Stripe CTF Post Mortem: A Would-Be Hacker's Tale
stephenwhitmore.com
Stripe CTF Post Mortem: A Would-Be Hacker's Tale
1–10 of 11 posts
Re: Stripe CTF Post Mortem: A Would-Be Hacker's Tale
#2He didn't talk about the last level for some reason.
Re: Stripe CTF Post Mortem: A Would-Be Hacker's Tale
#3He didn't talk about the last level for some reason.
Perhaps that's the "would-be" part. The portion of people who solved it dropped off fairly heavily for the last level.
Re: Stripe CTF Post Mortem: A Would-Be Hacker's Tale
#4last challenge?
Re: Stripe CTF Post Mortem: A Would-Be Hacker's Tale
#5He didn't talk about the last level for some reason.
Also skips 5 & 6. In a closing paragraph the author mentions the discussed levels were "some of my favourite levels".
Re: Stripe CTF Post Mortem: A Would-Be Hacker's Tale
#6
The attack could also have been a lot more interesting if .php files were disallowed but short snippets like this could be hidden inside GIF images.
Re: Stripe CTF Post Mortem: A Would-Be Hacker's Tale
#7That doesn't look like the work of a very talented hacker. Whatever happened to readfile() ? The attack could also have been a lot more interesting if .php files were disallowed but short snippets like this could be hidden inside GIF images.
In one of the rounds the attack was exactly that, payload inside a gif
Re: Stripe CTF Post Mortem: A Would-Be Hacker's Tale
#8That doesn't look like the work of a very talented hacker. Whatever happened to readfile() ? The attack could also have been a lot more interesting if .php files were disallowed but short snippets like this could be hidden inside GIF images.
In one of the rounds the attack was exactly that, payload inside a gif
Really? Which level was that? I don't recall using such a technique, but maybe there were multiple solutions.
Re: Stripe CTF Post Mortem: A Would-Be Hacker's Tale
#9That doesn't look like the work of a very talented hacker. Whatever happened to readfile() ? The attack could also have been a lot more interesting if .php files were disallowed but short snippets like this could be hidden inside GIF images.
> That doesn't look like the work of a very talented hacker.
Why not? Do all talented hackers use 'readfile()'?
Re: Stripe CTF Post Mortem: A Would-Be Hacker's Tale
#10He didn't talk about the last level for some reason.
The astute reader will also note that Five and Six were also not discussed. From the fourth paragraph, "I will be discussing a subset of the nine challenges".