đŸš©
THM Walkthroughs
  • THM Walkthroughs
    • đŸ§‘â€đŸ«Tutorial
  • 🟩Difficulty: Info
    • 🔌What is Networking?
    • 🔌Intro to LAN
    • 🐧Linux Fundamentals
      • 🐧Linux Fundamentals Part 1
        • Task 2 - A Bit of Background on Linux
        • Task 4 - Running Your First few Commands
        • Task 5 - Interacting With the Filesystem!
        • Task 6 - Searching for Files
        • Task 7 - An Introduction to Shell Operators
      • 🐧Linux Fundamentals Part 2
        • Task 3 - Introduction to Flags and Switches
        • Task 4 - Filesystem Interaction Continued
        • Task 5 - Permissions 101
        • Task 6 - Common Directories
      • 🐧Linux Fundamentals Part 3
        • Task 3 - Terminal Text Editors
        • Task 4 - General/Useful Utilities
        • Task 5 - Processes 101
        • Task 6 - Maintaining Your System: Automation
        • Task 8 - Maintaining Your System: Logs
    • đŸȘŸWindows Fundamentals
      • đŸȘŸWindows Fundamentals 1
      • đŸȘŸWindows Fundamentals 2
      • đŸȘŸWindows Fundamentals 3
    • 🔓Principles of Security
    • 🐍Python Basics
    • 🔍History of Malware
    • đŸŠčCommon Attacks
    • đŸ–„ïžSecurity Awareness
    • ⚔Intro to Offensive Security
    • đŸŠčPentesting Fundamentals
    • 🔓CVE Walkthroughs
      • đŸ–„ïžSudo Security Bypass: CVE-2019-14287
      • đŸ–„ïžSudo Buffer Overflow: CVE-2019-18634
      • đŸ–„ïžBaron Samedit: CVE-2021-3156
      • đŸ–„ïžOverlayFS: CVE-2021-3493
      • đŸ–„ïžPolkit: CVE-2021-3560
      • đŸ–„ïžPwnkit: CVE-2021-4034
      • đŸȘ¶Apache HTTP Server Path Traversal: CVE-2021-41773/42013
      • đŸ§»Dirty Pipe: CVE-2022-0847
      • 🟱Spring4Shell: CVE-2022-22965
    • 🟧Burp Suite
      • 🟧Burp Suite: The Basics
      • 🟧Burp Suite: Repeater
    • 🏁Challenges
      • ‎Bypass Disable Functions
    • đŸŽŸïžTHM PROMOs
      • đŸŽŸïžLearn and win prizes [PROMO ENDED]
      • đŸŽŸïžLearn and win prizes #2 [PROMO ENDED]
  • đŸŸ©Difficulty: Easy
    • 🚀Learning Cyber Security
    • 🔁The Hacker Methodology
    • 🔍Google Dorking
      • Task 2 - Let's Learn About Crawlers
      • Task 4 - Beepboop - Robots.txt
      • Task 5 - Sitemaps
      • Task 6 - What is Google Dorking?
    • 🐝OWASP Top 10
      • Task 5 - Command Injection Practical
      • Task 7 - Broken Authentication Practical
      • Task 11 - Sensitive Data Exposure (Challenge)
      • Task 13 - XML External Entity - eXtensible Markup Language
      • Task 14 - XML External Entity - DTD
      • Task 16 - XML External Entity - Exploiting
      • Task 18 - Broken Access Control (IDOR Challenge)
      • Task 19 - Security Misconfiguration
      • Task 20 - Cross-site Scripting
      • Task 21 - Insecure Deserialization
      • Task 24 - Insecure Deserialization - Cookies
      • Task 25 - Insecure Deserialization - Cookies Practical
      • Task 30 - Insufficient Logging and Monitoring
    • 📡Nmap
      • Task 2 - Introduction
      • Task 3 - Nmap Switches
      • Task 5 - TCP Connect Scans
      • Task 6 - Scan Types SYN Scans
      • Task 7 - UDP Scans
      • Task 8 - NULL, FIN and Xmas
      • Task 9 - ICMP Network Scanning
      • Task 10 - NSE Scripts Overview
      • Task 11 - Working with the NSE
      • Task 12 - Searching for Scripts
      • Task 13 - Firewall Evasion
      • Task 14 - Practical
    • 📡RustScan
      • Task 2 - Installing RustScan
      • Task 5 - Extensible
      • Task 7 - Scanning Time!
      • Task 8 - RustScan Quiz
    • 🐙Crack the hash
    • 🌍OhSINT
    • 🧑‍🚀Vulnversity
    • 🧊Ice
    • đŸȘŸBlue
    • 🎄Advent of Cyber 4 (2022)
  • 🟹Difficulty: Medium
    • đŸȘŸAttacktive Directory
      • Task 3 - Welcome to Attacktive Directory
      • Task 4 - Enumerating Users via Kerberos
      • Task 5 - Abusing Kerberos
      • Task 6 - Back to the Basics
      • Task 7 - Elevating Privileges within the Domain
      • Task 8 - Flag Submission Panel
    • 💀Mr Robot CTF
    • 🛗Linux PrivEsc
    • 🛗Linux PrivEsc Arena [WIP]
    • 🛗Windows PrivEsc Arena
  • 🟧Difficulty: Hard
    • 🐘Hacking Hadoop [WIP]
  • đŸŸ„Difficulty: Insane
    • â›șYou're in a cave [WIP]
  • Blank Room (Duplicate Me)
Powered by GitBook
On this page
  • Task 1 Introduction
  • Read the above.
  • Task 2 Accessing machines
  • Connect to our network or deploy the AttackBox.
  • Task 3 [Severity 1] Injection
  • I've understood Injection attacks.
  • Task 4 [Severity 1] OS Command Injection
  • I've understood command injection.
  • Task 5 [Severity 1] Command Injection Practical
  • Task 6 [Severity 2] Broken Authentication
  • I've understood broken authentication mechanisms.
  • Task 7 [Severity 2] Broken Authentication Practical
  • Task 8 [Severity 3] Sensitive Data Exposure (Introduction)
  • Read the introduction to Sensitive Data Exposure and deploy the machine.
  • Task 9 [Severity 3] Sensitive Data Exposure (Supporting Material 1)
  • Read and understand the supporting material on SQLite Databases.
  • Task 10 [Severity 3] Sensitive Data Exposure (Supporting Material 2)
  • Read the supporting material about cracking hashes.
  • Task 11 [Severity 3] Sensitive Data Exposure (Challenge)
  • Task 12 [Severity 4] XML External Entity
  • Deploy the machine attached to the task.
  • Task 13 [Severity 4] XML External Entity - eXtensible Markup Language
  • Task 14 [Severity 4] XML External Entity - DTD
  • Task 15 [Severity 4] XML External Entity - XXE Payload
  • Try the payload mentioned in description on the website.
  • Task 16 [Severity 4] XML External Entity - Exploiting
  • Task 17 [Severity 5] Broken Access Control
  • Read and understand how broken access control works.
  • Task 18 [Severity 5] Broken Access Control (IDOR Challenge)
  • Task 19 [Severity 6] Security Misconfiguration
  • Task 20 [Severity 7] Cross-site Scripting
  • Task 21 [Severity 8] Insecure Deserialization
  • Task 22 [Severity 8] Insecure Deserialization - Objects
  • Select the correct term of the following statement "if a dog was sleeping", would this be: A) A State, B) A Behaviour
  • Task 23 [Severity 8] Insecure Deserialization - Deserialization
  • What is the name of the base-2 formatting that data is sent across a network as?
  • Task 24 [Severity 8] Insecure Deserialization - Cookies
  • Task 25 [Severity 8] Insecure Deserialization - Cookies Practical
  • Task 26 [Severity 8] Insecure Deserialization - Code Execution
  • flag.txt
  • Task 27 [Severity 9] Components With Known Vulnerabilities - Intro
  • Read above.
  • Task 28 [Severity 9] Components With Known Vulnerabilities - Exploit
  • Read the above!
  • Task 29 [Severity 9] Components With Known Vulnerabilities - Lab
  • How many characters are in /etc/passwd (use wc -c /etc/passwd to get the answer)
  • Task 30 [Severity 10] Insufficient Logging and Monitoring
  • Task 31 What Next?
  • Read the above!
  1. Difficulty: Easy

OWASP Top 10

Learn about and exploit each of the vulnerabilities; the 10 most critical web security risks.

PreviousTask 6 - What is Google Dorking?NextTask 5 - Command Injection Practical

Last updated 2 years ago

Room Attributes
Value

Subscription Required

False [Free]

Type

Walkthrough

Difficulty

Easy

Tags

OWASP, Top 10, Injection, Broken Authentication

Task 1 Introduction

  • Injection

  • Broken Authentication

  • Sensitive Data Exposure

  • XML External Entity

  • Broken Access Control

  • Security Misconfiguration

  • Cross-site Scripting

  • Insecure Deserialization

  • Components with Known Vulnerabilities

  • Insufficent Logging & Monitoring

The room has been designed for beginners and assume no previous knowledge of security.

Read the above.

No answer needed

Task 2 Accessing machines

Connect to our network or deploy the AttackBox.

No answer needed

Task 3 [Severity 1] Injection

I've understood Injection attacks.

No answer needed

Task 4 [Severity 1] OS Command Injection

I've understood command injection.

No answer needed

Task 5 [Severity 1] Command Injection Practical

Task 6 [Severity 2] Broken Authentication

I've understood broken authentication mechanisms.

No answer needed

Task 7 [Severity 2] Broken Authentication Practical

Task 8 [Severity 3] Sensitive Data Exposure (Introduction)

Read the introduction to Sensitive Data Exposure and deploy the machine.

No answer needed

Task 9 [Severity 3] Sensitive Data Exposure (Supporting Material 1)

Read and understand the supporting material on SQLite Databases.

No answer needed

Task 10 [Severity 3] Sensitive Data Exposure (Supporting Material 2)

Read the supporting material about cracking hashes.

No answer needed

Task 11 [Severity 3] Sensitive Data Exposure (Challenge)

Task 12 [Severity 4] XML External Entity

Deploy the machine attached to the task.

No answer needed

Task 13 [Severity 4] XML External Entity - eXtensible Markup Language

Task 14 [Severity 4] XML External Entity - DTD

Task 15 [Severity 4] XML External Entity - XXE Payload

Try the payload mentioned in description on the website.

No answer needed

Task 16 [Severity 4] XML External Entity - Exploiting

Task 17 [Severity 5] Broken Access Control

Read and understand how broken access control works.

No answer needed

Task 18 [Severity 5] Broken Access Control (IDOR Challenge)

Task 19 [Severity 6] Security Misconfiguration

Task 20 [Severity 7] Cross-site Scripting

Task 21 [Severity 8] Insecure Deserialization

Task 22 [Severity 8] Insecure Deserialization - Objects

Select the correct term of the following statement "if a dog was sleeping", would this be: A) A State, B) A Behaviour

Task 23 [Severity 8] Insecure Deserialization - Deserialization

What is the name of the base-2 formatting that data is sent across a network as?

Task 24 [Severity 8] Insecure Deserialization - Cookies

Task 25 [Severity 8] Insecure Deserialization - Cookies Practical

Task 26 [Severity 8] Insecure Deserialization - Code Execution

flag.txt

Task 27 [Severity 9] Components With Known Vulnerabilities - Intro

Read above.

No answer needed

Task 28 [Severity 9] Components With Known Vulnerabilities - Exploit

Read the above!

No answer needed

Task 29 [Severity 9] Components With Known Vulnerabilities - Lab

How many characters are in /etc/passwd (use wc -c /etc/passwd to get the answer)

HINT: You know its a bookstore application, you should check for recent unauthenticated bookstore app rce's.

Task 30 [Severity 10] Insufficient Logging and Monitoring

Task 31 What Next?

Donate to the OWASP Foundation!

Read the above!

No answer needed

OWASP Logo

This room breaks each category in the project down and includes details on what the vulnerability is, how it occurs and how you can exploit it. You will put the theory into practise by completing supporting challenges.

Reveal Flag
Reveal Flag
Reveal Flag
Reveal Flag

A Behaviour

Binary

4a69a7ff9fd68

1611

đŸš©
đŸš©
đŸš©
đŸš©
đŸš©
đŸš©
đŸš©
đŸš©
OWASP Top 10 (2017)
Task 5 - Command Injection Practical
Task 7 - Broken Authentication Practical
Task 11 - Sensitive Data Exposure (Challenge)
Task 13 - XML External Entity - eXtensible Markup Language
Task 14 - XML External Entity - DTD
Task 16 - XML External Entity - Exploiting
Task 18 - Broken Access Control (IDOR Challenge)
Task 19 - Security Misconfiguration
Task 20 - Cross-site Scripting
Task 21 - Insecure Deserialization
Task 24 - Insecure Deserialization - Cookies
Task 25 - Insecure Deserialization - Cookies Practical
Task 30 - Insufficient Logging and Monitoring
đŸŸ©
🐝
Page cover image
TryHackMe | OWASP Top 10TryHackMe
https://tryhackme.com/room/owasptop10
Donate to Open Source Security Projects | OWASP Foundation
Logo
Logo