POSITIVE HACK DAYS



ORGANIZER

Contests

Onsite contests

Online contests

$natch
2drunk2hack
2600
BMS & SmartHouse attack
Critical Infrastructure Attack: Blackout
CAN4ALL

Best Reverser
Competitive Intelligence
HackQuest
WAF Bypass

$natch

The competition allows the participants to check their knowledge and skills in exploiting typical vulnerabilities in online banking system web services. The competition tasks will include actual vulnerabilities of Internet banking applications detected by Positive Technologies specialists while analyzing security of such systems.

Rules

Rules

The contest is held in two stages. At first, the participants are provided with copies of virtual machines containing vulnerable web services of an online banking system (an analogue of an actual Internet banking system). The participants should detect vulnerabilities in the system within a specified period of time. In the second stage the participants are to exploit the vulnerabilities for unauthorized money withdrawal within a limited time.

Participation Terms

Participation Terms

Any attendee is welcome to participate in the competition. The visitors can register at the information desk (in the lobby of the second floor). The number of participants is limited.

Technical Details

Technical Details

You will need a laptop to participate in the competition.

$natch

2drunk2hack

The competition enables the participants to try their skills in hacking a web application which is protected by a Web Application Firewall and demonstrate the ability to think straight in any situation.

Rules

Rules

The goal is to hack a web application protected by a Web Application Firewall (WAF). The web application contains a limited number of vulnerabilities, consecutive exploitation of which allows OS commands execution.
The competition takes 30 minutes. Every 5 minutes the competitors on whose actions WAF reacted more often can drink a 50 g shot of a strong drink and proceed with the competition.
The winner is the first who manages to capture the principal game flag on the stage of executing OS commands on the server. If the principal flag is not captured, the winner is the participant with the largest number of flags captured on other stages of vulnerabilities exploitation.

Participation Terms

Participation Terms

Any attendee who has reached the age of 18 is welcome to participate in the competition. The participants can register at the information desk in the lobby of the second floor. The number of competitors is limited.

Technical Details

Technical Details

Please bring your own software and hardware that you require for participation. Connection to the game network segment will be provided.

2drunk2hack

2600

This competition challenges the participants’ knowledge and skills in old school phreaking. The contestants will try to use soviet coin-operated telephone to call a predefined number.

Rules

Rules

The participants will be asked to first call a predefined number from an authentic soviet telephone using tokens as the means of payment and then extract the used token and give it back to the jury. The winner will be selected basing on how fancy the used extraction technique was. The competition results will be announced on the second day of the forum.

Participation Terms

Participation Terms

Any attendee is welcome to participate in the competition. The contest will last through the forum days.

Technical Details

Technical Details

The competitors must not perform any actions that may damage the competition telephone.

2600

CAN4ALL

Would you like to become a part of the Watch Dogs game? Then this contest is for you! Open a car, control it, activate the signaling system! For two days, the conference’s participants will have access to a car that can be hacked using CAN. There will be prizes.

Rules

Rules

Any attendee is welcome to participate in the competition. The contest will last through the forum days.

CAN4ALL

HackQuest

HackQuest challenges the security skills of participants around the world. Hackers have just seven days to solve a dozen tasks: the ideal preparation for the hardcore security activities at PHDays. Once again, the tasks are prepared by ONsec, a company renowned for analyzing and securing web resources. All HackQuest challenges are based on real life case studies that the ONsec auditors have come across during the past year.

Rules

Rules

The contest is open to any Internet user. It takes place one month before the start of the forum from 13 to 19 April.

Winners

Winners

Contest results are now available: slemma.com/share/6f99b6e90c475ba103971700456a7bc1b524e825

HackQuest

Best Reverser

This reverse-engineering competition is an opportunity for participants to show their skill at analyzing executables.

Rules

Rules

The contest is open to any Internet user. It takes place one month before the start of the forum from 11 to 17 April.

Technical Details

Technical Details

To get the file for the analysis please use this link: phdays.ru/upload/contests/PHDays2016.zip
Forward your answers to: best2016re@phdays.com

Best Reverser

Critical Infrastructure Attack: Blackout

Participants are challenged to hack information security of a power supply system. The highly realistic model reflects the technology and functionality seen in power grids around the world. It is divided into separate parts including generation, transmission, distribution, and power supply management. The aim is to disrupt normal operation of a general power supply system, to take control over a regional power dispatching system and the central control room, to turn off the electric power transmission on a hydroelectric facility, and even to flood a small town near the station.

Participation Terms

Participation Terms

The contest is held during the forum. Come to the stand at the PHDays venue.

Critical Infrastructure Attack: Blackout

BMS & SmartHouse Attack

Participants have an opportunity to try their hand at attacking various smart technologies designed to automate homes and offices. The set-up is a realistic hybrid of building automation and smart-home systems. Hackers can target a variety of systems including lighting, water meters, elevator, and ventilation with varying levels of security protection features. The challenge is to gain control of individual systems or disconnect them.

Participation Terms

Participation Terms

The contest is held during the forum. Come to the stand at the PHDays venue.

BMS & SmartHouse Attack

WAF Bypass

In this contest the aim is to bypass Positive Technologies Application Firewall, which protects an application with specially planted multiple vulnerabilities. The contest participants will be provided with the application's source code and a vulnerabilities report generated by Application Inspector – another new product of Positive Technologies. With the source code provided, the participants will be able to verify the existence of the detected vulnerabilities and try to find other ones.

The contest will be held throughout the forum and everyone is welcome to participate. To receive the prize the winner should provide his or her contact information (name, phone number, e-mail) and personally be present at the forum.

Rules

Rules

The participants will be offered to attack (or demonstrate the attack possibility) for the purpose of gaining data from a DBMS and file system. There are several vulnerable web applications in the contest. All attacks exploiting any SQL injection vector, inclusive of gaining file system access, OS commanding, brute force and binary search attacks are counted. Attacks exploiting other vulnerabilities (e. g. buffer overflow in the web server or DBMS server) are not counted. The winner is the first who obtains access to all specially crafted data (flags). There are three flags in the competition. If several competitors implement different techniques of exploiting the same vulnerability, the winner is the person whose attack allows obtaining the same DBMS data set using the least number of queries to the server.

Participation Terms

Participation Terms

Any PHDays is welcome to compete for prizes. The competition will last throughout the forum. To receive the prize, the winner should provide his or her contact information (name, phone number, postal address) or be present at the award ceremony in person.

Technical Details

Technical Details

The contestants get an archive with the source code of the web application with multiple vulnerabilities planted in it. A vulnerability scanning report by Application Inspector will also be provided. A WAF bypass is scored when a participant manages to gain one of the flags. Attack vectors will also be taken into account by the jury. The winner is the participant with the highest number of flags obtained.

WAF Bypass

Competitive Intelligence

The competition will enable participants of the forum to discover how quickly and accurately they can find useful information on the Internet.

Rules

Rules

The competition web page will contain questions concerning a certain organization, information about which can be found online. The task of the competition participants is to find as many correct answers to the questions as possible in the shortest time. The results will be announced at the end of the second day of the forum.

Technical Details

Technical Details

Please prepare your own hardware and software for participation in the competition. You will also need Internet connection.

Competitive Intelligence


Download the full program in PDF

Levels

The Labyrinth

The Labyrinth at Positive Hack Days is a real hacking attraction. During only one hour the participants of the competition are to get over the laser field and motion detectors, open secret doors, clear the room of bugs, combat with artificial intelligence, and render a bomb harmless. To get through the Labyrinth, you will need some skills in dumpster diving, lock picking, application vulnerabilities detection, social engineering, and of course there is no way without mother wit and physical fitness.

How to Get Into the Labyrinth?

To pass the Labyrinth, create a team of three persons and register in the contest zone. You will be offered some vacant time slots. Please note that passing the Labyrinth may take more than an hour, so avoid planning anything else for this time.

Rules

Rules

"The judge is always right." If while you are breaking through the perimeter the judge requires going back to the starting point, you must fulfill this requirement. Even if you don't hear the horrid sound of the security alarm.

"Sobriety is the norm of life." Do not mix up Labyrinth and Too Drunk to Hack — in order not to loose your way, keep your mind clear.

"Breaking? No, making!" Please avoid any destructive actions against the Labyrinth infrastructure. If you think that it is impossible to pass a room without applying a Bolt Cutter™, please consult the judge.

"Time is short." If you manage to pass the room quicker than it was planned according to the schedule (9 minutes are allocated for each room), you may use the rest of time to fulfill additional tasks. Accomplished all tasks? Impossible!

Winners

Winners

1st place
Antichat

2st place
Shkolota

3st place
Extra Team

The Labyrinth