3 ms·
This sounds a lot like the last level of capture the flag 2.
by circlingthesun 14y ago
This sounds a lot like the last level of capture the flag 2.
- lucian1900 14y agoAnd is also likely to suffer from vulnerabilities because of its complexity.
- mguillemot 14y agoThe security flaw highlighted in Stripe CTF2 was that you could check the validity of each independant chunk independantly of the others, which meant reducing the search space for bruteforce attacks. From what I understand, the technique proposed here would mean you cannot say anything about the validity of just one chunk: each server apply some operation on the password it receives and the chunk it stores, and all these operations have to be combined to say if the password was valid or not. If it's not, you cannot know which chunk was invalid.
- mattlong 14y agoReferring to the Stripe CTF 2.0 [1]. [1] https://github.com/stripe-ctf/stripe-ctf-2.0/tree/master/levels/8 https://github.com/stripe-ctf/stripe-ctf-2.0/tree/master/lev...