برای دریافت این دستاورد، باید در امتحان اوسپ نمره «قبولی» کسب کنین.

نفراتی که موفق به کسب نمره قبولی در امتحان اوسپ شدن

Baby OWASP

The detailed solution can be found [here](https://www.youtube.com/watch?v=5j_09K2gtUs)

Pgnix

Use the provided credentials to investigate potential SSRF vulnerability.

#### Requirements
+ Server-Side Request Forgery (SSRF)
+ Skill: Analyzing Backend Request Handling

#### Objective
Two sets of credentials have been leaked:  
- `armin@gmail.com` - `5AHL1Lq4wLk5A2`  
- `mikasa@gmail.com` - `ddJS)4W5Z28V7)`  

Leverage this information to identify and exploit the SSRF vulnerability. Your goal is to access and read the invoice for the third user.

Medusa

#### Requirements
+ Programming Language: JS
+ RCE: Finding and Exploitation

#### Objective
This is a difficult challenge with no hints provided. Use external resources and research techniques to brainstorm potential exploitation methods. Your goal is to achieve remote code execution and read the `/flag` file to complete the challenge.

Gladius

#### Requirements
+ Programming Language: PHP
+ Skill: Source Code Analysis, Endpoint Discovery
+ Command Injection: Identifying Vulnerable Endpoints, Bypass Filters

#### Objective
Carefully browse the site, paying attention to the source code to identify an endpoint that passes user input into the shell. Your goal is to execute the `id` command and capture its output, then read the `/flag` file to complete the challenge.

Metronium

Examine the login process closely to discover and exploit a logical vulnerability.

#### Requirements
+ Category: Broken Authentication
+ Skill: Logical Analysis of Authentication Flows
+ Objective: Unauthorized Account Access

#### Objective
Log in to the web application and carefully observe the authentication flow. Pay close attention to any extra steps or unusual behavior. Understand the underlying logic, identify a flaw, and exploit it to log in as the user `mamad` to complete the challenge.


Easy Auth

Analyze the application's authentication flow and investigate potential flaws in cookie handling.

#### Requirements
+ Category: Broken Authentication
+ Skill: Cookie Analysis and Manipulation

#### Objective
Carefully review the authentication flow and monitor the cookies for any unusual behavior. Identify a vulnerability that allows you to manipulate cookies and escalate privileges to become an administrator. Successfully achieve administrative access to obtain the flag.


Broken Auth

This is a black-box challenge, and there is no source code.

#### Requirements
+ SQL Injection: Understanding backend mechanisms and bypassing sanitization filters

#### Objective
Your goal is to extract the flag from the database by exploiting a SQL injection vulnerability.

SQLi Level 8 - BlackBox 1

Use the path `/proxy/internal_website/mamad.txt` to investigate its behavior and potential for exploitation.

#### Requirements
+ Topic: Attacking Secondary Contexts in Web Applications
+ Skill: Understanding Proxy Behavior
+ Vulnerability: Path Traversal, SSRF

#### Objective
Determine if the path sends an HTTP request to an internal server. If so, manipulate the path to access forbidden locations on the internal server and retrieve the private note.

Simple SSRF

This challenge replicates a real-world $3500 bug. Investigate the application to uncover misconfigurations.

#### Requirements
+ Vulnerability Type: Security Misconfiguration
+ Skill: Server-side investigation and Misconfiguration Exploitation

#### Objective
The challenge will load as a blank page, this is the intended behavior. Your task is to identify a vulnerability caused by misconfiguration and exploit it to read the `/flag` file on the server.


Real Mis

#### Requirements
+ Programming Language: PHP
+ Skill: Server-Side Analysis
+ Command Injection: Understanding Server Behavior

#### Objective
Your goal is to analyze the server-side functionality to understand how inputs are handled. Develop a command injection payload to execute shell commands on the server and retrieve the `/flag` file to complete the challenge.

Safe UUID

Use the parameter `/?source=true` to view the source code.

#### Requirements
- Programming Language: PHP
- Skill: Source Code Auditing
- SQLi: WAF Bypassing techniques

#### Objective
Your goal is to extract the flag from the database by exploiting a SQL injection vulnerability and bypassing the WAF

SQLi Level 6 - WAF Bypass 2

Explore the application's API to identify exposed documentation and access restricted routes.

#### Requirements
+ Category: API Security
+ Skill: API Enumeration and Exploitation

#### Objective
Start by fuzzing the application to locate the Swagger documentation. Analyze the discovered API endpoints and attempt to access the admin route.

Herra

Analyze the application's password recovery process to uncover and exploit vulnerabilities in authentication.

#### Requirements
+ Category: Broken Authentication
+ Skill: Reconnaissance and Exploiting Weak Token Generation

#### Objective
Carefully examine the "Forgot Password" functionality. Look for patterns in the password reset links, Can you guess another user's reset link? Use the endpoint `/api/v1/:email` to gather information (this step is outside the challenge scope). Focus on narrowing your recon to identify the administrator's account. Exploit the vulnerability to access the administrator's account and browse the `/admin` panel.


Thor

Investigate the application's confirmation functionality to identify logical vulnerabilities.

#### Requirements
+ Category: Broken Authentication
+ Skill: Analyzing Logic Flaws

#### Objective
Carefully examine the confirmation functionality for logical flaws. While not part of the challenge, you can gather information using `/api/v1/:email`. Use this information to uncover and exploit a logical vulnerability. Successfully exploit the vulnerability to access the `/admin` panel.


#### Requirements
+ Programming Language: JavaScript
+ Cross-Origin Resource Sharing (CORS): Filters Bypass

#### Objective
Your goal is to exploit a CORS misconfiguration to steal the admin's `API_KEY`. Begin by logging into the provided credentials and monitoring all HTTP requests. Carefully analyze these requests for potential CORS issues. Conduct tests to identify and exploit the misconfiguration, then craft a malicious link to trick the admin and exfiltrate their `API_KEY`.

#### Credentials:
Admin:
- Username: `voorivex_lab`
- Password: `supersecretpassword`

User:
- Username: `user`
- Password: `user`


GoodCMS

#### Requirements
+ Programming Language: PHP
+ SQL Injection: Blind Techniques

#### Objective
Investigate the application’s logging functionality to identify an entry point for SQL injection. Analyze potential user input fields that could lead to SQLi, and leverage this entry point to retrieve sensitive information.

Crazy Log

Leverage SSRF to access sensitive metadata from the server.

#### Requirements
+ Vulnerability Type: Server-Side Request Forgery (SSRF)
+ Skill: Accessing Cloud Metadata Services
+ Objective: Enumerating Cloud Metadata

#### Objective
Find a way to exploit the SSRF vulnerability to access and read metadata at `http://169.254.169.254/latest/meta-data`.


Apollo

Use the application's functionality to explore and bypass the applied filter.

#### Requirements
+ Server-Side Request Forgery (SSRF)
+ Skill: Filter Bypassing Techniques

#### Objective
This challenge includes a filter designed to restrict SSRF attempts. Your task is to bypass the filter and successfully access the internal endpoint at `localhost:3000/admin`.

Cobalt

Use the parameter `/?source=true` to view the source code.

#### Requirements
- Programming Language: PHP
- Skill: Source Code Auditing
- SQLi: Blind technique in boolean values

#### Objective
Your goal is to extract the flag from the database by exploiting a SQL injection vulnerability

SQLi Level 3 - Boolean Blind

#### Requirements
+ Programming Language: PHP
+ SQLi: Automated Exploitation Scripting

#### Objective
Identify and exploit the SQL injection vulnerability in the challenge. Write a script to exploit and extract information from the database.

Harry

Analyze the uploader functionality to identify weaknesses in its design and bypass file upload restrictions.

#### Requirements
+ Vulnerability Type: Insecure Design
+ Skill: Uploader Tricks

#### Objective
Try to read the `/flag`

Safe Uploader

Analyze the web application's JSONP implementation to identify and exploit authentication vulnerabilities.

#### Requirements
+ Category: Broken Authentication
+ Skill: JSONP Exploitation and Information Theft

#### Objective
Log in to the web application using the credentials `user` / `123@!`. Investigate if any JavaScript object contains sensitive information, such as an API key. Develop an attack scenario to exploit the vulnerability and steal the API key. Provide a crafted link to demonstrate the attack. For testing, use the admin credentials: `admin` / `R@!xK3m$s0`.

JSONP

Identify and exploit weaknesses in the application's checker function to bypass its restrictions.

#### Requirements
+ Server-Side Request Forgery (SSRF)
+ Skill: Understanding and Bypassing Input Validation

#### Objective
Your goal is to bypass the checker function and successfully access the `/admin` endpoint.


Server Side Request Forgery 4

#### Requirements
+ Programming Language: PHP
+ Skill: Header Analysis, Out-of-Band Data Exfiltration
+ Command Injection: Analyzing Server Backend and Exploring Alternative Paylods

#### Objective
Your goal is to understand why the Level 3 payload fails here. Set up a listener on your server and specify your IP and PORT as `http://IP:PORT` to inspect the request headers. Use these insights to deduce the command executed by the server. If direct command injection is unsuccessful, explore alternative techniques to read the `/flag` file.

Command Injection 5 - Partial 2

Server Side Request Forgery 3

Investigate the application's authentication mechanism and analyze its cryptographic implementation.

#### Requirements
+ Cryptographic Failures
+ Skill: JWT Analysis and Token Tampering

#### Objective
Register a user and log in to observe the JWT. Analyze the token and identify potential vulnerabilities. Although the `id` claim appears to be a randomly generated value, tampering with the token could grant access to the administration panel. Use basic application reconnaissance techniques to uncover the administrator's `id`. Your goal is to successfully access the `/admin` route by exploiting weaknesses in the cryptographic design.

Odin

Identify and exploit the open redirect vulnerability.

### Requirements
+ Open Redirect
+ Skill: URL Manipulation and Validation Bypassing

### Objective
Find and exploit an open redirect vulnerability that allows you to redirect users to `https://voorivex.academy`


Close Door

SQLi Level 5 - WAF Bypass 1

Use the parameter `/?source=true` to view the source code.

#### Requirements
- Programming Language: PHP
- Skill: Source Code Auditing
- SQLi: Time-based technique

#### Objective
Your goal is to extract the flag from the database by exploiting a SQL injection vulnerability

SQLi Level 4 - Time Blind

Investigate the web application for misconfigurations that reveal sensitive information.

#### Requirements
+ Vulnerability Type: Security Misconfiguration
+ Skill: Triggering and Analyzing Debug Information

#### Objective
Your task is to identify and exploit a misconfiguration in the application to generate a stack trace, exposing sensitive information.

PHP CMS

Command Injection 4 - Partial 1

Server Side Request Forgery 2

#### Requirements
+ Programming Language: PHP
+ Command Injection: Bypassing Filters
+ Search on the net for payloads

#### Objective
Your goal is to achieve command injection by testing various payloads to bypass server-side filters, allowing arbitrary command execution. Use manual techniques only (no automated tools like Commix) to find a way around the restrictions and read the `/flag` file.

Command Injection 3 - Filter Bypass

#### Requirements
+ Programming Language: PHP
+ RCE: Filtering bypass

#### Objective
Your goal is to execute code on the server and read the `/flag` file by identifying a way to inject commands without breaking the context.

Remote Code Execution 3

#### Requirements
+ Programming Language: PHP
+ RCE: Context Breaking and Filename Validation Bypass

#### Objective
Your goal is to read the `/flag` file by breaking the context with specific characters, analyzing the filename validation logic, and adjusting the input to achieve code injection.

Remote Code Execution 2

Analyze the application's caching mechanism to uncover and exploit a vulnerability.

#### Requirements
+ Category: Security Misconfiguration
+ Skill: Cache Poisoning and Exploitation
+ Objective: Retrieve Sensitive Information

#### Objective
Log in to the challenge using the credentials `admin` / `@AdMin1234!`. Investigate the application to identify its caching behavior. Discover a method to poison the cache with sensitive information. Craft a link to send to the admin, allowing you to retrieve the cached data and complete the challenge.


Catch me

Explore the application's input handling to identify and exploit a mass assignment vulnerability.

#### Requirements
+ Category: API Security
+ Skill: Mass Assignment Exploitation

#### Objective
Investigate the application's forms or API endpoints for mass assignment vulnerabilities. Identify unintentionally writable parameters and exploit this flaw to perform unauthorized actions, such as escalating privileges or modifying restricted data. Use this exploit to achieve the challenge goal.

Otex

This challenge simulates a **real-world IDOR** vulnerability that’s harder to spot. The goal is to exploit an issue with how user IDs are managed in the system.  

### Steps  
1. **Login** into the web application and observe the user’s unique ID.  
2. **Find a way** to disclose other users' IDs. You may need to inspect API calls or analyze the requests in the background.  
3. Use your findings to **access the admin’s attachment (ID: 23)**.  

### Requirements  
- **Knowledge of API Interactions**: You may need to interact with the API to discover hidden endpoints or data.  
- **Exploration of the Application**: Observe how the system handles user IDs and determine if they can be manipulated.  
- **Insecure Direct Object Reference (IDOR)

### Objective  
Your goal is to find a way to **access the admin's attachment** by exploiting an **IDOR vulnerability** in the web application.  


Hack the Object

Use the parameter `/?source=true` to view the source code.

#### Requirements
- Programming Language: PHP
- Skill: Source Code Auditing
- SQLi: UNION technique in integer values

#### Objective
Your goal is to extract the flag from the database by exploiting a SQL injection vulnerability

SQLi level 2 - Integer UNION

Use the parameter `/?source=true` to view the source code.

#### Requirements
- Programming Language: PHP
- Skill: Source Code Auditing
- SQLi: UNION technique in string values

#### Objective
Your goal is to extract the flag from the database by exploiting a SQL injection vulnerability

SQLi Level 1 - String UNION

#### Requirements
+ Programming Language: Python
+ SSTI: Exploitation Techniques, SSTImap

#### Objective
Identify the flaw in the application and attempt to exploit it to gain access to sensitive information. Utilize Tplmap or similar tools to facilitate your exploitation efforts. Your final goal is to read the `/flag` file to complete the challenge.

SSTI

#### Requirements
+ Programming Language: PHP
+ Command Injection: Command Separators, Out-of-Band Data Exfiltration

#### Objective
Your goal is to exploit the blind command injection vulnerability by using a command separator to execute commands on the server. Use an Out-of-Band (OOB) technique to retrieve command output and read the `/flag` file.


Command Injection 2 - Blind

Server Side Request Forgery 1

#### Requirements
+ Programming Language: PHP
+ Command Injection: Command Separators

#### Objective
Your goal is to exploit the command injection vulnerability by inserting a command separator to execute additional commands on the server and read the `/flag` file.

Command Injection 1

#### Requirements
+ Programming Language: PHP
+ RCE: Basic Remote Code Execution via Context Breaking

#### Objective
Your goal is to achieve PHP code execution via context breaking to read the `/flag` file.

Remote Code Execution 1

گواهینامه شرکت در کلاس هانت به مدت ۶ ماه، در این مدت مباحث و متدولوژی هانت به بچه‌ها آموزش داده شد، این گواهینامه فاقد امتحان است.

Narutow Hunters

گواهینامه قبولی در امتحان کلاس، نفرانی که این گواهینامه را دریافت دارند توانسته‌اند در امتحان اوسپ نمره قبولی را بگیرند.

OWASP Exam

# Mig Mig Challenge

The challenge, **"Mig Mig,"** is designed for the **Guts Hunt Class's Talent Program.** Anyone can participate, as it also serves an educational purpose. The challenge **began on March 5th** and will be available for **seven days, until March 12th at 21:00 GMT+3:30**.

The challenge requires a basic understanding of **Networks**, **Web Applications**, **HTTP**, **JavaScript**, **Programming Concepts**, and **Security Fundamentals** *(excluding Steganography and Forensics)*. **Brute-force attacks and fuzzing are not required** for any part of this challenge and may result in a **permanent IP ban**. Strong **critical thinking skills** are essential, and you are encouraged to use online resources such as **Google**, **ChatGPT**, and others.

## Challenge Structure

This challenge features **six vulnerabilities** that you must exploit to obtain the corresponding flags. Each flag follows this format: `FLAGn_xyz...`. The flags you collect must be submitted on the `/panel/flags` page. Once all six flags are submitted, you will receive the **Final Flag** in this format: `flag_xyz...`. Along with the final flag, you will receive **instructions on where to submit the final flag, where to send the challenge write-up, and what information to include**.

It is recommended that you **create your challenge account using your Voorivex Academy username** so we can track your collected flags and progress. A **lottery will then determine class admission**.

## Scoring System

- **Three Easy vulnerabilities** – **1 point each**
- **Two Medium vulnerabilities** – **2 points each**
- **One Hard vulnerability** – **3 points**
- **Total possible score: 10 points**

## Challenge Website
You can access the challenge website from [mig-mig.ir](https://mig-mig.ir)

Mig Mig

The challenge, named 'Zodiac,' is designed for the OWASP New Zero class's talent program. Anyone can participate in this challenge, as it also serves an educational purpose. Participants who successfully solve all the levels of the challenge will receive instructions on how to sign up for the talent list (who to email, what to email, etc.). There will be a lottery for participants on the list for class participation. The challenge requires a basic understanding of networks, web applications, HTTP, JavaScript, programming concepts, a basic understanding of security (not steganography or forensics), effective use of search engines such as Google, and critical thinking. It is crucial to approach each level with attention to detail. Remember to closely examine the provided puzzle pieces to successfully solve each level. The challenge levels do not require brute force or fuzzing over the HTTP protocol; however, there might be offline brute force involved in some levels. Please refrain from conducting fuzzing, as it may result in a permanent IP ban. During the challenge, feel free to use Google, ChatGPT, and other online resources for assistance. The challenge started on July 31st and will be available for 7 days until August 6th, although the deadline for the talent program is August 3rd (21:00 GMT+3:30). Details will only be revealed to those who successfully complete the challenge! As one of the main reasons for the challenge is education, there is a [help document](https://z.voorivex.academy/statics/Zodiac-Voorivex.pdf) providing all the resources needed to solve the challenge levels. There are 30 levels in this challenge. Completing up to level 25 qualifies participants for the lottery. If anyone manages to solve the last level, they will have twice the chances of winning in the lottery. Please note that the levels are not sorted from easiest to most difficult, Start the challenge from [here](https://z.voorivex.academy/).

Zodiac

Can you find a vulnerability and read the flag on the server?

- Please do not fuzz (no fuzzing required)
- You will be told exactly where the flag is
- the challenge will be up for 5 days (31th of may)
- a book for the first-blood :)

ReconMe

The challenge, named 'Escape the Blackhole' is designed for the Narutow Hunt class's talent program. Anyone can participate in this challenge, as it serves an educational purpose as well. Participants who successfully solve all the levels of the challenge will receive instructions on how to sign up for the talent list. There will be a lottery for participants on the list to class participation. The challenge requires a basic understanding of networks, web applications, HTTP, JavaScript, programming concepts, a basic understanding of security (not steganography or forensic), effective use of search engines such as Google, and critical thinking. It is crucial to approach each level with attention to detail. Remember to closely examine the provided puzzle pieces to successfully solve each level. The challenge levels do not require brute force or fuzzing over the HTTP protocol; however, there might be offline brute force involved in some levels. Please refrain from conducting fuzzing, as it may result in a permanent IP ban. During the challenge, feel free to use Google, ChatGPT, and other online resources for assistance. The challenge will be available for 10 days until March 7th, although the deadline for the Talent program is sooner, and the details will only be revealed to those who successfully complete the challenge! Please note that the levels are not sorted from easiest to most difficult.