How !SpamAndHex became a top hacker team (part 1)
Summer just started in 2011, when Gábor Pék, Buherátor and Bencsáth Boldizsár (aka “Boldi”) decided to do some nice hacking over the summer instead of going to splash in Lake Balaton all summer long. The annual international university hacking competition called iCTF was a big challenge with top competing teams. These guys needed to pull up their socks to have a chance.
The guys were not new in hacking, but they never considered competing before. They were typical self-taught hackers, reading blogs and hacker news, never learned hacking in the classroom.
To get better, they assembled a list of security topics to practice for the competition.
- Basic hacking tools: nessus, nmap, nikto, dirbuster, acunetix
- Operating system tools: bash, perl, python, process explorer, sysinternals tools
- Web hacking magic: sql injection, XSS, CSRF, cookie jacking, session hijacking
- Memory-based vulnerabilities: rop, bof, format string
- Hacks of the year: sony, anonymous, lulzsec
- Targeted attacks and APTs (advanced persistent threat)
- Malware disassembly
- Forensics: volatility
- Network handling: proxy, channeling
- Certificates, OTP
- Social network hacks: spear phishing, social spam
- Google hack DB
Most people were enjoying their vacation, but a small group of motivated students joined the effort. By September, the guys held regular meetings on Thursdays rigorously reviewing tools and hacks (with the help of some pizza and beer). The days of the iCTF 2011 competition came and the team finished 36th (named as Team.iCTF.CrySyS.A). I think this was the beginning of a beautiful friendship!
How did we get from this first CTF competition to compete twice at the DefCon finals? We will tell you in the next post.
In the meantime, we are creating awesome tutorial challenges for you to try some of these hacker tools. Check out the hacking tools above in the list and comment if you want to suggest some tools.
Share this post on social media!
Related Articles
Best practices to prevent IDOR vulnerabilities
Learn about Insecure Direct Object Reference and the steps you can take as a developer to make sure your applications are safeguarded against cyberattacks.
Interview with Davide Balzarotti
Having the right security mindset is important, so we asked an expert about learning security and building security awareness!
Vulnerabilities in authentication and authorization
Authentication and authorization both can be associated with common security vulnerabilities. Here are some ways to prevent them!