|Cure53 XSSMas Hacking Challenge 2016 Underway|
|Written by Nikos Vaggalis|
|Thursday, 22 December 2016|
Cure53 XSSMas Challenge, initiated in 2013, is a recurring hacking event, where those challenged have to solve a complex security puzzle in order to win money and fame, attempting to hack a web site in any means necessary.
'Any means', does not preclude rules of engagement. For example the 2015 challenge required hacking without user interaction, i.e setting a XSS trap and waiting for it to be activated as in the case of blind XSS.
So as not to spoil your fun with this year's challenge, which has been posted today, here we'll look back to last year's challenge required hackers to begin with index.php and progressively break through index3.php in order to obtain the price.
What was actually required is nicely summed up in:
The solution that cracked it first is summed up in the next 154 bytes of 'obfuscated' code:
Prizes were also handed to the shortest in (135) bytes, most efficient solution, as well :
Cure53 posts the complete samples, walk-throughs, solutions and lessons learned on their GitHub page, which apart from impressing also makes for very educational reading.
For example the lessons learned from last year's challenge were:
Challenges like this one don't offer much money-wise, last time an overall of 2.500,00 EUR was paid out to the winners, but are extremely valuable additions to a hacker's toolset, where XSSHunter and Hacksplaining should already be occupying a place. They are stepping stones in your professional career that prepare you for even bigger challenges such as those commissioned by bug bounty services like HackerOne where big names pay for discovering security vulnerabilities in their products.
That aside, act as means of funnelling the hacking creativity towards ethical and rewarding causes instead of letting the restless minds trying to satisfy their curiosity through other, less ethical and nefarious ways.
XSSMas Challenge 2016 has just been unveiled and you have until January 31st to solve it.
or email your comment to: firstname.lastname@example.org
|Last Updated ( Thursday, 22 December 2016 )|