Live data from Hacker News

'; CREATE TABLE `Capture the Flag`;' -- Stripe's Web Security CTF is Live

stripe.com

61–70 of 80 posts

Re: '; CREATE TABLE `Capture the Flag`;' -- Stripe's Web Security CTF is Live

#61
post #13

Huge kudos for the design of the site - it definitely gives off a Tron-like feel. I can't imagine the attention to detail to what amounts to just a game.

> I can't imagine the attention to detail to what amounts to just a game.

Game, marketing exercise, recruitment tool.

Re: '; CREATE TABLE `Capture the Flag`;' -- Stripe's Web Security CTF is Live

#62

I can't wait until the very last challenge just says: "SURPRISE, you typed in your password when you started this event, which is the most common way that someone's password will get stolen."

I just authenticated with Github (public info, read-only).

Re: '; CREATE TABLE `Capture the Flag`;' -- Stripe's Web Security CTF is Live

#65

This is suprisingly fun. At first, you feel like a badass, reading the documentation for every function call, googling for exotic bugs. Then you feel like a total idiot when you notice how simple it actually is. Finally, you laugh at people in the IRC because you know exactly how stupid they feel.

Yeah... I can't believe I spent time looking for something wrong with the HMAC used for session cookies. Also, I'm pretty sure I solved #5 the "wrong" way since it didn't actually involve the hint they gave.

Re: '; CREATE TABLE `Capture the Flag`;' -- Stripe's Web Security CTF is Live

#66
post #46
post #2

My favorite part is watching the captures in real time at https://stripe-ctf.com/leaderboard .

As I (and my now partner Eevee) race towards the level 8 finish line, I don't feel quite the same. I see us making limited progress and see the number of people finishing level 7 rising, haha. This is fun, though.

Good luck guys.

I just made it to level 8 this morning and haven't a clue where to really begin with it.

It's definitely a lot of fun and has been an interesting journey for sure. Love little games like this.

Re: '; CREATE TABLE `Capture the Flag`;' -- Stripe's Web Security CTF is Live

#67
post #66
post #46

Earlier quoted context omitted.

As I (and my now partner Eevee) race towards the level 8 finish line, I don't feel quite the same. I see us making limited progress and see the number of people finishing level 7 rising, haha. This is fun, though.

Good luck guys. I just made it to level 8 this morning and haven't a clue where to really begin with it. It's definitely a lot of fun and has been an interesting journey for sure. Love little games like this.

I've worked in/with security along these lines for a very long time. This CTF (particularly level 8) has been some of the most difficult stuff I've ever done. Thanks to Stripe for putting this together; if I wasn't already a customer, I absolutely would be now!

Re: '; CREATE TABLE `Capture the Flag`;' -- Stripe's Web Security CTF is Live

#68
post #65

This is suprisingly fun. At first, you feel like a badass, reading the documentation for every function call, googling for exotic bugs. Then you feel like a total idiot when you notice how simple it actually is. Finally, you laugh at people in the IRC because you know exactly how stupid they feel.

Yeah... I can't believe I spent time looking for something wrong with the HMAC used for session cookies. Also, I'm pretty sure I solved #5 the "wrong" way since it didn't actually involve the hint they gave.

I didn't use the Level 2 server for #5 either (although I did for #8) - so I suspect that many people solved it the same way.

Re: '; CREATE TABLE `Capture the Flag`;' -- Stripe's Web Security CTF is Live

#69
post #59

Don't know if I'll have time (or the skills) to finish Level 8 (it looks pretty intense), but the other levels were a lot of fun. This was done really well - thanks for doing it!

Level 7 is actually harder technically than Level 8, although Level 8 had problems at their end when there were too many people trying for it, overloading the Level 2 and Level 8 servers and making it hard to get a successful exploit. Once they fixed that, it was easy.

Re: '; CREATE TABLE `Capture the Flag`;' -- Stripe's Web Security CTF is Live

#70
post #13

Huge kudos for the design of the site - it definitely gives off a Tron-like feel. I can't imagine the attention to detail to what amounts to just a game.

> I can't imagine the attention to detail to what amounts to just a game. Game, marketing exercise, recruitment tool.

It serves an important purpose for them no doubt, but it is surprisingly polished and addictive. Just shows you that it's worth putting time into perfecting even activities which might seem peripheral - I'll bet they'll find some good people via this game (the ones who finished it really quickly and with clever solutions).

I'm totally stuck on Level 7 after getting some waffles and have no time to continue though, oh well.

Post reply on HN