task: Add first session information

Add first session information Signed-off-by: Gabriel Mocanu <[email protected]>
open-education-hub · Jun 24, 2024 · cb6cb58 · cb6cb58
1 parent 06f979f
commit cb6cb58
Show file tree

Hide file tree

Showing 38 changed files with 173 additions and 31 deletions.
diff --git a/...odel/activities/cockroach/sol/solution.sh → ...b-basics/drills/cockroach/sol/solution.sh b/...odel/activities/cockroach/sol/solution.sh → ...b-basics/drills/cockroach/sol/solution.sh
diff --git a/...ity-model/activities/eyes/sol/solution.sh → ...ty/web-basics/drills/eyes/sol/solution.sh b/...ity-model/activities/eyes/sol/solution.sh → ...ty/web-basics/drills/eyes/sol/solution.sh
diff --git a/...ty-model/activities/gimme/sol/solution.sh → ...y/web-basics/drills/gimme/sol/solution.sh b/...ty-model/activities/gimme/sol/solution.sh → ...y/web-basics/drills/gimme/sol/solution.sh
diff --git a/...el/activities/give-to-get/sol/solution.sh → ...basics/drills/give-to-get/sol/solution.sh b/...el/activities/give-to-get/sol/solution.sh → ...basics/drills/give-to-get/sol/solution.sh
diff --git a/...l/activities/give-to-post/sol/solution.sh → ...asics/drills/give-to-post/sol/solution.sh b/...l/activities/give-to-post/sol/solution.sh → ...asics/drills/give-to-post/sol/solution.sh
diff --git a/...odel/activities/king-kong/sol/solution.sh → ...b-basics/drills/king-kong/sol/solution.sh b/...odel/activities/king-kong/sol/solution.sh → ...b-basics/drills/king-kong/sol/solution.sh
diff --git a/...del/activities/lame-login/sol/solution.sh → ...-basics/drills/lame-login/sol/solution.sh b/...del/activities/lame-login/sol/solution.sh → ...-basics/drills/lame-login/sol/solution.sh
diff --git a/...ctivities/my-special-name/sol/solution.sh → ...cs/drills/my-special-name/sol/solution.sh b/...ctivities/my-special-name/sol/solution.sh → ...cs/drills/my-special-name/sol/solution.sh
diff --git a/...ity-model/activities/name/sol/solution.sh → ...ty/web-basics/drills/name/sol/solution.sh b/...ity-model/activities/name/sol/solution.sh → ...ty/web-basics/drills/name/sol/solution.sh
diff --git a/...del/activities/one-by-one/sol/solution.sh → ...-basics/drills/one-by-one/sol/solution.sh b/...del/activities/one-by-one/sol/solution.sh → ...-basics/drills/one-by-one/sol/solution.sh
diff --git a/...vities/produce-consume/public/consume.php → ...drills/produce-consume/public/consume.php b/...vities/produce-consume/public/consume.php → ...drills/produce-consume/public/consume.php
diff --git a/...tivities/produce-consume/public/index.php → ...s/drills/produce-consume/public/index.php b/...tivities/produce-consume/public/index.php → ...s/drills/produce-consume/public/index.php
diff --git a/...vities/produce-consume/public/produce.php → ...drills/produce-consume/public/produce.php b/...vities/produce-consume/public/produce.php → ...drills/produce-consume/public/produce.php
diff --git a/...ctivities/produce-consume/sol/solution.sh → ...cs/drills/produce-consume/sol/solution.sh b/...ctivities/produce-consume/sol/solution.sh → ...cs/drills/produce-consume/sol/solution.sh
diff --git a/...y-model/activities/readme/sol/solution.sh → .../web-basics/drills/readme/sol/solution.sh b/...y-model/activities/readme/sol/solution.sh → .../web-basics/drills/readme/sol/solution.sh
diff --git a/...model/activities/surprise/sol/solution.sh → ...eb-basics/drills/surprise/sol/solution.sh b/...model/activities/surprise/sol/solution.sh → ...eb-basics/drills/surprise/sol/solution.sh
diff --git a/...cs-browser-security-model/assets/CORS.jpg → ...cation-security/web-basics/media/CORS.jpg b/...cs-browser-security-model/assets/CORS.jpg → ...cation-security/web-basics/media/CORS.jpg
diff --git a/...sets/Session_01_Web_Basics_Diagram_01.jpg → ...edia/Session_01_Web_Basics_Diagram_01.jpg b/...sets/Session_01_Web_Basics_Diagram_01.jpg → ...edia/Session_01_Web_Basics_Diagram_01.jpg
diff --git a/...security-model/assets/browser-analogy.png → ...rity/web-basics/media/browser-analogy.png b/...security-model/assets/browser-analogy.png → ...rity/web-basics/media/browser-analogy.png
diff --git a/...del/assets/browser-security-mechanism.png → ...sics/media/browser-security-mechanism.png b/...del/assets/browser-security-mechanism.png → ...sics/media/browser-security-mechanism.png
diff --git a/...ts/components-browser-security-policy.png → ...ia/components-browser-security-policy.png b/...ts/components-browser-security-policy.png → ...ia/components-browser-security-policy.png
diff --git a/...wser-security-model/assets/devtools-1.png → ...-security/web-basics/media/devtools-1.png b/...wser-security-model/assets/devtools-1.png → ...-security/web-basics/media/devtools-1.png
diff --git a/...wser-security-model/assets/devtools-2.png → ...-security/web-basics/media/devtools-2.png b/...wser-security-model/assets/devtools-2.png → ...-security/web-basics/media/devtools-2.png
diff --git a/...wser-security-model/assets/devtools-3.png → ...-security/web-basics/media/devtools-3.png b/...wser-security-model/assets/devtools-3.png → ...-security/web-basics/media/devtools-3.png
diff --git a/...wser-security-model/assets/devtools-4.png → ...-security/web-basics/media/devtools-4.png b/...wser-security-model/assets/devtools-4.png → ...-security/web-basics/media/devtools-4.png
diff --git a/...wser-security-model/assets/devtools-5.png → ...-security/web-basics/media/devtools-5.png b/...wser-security-model/assets/devtools-5.png → ...-security/web-basics/media/devtools-5.png
diff --git a/...wser-security-model/assets/devtools-6.png → ...-security/web-basics/media/devtools-6.png b/...wser-security-model/assets/devtools-6.png → ...-security/web-basics/media/devtools-6.png
diff --git a/...ics-browser-security-model/assets/dom.png → ...ication-security/web-basics/media/dom.png b/...ics-browser-security-model/assets/dom.png → ...ication-security/web-basics/media/dom.png
diff --git a/...-security-model/assets/first-activity.png → ...urity/web-basics/media/first-activity.png b/...-security-model/assets/first-activity.png → ...urity/web-basics/media/first-activity.png
diff --git a/...er-security-model/assets/http-request.png → ...ecurity/web-basics/media/http-request.png b/...er-security-model/assets/http-request.png → ...ecurity/web-basics/media/http-request.png
diff --git a/...r-security-model/assets/http-response.png → ...curity/web-basics/media/http-response.png b/...r-security-model/assets/http-response.png → ...curity/web-basics/media/http-response.png
diff --git a/...ics-browser-security-model/assets/url.png → ...ication-security/web-basics/media/url.png b/...ics-browser-security-model/assets/url.png → ...ication-security/web-basics/media/url.png
diff --git a/...ecurity-model/assets/xml_http_request.png → ...ity/web-basics/media/xml_http_request.png b/...ecurity-model/assets/xml_http_request.png → ...ity/web-basics/media/xml_http_request.png
diff --git a/web-basics-browser-security-model/index.md → ...ion-security/web-basics/reading/README.md b/web-basics-browser-security-model/index.md → ...ion-security/web-basics/reading/README.md
diff --git a/chapters/web-application-security/web-basics/slides/Makefile b/chapters/web-application-security/web-basics/slides/Makefile
@@ -0,0 +1 @@
+include ../../../../common/makefile/slides.mk
diff --git a/chapters/web-application-security/web-basics/slides/slides.mdpp b/chapters/web-application-security/web-basics/slides/slides.mdpp
@@ -0,0 +1,10 @@
+---
+title: "Web Basics"
+revealOptions:
+  background-color: 'aquamarine'
+  transition: 'none'
+  slideNumber: true
+  autoAnimateDuration: 0.0
+---
+
+!INCLUDE "web-basics.md"
diff --git a/chapters/web-application-security/web-basics/slides/web-basics.md b/chapters/web-application-security/web-basics/slides/web-basics.md
@@ -0,0 +1,131 @@
+# Web Basics
+
+Security Summer School
+
+---
+
+## Motivation
+
+- Wide variety of Web applications
+- Complexity of the Web applications
+- Ubiquitous
+
+---
+
+## Web
+
+- Web vs Internet
+- Popularity
+- Attack surface
+
+---
+
+## Stateless
+
+HTTP
+
+Simple
+
+Without session
+
+---
+
+## Stateful
+
+FTP
+
+Session
+
+---
+
+## Security against Whom ?
+
+- Neighbors that sniff your Wi-Fi
+- Script kiddies that try to bruteforce your website login
+- Nation state actors that have exploits to undisclosed vulnerabilities in software you use
+
+---
+
+## Why ?
+
+- Financial gain
+- Internet crime
+- Cyber warfare
+- Data breaches
+
+---
+
+## Status of Web Application Security
+
+- Web application security is not mature field
+- The entry level to web development is low
+- New exploits and exploitation methods are frequently published
+- Security does not directly add revenue. In many cases, it is viewed as an extra cost
+- Complexity, various sources, public APIs
+
+---
+
+## Good to know
+
+- CVE
+- 0-day Vulnerability
+- CWE
+
+---
+
+## Static Web Sites
+
+fast
+
+simple
+
+---
+
+## Dynamic Web Sites
+
+customizable
+
+complex
+
+---
+
+## Roots of Web Application insecurity
+
+- Non-validated user input
+- Programmers mistakes
+
+---
+
+## Web Application Framework
+
+- Collection of pieces of software
+- Ease of development
+- Common solutions for wide variety of tasks
+
+---
+
+## Links
+
+[OWASP Top 10](https://owasp.org/www-project-top-ten/)
+
+- Broken Access Control
+- Cryptographic Failures
+- Injection
+- Insecure Design
+- Security Misconfiguration
+
+---
+
+## Types of vulnerabilities on web
+
+- Browser vulnerabilities
+- Server vulnerabilities
+- Web application vulnerabilities
+
+---
+
+## Browser
+
+- Software that displays pages and files on the web
+- Interpret and display HTML Web pages, applications, JavaScript, CSS
+- Plugins which extend the capabilities
diff --git a/config.yaml b/config.yaml
@@ -13,18 +13,18 @@ make_assets:
     command: make
     locations:
       - chapters/web-application-security/web-basics/slides
-      - chapters/web-application-security/cookies-and-session-management/slides
-      - chapters/web-application-security/sql-injection/slides
-      - chapters/web-application-security/cross-site-scripting/slides
-      - chapters/web-application-security/exotic-attacks/slides
-      - chapters/web-application-security/overview/slides
-      - chapters/system-and-data-security/framework-api-vulnerabilities/slides
-      - chapters/system-and-data-security/privilege-escalation/slides
-      - chapters/system-and-data-security/end-to-end-attack/slides
-      - chapters/system-and-data-security/overview/slides
-      - chapters/network-and-communication-security/enumeration-and-recon/slides
-      - chapters/network-and-communication-security/securring-cummunication/slides
-      - chapters/network-and-communication-security/overview/slides
+      # - chapters/web-application-security/cookies-and-session-management/slides
+      # - chapters/web-application-security/sql-injection/slides
+      # - chapters/web-application-security/cross-site-scripting/slides
+      # - chapters/web-application-security/exotic-attacks/slides
+      # - chapters/web-application-security/overview/slides
+      # - chapters/system-and-data-security/framework-api-vulnerabilities/slides
+      # - chapters/system-and-data-security/privilege-escalation/slides
+      # - chapters/system-and-data-security/end-to-end-attack/slides
+      # - chapters/system-and-data-security/overview/slides
+      # - chapters/network-and-communication-security/enumeration-and-recon/slides
+      # - chapters/network-and-communication-security/securring-cummunication/slides
+      # - chapters/network-and-communication-security/overview/slides
     args:
       - all
 
@@ -35,16 +35,16 @@ embed_reveal:
     extension: mdx
     build:
       web-basics: web-basics
-      cookies-and-session-management: cookies-and-session-management
-      securring-communication: securring-communication
-      sql-injection: sql-injection
-      cross-site-scripting: cross-site-scripting
-      enumeration-and-recon: enumeration-and-recon
-      framework-api-vulnerabilities: framework-api-vulnerabilities
-      exotic-attacks: exotic-attacks
-      privilege-escalation: privilege-escalation
-      end-to-end-attack: end-to-end-attack
-
+      # cookies-and-session-management: cookies-and-session-management
+      # securring-communication: securring-communication
+      # sql-injection: sql-injection
+      # cross-site-scripting: cross-site-scripting
+      # enumeration-and-recon: enumeration-and-recon
+      # framework-api-vulnerabilities: framework-api-vulnerabilities
+      # exotic-attacks: exotic-attacks
+      # privilege-escalation: privilege-escalation
+      # end-to-end-attack: end-to-end-attack
+      #
 docusaurus:
   plugin: docusaurus
   options:
@@ -63,17 +63,17 @@ docusaurus:
 
     static_assets:
       - web-basics: /build/make_assets/chapters/web-application-security/web-basics/slides/_site
-      - cookies-and-session-management: /build/make_assets/chapters/web-application-security/cookies-and-session-management/slides/_site
-      - sql-injection: /build/make_assets/chapters/web-application-security/sql-injection/slides/_site
-      - cross-site-scripting: /build/make_assets/chapters/web-application-security/cross-site-scripting/slides/_site
-      - exotic-attacks: /build/make_assets/chapters/web-application-security/exotic-attacks/slides/_site
+      # - cookies-and-session-management: /build/make_assets/chapters/web-application-security/cookies-and-session-management/slides/_site
+      # - sql-injection: /build/make_assets/chapters/web-application-security/sql-injection/slides/_site
+      # - cross-site-scripting: /build/make_assets/chapters/web-application-security/cross-site-scripting/slides/_site
+      # - exotic-attacks: /build/make_assets/chapters/web-application-security/exotic-attacks/slides/_site
 
-      - framework-api-vulnerabilities: /build/make_assets/chapters/system-and-data-security/framework-api-vulnerabilities/slides/_site
-      - privilege-escalation: /build/make_assets/chapters/system-and-data-security/privilege-escalation/slides/_site
-      - end-to-end-attack: /build/make_assets/chapters/system-and-data-security/end-to-end-attack/slides/_site
+      # - framework-api-vulnerabilities: /build/make_assets/chapters/system-and-data-security/framework-api-vulnerabilities/slides/_site
+      # - privilege-escalation: /build/make_assets/chapters/system-and-data-security/privilege-escalation/slides/_site
+      # - end-to-end-attack: /build/make_assets/chapters/system-and-data-security/end-to-end-attack/slides/_site
 
-      - enumeration-and-recon: /build/make_assets/chapters/network-and-communication-security/enumeration-and-recon/slides/_site
-      - securring-cummunication: /build/make_assets/chapters/network-and-communication-security/securring-cummunication/slides/_site
+      # - enumeration-and-recon: /build/make_assets/chapters/network-and-communication-security/enumeration-and-recon/slides/_site
+      # - securring-cummunication: /build/make_assets/chapters/network-and-communication-security/securring-cummunication/slides/_site
     config_meta:
       title: Web Security
       url: http://localhost/