SecNews publishes the solution of the Pwnzilla competition , which was organized in collaboration with the University of Piraeus and invited security researchers, security enthusiasts, and anyone who wished to test their knowledge in hacking systems through Web applications.
The competition was admittedly very difficult and it was not easy to identify the SQL Injection vulnerability using well-known tools and automated tools. This did not prevent over 1000 researchers, individual users , as well as security managers from banks, telecommunications operators and companies from taking an active part.
As we mentioned in a previous article , Greek researcher and penetration tester, Georgios Spanos, shared with the editorial team of SecNews and the University of Piraeus, step-by-step, the most comprehensive solution to the challenge.
It is worth noting that last year, Georgios Spanos had also found the solution to the first Pwnzilla, but later than that of Evangelos Mourikis.
We publish the most detailed solution exactly as Mr. Spanos sent it to us below:
In fact, the penetration tester even created his own appropriate scripts to conduct his test quickly and bypass any security measures that had been placed in the code of the exposed application!
In addition to Mr. Georgios Spanos, who impressed everyone with his high level of knowledge, it is worth expressing our congratulations to the Department of Digital Systems of the University of Piraeusand specifically to the Assistant Professor of the University of Piraeus, Mr. Christos Xenakis as the scientific supervisor of Pwnzilla , as well as to the technical supervisor of the PhD Candidate of the Department of Digital Systems, Mr.Anastasios Stasinopoulos, who undertook the technical implementation of the exercise.
Finally, let us remind you that major sponsors of the PwnZilla competition for 2015 were the Hosting company Host1Plus, which offers the gift for the grand winner, as well as the technology website iGuRu as a communication sponsor.
Soon there will be new competitions that will highlight new talents in information systems security and identifying weaknesses in real systems. The SecNews is trying, in consultation with sponsors, financial institutions and telecommunications providers who have expressed interest in holding new competitions to highlight new talents, to achieve the payment of monetary prizes corresponding to the Bug bounty provided by companies abroad.
So stay tuned for more information regarding the award ceremony.
Thank you to all participants!
