VbD structure

This page gives the structure of the vbd folder, and the purpose of each file in a challenge folder. Read it before you send your first vbd-hacking solution.

The repository keeps the vbd solutions in this structure:

Structure

This folder stores the vbd challenges.

vbd/
└── <site>/
    └── <cwe-code>-<exploit-name>/
        ├── LINK.lst
        ├── OTHERS.lst                    (only for a challenge that has one)
        ├── <gitlab-username>.feature     (solution file)
        ├── <gitlab-username>.yml         (YAML file)
        └── <gitlab-username>/            (optional folder for your scripts)
            └── <script-name>.<ext>       (script or exploit that you used)

Example

vbd/
└── vulnhub/
    └── 0020-sectalks-bne0x02-fuku/
        ├── LINK.lst
        ├── OTHERS.lst
        ├── friendglak.feature
        ├── friendglak.yml
        └── friendglak/
            └── friendglak.py

Steps

1. Rules

• The name of a file or a folder must have 35 characters or less.

• The name must be in lower case, and it must have no special character.

• Use a dash (-) in place of a space.

• Sometimes a folder name is already in use for a different category on the same platform. An example is two items with the same name in different categories. In that condition, add the category as a suffix after a dash: <name>-<category>. The full name must still have 35 characters or less. The commit message must say that the folder name has a category suffix, because of the name collision.

• The name of a vulnerability folder must be <cwe-code>-<exploit-name>, where:

  • <cwe-code> is the code of the vulnerability, in four digits.
  • <exploit-name> is the name of the vulnerability.

  An example is 0384-smgmt-cookies-httponly.

• The folder name and your .feature file must give the same CWE code. The file must contain a line with CWE-<code>: and the name of the vulnerability. The CI reads the first of these lines. It writes that code with four digits, and compares it with the first four characters of the folder name. A file with no CWE line stops the check.

2. Files

The challenge folder holds the files below. You add a solution file and a YAML file with your GitLab username. You can also add a folder with that name for your scripts. The other files belong to the challenge, and all the talents of that challenge share them.

• LINK.lst. This file contains the URL of the challenge. It must have only one line. The URL must give an HTTP 200 response, with no redirection.

• OTHERS.lst. This file contains the external solutions of that challenge. Do not read them, and do not use them to solve the challenge. External solutions gives the rules of this file. A vbd challenge folder sometimes has no OTHERS.lst, because no external solution is on the internet yet.

3. New challenge folders

You sometimes send the first solution of a challenge. Then you create the challenge folder, and you create LINK.lst in it.

CAUTION: Your pipeline fails if the challenge folder has no LINK.lst, or if LINK.lst is empty.