ØxＯＰＯＳɆＣ

2021 Events

Jan 28, 2021

[0x0F] - The Virtual Meet

Welcome to 2021 (come hell or high water)!

Saying that 2021 is starting on the wrong foot is an understatement, and let’s face it, for the time being, return to business as usual is not on the table. Nevertheless, nothing can stop us. Last year, against the odds, we managed to get our talented community to stick together and grow. This year will be no different - we’ll make it a unique, creative, and engaging journey for all of us, no matter what.

Without further ado, we are delighted to announce our first virtual meetup of the year, bringing you nothing less than our master brain teaser creator and veteran member of the community - José Moreira (@0xz3z4d45). If you are having a go at our latest challenge* or having a blast (if you belong to the most enthusiastic bunch), you can’t miss this one. We’ll be digging into the gut of the low-level world and explore the bizarre combinations that standard file formats have to offer us. Join us, and you’ll get privileged access to all the background knowledge you need to understand some of the concepts used behind the scenes and all you need for a successful journey tackling the different challenges. Last but not least, we’ll be handing you a treat, a little cookbook for you to check out.

(If you haven’t, what are you waiting for? Hit it now and give it a shot.)

In the meantime, you can join our Slack chat (https://oposec.herokuapp.com/) to discuss all kind of hackish stuff and, of course, interact with other members.

Hope to see you soon!

[Goals]

Learn something new, get to know other g33ks, and, the most important thing, have fun.

[Agenda]

[Challenge]

Oh oh oh Let the games begin!

URL: https://bit.ly/opoxmas

There are eight flags; find them and ping (@)zezadas any doubts shout out in the channel (#ch4llenges.).

Happy Hunting!

Feb 23, 2021

[0x4842443231] - The Virtual Meet

We hope we were able to give you a boost last time but don’t settle just yet. There’s more coming up. The 2nd meetup of the year is on, and you won’t get disappointed.

Steadily moving from hype to reality, IoT is here to stay. It’s no longer just about understanding what’s happening around us. More than anything, it’s about getting to the bottom of what can go seriously wrong in a world where automation is a must. Join us in our first talk in which we’ll help you to explore the ins and outs of this topic.

If you’re in the mood for something funky, we’ve got you covered as well. Our second talk is dedicated to a topic for some new, others alien. It is no doubt something you want to keep in your bag of tricks. Out of the caches of the interwebs, we are happy to dissect Edge Side Includes (ESI) attacks. Old but gold!

Let’s say that we haven’t given you enough good reasons to show up at this point. Would you say no to a “party”? That’s right, we’ll be blowing out the candles once more. Our community is turning five, and we’ll be celebrating the achievement with everyone who joins us. Just step into the meeting hall after the talks and be sure to put your party groove on.

In the meantime, you can join our Slack chat (https://oposec.herokuapp.com/) to discuss all kind of hackish stuff and, of course, interact with other members.

Hope to see you soon!

[Goals]

Learn something new, get to know other g33ks, and, the most important thing, have fun.

[Agenda]

Note: And the usual challenge write-up.

[Challenge]

Flag, Flag, Flag! Have a look, and you know :)

URL: https://neuromancer.herokuapp.com/

Ping (@)ines with the flag, and don’t forget to shout out at the #ch4llenges

Mar 24, 2021

[0xD4C3B2A1] - The Virtual Meet

“When the going gets weird, the weird turn pro.” Needless to say, it has been a weird year so far; thus, there is no better time to turn pro and be more skillful and creative at tackling the challenges ahead. To boost your resilience levels and tame the security bug in you, we are setting up the third meetup of the year.

We’re back with the special sessions. This time, we have the privilege of having the exceptional Pwn2Own Tokyo 2019 winner with Flashback Team, author of several public epic advisors, reverse engineer magician, and exploit novelist. Lately, he has turned his focus on the creation of educational videos. Still in the dark?

Without further delay, we are proud to announce that we have the honor and pleasure to have Pedro Ribeiro (@pedrib1337) sharing his knowledge with his one-of-a-kind talk about vulnerabilities in network equipment.

The security geek in you wouldn’t dare to say no to this opportunity!

In the meantime, you can join our Slack chat (https://oposec.herokuapp.com/) to discuss all kind of hackish stuff and, of course, interact with other members.

Hope to see you soon!

[Goals]

Learn something new, get to know other g33ks, and, the most important thing, have fun.

[Agenda]

Note: And the usual challenge write-up.

[Challenge]

“We all have secrets! And sometimes we need to share them with our online friends, safely… That’s easy! - Just implement a very secure, hackerproof™ secret sharing web application!”

URL: https://secret.mbie.me

Ping @mfbie with the flag and any doubts shout out in the channel (#ch4llenges).

Apr 27, 2021

[3433334d487a] - The Virtual Meet

If life gives you lemons… While we all are looking towards a post-pandemic future, for now, we can only find small glimpses of change. We might as well take stock of the extraordinary circumstances we are living in and make the most out of them.

If the warm spring weather, increased daylight haven’t boosted your mood, have a go at the goodies we have in store for you. We believe there’s no such thing as too much of a good thing, so we’ve decided to bring one of our brilliant guest speakers for a second round.

Last time, he went to the heart of the world of Red Teams; this time, he’s back with one of his adventures in the world of radio in a real scenario that you will find both exhilarating and familiar. In case you are still wondering, he develops research crossing the boundaries of everyday technology and is widely recognized in the field by presenting his work at key security conferences. It is with great pleasure we announce we have Pedro Umbelino (@kripthor) among us once again.

This is a lemonade you will want to put your hands on.

PS: In the meantime, you can join our Slack chat (https://oposec.herokuapp.com/) to discuss all kind of hackish stuff and, of course, interact with other members.

[Goals]

Learn something new, get to know other g33ks, and, the most important thing, have fun.

[Agenda]

Note: And the usual challenge write-up.

[Challenge]

“Don Joe insists his site is as secure as can be! Can you prove that the best web dev of all time is wrong?”

URL: https://don-joes-blog.herokuapp.com/

There are two flags; when you cross them, ping @miguelpduarte and explain your solution, any doubts, shout out in the channel (#ch4llenges).

May 26, 2021

[0x41757468] - The Virtual Meet

We’ve learned a significant amount through our experience of working from home. For many, the value of greater work-life balance, autonomy, or increased flexibility. Social isolation, however, has also brought about a different set of challenges: the need to help connections thrive, forge strong relationships, create the perfect settings for everyone to feel supported and therefore more engaged and focused on the tasks at hand.

One of our leading community goals is to foster engagement by forging connections to share knowledge. Despite the virtual format, now, perhaps more than before, our meetups have become key moments for those seeking networking and insights to apply to their ways of working.

In this meeting, we have the pleasure and honor to have among us once again a familiar face in our community, César Silva (@Apl3b). This time, he will tackle one of the most comprehensive and transversal topics in the InfoSec world – Authentication and Authorization. We will dive deep into the world of OpenID and OAuth, understand their usage, connections, and pitfalls. If AuthN/Z makes you scratch your head, you can’t miss this opportunity.

Enjoy, engage, connect!

PS: In the meantime, you can join our Slack chat (https://oposec.herokuapp.com/) to discuss all kind of hackish stuff and, of course, interact with other members.

[Goals]

Learn something new, get to know other g33ks, and, the most important thing, have fun.

[Agenda]

Note: And the usual challenge write-up.

[Challenge]

TBA

Jul 1, 2021

[0xF09F8EA3] - The Virtual Meet

We’ve reached that time when we all want to be off. Sure, we’re still stuck on a weird sci-fi flick, but we are eager to move on to a new setting. Finally, summer days are coming, the perfect opportunity to unwind, recharge and create those unforgettable memories with family and friends. So while you can’t give your full attention to partying, camping, fishing, or whatever suits you, you can still get out and about, enjoy the first warm summer rays of sunshine, and daydream about those special moments that are right around the corner.

Before you head out to your well-deserved break, we would like to hook you up with the right gear in case you run into some serious phishing. We got you nothing less than la crème de la crème to explore the topic. It is an honor to announce that Michele Orrù (@antisnatchor) and Giuseppe Trotta (@Giutro) will be with us at our next gathering.

Michele likes to dig into the phishing world and get his hands dirty on client-side exploitation. Besides being a regular speaker at leading security conferences, he co-authored “The Browser Hacker’s Handbook.” You may also know his work from projects such as BeEF or PhishLulz. Giuseppe’s work is as impressive. You know when you need to pull off an LPE stunt, Juicy Potato is always in your arsenal, right? Yup, you guessed it, he is one of the authors. Currently, he is a team member of the Bettercap project, and you most certainly came across his work on the Hack.me project or on the WAPTX training.

Together they created the Muraena Team and are taking phishing attacks to the next level. So if you are keen on the dirty little secrets that make phishing a modern and impactful attack, you won’t miss out on this opportunity to dive deep into the topic with the leading players in the field.

Enjoy, engage, connect!

PS: In the meantime, you can join our Slack chat (https://oposec.herokuapp.com/) to discuss all kind of hackish stuff and, of course, interact with other members.

[Goals]

Learn something new, get to know other g33ks, and, the most important thing, have fun.

[Agenda]

Note: And the usual challenge write-up.

[Challenge]

“A company named 0xOPOSEC is said to be in possession of what may be some unreleased lyrics of an Elvis Presley song. A disgruntled employee leaked a short portion of the song where we can hear the King of Rock and Roll singing ‘You ain’t nothing but (…)’. Help us figure out what the fuss is all about. We managed to get a hold of one account left behind by the disgruntled employee:

oposec.local\user1 l%^nMv0+A4XYKVgkUseA

We believe this oposec.local domain is accessible at 51.137.206.45. Good luck.”

There are two flags; when you cross them, ping @ArmySick and explain your solution, any doubts, shout out in the channel (#ch4llenges).

Sep 30, 2021

[0x6B3873] - The Virtual Meet

We’re back and ready to tackle the second half of the year. Whether you are still enjoying the last days of summer or you are already adjusting to the “new” back-to-work routine, we’ve got something to brighten up your days.

Keeping abreast of the developments in this brave new world is no easy feat. More than giving you a brush-up with the latest missing pieces, we want you to have the edge on the field and explore with you one of the trendiest deployment strategies that are around. If you’re still clueless, our next meetup will be dedicated to the world of Kubernetes. We’ll do an overview of the tech, cover the best practices, common security pitfalls, and walk you through how to enable and configure security features like RBAC, Network Policies, audit logs, and other subjects of interest. If you are eager to implement a new cluster and do it right, this is a session to keep on your priority list.

As usual, we bring you the best of the best to share their knowledge; this time, we have the pleasure to have Magno Logan among us. Magno is a senior information security specialist focused on K8s security, currently working at Trend Micro Canada. He is an active member in several tech and security communities and a founder of the JampaSec Security Conference and Paraíba OWASP Chapter. Be sure to check some of his work at https://katanasec.com .

Hope to see you soon.

Enjoy, engage, connect!

PS: In the meantime, you can join our Slack chat (https://oposec.herokuapp.com/) to discuss all kind of hackish stuff and, of course, interact with other members.

[Goals]

Learn something new, get to know other g33ks, and, the most important thing, have fun.

[Agenda]

Note: And the usual challenge write-up.

[Challenge]

URL: http://notepad.madlabs.pw/ Hint: https://bit.ly/3nvzSzx

Ping @simps0n with the flag and any doubts shout out in the channel (#ch4llenges).

Oct 26, 2021

[0x696E74656E743A2F2F] - The Virtual Meet

Get ready to embrace the spookiest time of the year with one of our freakiest and bone-chilling adventures yet. We are bringing back to the spotlight an old nightmare that keeps haunting the mobile world. Still clueless? Don’t sweat it; you won’t be in limbo for long.

Without further ado, we are delighted to announce that in our next gathering, we’ll be joined by Inês. If you don’t know this talented maverick, you should! She is always ready to help out and geared with a fierce bag full of tricks to hack whatever comes her way; she has been with us for a while and is one of our community’s best challenge slayers.

She’ll be guiding our path into Deep Links in the Android Platform. Don’t worry; we’ve got you covered if you don’t know what we are talking about. This will be a crash course on this endless nightmare from the original problem to attack strategies, mitigations, and how to test it.

This is an adventure your intrepid soul can’t pass up. While you wait for the big event, don’t be shy and greet @ines on slack.

PS: You can join our Slack chat (https://bit.ly/0xOPOSEC-Slack-I) to discuss all kind of hackish stuff and, of course, interact with other members.

[Goals]

Learn something new, get to know other g33ks, and, the most important thing, have fun.

[Agenda]

Note: And the usual challenge write-up.

[Challenge]

Some vulnerabilities never left us alone! Find the ghost from the past and FLAGs you will get.

URL: http://boo.madlabs.pw

Ping (@)simps0n with the flags and explain your solution, any doubts, shout out in the channel (#ch4llenges).

PS: Keep the fun alive! Please undo any state-changing action so others can play as well :)

Nov 23, 2021

[0x3C6E6F7363726970743E] - The Virtual Meet

As it’s drawing to a close, together, we look back on a challenging, nonetheless successful year for all of us. Amid the upheaval, we survived through lockdowns, shifted abruptly to remote, and kept wondering when it might all return to normal. There are plenty of unknown questions, but one thing there’s no doubt about is that the way we interact and create might never be the same. Thus, we keep striving to mitigate the distance and reimagine everything about how we connect.

Up to this point, the community has been strengthened by unique opportunities to learn with the very best in the field, and this time will be no different, except for one-minute detail. This will be one of those rare occasions that you will have the privilege of meeting an absolute Web Security World legend. Get ready to be starstruck because we are excited and proud to announce that we have the honor and pleasure to have Dr.-Ing. Mario Heiderich among us to dive into the crazy world of Mutation XSS.

In case you have been stranded on the far side of the galaxy, you should know that Mario is the founder of Cure53 (https://cure53.de/)* and one of the most influential security researchers on the web. On his research journeys, he managed to show: why IE was one of the greatest browsers that ever existed, subvert some JS frameworks logic to his advantage (AngularJS wink wink), demonstrate how difficult it is to sanitize user input safely** and why scripts are so overrated, i.e., stealing the pie without touching the sill. Bottom line, we can only thank him for making the web a safer place at the end of his compelling adventures.

It is self-explanatory why you should not miss the last meetup of the year. We are bidding farewell to 2021 in style, and you are more than welcome to join us at this great gathering.

In the meantime, you can join our Slack chat (https://join.slack.com/t/0xmadlabs/shared_invite/zt-w9zvp96c-orETMoj71yGdBMEpYT4PeQ) to discuss all kinds of hackish stuff and, of course, interact with other members.

Hope to see you soon!

If their work doesn’t ring a bell, you most probably need some guidance, but it’s never too late to dig in and feast on their epic pwnages and research work. ** Have a look at the DOM Purify project.

[Goals]

Learn something new, get to know other g33ks, and, the most important thing, have fun.

[Agenda]

Note: And the usual challenge write-up.

[Challenge]

Last Christmas, I gave you my leaks But the very next day, you gave it away This year, to save me from tears I’ll give you a special challenge

URL: http://xmas2021.sefod.eu/

Ping (@)zezadas w/ the flag(s) and get help on the usual channel #ch4llenges