From 66503f5c1ce957df0d50e88491538606bd21ad9a Mon Sep 17 00:00:00 2001
From: Ron <ron-github@skullsecurity.org>
Date: Mon, 14 Jan 2019 10:41:45 -0800
Subject: [PATCH] Beta 2 (#7)

* Create the basic outline of a web app without any challenges (#1)

* Start a readme file

* Fix headers because how do I header?

* Add a simple application that runs

* Add a session

* Add a public folder

* Basic template

* Add a header / footer

* Add a blank level 1

* Add some basic level templates

* Add bootstrap.js

* Add a navbar

* Lots of cleanups to the web code

* Add header/footer I forgot

* Basic challenges written and styled (#2)

* Implement level 1

* Add level 2

* Formatting fix

* Add level 3

* Add level 4

* Add skeleton files for 5/6/7

* Started to develop Level 5

* Add A challenge/solution for level 5

* Extracted level 5's code into a module to make it re-useable for level 6 and 7

* Add level 6, start workign on level 7

* Finish level 7 walkthrough

* Lots of refactoring and cleanup

* Add a dockerfile + rackup configuration (#3)

* Add solution files I missed earlier (#4)

* Add persistent sessions

* Remove old Rakefile

* Update and fix the makefile

* Updated the links to point to the new presentation

* Add a Makefile for docker
---
 Makefile                  |  8 ++++++++
 README.md                 | 15 ++++++---------
 solution/level1/README.md |  7 +++++++
 src/Rakefile              | 10 ----------
 src/lib/app.rb            | 10 ++++++++--
 src/lib/level1.rb         |  2 +-
 src/lib/views/level1.erb  |  2 +-
 src/lib/views/navbar.erb  |  2 +-
 8 files changed, 32 insertions(+), 24 deletions(-)
 create mode 100644 Makefile
 delete mode 100644 src/Rakefile

diff --git a/Makefile b/Makefile
new file mode 100644
index 0000000..8bfab1e
--- /dev/null
+++ b/Makefile
@@ -0,0 +1,8 @@
+all:
+	docker build -t cryptorama .
+
+run:
+	docker run --rm -p 3000:3000 -ti cryptorama
+
+clean:
+	docker rm cryptorama
diff --git a/README.md b/README.md
index 3c54121..6e07f9e 100644
--- a/README.md
+++ b/README.md
@@ -1,27 +1,24 @@
 Cryptorama!
 
 This is a fun series of crypto challenges that I designed to go along with
-[a crypto workshop](https://drive.google.com/drive/u/0/folders/1rF_Wn1t31lK-EXofOAT58nDc7ZUDSGSt)
+[a crypto workshop](https://drive.google.com/open?id=1nJB-PbDxTDDZFniFW1N3-N7stVavPe9bP7MMZgGbCvc)
 I created.
 
 # Running
 
-The easiest way to run this is to use docker. Then just run...
+The easiest way to run this is to use docker. With docker installed and running,
+run...
 
 
 ```
-make install
-make run
+make && make run
 ```
 
 ...as any user in the local `docker` group.
 
 # Challenges
 
-See the [src/](src/) folder for the application source code.
+See the [src/](src/) folder for the application source code and
+[solution/](solution/] for solutions.
 
 TODO: Outline the challenges here
-
-# Solutions
-
-See the [solutions/](solutions/) folder for solutions and walkthroughs.
diff --git a/solution/level1/README.md b/solution/level1/README.md
index c3f0533..d384691 100644
--- a/solution/level1/README.md
+++ b/solution/level1/README.md
@@ -5,3 +5,10 @@ Solution: `dr.z`
 # Walkthrough
 
 This is just layers and layers of encoding. The bottom string is what matters!
+
+Here's Jeff's:
+
+```
+echo '...' | ' | tr -d ' ' | base64 -d | tr ' ' '\n' | while read line || [ -n "$line" ]; do echo "$line" | xxd -r -p; done | tr ' ' '\n' | while read line || [ -n "$line" ]; do printf \\$(printf "%o" $line); done | while read -n 2 hex; do echo "$hex" | xxd -r -p; done | base32 -d
+From the desk of Dr.Z (unlicensed)<Paste>
+```
diff --git a/src/Rakefile b/src/Rakefile
deleted file mode 100644
index 912ee38..0000000
--- a/src/Rakefile
+++ /dev/null
@@ -1,10 +0,0 @@
-require "bundler/gem_tasks"
-require "rake/testtask"
-
-Rake::TestTask.new(:test) do |t|
-  t.libs << "test"
-  t.libs << "lib"
-  t.test_files = FileList['test/**/*_test.rb']
-end
-
-task :default => :spec
diff --git a/src/lib/app.rb b/src/lib/app.rb
index 46ef85b..62bbe23 100644
--- a/src/lib/app.rb
+++ b/src/lib/app.rb
@@ -9,6 +9,7 @@
 require 'sinatra'
 require 'sinatra/base'
 require 'singlogger'
+require 'securerandom'
 
 require 'level1'
 require 'level2'
@@ -18,14 +19,14 @@
 require 'level6'
 require 'level7'
 
+LOGGER = ::SingLogger.instance()
+
 module Cryptorama
   class Server < Sinatra::Base
     enable :sessions
 
     def initialize(*args)
       super(*args)
-
-      @logger = ::SingLogger.instance()
     end
 
     configure do
@@ -33,6 +34,11 @@ def initialize(*args)
         set :port, PARAMS[:port]
         set :bind, PARAMS[:host]
       end
+
+      set :session_secret, ENV.fetch('SESSION_SECRET') {
+				LOGGER.warn("No SESSION_SECRET found in ENV, using a random one")
+				SecureRandom.hex(64)
+			}
     end
 
     not_found do
diff --git a/src/lib/level1.rb b/src/lib/level1.rb
index 1cda287..6cfd325 100644
--- a/src/lib/level1.rb
+++ b/src/lib/level1.rb
@@ -50,7 +50,7 @@ class Server < Sinatra::Base
     end
 
     post '/level1' do
-      if params[:answer].downcase == LEVEL1[:answer].downcase
+      if params[:answer].downcase.index(LEVEL1[:answer].downcase)
         session[:level2][:open] = true
         session[:level1][:completed] = true
 
diff --git a/src/lib/views/level1.erb b/src/lib/views/level1.erb
index 0c7ad53..e7a9719 100644
--- a/src/lib/views/level1.erb
+++ b/src/lib/views/level1.erb
@@ -35,7 +35,7 @@
 </div>
 
 <div class='answer'>
-  <p>Who stole the package? (please enter the name exactly as shown on the note)</p>
+  <p>Who stole the package? (please enter the name <strong>exactly as shown on the note</strong>)</p>
 
   <%= erb :answer %>
 </div>
diff --git a/src/lib/views/navbar.erb b/src/lib/views/navbar.erb
index 5ff69c6..89f2262 100644
--- a/src/lib/views/navbar.erb
+++ b/src/lib/views/navbar.erb
@@ -10,7 +10,7 @@
       </li>
 
       <li class="nav-item">
-        <a class="nav-link" href="https://drive.google.com/open?id=1rQ0toD54prlNi84tVXe9xh1b1a6fTeXewwUe8NI6p9g">Slides</a>
+        <a class="nav-link" href="https://drive.google.com/open?id=1nJB-PbDxTDDZFniFW1N3-N7stVavPe9bP7MMZgGbCvc">Slides</a>
       </li>
     </ul>
   </div>