{"id":496,"date":"2023-06-20T19:00:32","date_gmt":"2023-06-20T19:00:32","guid":{"rendered":"https:\/\/3.85.236.57\/?page_id=496"},"modified":"2024-07-13T18:00:22","modified_gmt":"2024-07-13T18:00:22","slug":"con-appsec-challenge","status":"publish","type":"page","link":"https:\/\/saintcon.org\/con-appsec-challenge\/","title":{"rendered":"CON &#8211; AppSec Challenge"},"content":{"rendered":"<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2023\/06\/Appsec-2023_Full_Logo-2.svg\" alt=\"\"><\/p>\n<div>\n<p><small>Brought to you by<\/small><br \/><strong>@Sketrik &amp; @l4wke<br \/><\/strong><\/p>\n<\/div>\n<h2>Find and Fix vulnerabilities, it&#8217;s our biggest challenge.<\/h2>\n<div>\n<p>Do you have what it takes to find and fix vulnerabilities in source code? Compete against other attendees to be the first to fix all vulnerabilities in a web application. Clone the repo, find vulnerabilities, fix them, and submit your code to get a score. Not sure how to get started? Visit the AppSec community and learn how to use tools that will do the dirty work of finding vulnerabilities for you.<\/p>\n<p>Had trouble with Python last year? Don&#8217;t worry, it&#8217;s written in your favorite language this year. Or at least some part of it is&#8230;.<\/p>\n<\/div>\n<h3>Everything you need to know&#8230;<\/h3>\n<div>\n<p>Your job is to:<\/p>\n<p>&#8211; clone the repo<br \/>&#8211; find vulnerabilities<br \/>&#8211; fix vulnerabilities<br \/>&#8211; make sure unit tests pass locally<br \/>&#8211; submit your code to the scoring engine<br \/>&#8211; score more points than everyone else<br \/>&#8211; repeat as needed<\/p>\n<p>Vulnerabilities are scored based on the difficulty to find and fix.\u00a0<\/p>\n<p>This year&#8217;s twist is that the application you will be working with is composed of several different microservices, each written in a different language. Start with something familiar, and work your way towards a language you&#8217;ve never touched before.<\/p>\n<p>As always, you are welcome to use free automated tooling (such as DAST and SAST) to assist you.<\/p>\n<p>Prizes are awarded to the highest scorers, and a full contest rundown will be given after the contest closes.<\/p>\n<h4><span>How to play<\/span><\/h4>\n<p><span>Visit <a href=\"https:\/\/appsec.saintcon.community\/\">https:\/\/appsec.saintcon.community\/<\/a> to get started.<\/span><\/p>\n<p><span>A basic understanding of programming is necessary to compete in this challenge. If you would like help getting started, come visit the AppSec community &#8211; they will help you find and fix one easy vulnerability.<\/span><\/p>\n<h4><span>Rules:<\/span><\/h4>\n<ul>\n<li>\n<p>Hacking this site, the submission mechanism, or anything to do with this challenge is strictly forbidden. You are welcome to run the code on your own host and hack it there.<\/p>\n<\/li>\n<li>\n<p>Your submission will not work if you try to make changes to more than what is packaged with the make-package.py file. Limit your changes to the files (and directories) listed there.<\/p>\n<\/li>\n<li>\n<p>File uploads must be less than 4MB in size (you won&#8217;t need anything close to that large).<\/p>\n<\/li>\n<li>\n<p>Submissions can be made once per user per 5 minutes (and duplicate submissions will not be scored).<\/p>\n<\/li>\n<li>\n<p>Prizes will be awarded to the winners at the awards ceremony.<\/p>\n<\/li>\n<li>\n<p>The contest starts at 12pm on Tuesday and ends at 9am on Friday.<\/p>\n<\/li>\n<li>\n<p>Tiebreaks go to the first submission.<\/p>\n<\/li>\n<li>\n<p>Don&#8217;t try to hardcode your way past the functionality tests.<\/p>\n<\/li>\n<li>\n<p>If something doesn&#8217;t seem to be working, please visit the AppSec Community, use the #appsec challenge in Discord, or message @sketrik directly.<\/p>\n<\/li>\n<\/ul>\n<\/div>\n<hr>\n<h2>Contest Hours<\/h2>\n<div>\n<ul>\n<li><strong>Contest Start<\/strong><br \/>Tuesday \u2013 Noon<\/li>\n<li><strong>Contest End<\/strong><br \/>Friday \u2013 9:00a<\/li>\n<\/ul>\n<div class=\"uk-panel uk-margin\" id=\"page#0\">\n<h3>Booth Hours<\/h3>\n<ul>\n<li><strong>Tuesday<\/strong><br \/>10:30a \u2013 5:00p<\/li>\n<li><strong>Wednesday<\/strong><br \/>10:30a \u2013 5:00p<\/li>\n<li><strong>Thursday<\/strong><br \/>9:00a \u2013 5:00p<\/li>\n<li><strong>Friday<\/strong><br \/>9:00a \u2013 10:00a<\/li>\n<\/ul>\n<\/div>\n<\/div>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2023\/06\/Appsec-2023_Graphic_Logo.svg\" alt=\"\"><\/p>\n<div>\n<p>        <img decoding=\"async\" src=\"\/wp-content\/uploads\/2023\/06\/Appsec-2023_5K_Wallpaper.png\" alt=\"\"><\/p>\n<h3>Desktop Wallpaper<\/h3>\n<p>Do you Love our Contest?<\/p>\n<div>\n<p>Our challenge has desktop wallpaper available for download.<\/p>\n<\/div>\n<p><a href=\"\/wp-content\/uploads\/2023\/06\/Appsec-2023_5K_Wallpaper.png\">Download Wallpaper<\/a><\/p>\n<\/div>\n<p><!--more--><br \/>\n<!-- {\"type\":\"layout\",\"children\":[{\"type\":\"section\",\"props\":{\"header_transparent\":true,\"header_transparent_noplaceholder\":false,\"header_transparent_text_color\":\"light\",\"height\":\"viewport\",\"height_offset_top\":true,\"image\":\"wp-content\\\/uploads\\\/2024\\\/05\\\/WebBackgrounds-All-02.png\",\"image_position\":\"center-center\",\"image_size\":\"cover\",\"padding\":\"none\",\"sticky\":\"cover\",\"style\":\"default\",\"title_breakpoint\":\"xl\",\"title_position\":\"top-left\",\"title_rotation\":\"left\",\"vertical_align\":\"middle\",\"width\":\"default\"},\"children\":[{\"type\":\"row\",\"props\":{\"margin_remove_top\":true},\"children\":[{\"type\":\"column\",\"props\":{\"image_position\":\"center-center\",\"position_sticky_breakpoint\":\"m\"},\"children\":[{\"type\":\"image\",\"props\":{\"image\":\"wp-content\\\/uploads\\\/2023\\\/06\\\/Appsec-2023_Full_Logo-2.svg\",\"image_svg_color\":\"emphasis\",\"image_width\":\"512\",\"margin\":\"small\",\"margin_remove_bottom\":true,\"margin_remove_top\":true,\"text_align\":\"center\"},\"name\":\"LOGO IMAGE (SVG)\"},{\"type\":\"text\",\"props\":{\"column_breakpoint\":\"m\",\"content\":\"\n\n<p><small>Brought to you by<\\\/small><br \\\/><strong>@Sketrik &amp; @l4wke<br \\\/><\\\/strong><\\\/p>\",\"margin\":\"default\",\"margin_remove_top\":true,\"text_align\":\"center\",\"text_color\":\"emphasis\",\"text_style\":\"large\"},\"name\":\"Credits Text\"}]}]}]},{\"type\":\"section\",\"props\":{\"header_transparent\":true,\"header_transparent_text_color\":\"light\",\"image_position\":\"top-center\",\"overlap\":false,\"padding_remove_bottom\":false,\"padding_remove_top\":false,\"preserve_color\":false,\"style\":\"secondary\",\"title_breakpoint\":\"xl\",\"title_position\":\"top-left\",\"title_rotation\":\"left\",\"vertical_align\":\"\",\"width\":\"default\"},\"children\":[{\"type\":\"row\",\"props\":{\"column_gap\":\"large\",\"divider\":false,\"layout\":\"3-4,1-4\"},\"children\":[{\"type\":\"column\",\"props\":{\"image_position\":\"center-center\",\"position_sticky_breakpoint\":\"m\",\"width_small\":\"3-4\"},\"children\":[{\"type\":\"headline\",\"props\":{\"content\":\"Find and Fix vulnerabilities, it's our biggest challenge.\",\"margin\":\"large\",\"margin_remove_bottom\":true,\"maxwidth\":\"2xlarge\",\"title_element\":\"h2\",\"title_style\":\"h1\"},\"name\":\"Tagline Header\"},{\"type\":\"text\",\"props\":{\"column_breakpoint\":\"m\",\"content\":\"\n\n<p>Do you have what it takes to find and fix vulnerabilities in source code? Compete against other attendees to be the first to fix all vulnerabilities in a web application. Clone the repo, find vulnerabilities, fix them, and submit your code to get a score. Not sure how to get started? Visit the AppSec community and learn how to use tools that will do the dirty work of finding vulnerabilities for you.<\\\/p>\\n\n\n<p>Had trouble with Python last year? Don't worry, it's written in your favorite language this year. Or at least some part of it is....<\\\/p>\",\"margin\":\"default\",\"maxwidth\":\"2xlarge\"},\"name\":\"Brief Description\"},{\"type\":\"headline\",\"props\":{\"content\":\"Everything you need to know...\",\"margin\":\"large\",\"margin_remove_bottom\":true,\"maxwidth\":\"2xlarge\",\"title_element\":\"h3\",\"title_style\":\"h2\"},\"name\":\"Explore Header\"},{\"type\":\"text\",\"props\":{\"column_breakpoint\":\"m\",\"content\":\"\n\n<p>Your job is to:<\\\/p>\\n\n\n<p>- clone the repo<br \\\/>- find vulnerabilities<br \\\/>- fix vulnerabilities<br \\\/>- make sure unit tests pass locally<br \\\/>- submit your code to the scoring engine<br \\\/>- score more points than everyone else<br \\\/>- repeat as needed<\\\/p>\\n\n\n<p>Vulnerabilities are scored based on the difficulty to find and fix.\\u00a0<\\\/p>\\n\n\n<p>This year's twist is that the application you will be working with is composed of several different microservices, each written in a different language. Start with something familiar, and work your way towards a language you've never touched before.<\\\/p>\\n\n\n<p>As always, you are welcome to use free automated tooling (such as DAST and SAST) to assist you.<\\\/p>\\n\n\n<p>Prizes are awarded to the highest scorers, and a full contest rundown will be given after the contest closes.<\\\/p>\\n\n\n<h4><span>How to play<\\\/span><\\\/h4>\\n\n\n<p><span>Visit <a href=\\\"https:\\\/\\\/appsec.saintcon.community\\\/\\\">https:\\\/\\\/appsec.saintcon.community\\\/<\\\/a> to get started.<\\\/span><\\\/p>\\n\n\n<p><span>A basic understanding of programming is necessary to compete in this challenge. If you would like help getting started, come visit the AppSec community - they will help you find and fix one easy vulnerability.<\\\/span><\\\/p>\\n\n\n<h4><span>Rules:<\\\/span><\\\/h4>\\n\n\n<ul>\\n\n\n<li>\\n\n\n<p>Hacking this site, the submission mechanism, or anything to do with this challenge is strictly forbidden. You are welcome to run the code on your own host and hack it there.<\\\/p>\\n<\\\/li>\\n\n\n<li>\\n\n\n<p>Your submission will not work if you try to make changes to more than what is packaged with the make-package.py file. Limit your changes to the files (and directories) listed there.<\\\/p>\\n<\\\/li>\\n\n\n<li>\\n\n\n<p>File uploads must be less than 4MB in size (you won't need anything close to that large).<\\\/p>\\n<\\\/li>\\n\n\n<li>\\n\n\n<p>Submissions can be made once per user per 5 minutes (and duplicate submissions will not be scored).<\\\/p>\\n<\\\/li>\\n\n\n<li>\\n\n\n<p>Prizes will be awarded to the winners at the awards ceremony.<\\\/p>\\n<\\\/li>\\n\n\n<li>\\n\n\n<p>The contest starts at 12pm on Tuesday and ends at 9am on Friday.<\\\/p>\\n<\\\/li>\\n\n\n<li>\\n\n\n<p>Tiebreaks go to the first submission.<\\\/p>\\n<\\\/li>\\n\n\n<li>\\n\n\n<p>Don't try to hardcode your way past the functionality tests.<\\\/p>\\n<\\\/li>\\n\n\n<li>\\n\n\n<p>If something doesn't seem to be working, please visit the AppSec Community, use the #appsec challenge in Discord, or message @sketrik directly.<\\\/p>\\n<\\\/li>\\n<\\\/ul>\",\"margin\":\"medium\",\"maxwidth\":\"2xlarge\"},\"name\":\"Long Descriptions and Details\"},{\"type\":\"text\",\"props\":{\"column_breakpoint\":\"m\",\"content\":\"\n\n<h3>Instructions:<\\\/h3>\\n\n\n<ul>\\n\n\n<li>\\n\n\n<p>To get started, clone <a href=\\\"https:\\\/\\\/github.com\\\/smanesse\\\/saintcon-appsec-challenge-2023\\\">this repo.<\\\/a><\\\/p>\\n<\\\/li>\\n\n\n<li>\\n\n\n<p>Your task is to find and fix as many vulnerabilities as you can in the code in this project.<\\\/p>\\n<\\\/li>\\n\n\n<li>\\n\n\n<p>Instructions on how to run the project can be found in the README for the repo.<\\\/p>\\n<\\\/li>\\n\n\n<li>\\n\n\n<p>Once you are ready to submit your code, run the make-package.py script (included in the repo) to create a zip file containing only the necessary files, and upload this zip below.<\\\/p>\\n<\\\/li>\\n\n\n<li>\\n\n\n<p>It can take up to 15 minutes for your code to be scored, depending on submission volume.<\\\/p>\\n<\\\/li>\\n\n\n<li>\\n\n\n<p>You can view your submissions on your profile page.<\\\/p>\\n<\\\/li>\\n\n\n<li>\\n\n\n<p>Only your highest-scoring submission will be displayed on the scoreboard.<\\\/p>\\n<\\\/li>\\n\n\n<li>\\n\n\n<p>The max score is 100. All vulnerabilities scored present high or critical impact to the application. Examples of the types of vulnerabilities you might find in the application include SSTI, SSRF,<br \\\/>XSS, and SQLi.<\\\/p>\\n<\\\/li>\\n\n\n<li>\\n\n\n<p>Please note that the application must still function correctly - an unusable application is not secure. The definition of \\\"function correctly\\\" is the unit tests that have been provided. This is effectively the same set of unit tests that the scoring engine uses to check that the program is functioning correctly (although it is possible production tests will have different input). <br \\\/>Your vulnerability fixes should handle malicious input gracefully rather than blocking it outright. For example, you should parameterize SQL queries instead of blocking all input that contains an apostrophe.<\\\/p>\\n<\\\/li>\\n\n\n<li>\\n\n\n<p>Vulnerability tests will not be run on code that doesn't pass all of the unit tests.<\\\/p>\\n<\\\/li>\\n<\\\/ul>\",\"margin\":\"medium\",\"maxwidth\":\"2xlarge\",\"status\":\"disabled\"},\"name\":\"Long Descriptions and Details\"},{\"type\":\"divider\",\"props\":{\"divider_align\":\"center\",\"divider_element\":\"hr\",\"divider_style\":\"small\"}}]},{\"type\":\"column\",\"props\":{\"image_position\":\"center-center\",\"order_first\":\"s\",\"position_sticky_breakpoint\":\"m\",\"width_small\":\"1-4\"},\"children\":[{\"type\":\"headline\",\"props\":{\"content\":\"Contest Hours\",\"title_element\":\"h2\",\"title_style\":\"h3\"}},{\"type\":\"text\",\"props\":{\"column_breakpoint\":\"m\",\"content\":\"\n\n<ul>\\n\n\n<li><strong>Contest Start<\\\/strong><br \\\/>Tuesday \\u2013 Noon<\\\/li>\\n\n\n<li><strong>Contest End<\\\/strong><br \\\/>Friday \\u2013 9:00a<\\\/li>\\n<\\\/ul>\\n\n\n<div class=\\\"uk-panel uk-margin\\\" id=\\\"page#0\\\">\\n\n\n<h3>Booth Hours<\\\/h3>\\n\n\n<ul>\\n\n\n<li><strong>Tuesday<\\\/strong><br \\\/>10:30a \\u2013 5:00p<\\\/li>\\n\n\n<li><strong>Wednesday<\\\/strong><br \\\/>10:30a \\u2013 5:00p<\\\/li>\\n\n\n<li><strong>Thursday<\\\/strong><br \\\/>9:00a \\u2013 5:00p<\\\/li>\\n\n\n<li><strong>Friday<\\\/strong><br \\\/>9:00a \\u2013 10:00a<\\\/li>\\n<\\\/ul>\\n<\\\/div>\",\"css\":\"li {line-height: 1.2em; padding-bottom: 15px; font-size: 16px; color: #fc6;}\\nstrong {font-size: 21px; color: #fff;}\",\"margin\":\"default\"},\"name\":\"HOURS\"},{\"type\":\"image\",\"props\":{\"image\":\"wp-content\\\/uploads\\\/2023\\\/06\\\/Appsec-2023_Graphic_Logo.svg\",\"image_svg_color\":\"emphasis\",\"image_width\":\"100%\",\"margin\":\"large\",\"margin_remove_bottom\":true,\"text_align\":\"center\"}}]}]},{\"type\":\"row\",\"props\":{\"margin\":\"xlarge\",\"width\":\"default\"},\"children\":[{\"type\":\"column\",\"props\":{\"image_position\":\"center-center\",\"position_sticky_breakpoint\":\"m\",\"width_medium\":\"1-1\"},\"children\":[{\"name\":\"Wallpaper Section\",\"type\":\"panel\",\"props\":{\"block_align\":\"center\",\"content\":\"\n\n<p>Our challenge has desktop wallpaper available for download.<\\\/p>\",\"content_column_breakpoint\":\"m\",\"content_margin\":\"small\",\"icon_width\":80,\"image\":\"wp-content\\\/uploads\\\/2023\\\/06\\\/Appsec-2023_5K_Wallpaper.png\",\"image_align\":\"left\",\"image_grid_breakpoint\":\"s\",\"image_grid_width\":\"2-5\",\"image_height\":\"720\",\"image_svg_color\":\"emphasis\",\"image_vertical_align\":true,\"image_width\":\"1280\",\"link\":\"wp-content\\\/uploads\\\/2023\\\/06\\\/Appsec-2023_5K_Wallpaper.png\",\"link_margin\":\"medium\",\"link_style\":\"primary\",\"link_text\":\"Download Wallpaper\",\"margin\":\"default\",\"meta\":\"Do you Love our Contest?\",\"meta_align\":\"above-title\",\"meta_element\":\"div\",\"meta_margin\":\"small\",\"meta_style\":\"text-meta\",\"panel_expand\":\"image\",\"panel_image_no_padding\":true,\"panel_link\":false,\"panel_padding\":\"default\",\"panel_style\":\"card-secondary\",\"title\":\"Desktop Wallpaper\",\"title_align\":\"top\",\"title_element\":\"h3\",\"title_grid_breakpoint\":\"m\",\"title_grid_width\":\"1-2\",\"title_hover_style\":\"reset\",\"title_margin\":\"small\"}}]}]}],\"name\":\"About\"}],\"version\":\"4.4.4\"} --><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Brought to you by@Sketrik &amp; @l4wke Find and Fix vulnerabilities, it&#8217;s our biggest challenge. Do you have what it takes to find and fix vulnerabilities in source code? Compete against other attendees to be the first to fix all vulnerabilities in a web application. Clone the repo, find vulnerabilities, fix them, and submit your code [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-496","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/saintcon.org\/wp-json\/wp\/v2\/pages\/496"}],"collection":[{"href":"https:\/\/saintcon.org\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/saintcon.org\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/saintcon.org\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/saintcon.org\/wp-json\/wp\/v2\/comments?post=496"}],"version-history":[{"count":15,"href":"https:\/\/saintcon.org\/wp-json\/wp\/v2\/pages\/496\/revisions"}],"predecessor-version":[{"id":1551,"href":"https:\/\/saintcon.org\/wp-json\/wp\/v2\/pages\/496\/revisions\/1551"}],"wp:attachment":[{"href":"https:\/\/saintcon.org\/wp-json\/wp\/v2\/media?parent=496"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}