6 ms·
Stripe CTF Post Mortem: A Would-Be Hacker's Tale
- mbeattie 14y agoHe didn't talk about the last level for some reason.
- mcpherrinm 14y agoPerhaps that's the "would-be" part. The portion of people who solved it dropped off fairly heavily for the last level.
- alttag 14y agoAlso skips 5 & 6. In a closing paragraph the author mentions the discussed levels were "some of my favourite levels".
- noffle 14y agoThe astute reader will also note that Five and Six were also not discussed. From the fourth paragraph, "I will be discussing a subset of the nine challenges".
- newnham 14y agolast challenge?
- kijin 14y ago<?php echo `cat ../password.txt`; ?> That doesn't look like the work of a very talented hacker. Whatever happened to readfile() ? The attack could also have been a lot more interesting if .php files were disallowed but short snippets like this could be hidden inside GIF images.
- vasco 14y agoIn one of the rounds the attack was exactly that, payload inside a gif
- Smudge 14y agoReally? Which level was that? I don't recall using such a technique, but maybe there were multiple solutions.
- Smudge 14y ago> That doesn't look like the work of a very talented hacker. Why not? Do all talented hackers use 'readfile()'?
- apawloski 14y agoWhy on earth would a "talented hacker" do anything other than the easiest effective method? If it doesn't work, then just try something else. They certainly wouldn't waste their time trying to hide code snippets in a GIF when you could just upload the above. In short: the "talented hacker" is the one who compromises your system. The difficulty of execution does not matter if you get owned in the end.