Options
WAPT course from ine.Com
iNoSec
Registered Users Posts: 2 ■■□□□□□□□□
I enrolled on ine.com on WAPT and im really disapointed about some exercises... The exercises statement arent clear at all or simply not related at all with the lesson!!
Before i must say, they have the good idea to ask you if you are still connected to the lab every 45min, but not on the lab page, no on the main site, and if no answer, because who look the main website when you are on burp or on the lab website, they stop the lab and you must connect again to the VPN etc, you lose the focus, and lose time... anyway that's not the worst.
I will pass on their stupid regex who dont img/src as xss payload when img src work... anyway, read the rest of the post the best come...
Let's take the exercise/lab with title "Failure to restrict URL Access"
Here the Scenario etc:
So it is not written to connect to an account to learn about what page are protected/behind the login page but the solution is to connect to an account to have all the authenticated page and after try to access them being unauthenticated...
Totally stupid to not have the credentials or at least state you must be log to retrieve the page to test for "Failure to restrict URL Access"...
When you see a "Failure to restrict URL Access" and no cred are given you try to bruteforce directories, look at source code to find the hidden URL...
it is exercise, not real world or whatever so i follow the scenario... what a mistake...
After that we have an exercise on "Bypassing authentication through SQL Injection" so for all who know web hacking and already do CTF etc we all know bypassing login with SQLi mean OR 1=1 style payload but no ine/elearnsecurity decide to use only sqlmap (which really bad teaching for me but personal POV), and they must say to solve it with only the tool but the worst is : the SQLi is an error-based where you **** the db... So where is the auth bypass here??? what the **** a SQLi error based exercise have to do with a lesson on authentication/authorization???
Before all guys here come to say im a noob etc, i must say i already found real bug on h1/bugcrowd/intigriti/yes we hack platforms, im not a beginner and i didnt paid for the course (it is a gift).
The problem is the exercise must be in relation to the lesson (see SQLi on auth bypass), they must be clearer on what we must do on the lab (see "failure to restrict access url"). Someone can say me, in real world you have no hint or exercise statement but the goal of exercise in a lesson is to practice what you just learn not to make a real world pentest...
For all of that i think they must work a LOT on some part of their course/exercise but like all is not black or white, i must say their content is really well made and you will learn tons of things, i have no vpn issue except the 45m i talk at the beginning.
PS: they must implement a student forum to avoid some of this problems, because if there was a student forum i could ask for the SQLi auth bypass for example etc, they said me they will make one forum so w8nSee
Before i must say, they have the good idea to ask you if you are still connected to the lab every 45min, but not on the lab page, no on the main site, and if no answer, because who look the main website when you are on burp or on the lab website, they stop the lab and you must connect again to the VPN etc, you lose the focus, and lose time... anyway that's not the worst.
I will pass on their stupid regex who dont img/src as xss payload when img src work... anyway, read the rest of the post the best come...
Let's take the exercise/lab with title "Failure to restrict URL Access"
Here the Scenario etc:
So it is not written to connect to an account to learn about what page are protected/behind the login page but the solution is to connect to an account to have all the authenticated page and after try to access them being unauthenticated...
Totally stupid to not have the credentials or at least state you must be log to retrieve the page to test for "Failure to restrict URL Access"...
When you see a "Failure to restrict URL Access" and no cred are given you try to bruteforce directories, look at source code to find the hidden URL...
it is exercise, not real world or whatever so i follow the scenario... what a mistake...
After that we have an exercise on "Bypassing authentication through SQL Injection" so for all who know web hacking and already do CTF etc we all know bypassing login with SQLi mean OR 1=1 style payload but no ine/elearnsecurity decide to use only sqlmap (which really bad teaching for me but personal POV), and they must say to solve it with only the tool but the worst is : the SQLi is an error-based where you **** the db... So where is the auth bypass here??? what the **** a SQLi error based exercise have to do with a lesson on authentication/authorization???
Before all guys here come to say im a noob etc, i must say i already found real bug on h1/bugcrowd/intigriti/yes we hack platforms, im not a beginner and i didnt paid for the course (it is a gift).
The problem is the exercise must be in relation to the lesson (see SQLi on auth bypass), they must be clearer on what we must do on the lab (see "failure to restrict access url"). Someone can say me, in real world you have no hint or exercise statement but the goal of exercise in a lesson is to practice what you just learn not to make a real world pentest...
For all of that i think they must work a LOT on some part of their course/exercise but like all is not black or white, i must say their content is really well made and you will learn tons of things, i have no vpn issue except the 45m i talk at the beginning.
PS: they must implement a student forum to avoid some of this problems, because if there was a student forum i could ask for the SQLi auth bypass for example etc, they said me they will make one forum so w8nSee