Lab Challenges - Praktik Langsung di vuln.cybersecurity.or.id
Pilar Ke-4 TDCTF Security Academy
Target: 13 aplikasi vulnerable divuln.cybersecurity.or.id
Author: TDCTF Security Academy - Cybersecurity Indonesia
Filosofi
Tiga pilar pertama (Ethical Hacking, Forensics, Kriptografi) mengajarkan teori & teknik. Pilar ke-4 ini adalah medan perang - tempat Anda mempraktikkan semua ilmu di target nyata.
Setiap challenge adalah walkthrough langkah demi
langkah untuk menaklukkan satu vulnerability di
vuln.cybersecurity.or.id.
️ Peta 13 Target
| # | App | Vulnerability | Port | Subdomain | Tools |
|---|---|---|---|---|---|
| 1 | 🏦 Portal Berita | SQL Injection (Error-based) | 8081 | portal-vuln.vuln.cybersecurity.or.id |
sqlmap, curl |
| 2 | 📚 Library | SQL Injection (Union-based) | 8084 | lib-vuln.vuln.cybersecurity.or.id |
sqlmap, curl |
| 3 | 📝 WordPress | User Enum + Weak Pass | 8082 | wp-vuln.vuln.cybersecurity.or.id |
wpscan, curl |
| 4 | 🔐 WPS (WordPress Kedua) | Stored XSS | 8083 | wps-vuln.vuln.cybersecurity.or.id |
Browser, curl |
| 5 | 🎫 Ticket System | SQLi + File Upload Chain | 8085 | ticket-vuln.vuln.cybersecurity.or.id |
sqlmap, curl |
| 6 | 💼 Job Portal | SQLi + JWT | 8086 | jobportal-vuln.vuln.cybersecurity.or.id
|
curl |
| 7 | 🔌 REST API | IDOR + No Auth | 8087 | api-vuln.vuln.cybersecurity.or.id |
curl, jq |
| 8 | 🔑 Login API | JWT Manipulation | 8088 | loginapi-vuln.vuln.cybersecurity.or.id |
jwt_tool, Python |
| 9 | 🐧 Metasploitable 2 | Multi-vuln (UnrealIRCD, Samba) | 8089 | server-vuln.vuln.cybersecurity.or.id |
metasploit, nmap |
| 10 | 🧃 Juice Shop | XSS, SQLi, Broken Auth | 3000 | juice-vuln.vuln.cybersecurity.or.id |
Browser, Burp |
| 11 | 🐐 WebGoat | XXE, DES, SSRF | 9090 | webgoat-vuln.vuln.cybersecurity.or.id |
Burp, curl |
| 12 | 🐺 WebWolf | File Upload RCE | 9091 | webwolf-vuln.vuln.cybersecurity.or.id |
curl, nc |
| 13 | ⚡ Laravel | Debug Mode RCE | 8090 | laravel-vuln.vuln.cybersecurity.or.id |
curl, phpggc |
Cara Akses
Semua target bisa diakses melalui:
# Via domain (melalui Cloudflare tunnel)
http://portal-vuln.vuln.cybersecurity.or.id:8081/
http://lib-vuln.vuln.cybersecurity.or.id:8084/
http://wp-vuln.vuln.cybersecurity.or.id:8082/
http://wps-vuln.vuln.cybersecurity.or.id:8083/
http://ticket-vuln.vuln.cybersecurity.or.id:8085/
http://jobportal-vuln.vuln.cybersecurity.or.id:8086/
http://api-vuln.vuln.cybersecurity.or.id:8087/
http://loginapi-vuln.vuln.cybersecurity.or.id:8088/
http://server-vuln.vuln.cybersecurity.or.id:8089/
http://juice-vuln.vuln.cybersecurity.or.id:3000/
http://webgoat-vuln.vuln.cybersecurity.or.id:9090/
http://webwolf-vuln.vuln.cybersecurity.or.id:9091/
http://laravel-vuln.vuln.cybersecurity.or.id:8090/
# Via tunnel wildcard (jika DNS terkonfigurasi)
http://portal-vuln.vuln.cybersecurity.or.id/
http://lib-vuln.vuln.cybersecurity.or.id/
http://wp-vuln.vuln.cybersecurity.or.id/
http://wps-vuln.vuln.cybersecurity.or.id/
http://ticket-vuln.vuln.cybersecurity.or.id/
http://jobportal-vuln.vuln.cybersecurity.or.id/
http://api-vuln.vuln.cybersecurity.or.id/
http://loginapi-vuln.vuln.cybersecurity.or.id/
http://server-vuln.vuln.cybersecurity.or.id/
http://juice-vuln.vuln.cybersecurity.or.id/
http://webgoat-vuln.vuln.cybersecurity.or.id/
http://webwolf-vuln.vuln.cybersecurity.or.id/
http://laravel-vuln.vuln.cybersecurity.or.id/
# Via localhost (dari server ini)
http://vuln.cybersecurity.or.id/
Challenge Tersedia
(Daftar walkthrough akan diisi secara bertahap)
| # | Target | Walkthrough |
|---|---|---|
| 1 | 🏦 Portal Berita (SQLi) | ✅ Lihat Walkthrough |
| 2 | 📚 Library (SQLi) | ✅ Lihat Walkthrough |
| 3 | 📝 WordPress | ✅ Lihat Walkthrough |
| 4 | 🔐 WPS (Stored XSS) | ✅ Lihat Walkthrough |
| 5 | 🎫 Ticket System | ✅ Lihat Walkthrough |
| 6 | 💼 Job Portal (SQLi + JWT) | ✅ Lihat Walkthrough |
| 7 | 🔌 REST API (IDOR) | ✅ Lihat Walkthrough |
| 8 | 🔑 Login API (JWT) | ✅ Lihat Walkthrough |
| 9 | 🐧 Metasploitable 2 | ✅ Lihat Walkthrough |
| 10 | 🧃 Juice Shop | ✅ Lihat Walkthrough |
| 11 | 🐐 WebGoat | ✅ Lihat Walkthrough |
| 12 | 🐺 WebWolf | ✅ Lihat Walkthrough |
| 13 | ⚡ Laravel | ✅ Lihat Walkthrough |
Generated by @farishhz Agent Pentest Pipeline - TDCTF Security Academy