ChrisBriggsy

CySCA 2014 - Web Application Pentest

The CySCA organizers have released a VM image with most of the challenges from CySCA 2014, which you can grab from http://goo.gl/6ftZ39 to play with. Here are my solutions to the Web Application Pentest section.

Club Status

Only VIP and registered users are allowed to view the Blog. Become VIP to gain access to the Blog to reveal the hidden flag.

ChrisBriggsy

using System.Collections.Generic;

namespace Example_SSRS_Web_API_Integration.Models
{
    public class ReportDTO
    {
        public string ResourcePath { get; set; }
        public List<DataSourceDto> DataSources { get; set; }
        public List<ParameterDTO> Parameters { get; set; }
        public string ReportDataSourceName { get; set; }

ChrisBriggsy

        [HttpPost]
        public HttpResponseMessage SaveReport(string input)
        {
            var reportDto = JsonConvert.DeserializeObject<ReportDTO>(input);

            byte[] bytes;
            using (var reportViewer = new ReportViewer())
            {
                reportViewer.ProcessingMode = ProcessingMode.Local;
                reportViewer.LocalReport.ReportEmbeddedResource = reportDto.ResourcePath;

ChrisBriggsy

var gulp = require('gulp');
var less = require('gulp-less');
var path = require('path');
var plumber = require('gulp-plumber');
gulp.task('less', function () {
    return gulp.src('./Content/**/*.less')
    .pipe(plumber())
      .pipe(less({
          paths: [path.join(__dirname, 'less', 'includes')]
      }))

ChrisBriggsy

<Page
    x:Class="SignalRPiExample.MainPage"
    xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"
    xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
    xmlns:local="using:SignalRPiExample"
    xmlns:d="http://schemas.microsoft.com/expression/blend/2008"
    xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006"
    mc:Ignorable="d">

    <Grid Background="{ThemeResource ApplicationPageBackgroundThemeBrush}">

ChrisBriggsy

using Microsoft.AspNet.SignalR.Client;
using PropertyChanged;
using System;
using Windows.UI.Core;
namespace SignalRPiExample
{
    [ImplementPropertyChanged]
    internal class MainViewModel
    {
        private readonly CoreDispatcher _dispatcher;

ChrisBriggsy

public MainPage()
{
    this.InitializeComponent();
     DataContext = new MainViewModel();                
}

ChrisBriggsy

An exception of type 'System.IO.FileNotFoundException' occurred in Microsoft.AspNet.SignalR.Client.dll but was not handled in user code

Additional information: Could not load file or assembly 'System.Net, Version=2.0.5.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e, Retargetable=Yes' or one of its dependencies. The system cannot find the file specified.

ChrisBriggsy

1>  Fody (version 1.13.0.0) Executing
1>MSBUILD : error : Fody: An unhandled exception occurred:
1>MSBUILD : error : Exception:
1>MSBUILD : error : Unknown custom metadata item kind: 6
1>MSBUILD : error : StackTrace:
1>MSBUILD : error :    at Microsoft.Cci.Pdb.PdbFunction.ReadCustomMetadata(BitAccess bits) in c:\Code\cecil\symbols\pdb\Microsoft.Cci.Pdb\PdbFunction.cs:line 359
1>MSBUILD : error :    at Microsoft.Cci.Pdb.PdbFunction..ctor(ManProcSym proc, BitAccess bits) in c:\Code\cecil\symbols\pdb\Microsoft.Cci.Pdb\PdbFunction.cs:line 270
1>MSBUILD : error :    at Microsoft.Cci.Pdb.PdbFunction.LoadManagedFunctions(BitAccess bits, UInt32 limit, Boolean readStrings) in c:\Code\cecil\symbols\pdb\Microsoft.Cci.Pdb\PdbFunction.cs:line 136
1>MSBUILD : error :    at Microsoft.Cci.Pdb.PdbFile.LoadFuncsFromDbiModule(BitAccess bits, DbiModuleInfo info, IntHashTable names, ArrayList funcList, Boolean readStrings, MsfDirectory dir, Dictionary`2 nameIndex, PdbReader reader) in c:\Code\cecil\symbols\pdb\Microsoft.Cci.Pdb\P

ChrisBriggsy

{
        "name": "package",
        "version": "1.0.0",
        "private": true,
        "devDependencies": {
                "gulp": "3.8.11",
                "gulp-bower": "0.0.10",
                "gulp-config": "0.3.0",
                "gulp-less": "3.0.3",
                "gulp-plumber": "1.0.0"