Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Bitcoin Piñata

ownme.ipredator.se

Post reply on HN
Print view View original

41–50 of 112 posts

Re: The Bitcoin Piñata

#41

Post by nothrabannosir »

gradinafrica wrote: post #37

They seem to assume the reader has a certain level of competency with web traffic monitoring and client/server communicating tools. I suppose this is half the fun. Still, I'm trying to figure out what they mean by > " Before you ask: yes, Piñata will talk to itself and you can enjoy watching it do so. " Also, what should I be using to connect using TLS/TCP?

They offer a TLS client and server interface, so you can have your own host act as a proxy.

Try this:

    $ mkfifo /tmp/tlspipe
    $ nc -l -p 40001  /tmp/tlspipe
Then visit http://ownme.ipredator.se:10001 from that same host (curl or firefox or whatever). Now look at /tmp/tlspipe.

Disclaimer: I'm completely unfamiliar with named pipes or tls, but I think this is what they mean.

EDIT: This should also work:

    $ mkfifo /tmp/tlspipe
    $ nc ownme.ipredator.se 10002 /tmp/tlspipe
EDIT2: Just realized that the above only captures one part of the convo. Try this:

    $ nc ownme.ipredator.se 10002 /tmp/tlspipe
Now you have the full back and forth. E.g.:

    $ strings /tmp/server-to-client
    sYcdI*
            Cambridge1
    BTC Pinata Team1 0
    ocaml-tls@h3q.com0
    150207183718Z
    150329183718Z0$1
    tls services0
    
    ...

Re: The Bitcoin Piñata

#42

Post by eterm »

philk10 wrote: post #35
MrRogers wrote: post #33

Where could I, a total beginner in crypto-stuff, learn more about this kind of thing? What would be the list of things I'd need to know how to do in order to "break in", and where could I learn how to do them?

One possible starting point is here - http://cryptopals.com

But oddly not http://www.cryptopals.com/

Re: The Bitcoin Piñata

#43

Post by gradinafrica »

nothrabannosir wrote: post #41
gradinafrica wrote: post #37

They seem to assume the reader has a certain level of competency with web traffic monitoring and client/server communicating tools. I suppose this is half the fun. Still, I'm trying to figure out what they mean by > " Before you ask: yes, Piñata will talk to itself and you can enjoy watching it do so. " Also, what should I be using to connect using TLS/TCP?

They offer a TLS client and server interface, so you can have your own host act as a proxy. Try this: $ mkfifo /tmp/tlspipe $ nc -l -p 40001 /tmp/tlspipe Then visit http://ownme.ipredator.se:10001 from that same host (curl or firefox or whatever). Now look at /tmp/tlspipe. Disclaimer: I'm completely unfamiliar with named pipes or tls, but I think this is what they mean. EDIT: This should also work: $ mkfifo /tmp/tlsp…

`cat`ed tlsconvo2. That's some quality gibberish :D

Re: The Bitcoin Piñata

#44

Post by Cederfjard »

eterm wrote: post #42
philk10 wrote: post #35

Earlier quoted context omitted.

One possible starting point is here - http://cryptopals.com

But oddly not http://www.cryptopals.com/

Not so odd, I don't always use nor redirect www either (well I do if it's for a client, but otherwise I usually can't be bothered).

Edit: But I do get 404s when I click the "language-links" on the challenge pages, like http://cryptopals.com/sets/1/challenges/1/ruby. What are those anyways?

Re: The Bitcoin Piñata

#45

Post by martinko »

ikeboy wrote: post #39
marcell wrote: post #17

Suggestion: add an endpoint on the piñata that proves it has the private key. You can do this using Bitcoin's sign message method.

And then I just make it sign a message sending all the btc to my address, then broadcast that publicly. Very bad idea to sign everything that comes your way, kind of like `eval` on text input.

> Very bad idea to sign everything that comes your way, kind of like `eval` on text input.

Nowhere did he suggest this.

Re: The Bitcoin Piñata

#46

Post by ikeboy »

martinko wrote: post #45
ikeboy wrote: post #39

Earlier quoted context omitted.

And then I just make it sign a message sending all the btc to my address, then broadcast that publicly. Very bad idea to sign everything that comes your way, kind of like `eval` on text input.

> Very bad idea to sign everything that comes your way, kind of like `eval` on text input. Nowhere did he suggest this.

Others said it in the replies. And any implementation that tries to check the message opens up another avenue of attack.

Re: The Bitcoin Piñata

#47

Post by tlrobinson »

gradinafrica wrote: post #37

They seem to assume the reader has a certain level of competency with web traffic monitoring and client/server communicating tools. I suppose this is half the fun. Still, I'm trying to figure out what they mean by > " Before you ask: yes, Piñata will talk to itself and you can enjoy watching it do so. " Also, what should I be using to connect using TLS/TCP?

One of the ports (10000) acts like a normal TLS server, one of the ports (10001) is just used to trigger a TLS connection back to you on port 40001, and the 3rd (10002) is a TCP server that when connected to acts like a TLS client.

So to get them to talk to each other you could either write a server that listens on 40001 then proxies any incoming connections back to 10000 (that's what nothrabannosir's named pipes + nc example does), or just connect to 10000 and 10002 and pipe the two connections to each other.

e.x. in Node.js:

    var net = require("net");
    var server = net.connect({ host: 'ownme.ipredator.se', port: 10002 });
    var client = net.connect({ host: 'ownme.ipredator.se', port: 10000 });
    server.on('data', console.log.bind(console, 'server'));
    client.on('data', console.log.bind(console, 'client'));
    client.pipe(server).pipe(client);

Re: The Bitcoin Piñata

#48

Post by atmosx »

nothrabannosir wrote: post #41
gradinafrica wrote: post #37

They seem to assume the reader has a certain level of competency with web traffic monitoring and client/server communicating tools. I suppose this is half the fun. Still, I'm trying to figure out what they mean by > " Before you ask: yes, Piñata will talk to itself and you can enjoy watching it do so. " Also, what should I be using to connect using TLS/TCP?

They offer a TLS client and server interface, so you can have your own host act as a proxy. Try this: $ mkfifo /tmp/tlspipe $ nc -l -p 40001 /tmp/tlspipe Then visit http://ownme.ipredator.se:10001 from that same host (curl or firefox or whatever). Now look at /tmp/tlspipe. Disclaimer: I'm completely unfamiliar with named pipes or tls, but I think this is what they mean. EDIT: This should also work: $ mkfifo /tmp/tlsp…

Maybe then run something like:

$ cat /tmp/tlsconvo2|xxd|less

But I'm not into crypto, even that I don't know what it means or if it's the way to go. I liked the initiative though :-)

Re: The Bitcoin Piñata

#49

Post by eterm »

Cederfjard wrote: post #44
eterm wrote: post #42

Earlier quoted context omitted.

But oddly not http://www.cryptopals.com/

Not so odd, I don't always use nor redirect www either (well I do if it's for a client, but otherwise I usually can't be bothered). Edit: But I do get 404s when I click the "language-links" on the challenge pages, like http://cryptopals.com/sets/1/challenges/1/ruby . What are those anyways?

They are Solutions. The C++ one to the first exercise works:

http://cryptopals.com/sets/1/challenges/1/cpp/

Re: The Bitcoin Piñata

#50

Post by [deleted] »

tlrobinson wrote: post #47
gradinafrica wrote: post #37

They seem to assume the reader has a certain level of competency with web traffic monitoring and client/server communicating tools. I suppose this is half the fun. Still, I'm trying to figure out what they mean by > " Before you ask: yes, Piñata will talk to itself and you can enjoy watching it do so. " Also, what should I be using to connect using TLS/TCP?

One of the ports (10000) acts like a normal TLS server, one of the ports (10001) is just used to trigger a TLS connection back to you on port 40001, and the 3rd (10002) is a TCP server that when connected to acts like a TLS client. So to get them to talk to each other you could either write a server that listens on 40001 then proxies any incoming connections back to 10000 (that's what nothrabannosir's named pipes + n…

[deleted]
Post reply on HN