web application security lab

Hacker Pumpkin Carving

hacking XSS vector pumpkin
Normal (girlfriend) pumpkin and l33t JavaScript injected XSS pumpkin: ';alert('XSS')//
(Okay, I know I missed the semi-colon - I didn't debug my gourd).

Okay, here's the deal. I have decided it's time for all of us to get into the spirit. So this is the first annual hacker pumpkin carving contest for all the ha.ckers out there. And without being a hypocrite, I've kicked it off by doing the first pumpkin myself. I've given all of you 2 weeks notice, so I don't want to hear any bitching that you didn't have enough time. No whining. Log off from world of warcraft and go to the store.

Now it's your turn. Submit your best pumpkins on or before Halloween (Midnight GMT October 31st, 2006) and I'll throw it up on the website. I'll make a decision on which is best (no I don't vote for myself unless I'm the only one who posts his pumpkin). This isn't a democracy - my vote is the only one that matters, so aim to impress! Here are the rules:

There are none. Okay, well that's not really true. It should involve a pumpkin. I'll be extra impressed by craftsmanship and l33t haX0rship. Bonus points for 0-day pumpkins, or pumpkins involved in hacking "incidents." Be creative. I can be bribed.

I'll post the winner sometime after Halloween depending on my general mood and level of hung-over-ness. If you want to chat about it, do so on the forums. Email me your pumpkin pictures (640x480 or less preferrably so I don't have to use The Gimp on them). I can be reached at h@ckers.org. Good luck!

Entrant: Brian Eaton and WINNER!

    Brian did a nice you've got mail theme - wondering if he has a crush on Meg Ryan. ;) Alas, Brian's Cialis spam blocked our inbox and warmed our hearts: You've Got Mail

Entrant: Jas First runner up

    Jas did a number of scary halloween and war scenes. Not hacker related but pretty trick: 1 2 3 4 5

Entrant: Sil Second runner up

Does this count? lynx -dump http://infiltrated.net/foo|awk '{a[i++]=$0} END {for (j=i-1; j>=0;) print a[j--] }'|sed 's/\$/ /g;s/S/U/g'|awk '!($0 in a) {a[$0];print}'

Uh... Windows (l)users need not apply... Retardo Linux/BSD users try:

lynx -dump http://infiltrated.net/foo|\
awk '{a[i++]=$0} END {for (j=i-1; j>=0;) print a[j--] }'|\
sed 's/\$/ /g;s/S/U/g'|\
awk '!($0 in a) {a[$0];print}'

Yes, it counts, and it's pretty funny, although it was lacking orange. If it had been ANSI colors I might have scored this one higher.

Entrant: genec-lori Super last, like the lowest possible score