SANS542 GWAPT CTF - WON!!!

So after an intensive theory/practical classes, the 6th day is where the knowledge starts to apply! CTF! The reward: a limited edition SANS medal coin! The medal is only given to those who managed to win the Capture the Flag competition and yes, it is a big deal to bring back a glory for the team and company after spending so much for the training in Bangkok, Thailand.

It wasn't an easy competition. The flags were to Social Security Numbers, Addresses, Bank Accounts and its balances. We had to think outside of the box to capture a flag like for example, after using Nikto, we found ourselves staring blank at the result until one of us viewed the source code of the results and PING! we found a flag!

It wasn't easy to be honest, and while i tried to use commercial tools to cheat my way to win, eventually, it couldn't find anything. Tools that were used during the CTF were

1) NMAP
2) CEWL
3) Burpsuite (lots and lots of it)
4) Nikto
5) Your creativity

It was a great team effort and we finally pulled it off! Got all 3 flags. And well, here it is:

SANS Thailand 2013

Web App Penetration Testing and Ethical Hacking (SEC542)

August 26-31.2013

Bangkok

My team mate and my laptop...

This is my first time winning a Capture the Flag event and looking forward to more such competitions in the future. 

SANS 542 - Web Application Penetration Testing: Day 1

SANS 542.1

The Attacker's View of the Web

Location: Bangkok's Crowne Plaza Hotel

Topics covered during Day 1:

>Setting up Samurai WTF

> Web Site Server Architecture

>Understanding HTTP protocol

>Pentesting Types and Methods

>Components of Web App pentest

>Reports of findings

>Attack Methodology

>Types of Flaws

>Javascript

While many of the day 1 lesson covered i already have the knowledge, there were also many that i learnt such as analyzing HTTP using Wireshark and Paros Proxy. Also i learnt how to decrypt HTTPS communication using Wireshark. Basic Javascript attacks such as XSS were introduced and will be covered more in the other days and im so looking forward for that! The trainer was from Belgium and he had a great command of the English language that could easily understood. Can't wait for day 2.