You are the new recruit. The student portal is yours to protect.
Picture the BIT (Bangalore Institute of Technology) student portal: every student's marks, fee payments and personal details in one place. Walk the campus one stop at a time. Each stop teaches one idea.
- Read the briefingEvery level starts with the one idea you need and the goal you must reach.
- Play the levelSort, score, break and fix things. The bar at the bottom shows how close you are.
- Collect what you learnedFinish the level to see the takeaways. Retry as often as you like: every attempt is counted.
- Asset
- Something of value that you protect.
- Threat
- Anything that could harm an asset.
- Vulnerability
- A weakness that a threat can use.
- Control
- What you do to reduce the risk.
Level 7 sends you to four real projects to assess. You can open the list any time: the four projects ↗
| Level | Attempts | Best score | Status |
|---|
Encrypt a message
Break this one
Someone sent this over the college Wi-Fi. You do not have the key.
Change one character
A stolen password table
This table was stolen from a badly built website. It holds SHA-256 hashes, not passwords. You cannot reverse a hash, so do what attackers do: type a password that many people use and see whether its hash is in the table.
| User | Salt | Stored hash | Cracked? |
|---|
Try the passwords that top every "most common" list: 123456, password, qwerty.
Read only. Find your proof in the code and the documents. Never test a website you do not own.
Pick a project to get its link.
- READMEWhat the app does and what data it holds: these are your assets. Also look for warnings and default logins.
- Data foldersFolders named models, data or schema list the tables and fields. Each one is a possible asset.
- Config filesLook in config, .env examples and docker-compose files. A password or secret key written in the code is a vulnerability.
- Dependency filepackage.json, pom.xml or composer.json lists the libraries used. Old versions carry known flaws (CVEs).
- Security tab, IssuesWhat other people have already reported. Search the Issues for the word "security".
Accounts Office, BIT
Set the username to admin. In the password box type ' OR '1'='1 and read the query on the right. Another way: username admin' -- with any password.
| Rows returned | Role |
|---|