4 ms·
...:: Hacking World Cup Tickets for Germany 06 ::... Australia was a late qualifier for the tournament. The ticket submission was via email. Tickets were alloc
by tezza 17y ago
...:: Hacking World Cup Tickets for Germany 06 ::...
Australia was a late qualifier for the tournament. The ticket submission was via email. Tickets were allocated on a first email received basis after 09:00. There was a countdown webpage which advertised the time.
--- Preparation
* I telneted to port 25 of the destination and saw via EHLO that the mail server clock was 1 minute faster than advertised on the webpage, giving a start time advantage
* I pre crafted the SMTP message into a text file. This had the sending time as 09:00:01
* Before the day I checked out how long the mail server would keep open any connections without any input (10 minutes)
---
Cometh the day:
* I opened up several telnet sessions to port 25 , 10 minutes before.
* when the time came, I did several EHLO messages to check my session was alive
* I cut'n'pasted my SMTP message into the server
* I closed all my connections (other people were bouncing at this point as the server connection pool was exhausted)
---
I got my tickets.
- jrockway 17y agoBrilliant.
- huhtenberg 17y ago> the server connection pool was exhausted Why ? Did you TCP-flooded SMTP server after you connected ? Have you considered that it might be very simple to track you down since you'd be one of few people who got the tickets that day through this channel ?
- tezza 17y agoThe flood was of all of the other Oz applicants hitting SEND on their email clients. That was why I allocated myself two channels before. There were many more than 2 channels available. I could have DDOSed the server to ensure only I got tickets, but that sounds like an ugly thing to do.