rs
• logout4shell
• nocode
• printf-tac-toe
• printbf

Browsing vs SDN (site-to-site)

Privacy

“providers who claim not to keep any logs of their users’ online activities recently left 1.2 terabytes of private user data exposed” 🤔

Privilege escalation

what to do once you have RCE

• can execute arbitrary commands, but we’re executing them as a lower-level user (e.g. www-data or Nobody)
• We want our commands to execute as root/admin/superuser

How to privesc

• world-writable /etc/passwd (wait it is useful?)
• cronjob running as sudo
• setuid binaries
• commands run as root without password
• vulnerabilities in the kernel itself (dirtycow?)

Docker escape

Useful resources

• linPEAS
• CDK
• amicontained
• deepce
• grype