blairsec writeups

Last meeting we learned about classical cryptography!

On 2/10, we learned about how exploitations could be based on flaws in the hardware of a device rather than the software which we normally talk about.

Last meeting we learned about how to use GDB, lecture here.

Last meeting Jason taught us about how to reverse engineer executables! Lecture here.

Last meeting we went over an overview of vulnerability research, the recent log4j vulnerability, and finally some more Linux stuff. Lecture here.

After some teacher sponsor troubles, we finally got a meeting together last week, and we talked about Linux fundamentals.

Last meeting, we did a bunch of random small web topics, and there were challenges on type juggling, SSRF, and SSTI.

On 10/14, we focused on SQL injections which allow us to access data in databases that we wouldn’t be given otherwise!

Last meeting, we talked about local file inclusion, which is a pretty dangerous vulnerability. We can read files we aren’t supposed to, and in certain cases even gain code execution on the server itself, which is impossible to do with XSS.

Last meeting (9/30), we split into two groups. The main group learned about CSP and tackled the challenge I’m writing up now, and the beginner group went with Alexa to learn about CTFs and get used to the format.