Shameless: Enjoying this challenge? You'd enjoy working with us. We're hiring in Chicago, in Mountain View, and in Manhattan. This stuff is our day-to-day, plus reversing, custom protocols, tool development, and exotic applications. If you've never done appsec work professionally, but find these challenges fun and straightforward, we'd love to talk to you:<p>We've hired more people off HN than from any other vector.<p>www.matasano.com/careers<p>(Or, you know, ask Stripe for a job. I'm sure they're hiring too!)
Shameless, following tptacek and borski's examples: Having fun finding broken code? Want to get paid without going to the effort of writing exploits? You might want to look at the Tarsnap (or scrypt, or kivaloo, or spiped) code and see if you can win some bug bounties: <a href="http://www.tarsnap.com/bugbounty.html" rel="nofollow">http://www.tarsnap.com/bugbounty.html</a><p>(Or, you know, ask Stripe or Matasano or Tinfoil Security for a job. They'll pay you far more than you'd ever get from Tarsnap's bug bounties.)
Disclaimer: <i>Also shameless</i><p>A lot of people have fun with this kind of challenge, as well as network security in general. Over 10,000 people went to DEFCON this year (I've seen estimates between 13,000 and 16,000). Hacker IRC rooms are constantly buzzing. Security is fun, and while building software is immensely satisfying, so is breaking it.<p>So why is the information security industry so tiny?<p>For one, it's competitive, but I think that many, <i>many</i> qualified security guys don't realize that there's a thriving industry around this kind of stuff.<p>If you want to work in security, these CTF-style challenges are a great way to show that you're self-motivated and clever. I'm always hiring application security engineers, and honestly it's pretty difficult to find people who are new to the field. People seem to either have a decade of experience and bounce from company to company, or no experience at all and assume that they "aren't good enough."<p>If a company can't take some raw talent and refine it, they don't deserve raw talent in the first place. We call that training.<p>If you like this kind of stuff, apply at Stripe, or Matasano, or Tinfoil Security -- or even my engineering team at Redspin. If you mention "HN" or "Hacker News" in an email to jobs at redspin.com, I'll know exactly where you came from :)<p>PS: Redspin hires all kinds of security engineers, from policy & procedure specialists to network infrastructure guys to appsec experts. It's better to apply and have a conversation than to be too afraid to try!
Shameless, ala tptacek: Enjoying this challenge? We do similar things on a daily basis over at Tinfoil Security. We develop tools to attack websites in a lot of similar ways to this Stripe CTF. We're hiring in Palo Alto, and even if you've never done appsec work before, we'd love to chat.<p><a href="https://www.tinfoilsecurity.com/jobs" rel="nofollow">https://www.tinfoilsecurity.com/jobs</a><p>(Or, you know, ask Stripe or Matasano for a job. They're both crazy awesome, have a ton of respect from me, and are also hiring.)
Huge kudos for the design of the site - it definitely gives off a Tron-like feel. I can't imagine the attention to detail to what amounts to just a game.
My favorite part is watching the captures in real time at <a href="https://stripe-ctf.com/leaderboard" rel="nofollow">https://stripe-ctf.com/leaderboard</a>.
I was looking forward to verifying the P = NP proof on level 3, but sadly I don't have access to DARPA’s 1000-node testbed, nor does my phone have any optical storage space. Sigh :(<p>Anyway, love the challenge, the attention to detail is awesome :)
This is suprisingly fun. At first, you feel like a badass, reading the documentation for every function call, googling for exotic bugs. Then you feel like a total idiot when you notice how simple it actually is. Finally, you laugh at people in the IRC because you know exactly how stupid they feel.
I really enjoyed this until I got stuck on level 3. I have a bunch of ideas about what the solution might be but I'm not good. Are there any websites with challenges similar to this that are more geared towards someone that isn't so great at this sort of thing? A "beginner" at security stuff?
Stopped at level 3, for a break, and because I couldn't see the exploit so easily. But still, amazing site design and great fun.<p>Would love to sit down with it for a bit longer and crack on.
I finished first three levels. I will continue with the rest tomorrow.<p>I think if they didn't provide code, it would have been really difficult. Is everyone feeling same way?
unrelated to the game, but on the social network question:<p>> $url = "<a href="https://upload.wikimedia.org/wikipedia/commons/f/f8/" rel="nofollow">https://upload.wikimedia.org/wikipedia/commons/f/f8/</a> . "Question_mark_alternate.svg";<p>can't someone edit the image on wikipedia and change the image displayed to everyone else here -- or is the wikimedia image system only accessible by admins?
I'm now really looking forward to work finishing for the day. The first thing I did was email all the developers at work and challenge them with a race to the finish :p ....I'm a grad halfway through my year of QA.
Have had a lot of fun with this so far even though I'm only at level 4, kind of went off on a tangent on level 3 and after getting a partial solution I realised that there was a much easier way of approaching it
I can't wait until the very last challenge just says: "SURPRISE, you typed in your password when you started this event, which is the most common way that someone's password will get stolen."
Don't know if I'll have time (or the skills) to finish Level 8 (it looks pretty intense), but the other levels were a lot of fun. This was done really well - thanks for doing it!
The public URL for the Secret Safe given to me in Level 0 doesn't actually return a response when I get request it, the connection just sits open - is this expected?
Level 2 is just giving me timeouts. Joined IRC channel to report bug, and somebody gave away the answer for level 2. Bummer, I had been enjoying myself.