Capture the flag: secure the portal

Classroom resources

Load these into Waypoints Prepare: choose Load URL and paste the copied address, or download the file and import it. In Prepare, the worksheet's Teacher edition shows the answers; the student copy hides them.

• Slides Download Copy address for Prepare Present from the browser, or export to PowerPoint or PDF.
• Worksheet Download Copy address for Prepare Print the student copy; the Teacher edition has the answers.

Students will be able to

• I can find weaknesses in a system using what I know about addresses, hashes, permissions and keys.
• I can fix a system so each role has only what it needs.
• I can match a weakness to the fix that stops it.

Timing

Predict and Try 6 min · Flags 22 min · Fix 8 min · Report 8 min · Discussion 6 min

Before class

Defensive framing throughout: the portal is fictional and theirs to test; every finding leads to a fix and a report. Talk about permission: testing someone else's system without it is illegal (Criminal Code Act 1995 (Cth), Part 10.7) and against school rules.

Flags (case does not matter):

• Flag 1: WP{203.0.113.10}
• Flag 2: WP{zoe} (her password is football)
• Flag 3: WP{marks}
• Flag 4: WP{alice-public}

The kit's node 5 asks students to trace data through a networked system and say where each mechanism operates; the report step does that. Secret messages (Code) has its own capture the flag on micro:bits; classes that did it will recognise the format.

Running the lesson

1. Predict: have students say what makes testing ethical (permission, reporting).
2. Try: ask what the address tells you about who owns the site.
3. Flags: let pairs split the four flags, then explain to each other.
4. Fix: ask what zoe should do as well (change her password, use a passphrase).
5. Report: ask which weakness is most serious, and why.

The hard part (on purpose)

Students want to guess flags. Insist each flag comes from a board: say which board and what you saw.

When students get stuck

Answers to the checks

1. why test your own system?: Why do security teams try to break into their **own** school or company systems?
   To fix them first. Testing only systems you have permission to test, and reporting what you find, is called ethical hacking or penetration testing.
2. Try: a suspicious email: An email says: "Your password expires today. Reset it at schoo1.edu.au." Press Go. Where does the link really go?
   
   To 198.51.100.66, not the school (203.0.113.x). The email is phishing: weakness one.
3. Flag 1: the real address: Flag 1 (names and addresses). Students should type the real portal's name instead of clicking links. What is the real portal's IP address? Look up school.edu.au. The flag is WP{ then the address, then }.
   A flag (the exact answer is in the teacher notes)
   school.edu.au is 203.0.113.10. The phishing link went to 198.51.100.66.
4. Flag 2: the weak password: Flag 2 (hashes). The portal's stored hashes are on the board. The five most common passwords are 123456, password, qwerty, dragon and football. Type each and see whether its hash is in the list. Which user has one of them? The flag is WP{ then the user's name, then }.
   A flag (the exact answer is in the teacher notes)
   football hashes to 6382deaf1f5d: zoe's. The other users have long passphrases that are on no guess list.
5. Flag 3: the wrong permission: Flag 3 (permissions). Sign in as Sam (password maple) and test what a student can do. Which file can students change that they should only read? The flag is WP{ then the file name in lower case, then }.
   A flag (the exact answer is in the teacher notes)
   Students can change Marks. They should only read them.
6. Flag 4: the right key: Flag 4 (keys). The portal sends Alice's new password to her. Which key must lock it so only Alice can read it? Test the choices. The flag is WP{alice-public}, WP{alice-private} or WP{bob-own}: pick the one that works.
   A flag (the exact answer is in the teacher notes)
   Alice's public key (her padlock): anyone can lock with it, only her private key opens it.
7. Fix: secure the portal: Fix the portal: give every role only what its job needs, and switch on multi-factor sign-in.
   
   Least privilege closes the marks hole, and with MFA a stolen password (like zoe's) is no longer enough to get in.
8. the report: Match each weakness to the fix that stops it.
   A phishing link to schoo1.edu.au → Check the exact address (or type it); zoe's password was on the common list → Long passphrases, stored as salted hashes; Students could change Marks → Least privilege; A stolen password let someone sign in → Multi-factor sign-in; A message sent with no padlock could be read → Lock with the receiver's public key (HTTPS)
   Every weakness has a fix from this course. A real report lists what was found, how serious it is, and what to change.

Solutions

One possible solution for each task. Other correct programs are fine.

Fix: secure the portal

Open task: any program that does what the step asks.

Stretch and support

Stretch: Write a one-page security report for the portal: each finding, how serious it is (low, medium, high), and the fix.

Support: A checklist card: names and addresses, hashes, permissions, keys, with the board for each.

Exit ticket

Name two weaknesses you found in the portal and the fix for each.

Any two: phishing link (check the exact address), weak password (passphrase, salted hashes, MFA), students could change marks (least privilege), unlocked message (receiver's public key, HTTPS).

What each step is for

• why test your own system?: Committing to why defenders attack their own systems frames the challenge: finding a weakness is only useful because it leads to a fix.
• Try: a suspicious email: Looking up the email's link starts the investigation with the first lesson in reverse: from a suspicious name to where it really goes.
• capture four flags: Each flag needs one idea from the course applied to the portal: DNS, hashing, permissions and public keys.
• Fix: secure the portal: Turning the findings into fixes is the point of the challenge: least privilege and multi-factor sign-in close two of the holes on the board.
• the report: Matching each weakness to its fix is the security report: what was found, and what stops it.

Where it leads

This closes Security and privacy, and the Digital systems Years 9–10 work on 10K01.

Code links: Secret messages (micro:bit ciphers, key exchange, challenge and response, its own capture the flag).