9 ms·
Securing Stripe's Capture the Flag
- elliottcarlson 14y agoAwesome write up and awesome challenge - look forward to the next one!
- obituary_latte 14y agoheart attack Thought for a minute after seeing the headline maybe the CTF was closed... I'd have thrown many (more) monitors out the window if I didn't get to finish lvl8 after spending so long on it...or at least ditch a few more monitors trying to finish it.
- ben1040 14y agoThanks for the writeup - while going through the levels, I was wondering how some of this stuff was set up from the game-master's perspective. This was really fun to play, and I learned a thing or two (specifically the manner in which you solve #7 was totally new to me). Thanks for putting the CTF together!
- fijter 14y agoYou guys did an awesome job, great stuff to waste some evenings on. It's nice to read about all these measures, especially since I've already noticed most of them while capturing the flag :)
- emilw 14y agoGreg, I'm sorry I can't comment on the original article I don't have a FB account. What was the amount of traffic at peak times between level 2 and 8?
- bvdbijl 14y agoGreat job on the CTF, had only minor issues with level 8 because of the traffic (which made it more of a challenge) and I was wondering how you guys did the XSS vulns, really nice job!
- xPaw 14y agoCTF was lots of fun, but I never really bothered finishing final level :(
- copithod 14y agoThe CTF was one of the more educationally useful things I've done in a while, thanks!
- tlrobinson 14y agoNice writeup. I loved the CTF. Need moar. Seriously, what else is out there like this?
- gdb 14y agoGlad you enjoyed :). We have a few places linked on https://stripe-ctf.com/about https://stripe-ctf.com/about (namely http://google-gruyere.appspot.com/ http://google-gruyere.appspot.com/ and http://www.hackthissite.org/ http://www.hackthissite.org/).
- jw_ 14y agoA commenter in another thread on CTF recommended io.smashthestack.org. It's very well done - I only got through a half-dozen levels or so before my attention wandered but I really enjoyed it.
- gbrindisi 14y agohttp://ctftime.org/ http://ctftime.org/
- philfreo 14y agoThanks for putting this together. Was very educational working through each level (and felt great to capture the flag). Loved that it was spread out across node.js/python/ruby/php/javascript. Were any unexpected security vulnerabilities found (or patched mid-game by you) in the overall infrastructure? Not sure if this was intentionally left open-ended but for example in Level 6 I exploited a Ruby session/cookie bug to gain access to the target user, before realizing that the easier way was just a simpler JavaScript XSS vulnerability.
- timo614 14y agoThere was an issue where a user could steal the nickname of other users. https://twitter.com/homakov/status/239061158043213824 https://twitter.com/homakov/status/239061158043213824 https://twitter.com/homakov/status/239107933290520576 https://twitter.com/homakov/status/239107933290520576 It looks like homakov had a little fun with it (the guy who griefed github a bit half a year ago with their whitelisted attributes vulnerability and got the rails core team to put whitelisting on by default).
- gdb 14y agoThere were a few unintentional vulnerabilities in the levels. Only one actually made the levels significantly easy enough that it was worth patching -- namely, the session cookie bug you reference (it actually affected three levels). There was also a bug in the CTF architecture where you could set your user's URL to a javascript: URL. But to my knowledge no one has found vulnerabilities in the rest of the infrastructure :).
- ryan-c 14y agoI was one of the ones who went through those three levels with the session cookie bug. How many people reported it? Do you have a problem with me posting a write-up on the bug somewhere (now that it's fixed)?
- gdb 14y agoWe fixed it as soon as it was reported, and have probably gotten four or five independent reports at this point. Feel free to post away!
- jiggy2011 14y agoI haven't done this yet, is it still online? How difficult is it?
- the_mitsuhiko 14y agoIt's not that hard until level 8. At that point I got too lazy to actually continue with it :)
- antsam 14y agoReally enjoyed the CTF, thanks for hosting it! Had to run my code twice to get the last chunk on level 8, not sure why though... Was it jitter? Also, will you be sending confirmation e-mails for the t-shirts?
- gdb 14y agoI'll avoid posting spoilers here, but feel free to shoot me an email (gdb@stripe.com) if you want to discuss more. We will indeed send out confirmation emails for the shirts -- you'd be surprised by how many people typo their addresses.
- brown9-2 14y agoAssuming you used the same strategy I am using now for level 8 (and which seemed popular on the IRC channel), I think the method for determining the other chunks doesn't work for the last one, since it is the last one in the series.
- zx2c4 14y agoNext time, use grsecurity & pax. No excuses not to. Kernel hardening that you must absolutely have on a shared box. http://grsecurity.net/ http://grsecurity.net/ http://en.wikibooks.org/wiki/Grsecurity http://en.wikibooks.org/wiki/Grsecurity http://en.wikipedia.org/wiki/Grsecurity http://en.wikipedia.org/wiki/Grsecurity http://en.wikipedia.org/wiki/PaX http://en.wikipedia.org/wiki/PaX Grsec's RBAC isn't strictly necessary, but it's quite nice too.
- Axsuul 14y agoStripe CTF made me feel like I was in college again! It was a good feeling.
- zobzu 14y ago"we make CTF and recommend using chroot" /facepalm