Prompt
We need to verify that you can look up information about OWASP as it's critical to your mission. See what you can find out about the Open Worldwide Application Security Project using their website.
Walk-Through
This challenge involves finding information about OWASP and using the OWASP webpage in coordination with the Wayback Machine (or web.archive.org) to uncover archived information.
OWASP, or Open Worldwide Application Security Project, is a nonprofit organization whose goal is to improve software security through community led projects, chapters and by hosting conferences. They want information about application security to be open source, so they publish public resources that organizations can use to get started at producing more secure code.
OWASP is a key resource and organization to know in the cybersecurity space since it is commonly referenced by many books, tools, private cyber organizations as well as U.S. Federal organizations.
Start this challenge by looking at the OWASP homepage as well as the Wikipedia page associated with OWASP.
The Wikipedia page may help reveal information about the organization that may be found in dropdowns or other menus, and the OWASP website lets you verify that that information is correct and accurate. This is always a best practice when starting an OSINT challenge; especially if you have no knowledge on the topic.
Notice at the bottom of the Wikipedia page there are a few archived links. These reference information that is archived in a tool known affectionately as The Wayback Machine.
Guide
This challenge is structured to help you understand ways to use the Wayback Machine, or the Internet Archive ( or web.archive.org), however, there are various paths to solving each question (and some paths involve not using the Internet Archive). The Wayback Machine is a digital archive that allows you to see past versions of websites, old documents, and sometimes videos. Knowing how to use it is an important tool in OSINT.
The first question can be answered with a simple internet query as there is a current page on the OWASP site that contains information about the updated naming from 2021.
However, what if we wanted to cite this change to preserve the link for the future? Search for “Wayback Machine”, or web.archive.org. Then enter the URL in the caption for the image above.
You will be brought to:
There are various strategies to look for the nomination deadline for the WASPY awards. Try using the Wayback Machine to find the primary source on the OWASP webpage.
The question gives what year to look for.
Blue dots represent days with archived pages. Click on days with blue dots to see full pages. Green dots will have pages with redirects.
Once you find the right page, you will be able to see where you could find more information about the WASPY awards and the answer to question 2. Be sure to enter the date in the correct format!
The Wayback Machine search bar searches through the URL. You cannot use the search bar to find exact words on an archived page, therefore, you cannot simply ‘search’ the archive for mentions of this Project.
We can use a similar process as we did for question 2 to find the name of the project listed in the LAB Project Code Analysis Report from 2014. This might be a bit more difficult to find. However, various archived versions of this page allow you to click through their website directory. Use the directory listing at the left and click to see what category might contain something about LAB
Use CTRL + F to search the various pages for a “Code Analysis Report”.
The last question for this challenge asks for the person who a particular presentation is attributed to. The file name of the presentation is given in the question, but recall from above that entering that information into the search bar on the internet archive will not yield any results.
For finding documents with specific file extensions, there are a few tricks you can use on Wayback Machine. There are various helper tools you can install and download, but if you don’t want to download anything you can start by entering the partial URL we know the presentation is found on.
Use the “Filter results” bar at the top right of the URL list to search for PDFs.
Try looking for PCI.pdf from the URL list to see if you can find the exact file and find who the presentation is attributed to!
Useful resources for this challenge:
- OWASP - https://owasp.org/
- OWASP wikipedia - https://en.wikipedia.org/wiki/OWASP
- Wayback Machine - https://web.archive.org/
- Watch our Tutorial Video
Tutorial Video
Watch our full Tutorial Video to learn more specifics about using open source tools like the Wayback Machine and see a walkthrough of how to solve this challenge: