5 ms·

I also loved the last CTF. I got to the last level but by the time I'd worked out how to attack it port numbers seemed to be jumping all over the place. I figur

by aidos 13y ago

I also loved the last CTF. I got to the last level but by the time I'd worked out how to attack it port numbers seemed to be jumping all over the place. I figured that it was just that too many people were hammering it. Had a solution that worked locally, and I was pretty happy to have gotten that far. Really looking forward to the next round - especially now that I work for myself and can dedicate the day to it :)

orf 13y ago
Yeah, exactly the same. Couldn't work out how to deal with the jitter. Shame :(
- strags 13y ago
  If I remember correctly, I got around the jitter by pipelining the HTTP requests - ie. shove several HTTP requests down a TCP connection without waiting for the responses. This made it far more likely that the server would execute your requests contiguously without anyone else's being serviced in-between.
  - lunixbochs 13y ago
    Can confirm. They had code to lock the server to you and guarantee you got consecutive ports, but SSL handshake time on your HTTPS requests meant you wouldn't keep the lock for very long. I started brute forcing before the jitter was very bad but only got one chunk in with my Python script. I rewrote my solution in Go (which does http pipelining) and I could solve a whole password in about 4 minutes even during the peak time during the day when everyone was trying. My Go solution could reliably get 10-20 valid port numbers in a row during peak times, and only jittered for 3 port numbers or so. (I started my last block at about the same time as Eevee, but it ended up being 8044 so I had to settle for 21st place)
    - atto 13y ago
      Hah. We chatted on their IRC a bit that night. I solved it in Python a little bit after you, and then you encouraged me to try it with Go.
    - aidos 13y ago
      Which I knew that at the time :) I hit the last level when only 200 or so people had finished (I think, from memory) but I gave up on the jitter front. I don't have much experience with the lower level networking side and I ran out of time to dedicate to it. Having said that, I learnt a load along the way. Really looking forward to the next round.

by aidos 13y ago

orf 13y ago

Yeah, exactly the same. Couldn't work out how to deal with the jitter. Shame :(

strags 13y ago
If I remember correctly, I got around the jitter by pipelining the HTTP requests - ie. shove several HTTP requests down a TCP connection without waiting for the responses. This made it far more likely that the server would execute your requests contiguously without anyone else's being serviced in-between.
- lunixbochs 13y ago
  Can confirm. They had code to lock the server to you and guarantee you got consecutive ports, but SSL handshake time on your HTTPS requests meant you wouldn't keep the lock for very long. I started brute forcing before the jitter was very bad but only got one chunk in with my Python script. I rewrote my solution in Go (which does http pipelining) and I could solve a whole password in about 4 minutes even during the peak time during the day when everyone was trying. My Go solution could reliably get 10-20 valid port numbers in a row during peak times, and only jittered for 3 port numbers or so. (I started my last block at about the same time as Eevee, but it ended up being 8044 so I had to settle for 21st place)
  - atto 13y ago
    Hah. We chatted on their IRC a bit that night. I solved it in Python a little bit after you, and then you encouraged me to try it with Go.
  - aidos 13y ago
    Which I knew that at the time :) I hit the last level when only 200 or so people had finished (I think, from memory) but I gave up on the jitter front. I don't have much experience with the lower level networking side and I ran out of time to dedicate to it. Having said that, I learnt a load along the way. Really looking forward to the next round.