EH-Net

Hey all you eager EH-Netters,

Here's another contest to test your skills. It's pretty simple...

1. Visit the Amazon Page for the new pen testing book, "Ninja Hacking," by Thomas Wilhelm and Jason Andress (Both EH-Netters  8) ). The link can be found in the book review by Ryan Linn (http://www.ethicalhacker.net/content/view/350/2/).

2. There is a clue embedded somewhere on the Amazon page. That starts your ninja adventure.

3. The only hint we'll offer is that powers of observation are sometimes more important than L337 5|<1LL5!!

That's about it. The only other thing to mention is how we choose our winners. There are 3 signed copies of Ninja Hacking up for grabs. 3 names will be randomly chosen from the group of ninjas that finish the challenge by February 28, 2011.



Happy Hacking,
Don

---

Interesting... I almost did something without realizing there was a related competition!

Good luck everyone, I've got Thomas' other book and can say it was a great read.

EDIT: Removed

He he, nice... I thought I had it there for a while...

looks like fun

Nice, I thought I had it too but I hit a dead end   ;D

Ah, come on!.... it's easy!!

Ok, no it's not. I got stuck, too.   :-\

Jason put a good challenge together, I must admit. Serious kudos.

I did the same thing. That's the reason for the hint in #3 above.

Don

I've been bashing my head against this since the post went up. But am having no luck on it.

OK, so I'm pretty sure I found the starting point.  Now trying to determine what to DO with it...  This one has my interest piqued.

^ further than i've got :( read it and re-read it. 
May need to have a look earlier in the day when i'm a bit more focused

There are 2 things I think could be the starting point. But I'm not really sure.

i think i found it
i emailed don and wait his reply

I did one and got a good way with the other but am not sure what to do with it.  I think I may have followed a red herring, but since I cannot do with one thing what I want to do and get anywhere, I will keep down the (herring) path.

very difficult challenge.  either that or my 1337 observation kung foo is weak

Anyone else freak out when they thought they were done and you were told to 'try harder'?

At that point, I had some choice words for Jason that I'll keep in my head. As his evil laughing faded away in my head, I could then hear him quoting Sun Tzu.

Don

but it was the way he did it.  That had style

I AM STUCK IN PDF PASSWORD WHO IS WITH ME ???????

I got stuck here too "try harder" ???

Super fun... and super frustrating... masochism at its finest.

EDIT: got the 'try harder'...... Choice words were yelled....

Wow... either I'm really close, or he threw a lot of EXTRA fun into this!

(Edit - but the extra fun is definitely a challenge, in and of itself, whether intentional or not...)

agreed

Same, got stuck there after 30 minutes  ;D I did check meta-data too but I didn't check stenography, too lazy for that really  :)

The Amazon page is filled with extreme amounts of information so it is quite a lot one can try to look for.

Well..... took me long enough, but I think I've gotten to the end.  Awaiting confirmation.

And we have our first Ninja!!

Let me have your thoughts without giving it away... did the hint in Step #3 help or did you just find it on your own?

We've also thought about giving away a little EH-Net love today by offering a hint, but we can't figure out how to do it without spoonfeeding. Feel free to PM me if you feel you can't discuss without revealing anything.

Well done,
Don

Thanks, Don!

(and PM'd you on the hints, etc...)  I know one that MAY come in handy, but not sure how you'd present it, without making things TOO obvious, either.

Can't believe I missed the very obvious hint. Really. It took me this long to see it. I kept thinking I had the wrong page or my work proxy was obscuring something critical. I'm ashamed. I'm so NOT a ninja. Well, let's see how far this notaninja can get. Grats Hayabusa!

<grin>Be ready to work a little.  That first part was the easy part.

Thanks for the kudos.

Congrats!  I am banging my head on it, but not making progress since the first bit

We're up to 3 ninjas!!

Don

Very interesting challenge......
- obtained the first step
- obtained the second step
- found the"try harder"
........ cannot figure the passphrase out for the embedded file


Lots of fun!

i think i finish it wait the results

thx for this great game

This an awesome challenge, and I appreciate the challenge.  But, I'm stuck on the PDF (probably overlooked something).

ok, try harder, been stuck 2 weeks, still am.  argh!! ???

I never even found the first clue. So you did way better than I did.

Hint: Where could they possibly insert embedded information when they can't edit the Amazon page itself? (It's very limited what is possible, and you might be surprised what starts this journey, also how you reach the dead end and then might realise that you forgot to look for something you didn't anticipate  ;) Thanks Dxxxx

I think the winners has probably already been found by now though  :)

There's still time! Everyone that gets through gets a shot at the drawing, so for anyone that hasn't solved it yet, you still have a chance.   8)

I must be really stuck then, as I have not found any PDF that would require getting into......

As jason noted, the winners are drawn, after February ends, once all successful folks have submitted their answers.  So they haven't been 'chosen,' yet.  So I wish everyone else luck, who's trying. 

That said, for those who put in the hours and have figured it out, thus far, congratulations for success. 

For those who haven't gotten it, yet, keep trying.

I won't drop hints, as I don't want to diminish the chances of others (who've worked hard and found the answers) to win the book.  After I'd solved it, don and I had discussed on a PM, and decided that since folks WERE then managing to solve this, it was best to 'keep the playing field level.'  If spoilers are to be handed out, I'm sure the authors will do so, for folks' learning purposes, after the contest ends.

Suffice to say MaXe's 'hint' is all the more someone should need, to at LEAST get started.

Woot! found the PDF, finally feel like I have accomplished something...

Now opened the Password

how much further do I need to go?  I think I am beginning to bug the guy and don't wanna waste his time.

When you've reached the finish you'll know.  If you don't know, yet, you're likely not quite there...

 ;)

Keep going, you're very close  ;D

Ok, so I have spent way too much time on this. Anyone else stuck on the password? Trying to use l337 5|<1LL5 (pdf crackers) but feel like I should be able to guess it. Posting to vent frustration.... ???

Props to Jason for putting this challenge together.  More props to those who have already finished it!!

"Try Harder" indeed!  Wow.

Finished yesterday, just amazing challenge.  Learned a lot from it.  Thanks to the organizers.

Last weekend to play!!

Don

Stumped at the try harder mark... I'll keep digging.

Got a step further...stuck again...this is lots of fun. Thanks to all who put time into it.

Keep after it, you'll get there  ;D

Stuck on the PDF... still... trying to BF it, but can't figure out what I'm missing.

Me too!!!!! It's 128 bit AES, it'll be tough to BF won't it?

Don, will we get any last minute hints?

Short answer... no.

Long answer... we have more than 3 ninjas, so there will be winners of the signed copies of the book without having to reward some who had hints and some who didn't. So for fairness, there willbe no hints before the end of the month.

On March 1, we'll start giving away little hints to see if some people want to try it without being given the entire thing.

Then we'll do a write-up... maybe even with the help of the first ninja... so we'll take you through the whole process.

Hope that helps,
Don

That's fair, and thanks for giving us a couple of extra days to still figure it out. It's been really challenging and I'm enjoying learning along the way. There's still time for me to figure it out tonight! :)

Finally got it...wow. It was a great challenge and a lot of fun. Thanks guys.

If this is a hint, don, I'll start putting something together from my notes.   ;)

So how many finished this puzzle?  I'm excited to find out.

Like many, I got stuck at the try harder part, but I made it past that part yesterday, though I'm still trying to figure out how to get the data out of the part that I discovered using my powers of observation.

That part was so cool and I didn't know you could do what it takes to get that out of the part you discovered.  (vague enough to not give spoilers)

Alright, I'm ready for hint...lol, sooo not a ninja..not yet.

Like many others, I got stuck on the .pdf.

Where will be able to find out the solution and steps that were taken?

Loved this challenge....didn't get far, but still loved it!

Stay tuned for 2 more hints then writeups from some (maybe all) of the 6 ninjas.

Don

Wow only 6 made it?  I'll start working on my writeup.

I am also in an organization called Toastmaters, which is a public speaking group.  I was considering doing this as a speech that involves visual aids, so doing a writeup would assist in that decision as well.

I must have fallen out of the dense tree and hit several branches as i'm still getting nowhere with this one, even with the hint :(

Wow, I thought there was a lot more who did it!  :)

Congrats to the six who made it! Job well done!

After hearing from some out there, I guess we'll have to do a prequel hint. So...




Don

GRRR... Really didn't think that was part of the challenge. Which is probably why I was never able to start it.

For those why don't have smartphones, there are websites with online QR readers, too.  If it makes you feel better, chrisj, I had fits trying to read the code, at first, and thought it might not be a clue, either.  Remember to lower your camera resolution, or it might not be able to read properly.

The binary code on Jason's face .... needs to be decoded .... by hand  ;D

I came way late to this party. I saw the QR code and figured it had something to do with the challenge but the only thing my phone got from it was an email address so I wasn't sure whether this was part of the challenge or not.

...and then it was time to go back to work.

@WCNA - but isn't the email address, in and of itself, kind of 'thought provoking'?  As it would certainly appear to be, maybe dropping an email to that address would be worth your time.

@Data_Raid - bwahahahahaha - yeah, I spent plenty of time exploring that, too.  (you're too funny)

Learned something new!  I had worked a little with those 2D barcodes before, but only using handheld scanners in a warehouse.  I didn't know that there were smartphone apps and websites that decoded those for you too.

It was. But I've seen some pretty good email addresses over the last couple of years. The guys at Sun Microsystems (Before Oracle bought them) had some great ones.

So while my phone scanned and I saw the address. And I thought, yeah maybe... I ended up not doing it because I figured he got a really cool email address.

I observed it, but figured there was NO way it was that easy to start.

Understood.  I know how it goes.

Easy he says...  So much for my powers of obvservation!!

I was looking in the right area as it happens but completely missed that damn code  ::)

ok, maybe I should have said, the first answer couldn't be that simple... That was what I thought anyway. kicking myself hard

The point of the hints is not to kick yourselves, but to try and complete the challenge before all hints are revealed. So give it a shot now! You can still say you did it without being (entirely) spoonfed.  ;)

Don

I've been following this site for awhile now, finally had to register to say I love this challenge, excellent job especially the starting point.... Like several others I've been stuck on the PDF but regardless very cool promotional idea!

     File: Try Harder
     User: Easy for you to say.
     File: No need to get snippy. I'm just data.
     User: Sorry. Maybe I should get to know you better.



Don

This was a frustrating point in the race :)

Did the hint help you get past it?

Don

It didn't help me, but I'm sure I'm making it out to be harder than it actually is lol

I'm pretty sure I've found what I need to move on....but the problem is I don't know what to do with it.....

Unfortunately, I've had the puzzle piece since before the contest ended...I just can't figure out what it is used for...

I'm in the same boat tried cracking the PDF analyzed the structure looking for clues and tried manipulating the qscan codes with no success I'm sure its something Ive overlooked but I'm at a loss but I refuse to give up!

What is defined as data about data? How do you find it?

Don

When it comes to data analysis, there are no strings attached... ;)

That's a good one....anyway....the outcome of your hint is exactly what I've had for roughly 2 weeks trying to figure out what to do with.... ;D ;D ;D

By the way, there's a more precise way to get the clue, hayabusa. I'm assuming Jason chose a JPEG for this precision...

It's no more precise, actually.  And if you think about my hint, it'd have helped on more than just this clue.  Works wonders for multiple pieces...

Edit- if you ever do a lot of forensics, you'll understand the method to my madness, and the reason you might consider going to it more quickly, down the road, especially when analyzing multiple files.  ;-)

Further... Sorry to ramble.  Some of the data we're referring to was NOT as obvious, using methods which I'm pretty sure you refer to, as it depends on the basics of your OS and default tools.  To be frank, I did try the 'other' methods, as well, in the event I missed something, but mine was faster, and I could automate multiple task quickly with it.  While it meant 'glancing over' the output, it was worth it to find multiple pieces of info for verification...

PM me, off thread, ziggy, if you want someone to sound your thoughts to.  Sometimes, I find things come to me as I just tell someone what I'm thinking about.  I'm happy to be a sounding board, if it helps you move forward in it.  ;-)

Don

!?!?ton yhw ,niaga nehT .ni ti enohp tsuj t'nac uoY .troffe fo tol a sekat egnellahc sihT

3# tniH

<smile>

I didn't phone it in, I did it differently...

Was anyone else able to solve this with the hints?

Yes. A few more made it through. We'll be posting the write-ups in April after I get them all, edit, format blah blah blah.  ::)

Don

and when do we find out who won?

who won this contest ??

thanks

I think they're still drawing randomly, but keep ending up with one or several winners that shouldn't win  ;D If not, no idea. I gave up on following this contest a long time ago to be honest, and I don't really care any more  ;D But congratulations to the winners!  :) Whenever they're announced  ;D

I'm still waiting for the results. When are we going to found out? I can't wait to see the answers.

I'll ping Don about it...

Totally my bad. Here's another hint to get most of you through until I get the winning answers posted.

Look at the metadata. When you find a code, try typing it out using the numbers on your phone. See what the message reads and act accordingly.

BTW - The 3 winners have been contacted. 2 of 3 have received their books. I'm still waiting to get a secondary address from the 3rd.

No excuses, just having a lame moment on this one,
Don

i know the  3rd winner

he lives in far place in egypt :)

I'm still waiting for the answers. Don, what happen here?