- This topic has 81 replies, 21 voices, and was last updated 10 years, 8 months ago by
.
-
Posts
-
-
We are happy to announce the first of our Public Hacking contests, labeled “How strong is Your Fu?“. The challenge will last for two days, and may go on longer, depending on how long our machines survive. The reward ? The winner of the contest will be able to choose ONE of our Online courses, free of charge. This could be either PWB, WiFu or CTP (30 day labs where relevant).
More here. 🙂
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
The first 3 steps of hacking are:
1) research
2) research again
3) research even moreHeck you have to do that before you can even get started most of the time. Who is the client, are they legit, is the guy asking for the pen-test really an employee?
Anyway as n1p said, read the link. You have to dig a little deeper, but the information is there.
-
-
-
-
-
-
@awesec wrote:
Actually it’s a quote by Abraham Lincoln.
OK, geek time for the scholars –
And, as Lincoln was quite the scholar, himself I personally think he spoke with reference to the Bible, specifically Ecclesiastes 10:9-10, where it says:
“Whoso removeth stones shall be hurt therewith; and he that cleaveth wood shall be endangered thereby. If the iron be blunt, and he do not whet the edge, then must he put to more strength: but wisdom is profitable to direct.”
-
http://www.information-security-training.com/n … les/
register quick!
-
-
-
-
-
@DavidW wrote:
I don’t have a whole lot of skills either but I’m going to atleast try and see what I can do.
same here, if i participate it will be learning experience for me.
-
-
-
-
-
-
-
From http://www.information-security-training.com/news/how-strong-is-your-fu-registration-and-rules/
FYI:
“cc says:
April 23, 2010 at 4:13 amhey guys,
why are you sending emails from apache@localhost.localdomain ?
a lot of mail servers block that kind of stuffpretty sure lot of registrations will bounce”
admin says:
April 23, 2010 at 4:31 amChanged SMTP settings, try now. Thanks for the heads up!
I guess try again guys…
-
@rvs
Thanks! I tried again and received my confirmation email. -
-
-
-
-
-
there are plenty other ways to get a good fingerprint of the system at hand (like said: telnet or netcat will do just fine).
I decided not to sign up because of absence on the first day. this way i will give someone else the opportunity to give it a REAL try…(my guess: it will be cracked within the first 24h, or not at all 8))
-
-
I have to wonder how difficult the Tournament will be compared to the PWB challenge or the CTP challenge.
Having taken PWB and obtained OSCP, I’m pretty sure it will be a quality exercise and worth the time, and I’m all for free training! However, if it more the Tournament is more difficult than the courses’ challenge exams, will the winner need the training? I mean if you win the Tournament by basically passing the challenge exam at the end of a course, and the prize is the course… Of course if it’s easier, than it should be cracked pretty quickly.Anyway, just thinking out loud (or rather silently, but publicly). At any rate, I expect it to be fun and the competition to be fierce. And if I happen to win, I’ll greedily accept the free CTP training.
-
-
Offensive Security recently announced that they’ll allow everyone to participate. However, the tournament will be conducted in two phases and only the first 100 who complete phase 1 will be allowed to advance to phase 2.
What to expect
* The challenge will be built of two Phases, appropriately called “Phase 1″ and “Phase 2″. Phase one is also humorously called “The noob filter”, as only the first 100 people who hack their way past this machine will pass on to “Phase 2″. Please do not be offended by the choice of machine names, it’s all done in humor. Once “Phase 1″ is hacked by an attendee, they will find instructions on how to proceed to “Phase 2″.
* “Phase 2″ will involve VPN access to an internal lab, with several additional machines which are trembling with anticipation for the taunting session hacking tournament.
* All registered attendees will get an email on the 8th of May, around 14:00 GMT (that means around 10am EST) with further instructions, attack adresses, etc. We have around 120 people who have not verified their registration – those will not be included in the list. If you did not get a confirmation email, re-register, or contact Offsec Staff (figure out how).Complete information here;
http://www.information-security-training.com/events/offensive-security-hacking-tournament-updates/ -
-
-
-
-
-
-
-
-
-
-
-
-
for those of us not playing (I have not the skill), where is the score board to watch?
*edit: Never mind, I found it:
http://scoreboard.information-security-training.com/scoreboard/ -
I cant get past noob filter, i get access to WAF but i dont know what to do after that..
http://www.securityfocus.com/archive/1/508124/30/0/threaded < i dont understand this..
-
-
-
-
-
-
-
-
I officially got my butt kicked, big time, and I loved every minute of it. I thought it was a tough challenge, although I expected nothing less. I realized how weak my FU is and how much work I need on exploit development. If nothing else, this should motivate me.
There were a few EH.net members in IRC, trying to get through it. Hopefully everyone had a blast like I did.
P.S. Mark, I read your article (and the links your provided) on SEH Exploits about 10 times this weekend. 🙂
-
@Ketchup wrote:
I officially got my butt kicked, big time, and I loved every minute of it. I thought it was a tough challenge, although I expected nothing less. I realized how weak my FU is and how much work I need on exploit development. If nothing else, this should motivate me.
There were a few EH.net members in IRC, trying to get through it. Hopefully everyone had a blast like I did.
P.S. Mark, I read your article (and the links your provided) on SEH Exploits about 10 times this weekend. 🙂
dude, you did good job.
I couldn’t even get past phase 1, i figured out how to do it this morning, but it was too late.
I am not very good at web applications. -
-
-
It was fun, but totally kicked my butt too. Never got past phase 1. I didn’t get much time besides Saturday morning and a little while Saturday evening to spend on it, though I did spend all weekend thinking about it. Now I know I need to focus some study on exploiting web apps.
On another note, I managed to get through the Google Code Jam qualification round, so the weekend wasn’t a total loss! -
I tried…Guess I did not “Try Harder”!
I looked at the source of the pages to try and pick something out. “HAHAHAHA!” kept bugging me.
I kept getting the 5 minute delay. 🙁I think I will be taking some courses this year when the time is right! 😉
Congrats on getting by Level 1 Ketchup and xXxKrisxXx and anyone else I forgotten!
-
Well the annoying thing was that I pretty much had the solution to phase 1 thanks to What90. Lag prevented me from getting a HTTP response from the exploit :- There were a few slots left and I just didn’t make it.
I learned something from this though. I was trying to bypass the filter by HTTP Parameter Pollution. So I was skipping through PDF’s and PPT’s trying to learn as much about it as quickly as I could. Also tried a bunch of other SQL Injection vectors. And in the end I was thinking far too difficult. Though the HPP techniques will come in handy in the future perhaps 8)
Perhaps Ill see if I can install dotDefender and try the exploit in a lab environment ;D And I’ve heard there will be another contest like this in the future, so hopefully my Fu will be stronger by then 😉
-
Offensive Security has declared winners and posted the solutions to the contest.
http://www.information-security-training.com/blog/Now that I look at the answers I feel so stupid that I wasn’t able to clear this stage. I was on the right track but someone or the other regularly changing the passwords confused me a lot.
-
Offsec released some of the reports for the challenges.
http://www.information-security-training.com/news/hsiyf-runner-up-documentation/
I feel absolutely silly for spending I don’t even know how many hours trying to modify an exploit to work with Windows 7, when I didn’t have to 😀 I can’t believe I missed the completely easy route and went for something nuts. It’s not the first time though 🙂 Oh well, live an learn.
-
-
@impelse wrote:
That’s the way to learn, I am very sure you will never forget it and next time you will save time.
Amen! But congrats on the fun and learning you DID get, Ketchup.
-
-
-
-
- You must be logged in to reply to this topic.
