A security team tests a system before attackers do. Use everything from this course to find four weaknesses in a school portal (a lookalike link, a weak password, a wrong permission and an unlocked message), capture a flag for each, then fix the portal and match each weakness to its fix.
Security teams are paid to find the holes in their own systems first. Today the portal is yours to test.
A capture the flag (CTF) is a security challenge: you look for weaknesses in a system you have permission to test, and each one you find gives you a flag, a secret word to type in. Security teams do this to their own systems so they can fix the holes before attackers find them.
The school portal is yours to test. There are four weaknesses, one for each lesson in this course. Each flag looks like WP{…}.
Predict: Read the problem and decide what you think before you try anything. A wrong guess is fine: it shows you what to look for.
Try: Try it on the board and compare the result with your prediction.
Investigate: Work out why it happens, one step at a time.
Modify: Change the problem on purpose and see what happens.
Make: Make your own problem using what you have learned. Expect a few tries; that is normal.
Make your prediction first. Help opens once you've locked it in.
PredictRead the problem and decide what you think before you try anything. A wrong guess is fine: it shows you what to look for.
Why test your own system?
TryTry it on the board and compare the result with your prediction.
Try: a suspicious email
Keep that address in mind for the first flag.
Try it yourselfYour edits are saved in this browser.
An email says: "Your password expires today. Reset it at schoo1.edu.au." Press Go. Where does the link really go?
Use the board. This ticks when you get there.
InvestigateWork out why it happens, one step at a time.
Capture four flags
Try it yourselfYour edits are saved in this browser.
Flag 1 (names and addresses). Students should type the real portal's name instead of clicking links. What is the real portal's IP address? Look up school.edu.au. The flag is WP{ then the address, then }.
Flag 2 (hashes). The portal's stored hashes are on the board. The five most common passwords are 123456, password, qwerty, dragon and football. Type each and see whether its hash is in the list. Which user has one of them? The flag is WP{ then the user's name, then }.
Flag 3 (permissions). Sign in as Sam (password maple) and test what a student can do. Which file can students change that they should only read? The flag is WP{ then the file name in lower case, then }.
Flag 4 (keys). The portal sends Alice's new password to her. Which key must lock it so only Alice can read it? Test the choices. The flag is WP{alice-public}, WP{alice-private} or WP{bob-own}: pick the one that works.
ModifyChange the problem on purpose and see what happens.
Fix: secure the portal
Try it yourselfYour edits are saved in this browser.
Need a hint?
Students should read Marks, not change them.
Another hint
Click the Students row's Marks cell until it says read.
Another hint
Then switch on multi-factor sign-in.
Fix the portal: give every role only what its job needs, and switch on multi-factor sign-in.
Use the board. This ticks when you get there.
MakeMake your own problem using what you have learned. Expect a few tries; that is normal.
The report
Then: which weakness would you fix first, and why?
Match each weakness to the fix that stops it.
A phishing link to schoo1.edu.au
zoe's password was on the common list
Students could change Marks
A stolen password let someone sign in
A message sent with no padlock could be read
For teachers
A capture-the-flag finale. Students test a fictional school portal with the course's boards, capture four flags (a phishing address, a weak password found by auditing hashes, an over-wide permission, the right key), fix the permissions and switch on MFA, then match each weakness to its fix (AC9TDI10K01 node 5). About 50 minutes.
I can find weaknesses in a system using what I know about addresses, hashes, permissions and keys.
I can fix a system so each role has only what it needs.
I can match a weakness to the fix that stops it.
Before class
Defensive framing throughout: the portal is fictional and theirs to test; every finding leads to a fix and a report. Talk about permission: testing someone else's system without it is illegal (Criminal Code Act 1995 (Cth), Part 10.7) and against school rules.
Flags (case does not matter):
Flag 1: WP{203.0.113.10}
Flag 2: WP{zoe} (her password is football)
Flag 3: WP{marks}
Flag 4: WP{alice-public}
The kit's node 5 asks students to trace data through a networked system and say where each mechanism operates; the report step does that. Secret messages (Code) has its own capture the flag on micro:bits; classes that did it will recognise the format.
Running the lesson
Predict: have students say what makes testing ethical (permission, reporting).
Try: ask what the address tells you about who owns the site.
Flags: let pairs split the four flags, then explain to each other.
Fix: ask what zoe should do as well (change her password, use a passphrase).
Report: ask which weakness is most serious, and why.
The hard part (on purpose)
Students want to guess flags. Insist each flag comes from a board: say which board and what you saw.
When students get stuck
A student guesses flag 2. Ask: Which common passwords have you hashed so far? Fix: Type each of the five; one lights a row.
A student stuck on flag 4. Ask: Which padlock let Alice open the box and kept Eve out? Fix: Test all three on the board.
Stretch and support
Stretch: Write a one-page security report for the portal: each finding, how serious it is (low, medium, high), and the fix.
Support: A checklist card: names and addresses, hashes, permissions, keys, with the board for each.
Where it leads
This closes Security and privacy, and the Digital systems Years 9–10 work on 10K01.
Code links: Secret messages (micro:bit ciphers, key exchange, challenge and response, its own capture the flag).
What each step is for
why test your own system?: Committing to why defenders attack their own systems frames the challenge: finding a weakness is only useful because it leads to a fix.
Try: a suspicious email: Looking up the email's link starts the investigation with the first lesson in reverse: from a suspicious name to where it really goes.
capture four flags: Each flag needs one idea from the course applied to the portal: DNS, hashing, permissions and public keys.
Fix: secure the portal: Turning the findings into fixes is the point of the challenge: least privilege and multi-factor sign-in close two of the holes on the board.
the report: Matching each weakness to its fix is the security report: what was found, and what stops it.
Now you can
Find weaknesses in a system using what I know about addresses, hashes, permissions and keys.