POSITIVE HACK DAYS



ORGANIZER

Contests


Download the full program in PDF

Levels

Onsite contests

Online contests

$natch
2drunk2hack
2600
Leave ATM Alone
Choo Choo Pwn
WAF Bypass

Competitive Intelligence
Hash Runner

$natch

The competition allows the participants to check their knowledge and skills in exploiting typical vulnerabilities in online banking system web services. The competition tasks will include actual vulnerabilities of Internet banking applications detected by Positive Technologies specialists while analyzing security of such systems.

Rules

Rules

The contest is held in two stages. At first, the participants are provided with copies of virtual machines containing vulnerable web services of an online banking system (an analogue of an actual Internet banking system). The participants should detect vulnerabilities in the system within a specified period of time. In the second stage the participants are to exploit the vulnerabilities for unauthorized money withdrawal within a limited time.

Participation Terms

Participation Terms

Any attendee is welcome to participate in the competition. The visitors can register at the information desk (in the lobby of the second floor). The number of participants is limited.

Prizes

Prizes

Following the results of the competition, each participant gets a monetary reward equaling to the amount of money stolen from the game Internet bank service.

Technical Details

Technical Details

You will need a laptop to participate in the competition.

$natch

2drunk2hack

The competition enables the participants to try their skills in hacking a web application which is protected by a Web Application Firewall and demonstrate the ability to think straight in any situation.

Rules

Rules

The goal is to hack a web application protected by a Web Application Firewall (WAF). The web application contains a limited number of vulnerabilities, consecutive exploitation of which allows OS commands execution.
The competition takes 30 minutes. Every 5 minutes the competitors on whose actions WAF reacted more often can drink a 50 g shot of a strong drink and proceed with the competition.
The winner is the first who manages to capture the principal game flag on the stage of executing OS commands on the server. If the principal flag is not captured, the winner is the participant with the largest number of flags captured on other stages of vulnerabilities exploitation.

Participation Terms

Participation Terms

Any attendee who has reached the age of 18 is welcome to participate in the competition. The participants can register at the information desk in the lobby of the second floor. The number of competitors is limited.

Prizes

Prizes

Positive Technologies (the PHDays organizers) and the sponsors of the forum provide prizes for the competition.

Technical Details

Technical Details

Please bring your own software and hardware that you require for participation. Connection to the game network segment will be provided.

2drunk2hack

Hash Runner

Hash runner challenges the competitors’ knowledge of cryptographic hash algorithms and skills of cracking password hash functions.

Rules

Rules

The competitors will be provided with a list of hash functions generated according to various algorithms (MD5, SHA-1, BlowFish, GOST3411, etc.). Points for each decrypted password are scored according to the algorithm’s level of difficulty. To become a winner, a competitor should gain the most points in a limited period of time, leaving the rivals behind.

Participation Terms

Participation Terms

Any Internet user can participate in the competition. You can register via the website phdays.com (the registration opens one week before the forum begins). The competition will be held as part of PHDays III and will last through the forum days.

Prizes

Prizes

Prizes will be provided by the PHDays organizers — the Positive Technologies company, and by the forum sponsors. The winner will receive a special prize.

Technical Details

Technical Details

Please prepare your own software and hardware for participation in the competition. You will also need Internet connection to participate.

Hash Runner

2600

This competition challenges the participants’ knowledge and skills in old school phreaking. The contestants will try to use soviet coin-operated telephone to call a predefined number.

Rules

Rules

The participants will be asked to first call a predefined number from an authentic soviet telephone using tokens as the means of payment and then extract the used token and give it back to the jury. The winner will be selected basing on how fancy the used extraction technique was. The competition results will be announced on the second day of the forum.

Participation Terms

Participation Terms

Any attendee is welcome to participate in the competition. The contest will last through the forum days.

Prizes

Prizes

Positive Technologies (the PHDays organizers) and the sponsors of the forum provide prizes for the competition.

Technical Details

Technical Details

The competitors must not perform any actions that may damage the competition telephone.

2600

WAF Bypass

In this contest the aim is to bypass Positive Technologies Application Firewall, which protects an application with specially planted multiple vulnerabilities. The contest participants will be provided with the application's source code and a vulnerabilities report generated by Application Inspector – another new product of Positive Technologies. With the source code provided, the participants will be able to verify the existence of the detected vulnerabilities and try to find other ones.

The contest will be held throughout the forum and everyone is welcome to participate. To receive the prize the winner should provide his or her contact information (name, phone number, e-mail) and personally be present at the forum.

Rules

Rules

The participants will be offered to attack (or demonstrate the attack possibility) for the purpose of gaining data from a DBMS and file system. There are several vulnerable web applications in the contest. All attacks exploiting any SQL injection vector, inclusive of gaining file system access, OS commanding, brute force and binary search attacks are counted. Attacks exploiting other vulnerabilities (e. g. buffer overflow in the web server or DBMS server) are not counted. The winner is the first who obtains access to all specially crafted data (flags). There are three flags in the competition. If several competitors implement different techniques of exploiting the same vulnerability, the winner is the person whose attack allows obtaining the same DBMS data set using the least number of queries to the server.

Participation Terms

Participation Terms

Any PHDays III is welcome to compete for prizes. The competition will last throughout the forum. To receive the prize, the winner should provide his or her contact information (name, phone number, postal address) or be present at the award ceremony in person.

Prizes

Prizes

The winner will receive a special prize from the forum’s technological partner, ICL. The people who took first five places will receive prizes and souvenirs from the PHDays organizers (Positive Technologies) and the ICL company.

Technical Details

Technical Details

The contestants get an archive with the source code of the web application with multiple vulnerabilities planted in it. A vulnerability scanning report by Application Inspector will also be provided. A WAF bypass is scored when a participant manages to gain one of the flags. Attack vectors will also be taken into account by the jury. The winner is the participant with the highest number of flags obtained.

WAF Bypass

Competitive Intelligence

The competition will enable participants of the forum to discover how quickly and accurately they can find useful information on the Internet.

Rules

Rules

The competition web page will contain questions concerning a certain organization, information about which can be found online. The task of the competition participants is to find as many correct answers to the questions as possible in the shortest time. The results will be announced at the end of the second day of the forum.
Results

Participation Terms

Participation Terms

Any Internet user is welcome to take part in the competition. You can register via the website phdays.com (the registration opens one week before the forum begins). The competition will last through the forum days.

Prizes

Prizes

Plase prepare your own hardware and software for participation in the competition. You will also need Internet connection.

Technical Details

Technical Details

Prizes will be provided by the PHDays organizers — the Positive Technologies company, and by the sponsors of the forum.

Competitive Intelligence

Leave ATM Alone

The competition challenges the participants' skills in exploiting ATM vulnerabilities. The software for the tasks is specially developed for PHDays III and contains the most common vulnerabilities of such systems seen in wild life.

Rules

Rules

The competition consists of two rounds. In the first round the participants will have a chance to find and exploit vulnerabilities in a system deployed on an ATM. Those who achieve the best results in the first round become finalists, and in the second round will face similar challenges but with a stricter time limit.

Participation Terms

Participation Terms

Any attendee of the forum can take part in the competition. You can register in the competition zone. The number of participants is limited.

Prizes

Prizes

The winners will be awarded prizes by the PHDays organizers — Positive Technologies, and by the sponsors of the forum.

Technical Details

Technical Details

Please bring your own ... brains :)

Leave ATM Alone

Choo Choo Pwn

The competition challenges the participants' skills in exploiting various vulnerabilities in industrial equipment which provides automation and control of technological processes. The contestants will be offered to choose from access to communication systems of industrial equipment or HMI systems access. The goal is to independently obtain access to a model of a system which controls a railroad and cargo loading by exploiting vulnerable industrial protocols or bypassing authentication of SCADA systems or industrial equipment web interfaces. The Industrial Control System (ISC) of the railroad will include video surveillance, and, as an additional task, the competitors will be offered to disable the surveillance system.

Rules

Rules

The competitions consists of two main rounds and an extra one. In the first round, the goal is to obtain access to the cargo loading system. In the second round, the participants will have an opportunity to gain access to the railroad ICS. During the extra round the competitors will have a chance to disable the surveillance system.
The participants will be given access to the ICS system and its HMI components. During the time defined by the organizers, the participants should whether disable some separate parts of the model, or to gain controlled access.

Participation Terms

Participation Terms

Any attendee of the forum can take part in the competition. You can register in the competition zone. The number of participants is limited.

Prizes

Prizes

The contestants will be awarded some nice prizes which will vary depending on level of access gained.

Technical Details

Technical Details

Please bring your own laptop to participate in the contest.

Choo Choo Pwn


Download the full program in PDF

Levels

The Labyrinth

The Labyrinth at Positive Hack Days is a real hacking attraction. During only one hour the participants of the competition are to get over the laser field and motion detectors, open secret doors, clear the room of bugs, combat with artificial intelligence, and render a bomb harmless. To get through the Labyrinth, you will need some skills in dumpster diving, lock picking, application vulnerabilities detection, social engineering, and of course there is no way without mother wit and physical fitness.

How to Get Into the Labyrinth?

To pass the Labyrinth, create a team of three persons and register in the contest zone. You will be offered some vacant time slots. Please note that passing the Labyrinth may take more than an hour, so avoid planning anything else for this time.

Rules

Rules

"The judge is always right." If while you are breaking through the perimeter the judge requires going back to the starting point, you must fulfill this requirement. Even if you don't hear the horrid sound of the security alarm.

"Sobriety is the norm of life." Do not mix up Labyrinth and Too Drunk to Hack — in order not to loose your way, keep your mind clear.

"Breaking? No, making!" Please avoid any destructive actions against the Labyrinth infrastructure. If you think that it is impossible to pass a room without applying a Bolt Cutter™, please consult the judge.

"Time is short." If you manage to pass the room quicker than it was planned according to the schedule (9 minutes are allocated for each room), you may use the rest of time to fulfill additional tasks. Accomplished all tasks? Impossible!

Winners

Winners

1st place
Antichat

2st place
Shkolota

3st place
Extra Team

The Labyrinth