YAML template: VbD | Fluid Attacks Academy

For a vbd challenge, the name of this file is {user-name}.yml. Remove all the comments from your file.

Fill the fields in angle brackets <>. The list below the box tells you what each field is.

type: <scope>
user-name: <user-name>
stage: <phase>
discovered-vulnerabilities:
  by-me: <X>
  in-repo: <Y>
  total: <X+Y>
estimated-vulnerabilities: <N>
discovery-percentage: <D%>
effort: <H>
date: <commit-date>
path: <solution-path>

<scope> is vbd.
<user-name> is your GitLab username. It must be the same as the first part of the name of your branch.
<phase> is the phase of the Academy that you are in. The key of this field in the YAML file is stage, and it is not the academy stage of Terms. Your team leader gives you the phase when you start. Select one of these four values, and use the same value in all your merge requests. Change it only when your team leader tells you to change it.
- journey.
- quest.
- onboarding.
- practice.
How it works gives each phase.
<solution-path> is the name of your solution file. It must obey the naming conventions of the repository.
<commit-date> is the date of the commit. The command git log gives it to you. You must write the UTC date. If you are in Bogota, Colombia, add 5 hours. The format is Year-Month-Day Hours:Min:SecondsZ. An example is 2021-04-16 09:41:52Z.
X is the accumulated quantity of vulnerabilities that you discovered in this system.
Y is the accumulated quantity of vulnerabilities that the repository already has for this system. It does not include the vulnerabilities that you reported before. Both values can be zero, if you find a vulnerability in a new ToE.
N is the estimated quantity of vulnerabilities in the system. The official documentation of the system gives this number. A site such as VulnHub also gives it.
D is (X + Y) * 100 / N, with two decimal places or less.
When a calculation gives a decimal, write 3 decimal places or less, and do not round the value. For example, write 15.075 and not 15.08. Write 15.07 as 15.07, and 15.0 as 15.0. All the formulas below obey this rule.
Effort is the quantity of hours that you used for this challenge, in decimal hours.

Time Doctor gives no time for each challenge, because it runs against one task. You decide which part of a session is for this challenge, and you write that value. Terms gives the time-tracking rules.

The value can be exact, or an honest estimate.

Write the hours with 3 decimal places or less, and do not round the value. For example, 10 hours and 0 minutes is 10.0. A time of 0 hours and 24 minutes is 0.4, because 24 / 60 = 0.4. A time of 5 hours and 13 minutes is 5.216.

For example, you discovered 15 vulnerabilities in a system, and the repository has 2 vulnerabilities from other talents. Later you discover one more, and other talents reported 3 more in the same time. Then by-me is 16, in-repo is 5, and total is 21.

You must fill all these values. A vbd challenge records vulnerability counts and not a score, so this file has no score, global-rank or national-rank field. Read VbD structure for the folder that holds this file.

Full example:

type: vbd
user-name: friendglak
stage: onboarding
discovered-vulnerabilities:
  by-me: 1
  in-repo: 0
  total: 1
estimated-vulnerabilities: 1
discovery-percentage: 100%
effort: 3.3
date: "2021-04-08 14:57:03Z"
path: friendglak.feature

These are user.yml files that are already in the repository:

Example 1.
Example 2.