CHALLENGES.md — the work sheet
Targets and objectives, no payloads, and a scoring tool to check your flags against.
Projects · Low · 1 of 13
Insecurity BBS Ready
A bulletin board. One board, one database, a handful of forms. The smallest surface in the family, and the place to start.
Posts, comments, profiles, uploads, an admin console and a couple of network tools. Everything a bulletin board needs and nothing it does not, which is what makes it legible: every request you send has an obvious destination in the source.
Board
Answers to bbs.insecurity.cc
Implementations
Where it runs
| Platform | Repository | State |
|---|---|---|
| PHP | insecurity-bbs-phpThe original. No framework, no Composer, no dependencies. | Ready |
| JSP | insecurity-bbs-jspThe Java twin, on an embedded Tomcat. | Ready |
| Perl | insecurity-bbs-perlThe port that drops the browser entirely: a program on a terminal, on a Unix host it shares. | Ready |
This is the only product with anything to work yet. Its boards carry the same exercise ids wherever an exercise survives the move, so working one and then another makes the language the variable and nothing else.
What you get
Three documents, in this order
Most labs hand you a vulnerability and a payload. These hand you a target, then an explanation, then the fix — and argue for why it is that fix.
LAB.md — the answer key
Every payload, worked, with the reasoning that found it. Kept beside the board rather than in it: no exercise list in the markup, no seeded credentials on the login page, no notes in the source.
REMEDIATION.md — the half usually left out
secure/ holds hardened counterparts of the most
instructive files, and the document walks the diffs: what the fix is,
and why it is that one rather than the filter that looks like it.
Or see the whole family, banded by surface.