Comments (3)
The audit scenario is not meant to have flags. It aims for some realism. If you want a scenario that gives you flags try the CTF scenarios, such as flawed_fortress_1.xml.
The intention for the audit scenario is to conduct a pen test. We get students to write a formal pen test report.
from secgen.
Yeah I get it. But still it would be great if this specific non generated flag would not show in scenario.xml/marker.xml files as that is confusing. I was also a bit dissapointed because scenario you could not remotely attack the desktop computer as there was not any remotely exploitable vulnerability in that (it just had lightdm auto login). I don't get it what is the purpose of desktop VM. I feel there should be some specific target you go after as that usually you do in a pentest. You try to get accesss to some data.
Also one other thing it would be nice if there was a scenario that mixed a range of OSes like they do in OSCP exams/labs.
from secgen.
The desktop is there as part of the scenario for the sake of completeness. Really I would like to expand this scenario significantly to include more internal servers etc, to reflect what is found in real organisations. It would be unusual for a desktop VM to have many running vulnerable services. One idea for further development is to have client side vulnerabilities, such as vulnerable versions of Adobe Reader, and have the VM automate execution of email attachments, so you can launch phishing attacks against the system.
We have initial support for Windows VMs, but we severely lack content (SecGen modules) for Windows at this point... Also it should be easy to add more Linux base boxes, but that does require a fair amount of manual testing of our existing modules, and when we deploy to cloud providers we need to replicate each base box there too.
Thanks again for your interest in the project, and for raising the issues -- it helps the project to know your experiences and help raise things that could use further attention.
Mentioning @thomashaw, just so he sees this conversation on the closed issue.
Thanks again, @fsacer.
from secgen.
Related Issues (20)
- Kali web metapackage fails to build: unable to locate the 'kali-tools-web' dependency HOT 4
- Commando: login sometimes fails even when using correct credentials HOT 12
- Commando: show database errors in login form HOT 3
- Commando: implement insecure cookie vulnerability HOT 3
- Commando: there is an additional flag generated which is nowhere to be found in the application
- How you merge the CTFd_importable.zip into an existing CTFd instance?
- Issue setting up SecGen HOT 2
- Issues finding the Kali Repo when building CTF Scenario
- The following SSH command responded with a non-zero exit status. HOT 2
- Distcc Error HOT 3
- Base box root password HOT 1
- secgen's VM build process fails with "hostonlyif" message HOT 16
- Stderr: VBoxManage: error: VT-x is not available (VERR_VMX_NO_VMX) HOT 1
- ESXi fail to build, Vagrantfile error HOT 4
- Builder conflicting requirements HOT 5
- Bundler unable to install digest-whirpool [Windows, Ruby 2.7.6, Bundler 2.1.4] HOT 4
- syntax error: "rescue StandardError" HOT 16
- gitlist_040--1-/home/git/repositories/secret_files/-append HOT 1
- unable to build vm(Solved) HOT 1
- Module modules/generators/content/password_file missing required puppet module manifests folder HOT 3
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from secgen.