Hacker News Reader

Comment by orf | Hacker News Reader

The last stripe CTF was amazing, I managed to be one of the first hundred or so to get to the last stage but got utterly stumped by it. The solution involved tracking the incrementing port numbers of a Linux server as a kind of side channel attack to bruteforce a password if I remember correctly - a very interesting puzzle.

The whole thing was very fun, I highly recommend anyone interested in security to give it a go. The XSS challenges were also cool: they ran a headless webkit browser to emulate a user so your XSS code actually did something.

View on HN

The last stripe CTF literally changed my life. I've always been interested in security but didn't have the confidence and honestly thought I didn't have it takes to be successful in the field. I decided to try the CTF anyway just for fun and was able to finish everything much to my surprise. I had read about SHA-1 padding when it affected Flickr so I knew just what to do on the level that involved SHA-1 padding, which I thought was the hardest.

When I came to HN and saw a lot of people I admire talking about how hard it was, especially daeken [1], I remember thinking something along the lines of "well, I thought it was hard but not that hard", and decided to try to find a few security bugs in open source software... Best thing I ever did... In just a few weeks I found some nice bugs on both Drupal and Wordpress, got the first CVE credited to myself, and then I started to have fun (and some profit) with the various bug bounty programs around the web, most notably those run by Google (I'm currently 0x05 overall) [2] and Facebook (7th) [3].

After a year doing security work on the side I was able to quit my day job last august and now I make my living basically as a security consultant and also as a "bounty hunter". I also got multiple job offers from US companies (I currently live in Brazil).

And all of this happened only because the stripe CTF gave me the confidence to actually follow my dreams. Oh, and I still don't know if I have what it takes to be really successful in the field, but frankly security bugs are everywhere so I go ahead and keep on finding them. I'm learning a lot every single day and the mean time between bugs is getting lower and lower, which is great. So thank you Stripe. Thank you very much.

Shameless plug: BTW, I'm in the committee for the W2SP conference, so if anyone has some interesting discovery to share, please submit a paper.

[1] https://news.ycombinator.com/item?id=4424299 [2] https://www.google.com/about/appsecurity/hall-of-fame [3] https://www.facebook.com/whitehat/thanks [4] http://www.w2spconf.com/2014/

>And all of this happened only because the stripe CTF

Well that and all of your hard work and talent.

That's a very inspiring story. Kudos to you.

Yea, I definitely had fun as well, although my week dictated that I was in the ~600s for finishing level 8. I might try to put a little more time in up front for a higher finish this time.

The last level involved compromising one of the earlier servers iirc because the pw dbs only responded in-network. The "Password Database" was chunked amongst a few servers, requiring an increase in the port number on the response due to a waterfall type password check (ie: if chunk1 is correct, go hit chunk2 server and check). You also had to re-check your chunks because other people's requests were making the port increase as well. I had a huge rush when my script finally stopped and my "password" showed up on screen.

Definitely looking forward to one based in distributed systems as I've been researching that sort of stuff over the last year and such.

I enjoyed the most recent one so much that I went back and did the first one and enjoyed it even more. They have images available for it here[0] if you're interested!

0: https://stripe.com/blog/capture-the-flag-wrap-up

Thanks for the kind words! As a note, this CTF is going to be a different angle — rather than being about security, this will focus on distributed systems engineering.

Is there any way to replay these old events, like via AWS AMI's or something? I missed them and see some solution code / slides but I'd love to still try and figure these out on my own if possible.

We have images for the first CTF: https://stripe.com/blog/capture-the-flag-wrap-up. The second CTF had a more complicated architecture, which we never ended up packaging. It's possible we'll get to it at some point (alternatively, if anyone is potentially interested in packaging it, feel free to ping me — I'm gdb@stripe.com).

Some coworkers and I put together a Vagrant + Puppet setup for CTF 2: https://github.com/e28eta/stripe-ctf-2.0

I know it's got a couple bugs still, but the first levels should be pretty solid.

How is this a CTF then?

I also loved the last CTF. I got to the last level but by the time I'd worked out how to attack it port numbers seemed to be jumping all over the place. I figured that it was just that too many people were hammering it. Had a solution that worked locally, and I was pretty happy to have gotten that far. Really looking forward to the next round - especially now that I work for myself and can dedicate the day to it :)

Yeah, exactly the same. Couldn't work out how to deal with the jitter. Shame :(

If I remember correctly, I got around the jitter by pipelining the HTTP requests - ie. shove several HTTP requests down a TCP connection without waiting for the responses. This made it far more likely that the server would execute your requests contiguously without anyone else's being serviced in-between.

Can confirm. They had code to lock the server to you and guarantee you got consecutive ports, but SSL handshake time on your HTTPS requests meant you wouldn't keep the lock for very long.

I started brute forcing before the jitter was very bad but only got one chunk in with my Python script.

I rewrote my solution in Go (which does http pipelining) and I could solve a whole password in about 4 minutes even during the peak time during the day when everyone was trying.

My Go solution could reliably get 10-20 valid port numbers in a row during peak times, and only jittered for 3 port numbers or so.

(I started my last block at about the same time as Eevee, but it ended up being 8044 so I had to settle for 21st place)

Which I knew that at the time :) I hit the last level when only 200 or so people had finished (I think, from memory) but I gave up on the jitter front. I don't have much experience with the lower level networking side and I ran out of time to dedicate to it. Having said that, I learnt a load along the way. Really looking forward to the next round.

Hah. We chatted on their IRC a bit that night. I solved it in Python a little bit after you, and then you encouraged me to try it with Go.

Reply on news.ycombinator.com