Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Henceforth, All Job Applicants Must Hack Into Our Backend (Dev Challenge)

seatgeek.com

Post reply on HN
Print view View original

31–40 of 44 posts

Re: Henceforth, All Job Applicants Must Hack Into Our Backend (Dev Challenge)

#31

Post by revolvingcur »

sovande wrote: post #11
pennig wrote: post #3

Not too shabby. Was pretty trivial to do with Safari's developer tools, actually. I submitted this as my resume: http://www.russellheimlich.com/blog/wp-content/uploads/2007/...

Hmm, did you modify the session cookie? Because that is _not_ trivial with Safari developer tools. Edit: Removed potential spoilers.

It's unfortunately not easy to do with Chrome either (with or without extensions). I wound up downgrading to Firefox 3 from beta 4 to get back to the more mature plug-ins that make this light work.

Re: Henceforth, All Job Applicants Must Hack Into Our Backend (Dev Challenge)

#32

Post by mcknz »

vinhboy wrote: post #22
jayphelps wrote: post #9

Waaay too easy...honestly, I'm not tooting my own horn. But I guess it would keep the lazy applicant from applying. EDIT: on second thought, maybe it is the right level. They aren't likely looking for $100k+ hacker geniuses, just guys who can think outside the box and know how to do basic digging and prevent your typical hack. I retract my statement. Clever application process.

Damn, you guys are way smarter than me. Took me like 2 hours for the first step. The rest was easier. I am not good at riddles I guess...

Took me about that long for the first step, then did a facepalm once I realized the solution. Was way overthinking that one, but it's like you either know it or you don't -- if you know it you'll figure it out eventually.

Re: Henceforth, All Job Applicants Must Hack Into Our Backend (Dev Challenge)

#34

Post by temphn »

jack7890 wrote: post #13

Regarding whether or not it's too easy...that's something we wondered about. We decided we wanted a relatively straightforward initial screen rather than an complex brainteaser. So I would by no means liken this to the Greplin Challenge, but we're trying to accomplish something different. We're hoping to eliminate the crappy applicants so we can spend more time on the good ones.

Not a web developer, but a scientist who plays around with it a little bit. Here is what I tried:

1) Viewed source. Didn't see any obvious comments.

2) Looked at .css files. Nothing obvious there, though there are styles for form/etc classes and elements that aren't used in the page.

3) Tried creating some forms with input and label elements in the markup in Firebug to see if CSS labeling on buttons showed anything. Just showed "Submit Query".

4) Looked at session headers in Firebug/Safari and saw something along the lines of
5) Noticed 'csrf.token' and googled to figure out it was a cross site request forgery prevention token, which seems sort of related.

Tried to mess around with this in Python and sort of got somewhere with this

  >>>urllib.unquote("%7B%22csrf.token%22%3A%22R5wuQON8nVfha%2F7WRCXTvVMo7rZzu41dFPOVZ2V0MMw%3D%22%7D")
  '{"csrf.token":"R5wuQON8nVfha/7WRCXTvVMo7rZzu41dFPOVZ2V0MMw="}'
Then tried re-encoding:

  >>> urllib.quote(eval(urllib.unquote("%7B%22csrf.token%22%3A%22R5wuQON8nVfha%2F7WRCXTvVMo7rZzu41dFPOVZ2V0MMw%3D%22%7D")).values()[0])
  'R5wuQON8nVfha/7WRCXTvVMo7rZzu41dFPOVZ2V0MMw%3D'
and then doing an HTTP POST with curl

  curl -v -d "csrf.token=R5wuQON8nVfha/7WRCXTvVMo7rZzu41dFPOVZ2V0MMw%3D" apply.seatgeek.com
But no dice. Is this totally the wrong direction? Is this puzzle really that obvious to any real web developer worthy of the name, and if so where did you earn your spurs/what books/sites did you read?

Re: Henceforth, All Job Applicants Must Hack Into Our Backend (Dev Challenge)

#35

Post by konad »

notr00t wrote: post #24
zg wrote: post #18

Would be funny if somebody went overboard and actually rooted the box, deleted the other entries and changed the site so the problem couldn't be solved (or closed the competition). Then I guess you'd have to give him the job by default :-)

Always has to be a "him" right? Myopic macho nonsense, just like this company that wants "hyper-motivated" applicants. Ridiculous, geek-macho, over-caffeinated boys who speak first and (maybe) think later.

which pronoun should one use ?

Re: Henceforth, All Job Applicants Must Hack Into Our Backend (Dev Challenge)

#36

Post by mcknz »

temphn wrote: post #34
jack7890 wrote: post #13

Regarding whether or not it's too easy...that's something we wondered about. We decided we wanted a relatively straightforward initial screen rather than an complex brainteaser. So I would by no means liken this to the Greplin Challenge, but we're trying to accomplish something different. We're hoping to eliminate the crappy applicants so we can spend more time on the good ones.

Not a web developer, but a scientist who plays around with it a little bit. Here is what I tried: 1) Viewed source. Didn't see any obvious comments. 2) Looked at .css files. Nothing obvious there, though there are styles for form/etc classes and elements that aren't used in the page. 3) Tried creating some forms with input and label elements in the markup in Firebug to see if CSS labeling on buttons showed anything.…

Not totally -- you're looking at the right things. As people have been saying there are kind of two parts to it. The first part has a lot more to do with the page content than the technical specifics.

Re: Henceforth, All Job Applicants Must Hack Into Our Backend (Dev Challenge)

#37

Post by shyknee »

Great idea! I thought I had it figured out last night but the blank screen I got when submitting kept bothering me. This morning I double checked the requirements and saw if I got a blank screen I had not done it right.

I went back and got it figured out - I think the barrier to entry for this is just right.

Re: Henceforth, All Job Applicants Must Hack Into Our Backend (Dev Challenge)

#38

Post by Ixiaus »

temphn wrote: post #34
jack7890 wrote: post #13

Regarding whether or not it's too easy...that's something we wondered about. We decided we wanted a relatively straightforward initial screen rather than an complex brainteaser. So I would by no means liken this to the Greplin Challenge, but we're trying to accomplish something different. We're hoping to eliminate the crappy applicants so we can spend more time on the good ones.

Not a web developer, but a scientist who plays around with it a little bit. Here is what I tried: 1) Viewed source. Didn't see any obvious comments. 2) Looked at .css files. Nothing obvious there, though there are styles for form/etc classes and elements that aren't used in the page. 3) Tried creating some forms with input and label elements in the markup in Firebug to see if CSS labeling on buttons showed anything.…

No worries, I'm certainly not "getting" the riddle myself. I tried md5sum'ing the response body and base64 encoding it and replacing the cookie's csrf.token value with that, which didn't work (I did notice, however, that the server is accepting whatever you put in the cookie without re/over writing it).

I tried POSTing and PUTing with data values like "csrf=valuefromcookie" and (this may seem stupid) "browser=seatgeek".

I hand crafted a request using cURL.

I also discovered their VHOST settings aren't quite right either because when you POST to https://apply.seatgeek.com it takes you straight to the homepage (instead of redirecting you to the http://apply.seatgeek.com page).

Either way, kudos to those that got it in 15 minutes - I wasted far too much time chasing my tail on this one.

Re: Henceforth, All Job Applicants Must Hack Into Our Backend (Dev Challenge)

#39

Post by mcknz »

Ixiaus wrote: post #38
temphn wrote: post #34

Earlier quoted context omitted.

Not a web developer, but a scientist who plays around with it a little bit. Here is what I tried: 1) Viewed source. Didn't see any obvious comments. 2) Looked at .css files. Nothing obvious there, though there are styles for form/etc classes and elements that aren't used in the page. 3) Tried creating some forms with input and label elements in the markup in Firebug to see if CSS labeling on buttons showed anything.…

No worries, I'm certainly not "getting" the riddle myself. I tried md5sum'ing the response body and base64 encoding it and replacing the cookie's csrf.token value with that, which didn't work (I did notice, however, that the server is accepting whatever you put in the cookie without re/over writing it). I tried POSTing and PUTing with data values like "csrf=valuefromcookie" and (this may seem stupid) "browser=seatgee…

Not so stupid. The error message is important.

Re: Henceforth, All Job Applicants Must Hack Into Our Backend (Dev Challenge)

#40

Post by [deleted] »

dwwoelfel wrote: post #30
dwwoelfel wrote: post #19

Earlier quoted context omitted.

I think that you may have erred on the side of too easy. I have very little web development experience, but I was able to solve it in a few minutes. I didn't even use any developer tools.

Edit: I didn't realize that there was a second part. Maybe it wasn't too easy after all.

[deleted]
Post reply on HN