8 ms·

This is a clever way to recruit hackers into the Google Security team. Here's some of the most useful content from the webpage: * Episode 0: https://www.youtub

This is a clever way to recruit hackers into the Google Security team. Here's some of the most useful content from the webpage: * Episode 0: https://www.youtube.com/watch?v=przDcQe6n5o https://www.youtube.com/watch?v=przDcQe6n5o * Challenge 1: https://hackerchess-web.h4ck.ctfcompetition.com/ https://hackerchess-web.h4ck.ctfcompetition.com/ * Challenge 2: https://aurora-web.h4ck.ctfcompetition.com/ https://aurora-web.h4ck.ctfcompetition.com/ * Episode 1: Coming soon

wnevets 4y ago
> * Challenge 1: https://hackerchess-web.h4ck.ctfcompetition.com/ https://hackerchess-web.h4ck.ctfcompetition.com/ is the goal to hack the chess game or the admin panel? I never know how to do these things
- bombcar 4y ago
  I would guess the goal is to beat a world champion while playing black and get accused of cheating.
  - eyegor 4y ago
    - marcofatica 4y ago
      It's a pain in the ass
  - gpm 4y ago
    So, I solved this challenge the "intended" way instead of just using an engine. But I'm pretty sure that you could just use an engine for longer than they are. Behind the scenes it appears to just be running stockfish with a timeout of "10" (10s? Didn't check what units, seems faster than 10s so maybe 10ms or something).
    - missblit 4y ago
      It's milliseconds (well except for 0, which stockfish considers an edge case) See: http://wbec-ridderkerk.nl/html/UCIProtocol.html http://wbec-ridderkerk.nl/html/UCIProtocol.html , https://github.com/official-stockfish/Stockfish/issues/3720 https://github.com/official-stockfish/Stockfish/issues/3720 That said I don't think a strong chess engine alone would be enough to pass this puzzle.
    - esjeon 4y ago
      Mind that you're reading a comment written by a dude who got p0wned by Stockfish searching only depth 0. I mean, if you're going down the path of fighting against the AI, you do need an engine.
- Gollapalli 4y ago
  Well, I got the admin panel to show a completely blank page, instead of an Invalid Login message, so that's progress.
  - hayst4ck 4y ago
    You got it to 500, which can be seen via the network dev tools console. (A place you can also right click and "Copy as cURL", to iterate on the command line faster) ^^ A 500 is almost always a good sign when it comes to hacking. Hacking is the art of finding the difference between intended behavior and actual behavior. That is pretty much the definition of a 500.
    - Gollapalli 4y ago
      Well I got the admin menu to show up. Still lost the chess game though (my chess skills need work).
      - hayst4ck 4y ago
        A little bit of python and some stockfish could probably improve your play dramatically! https://github.com/official-stockfish/Stockfish https://github.com/official-stockfish/Stockfish
        Gollapalli 4y ago
        Lol I thought about it. Thanks for the reply.
      - m4jor 4y ago
        Any tips? I tried brute forcing the login admin panel but no luck yet. What username should I use? I tried all the basic ones and cant get it to display anything besides "Invalid Login!".
        hayst4ck 4y ago
        It sounds like you've tried [a-zA-Z]* usernames in an attempt to see if you could guess a username. It probably says "Invalid Login!" no matter what is guessed. What do you imagine the code that takes the logins eventually does? It seems likely that the username and password will end up in a query against a database to see if the user is valid and (theoretically) if the hash of the password matches the stored value. What kind of input could you try to see if that behavior is done securely? This is a good site to start learning about security: https://owasp.org/www-project-top-ten/ https://owasp.org/www-project-top-ten/ Injection will be the most immediately relevant.
- hayst4ck 4y ago
  The goal is to find the flag, usually somethign unambiguous like "flag{some_lind_of_message}". There are generally no other rules to a CTF other than "don't run a scanner against us"/"don't brute force." Analyzing and listing out ways to interact with the site will show you your surface area, although sometimes the interaction is so opaque you might have to check the "robots.txt" or other well known files. The start button, the difficulty level, making a move, and the admin panel all offer ways to test different inputs to see if you can get unexpected output. What inputs do they accept? What headers do they have? What encodings do they use? Are there any input checks done client side rather than server side? Then it becomes a matter of thinking about what happens with these inputs/outputs. Did it ask for a file name? What if I feed it a file it doesn't expect. Might this input be used for a database query, how could I abuse that? Could my input or the output be marshaled? Could my input be passed to an exec somewhere? Can I find artifacts that tell me what programming languages/servers/libraries are being used? How can I probe for these things? The people who do these for fun several times a month will often make writeups that offer hints of techniques to solve problems when the competition is done. These are some related sites: https://ctftime.org/ https://ctftime.org/ https://ctftime.org/writeups https://ctftime.org/writeups https://owasp.org/www-project-top-ten/ https://owasp.org/www-project-top-ten/
  - devmor 4y ago
    I got to to prompt me for its own moves and fed it some invalid base64 and now it's completely broken unless I clear the session. That's as far as I'm really interested in going, but it was fun to play around.
registeredcorn 4y ago
>This is a clever way to recruit hackers into the Google Security team. I can't help but wonder how effective something like this actually is. I'm trying to not be overly negative, even though I have nothing nice to say about the company. I just find it really hard to believe that anyone would be sincerely excited to work at a place like Google. I mean, I'm sure the pay and benefits are good for the moment, but it just seems like an unethical move, you know? Drug dealers make tons of money, but it doesn't really entice smart or ethical people to the profession in large numbers. Is wrapping it in some shallow webpage supposed to push people over the edge for some queer reason?
- danielheath 4y ago
  I mean, it's pretty easy to tell yourself google maps is a social good (because there are lots of good arguments that it is!). Similarly, there are lots of reasons why improving the security of google is a good thing _even if_ you think google itself is evil.
  - bawolff 4y ago
    Never mind google maps, its pretty easy to tell yourself google project zero is a social good.
    - deleted 4y ago
      [deleted]
  - Morgawr 4y ago
    > Similarly, there are lots of reasons why improving the security of google is a good thing _even if_ you think google itself is evil. Especially when you consider the fact that a lot of stuff that Google security researchers do directly affects and influences (for the better, I'd say) the current industry too. See: Project Zero team, etc. Disclaimer: I work at Google. Opinions are my own, etc etc
    - hulitu 4y ago
langsoul-com 4y ago
Australian signal intelligence, Australia's NSA does the same. Their website has cyber security challenges and, apparently, if you complete all 12 levels you'll get a interview. Honestly, it's pretty neat. If you hated resume bullshit, then that's a great option.
- graderjs 4y ago
  if you complete all 12 levels you'll get a interview. Or a knock on the door in the middle of the night and an attempted online trolling campaign, maybe with a free side of attempted fake-rumor-based reputation assassination irl too.
  - O__________O 4y ago
    Strange game. The only winning move is not to play. How about a nice game of chess? https://hackerchess-web.h4ck.ctfcompetition.com/ https://hackerchess-web.h4ck.ctfcompetition.com/
    - graderjs 4y ago
      Exactly. They should have thought about that before they started it. But I guess they fucking didn't.... Anyway, what game should I pick up instead?
kristopolous 4y ago
is it really though? I was actually doing something, was a bit curious, spent 30 seconds on it and thought "well this looks like a waste of time" and then scrolled through to see the comments and now I'm bouncing and going back to what I was doing. The people better than me wouldn't have even done that. The best and the brightest are busy doing stuff. Why would they even come in contact with stuff like this?
- wil93 4y ago
  I'm under the impression that CTFs are where the top security talent is harboured and discovered, though I have no data about it.
  - saagarjha 4y ago
    Definitely not required, but it’s a fun pastime for many. Kind of like how bullet chess relates to the professional game.
  - kristopolous 4y ago
    I guess. The best engineers and people I know with PhDs in computer security who can't reveal their employer really don't give a toss about games. There's a lot of clever people that really do not care for competitive recreation. You can be a serious scholar without also being an enthusiastic puzzlemaster So CTF is just another form of cohort filtering masquerading as competence selection; a modern version of going for beers and golfing with a candidate and then wondering why you have a bunch of beer drinking golfers working for you
    - UncleMeat 4y ago
      I've got a PhD in security from arguably the best program in the world. A bunch of people in my cohort did CTFs regularly. Many of us didn't, but the idea that CTFs were only done by less skilled people is bogus. Further, security really is one of those fields where skill matters more than everything else. There really are people attending defcon that don't have any formal training but are as deeply skilled at the people published best-papers in Oakland or whatever.
MauranKilom 4y ago
Just FYI (and with minimal spoilering), antivirus hates the file that the tool lets you search through in challenge 2.
deleted 4y ago
[deleted]
mimsee 4y ago
Episode 1: https://www.youtube.com/watch?v=N7N4EC20-cM https://www.youtube.com/watch?v=N7N4EC20-cM

wnevets 4y ago

> * Challenge 1: https://hackerchess-web.h4ck.ctfcompetition.com/ https://hackerchess-web.h4ck.ctfcompetition.com/ is the goal to hack the chess game or the admin panel? I never know how to do these things

bombcar 4y ago
I would guess the goal is to beat a world champion while playing black and get accused of cheating.
- eyegor 4y ago
  - marcofatica 4y ago
    It's a pain in the ass
- gpm 4y ago
  So, I solved this challenge the "intended" way instead of just using an engine. But I'm pretty sure that you could just use an engine for longer than they are. Behind the scenes it appears to just be running stockfish with a timeout of "10" (10s? Didn't check what units, seems faster than 10s so maybe 10ms or something).
  - missblit 4y ago
    It's milliseconds (well except for 0, which stockfish considers an edge case) See: http://wbec-ridderkerk.nl/html/UCIProtocol.html http://wbec-ridderkerk.nl/html/UCIProtocol.html , https://github.com/official-stockfish/Stockfish/issues/3720 https://github.com/official-stockfish/Stockfish/issues/3720 That said I don't think a strong chess engine alone would be enough to pass this puzzle.
  - esjeon 4y ago
    Mind that you're reading a comment written by a dude who got p0wned by Stockfish searching only depth 0. I mean, if you're going down the path of fighting against the AI, you do need an engine.
Gollapalli 4y ago
Well, I got the admin panel to show a completely blank page, instead of an Invalid Login message, so that's progress.
- hayst4ck 4y ago
  You got it to 500, which can be seen via the network dev tools console. (A place you can also right click and "Copy as cURL", to iterate on the command line faster) ^^ A 500 is almost always a good sign when it comes to hacking. Hacking is the art of finding the difference between intended behavior and actual behavior. That is pretty much the definition of a 500.
  - Gollapalli 4y ago
    Well I got the admin menu to show up. Still lost the chess game though (my chess skills need work).
    - hayst4ck 4y ago
      A little bit of python and some stockfish could probably improve your play dramatically! https://github.com/official-stockfish/Stockfish https://github.com/official-stockfish/Stockfish
      - Gollapalli 4y ago
        Lol I thought about it. Thanks for the reply.
    - m4jor 4y ago
      Any tips? I tried brute forcing the login admin panel but no luck yet. What username should I use? I tried all the basic ones and cant get it to display anything besides "Invalid Login!".
      - hayst4ck 4y ago
        It sounds like you've tried [a-zA-Z]* usernames in an attempt to see if you could guess a username. It probably says "Invalid Login!" no matter what is guessed. What do you imagine the code that takes the logins eventually does? It seems likely that the username and password will end up in a query against a database to see if the user is valid and (theoretically) if the hash of the password matches the stored value. What kind of input could you try to see if that behavior is done securely? This is a good site to start learning about security: https://owasp.org/www-project-top-ten/ https://owasp.org/www-project-top-ten/ Injection will be the most immediately relevant.
hayst4ck 4y ago
The goal is to find the flag, usually somethign unambiguous like "flag{some_lind_of_message}". There are generally no other rules to a CTF other than "don't run a scanner against us"/"don't brute force." Analyzing and listing out ways to interact with the site will show you your surface area, although sometimes the interaction is so opaque you might have to check the "robots.txt" or other well known files. The start button, the difficulty level, making a move, and the admin panel all offer ways to test different inputs to see if you can get unexpected output. What inputs do they accept? What headers do they have? What encodings do they use? Are there any input checks done client side rather than server side? Then it becomes a matter of thinking about what happens with these inputs/outputs. Did it ask for a file name? What if I feed it a file it doesn't expect. Might this input be used for a database query, how could I abuse that? Could my input or the output be marshaled? Could my input be passed to an exec somewhere? Can I find artifacts that tell me what programming languages/servers/libraries are being used? How can I probe for these things? The people who do these for fun several times a month will often make writeups that offer hints of techniques to solve problems when the competition is done. These are some related sites: https://ctftime.org/ https://ctftime.org/ https://ctftime.org/writeups https://ctftime.org/writeups https://owasp.org/www-project-top-ten/ https://owasp.org/www-project-top-ten/
- devmor 4y ago
  I got to to prompt me for its own moves and fed it some invalid base64 and now it's completely broken unless I clear the session. That's as far as I'm really interested in going, but it was fun to play around.

registeredcorn 4y ago

>This is a clever way to recruit hackers into the Google Security team. I can't help but wonder how effective something like this actually is. I'm trying to not be overly negative, even though I have nothing nice to say about the company. I just find it really hard to believe that anyone would be sincerely excited to work at a place like Google. I mean, I'm sure the pay and benefits are good for the moment, but it just seems like an unethical move, you know? Drug dealers make tons of money, but it doesn't really entice smart or ethical people to the profession in large numbers. Is wrapping it in some shallow webpage supposed to push people over the edge for some queer reason?

danielheath 4y ago
I mean, it's pretty easy to tell yourself google maps is a social good (because there are lots of good arguments that it is!). Similarly, there are lots of reasons why improving the security of google is a good thing _even if_ you think google itself is evil.
- bawolff 4y ago
  Never mind google maps, its pretty easy to tell yourself google project zero is a social good.
  - deleted 4y ago
    [deleted]
- Morgawr 4y ago
  > Similarly, there are lots of reasons why improving the security of google is a good thing _even if_ you think google itself is evil. Especially when you consider the fact that a lot of stuff that Google security researchers do directly affects and influences (for the better, I'd say) the current industry too. See: Project Zero team, etc. Disclaimer: I work at Google. Opinions are my own, etc etc
  - hulitu 4y ago

langsoul-com 4y ago

Australian signal intelligence, Australia's NSA does the same. Their website has cyber security challenges and, apparently, if you complete all 12 levels you'll get a interview. Honestly, it's pretty neat. If you hated resume bullshit, then that's a great option.

graderjs 4y ago
if you complete all 12 levels you'll get a interview. Or a knock on the door in the middle of the night and an attempted online trolling campaign, maybe with a free side of attempted fake-rumor-based reputation assassination irl too.
- O__________O 4y ago
  Strange game. The only winning move is not to play. How about a nice game of chess? https://hackerchess-web.h4ck.ctfcompetition.com/ https://hackerchess-web.h4ck.ctfcompetition.com/
  - graderjs 4y ago
    Exactly. They should have thought about that before they started it. But I guess they fucking didn't.... Anyway, what game should I pick up instead?

kristopolous 4y ago

is it really though? I was actually doing something, was a bit curious, spent 30 seconds on it and thought "well this looks like a waste of time" and then scrolled through to see the comments and now I'm bouncing and going back to what I was doing. The people better than me wouldn't have even done that. The best and the brightest are busy doing stuff. Why would they even come in contact with stuff like this?

wil93 4y ago
I'm under the impression that CTFs are where the top security talent is harboured and discovered, though I have no data about it.
- saagarjha 4y ago
  Definitely not required, but it’s a fun pastime for many. Kind of like how bullet chess relates to the professional game.
- kristopolous 4y ago
  I guess. The best engineers and people I know with PhDs in computer security who can't reveal their employer really don't give a toss about games. There's a lot of clever people that really do not care for competitive recreation. You can be a serious scholar without also being an enthusiastic puzzlemaster So CTF is just another form of cohort filtering masquerading as competence selection; a modern version of going for beers and golfing with a candidate and then wondering why you have a bunch of beer drinking golfers working for you
  - UncleMeat 4y ago
    I've got a PhD in security from arguably the best program in the world. A bunch of people in my cohort did CTFs regularly. Many of us didn't, but the idea that CTFs were only done by less skilled people is bogus. Further, security really is one of those fields where skill matters more than everything else. There really are people attending defcon that don't have any formal training but are as deeply skilled at the people published best-papers in Oakland or whatever.

MauranKilom 4y ago

Just FYI (and with minimal spoilering), antivirus hates the file that the tool lets you search through in challenge 2.

deleted 4y ago

[deleted]

mimsee 4y ago

Episode 1: https://www.youtube.com/watch?v=N7N4EC20-cM https://www.youtube.com/watch?v=N7N4EC20-cM