HackThisSite
From Wikipedia, the free encyclopedia
 The HTS Website |
|
| Origin | Chicago, Illinois |
|---|---|
| Country | United States International |
| Years active | 2003–2008 |
| Category | Hacking/media |
| Founder(s) | xec96 The_Anarchist spiffomatic64 |
| Product(s) | HackThisZine e-zine |
| Affiliated Group(s) | Hackbloc Hacktivist.Net |
| Website(s) | Main Site |
HackThisSite.org, commonly referred to as HTS, is a popular online hacking and security website. The organization is currently the largest online hacking community in the world with a userbase of well over 350,000.[1] It aims to provide users and teams with a way to learn and practice basic and advanced "hacking" skills through a series of challenges, in a safe and legal environment. Per its size, many HTS users have begun their own HTS-based local hacker groups.
HackThisSite involves a small, loose team of developers and moderators who maintain its network of websites, IRC server, and related projects. It produces an e-zine which it releases at various hacker conventions and through its hackbloc portal. Hard copies of the zine are published by Microcosm and Quimbys. It also has a short news/blog section run by devs.
Contents |
[edit] IRC and Forums
HackThisSite is known for its IRC network where many of its users congregate. Within this network, users converse on a plethora of topics ranging from current-day politics to technical issues with programming and Unix-based operating systems. Mostly, the HackThisSite IRC network serves as a social gathering of like-minded people to discuss just about anything. Although there are many channels on the IRC network, the main channel #hackthissite has a +z flag which requires users to connect using SSL. This requirement is for several reasons, including encouraging people in the how and why to learn to use SSL encrypted communications, as well as being an unofficial 'idiot challenge'. Other official channels include #help, and #rootthisbox, for official updates/help on RootThisBox. Because Hackbloc has been inactive for months, its IRC channel has been changed to a current related project, (at #rmyou).
HackThisSite currently has one main set of forums, because of the recent split from its ex-sister site CriticalSecurity.net. The Hackbloc Forums also had many HTS users involved them, however they were recently taken down. Before the split, the CriticalSecurity.net forums had most HTS discussion, specifically related to help with the challenges on the site as well as basic hacking questions. The Hackbloc forums were more for focused hacktivist discussion as well as a place for people to discuss news and plan future projects. Many people criticize the forums as being too 'newbish' compared to IRC, most likely because many new users visit the forums to ask for help with the challenges. Because of the down time, HackThisSite has created their own forums.
[edit] Articles and Text
HTS members contribute original texts to the articles area of the site. This area is broken down into different sections on a range of topics. Some of these sections include Ethics, Tutorials, and Politics. The topics covered in these articles range widely in complexity. Topics range from walkthroughs for the missions provided by HackThisSite, to articles regarding advanced techniques in a plethora of programming languages.
[edit] Mission Challenges
HackThisSite is also host to a series of "missions" aimed at simulating real world hacks. These range from ten basic missions where one attempts to exploit relatively simple server-side scripting errors, to difficult programming and application cracking missions. The missions works on a system of points where users are awarded scores based on their completion of missions. In general, the missions become steadily more difficult as the user advances through a particular mission category.
[edit] Basic and Realistic Challenges
The Web hacking challenges includes ten Basic Web Challenges. Each challenge consists of an authentication page with a password entry box, plus other files which are to be exploited or attacked in order to gain the correct password. Successful authentication to the main challenge page will advance the user to the next challenge. These challenges are typically considered simple and are used as an introduction to hacking. There are sixteen Realistic Missions which attempt to mimic real, moderate to difficult hacking, in real life situations. Each mission is a complete web site featuring multiple pages and scripts. Users must successfully exploit one or more of the web sites pages to gain access to required data or to produce changes.
[edit] "HackThisSite"
Users are encouraged to find vulnerabilities in HackThisSite and report them as Bug Reports. If the vulnerability is significant, then the user may be included in the HTS 'Hall of Fame'.
[edit] Programming Challenges
A Programming Challenges section also exists. This section currently consists of ten challenges charging the user to write a program which will perform a specified function within a certain amount of seconds after activation. These programming challenges range from simple missions such as parsing the contents, to reverse-engineering an encryption algorithm. These help users develop and practice on-the-go programming skills.
[edit] Application Challenges
The goal of application challenges is generally to extract a key from an application, usually involving some form of reverse-engineering. But other challenges involve program manipulation.
[edit] New Challenges
More recently, HTS came out with logic challenges which as moo, HTS's official bot, proclaims "they're not meant as a challenge to overcome like the rest of HTS challenges, they're meant to be overcome by you, and you alone, from solving." Quoting the logic pages: "Please remember that these are logic missions. There will be few if any hints. Don't ask for them please." As of June 2008 there are 28 Steganography challenges.
Also of recent creation are the "extended basic" missions. These are designed to be code review missions where you learn how to read code and look for flaws.
A set of ten easter eggs hidden around HTS were known as the "HTS missions". One of these "missions" was the fake Admin Panel, for example. Developers have recently decided to remove HTS easter eggs: some allowed XSS and SQL exploits and many members submitted false bug reports because of them.
[edit] Steganography Challenges
Steganography challenges have recently been added. As of June 2008 there are 8 Steganography challenges.
[edit] Root This Box
HackThisSite also runs a series of live hacking challenges called RootThisBox.org where individuals and organizations can configure their systems to be used as target boxes. Players can then attempt to gain access to these boxes and defend them from other hackers, similar to past 'king of the hill' styled hacking competitions. The project was redeveloped recently and is now open to registered users.
[edit] Controversy
There has been criticism that HackThisSite's self-description as a "hacker training ground" encourages people to break the law. Many people related to the site state that although some of the skills taught can be used for illegal activities, HTS does not participate in or support such activities. Despite this, several individual members have been arrested and convicted for illegal activity (most notably Jeremy Hammond, founder of HackThisSite[2]). However there is little evidence to suggest that HackThisSite was related.
[edit] phpBB/HowDark incident
In November of 2004 the [defunct] HTS-based HowDark Security Group notified the phpBB Group, makers of the popular phpBB bulletin software, of a serious vulnerability[3][4][5] in the product. The vulnerability was kept under wraps while it was brought to the attention of the phpBB admins, who after reviewing, proceeded to downplay its risks.[6] Unhappy with the Groups' failure to take action, HowDark then published the bug on the bugtraq mailing-list. Malicious users found and exploited the vulnerability which led to the takedown of several phpBB-based bulletin boards and websites. Only then did the admins take notice and release a fix.[7][8] Slowness to patch the vulnerability by end-users led to an implementation of the exploit in the Perl/Santy worm (read full article) which defaced upwards of 40,000 websites and bulletin boards within a few hours of its release.
[edit] Protest Warrior Incident
In early 2006 Jeremy Hammond of HackThisSite was arrested following an FBI investigation into an alleged hacking of conservative political activist group Protest Warrior. The federal government claimed that a select group of HTS hackers gained access to the ProtestWarrior user database, procured user credit-card information and conspired to run scripts that would automatically wire money to a slew of non-profit organizations. The plot was uncovered when a hacker said to have been disgruntled with the progress of the activities turned informant. [9]
[edit] Disputes and Internal Problems
Moderators, Developers, and Ops on HTS and its forums successor Critical Security.NET are arranged in a democratic but highly anarchical fashion. While this structure appears to work most times, when disputes arise, loyalties tend to become very confusing. Subsequently, HTS has a long history of mods, ops, and devs turning darkside and severely impairing or completely taking down the site.[10][11] In one of the most notorious incidents and the last major attack to occur, several blackhat dissidents gained root-level access to the website and proceeded to "rm -rf" the entire site. This led to HTS being down for months. It was later rebuilt as HTS v3.
[edit] See also
[edit] External links
[edit] References
- ^ HackThisSite! Rankings (Log-in Required). HackThisSite.org. Retrieved on 2008-04-12.
- ^ http://www.hackthissite.org/news/view/354
- ^ SQL Injection in phpBT (bug.php) add project. Security Focus (bugtraq archive). Retrieved on 2006-11-28.
- ^ phpBB Code EXEC (v2.0.10). Security Focus (bugtraq archive). Retrieved on 2006-11-28.
- ^ SQL Injection in phpBT (bug.php). Security Focus (bugtraq archive). Retrieved on 2006-11-28.
- ^ howdark.com "exploits". phpBB Group. Retrieved on 2006-11-28.
- ^ howdark.com exploits - follow up. phpBB Group. Retrieved on 2006-11-28.
- ^ phpBB 2.0.11 released - Critical update. phpBB Group. Retrieved on 2006-11-28.
- ^ Austin group complains of hack attack. The Austin American-Statesman. Retrieved on 2007-02-25.
- ^ Forums Upgrade 2.1.3 - Take 2, Redone. CriticalSecurity.NET. Retrieved on 2006-11-27.
- ^ Rollback, Database restoration. CriticalSecurity.NET. Retrieved on 2006-11-27.
