After you answer a question, there should be an explanation of the right answer. I was able to guess through some that I had no idea what they actually were, and an explanation of why I did/didn't get it right will help a lot and actually help me identify vulnerable code.
A little coloration and indentation would be great. Going through a chunk of 20 lines of unknown language in a couple seconds is already enough of a challenge especially for beginners, no need to add unreadability to it :P.
alex here. After getting a question correct, you can submit the same POST request with the same answer, and a very large negative number for the time. I imagine they're just adding your newly calculated score (30?-time) to your session's previous score. A lesson in sanitising inputs!
You should aways have the answer "Non-exploitable code" for every question. For some questions, the lack of this answer makes it clear that there is a vulnerability, and the structure of the question makes it obvious which one of the answers is most likely (e.g., no SQL or methods dealing with SQL exclude all SQL based answers, a question with "sleep" is highly likely to be a DOS by Sleep, etc.)
I'm not a CS guy, but I was able to deduce a lot of the answers just from how the question was structured.
EDIT: The actual response in the app is "Non-exploitable code". Updated my comment to reflect this
Just ran through 4 of the "beginner" tests and almost none of the answers I ran across was "none exist." Not trying to prove or disprove your point but did find it odd.
I liked the one that was a C program that used argv[0] (or argv[1] - cant remember) as the connection string for an SQL database. Then the answer was SQL injection. I mean, sure, you can argue that's a flaw with the program, but it's also THE ONLY POSSIBLE USE for the program.
I got 5/5 on advanced, but I don't think that proves anything. For most of the questions my response would be "decomp your code better and use comments."
I was wondering that too... With some sort of insight into the correct response, one might be able to learn rather than just be tested. A lot of fun regardless.
There's a big difference between having to select between four different kinds of vulnerabilities when given a piece of that you're told is insecure, and identifying them in the wild. This is more putting the square peg in the square hole than it is measuring the angles and being able to accurately identify the shape.
One of the questions that I got had an option that said "No vulnerabilities". I think having that option for every question with some solid code will let you find vulnerabilities more accurately.
I had hoped from the description this would be more like the latter, with vulnerabilities you had to exploit to advance to the next level. As a format, multiple choice quizzes are not that interesting.
Like the idea (and infact I've submitted some code loosely based on an example I actually found in an application!), but yeah, the comments about needing more time because of having not used some of the languages applies here also. And yeah, an explanation of the right answer would help - especially if you haven't used the language (at all, or in a while).
When you beat the advanced levels, and are looking for a real challenge, give http://escape.alf.nu a try. I didn't make it but it's the most difficult but still educational hacking challenge I've seen. Also, since it validates answers server-side these days, it isn't, itself, hackable.
