Solving the Security B-Sides London 2012 Web Hacking Challenge

This year (2012) I wrote a web hacking challenge for BSides London. Rather than write a lengthy blog post about how to solve it (when others have already covered it), I thought I'd do some vidz. They're all up on my (new) YouTube account and embedded below for your viewing enjoyment.

I had a ton of fun writing and supporting this challenge and I'm especially grateful to Tomasz Miklas for hosting and monitoring it throughout. Congratulations to Tom Mackenzie who won it and I'll see him at 44Con in September.

The challenge is back online again now for people who want to play for fun at a new URL http://hive.0x41.cc/. It's on Bytemark's BigV beta so it may be up and down/subject to outages, etc but for the most part it'll be there. Until they start charging at least!

The code has been open-sourced for any one who is interested in both finding out how it worked or using it for education. You can fork it on Github at https://github.com/7Elements.

The questions were:

1. What is Matt’s password for the Intranet?


2. Who did Iggy meet on January 20th?


3. What is Javvad’s password?


4. What is the kernel version of the underlying server?


5. What is the SHA1 value in the file /bsides-challenge? (on the host itself, not on the website)

I recommend you crank the quality setting straight up to HD and go full screen on these.

Question 1

Question 2



Question 3



Questions 4 and 5

There were actually loads of ways to do these two questions, but here is one way.