Posted by admin on Jul 27, 2010 in Today's News
This is the total walk through and it wasn’t easy.
(1) first go to the main challenge page and then grab the cypher
Now from looking at the text you can see the obvious thing and that is it looks like a base64 encode. This can be seen in the fact that base64 encodes will end in an equal sign if the total bits of data cannot be equally converted from 34 bits to 32 bits.
So we grab the text and run it through a base64 converter.
This then give us a raw .bin file
I recommend using a Hex file viewer, however I used EditPlus Text Editor as it was closer to hand.
I saw what looked like a file header
it had EXIF (which I know to usually mean camera files).
and more importantly I also saw JFIF which is the JPEG File Interchange Format (JFIF)
From here I guessed that I would firstly grab EXIF Tool to decode and potential EXIF data as I thought it would have a message hidden in the camera name or something similar.
There was no interesting info so I just changed the file extension to JPG and thought I would check what I had and then I saw the XKCD comic.
Personally my fave one is
Exploits of a Mum
however you one is
Total Time Start to Finish = 12 minutes.
I was informed this morning that I was not quite there. I got a tweet from@Cyberchallenge stating that if I sent my email about the cipher to a certain email address then I had got it wrong.
So I thought back to the drawing board and lets look again at the image. Firstly look in a Hex Editor and I saw what I thought was a phone number. 01444.’9=82<.342 = 01444-982-342 well it would seem that I was on the wrong track as that number is not in service.
So I then loaded up another EXIF viewer and again nothing.
I then looked at the original image on the XKCS site and I noticed that it was a PNG and not a JPG, if it was just a case of getting the normal image when why change its extension and also why all the extra white space.
I then carried out a quick check on TINEYE. (which is a great tool). however this also gave nothing except it did let me compare other images out there against the one I had earlier decoded and my image was the only one with the morse code around the edge.
I then looked a little closer and thought it was binary. Also like the pits used when burning the lead in section of a protected DVD / CD.
I then read up on hiding binary in images. – Suggested reads are.
I then loaded up Paint.Net and began to play.
Firstly looking at the Histograms. If you move them around you’ll see that the boarder is a different layer than the rest of the image.
This then confirmed to me it was binary and all I had to do was to try and count the pixels to see where a binary code started and ended.
Paint.Net has a Pixel grid so I loaded this up and began to count.
White Pixels = Zero and Black Pixels = One
010000110111100101110010011011100110011001110010001000000111001101100010011110010111100101100010 and so on and so on
I then grabbed the text and loaded that into a binary to string converter and this gave me garbled text. = Cyrnfr sbyyb in the example above.
I then used google to check the text and I found only one result and it was 2007 on a site called Perl Monks
This thread has some one attempting to decode a piece of text and it has one of our words. = Cyrnfr
It was suggested Rotr13, so again I read up on Rotr13 and its a simple encryption where the letters are rotated 13 chars . So this gave me Please follo (looks like please follow)
I now knew that i was right about the binary and all I had to do is to count the whole image and then rotate each of the letter 13 places.
This then gave me
Please follow this link: https://cybersecuritychallenge.org.uk/834jtp.html https://cybersecuritychallenge.org.uk/834jtp.html
Game Over - ** at least that’s what I thought **
I visited the URL and got a new code !! – this one although easier actually took longer as it was custom code and I didn’t bother to code a parser (which I now wish I had done) so I had to decode it all by hand.
The part that gave the code away was that I figured it would start with a well done message so I counted the chars and looked for well done or other words like congratulations. (it was all hex so it wasn’t too hard) I was right about the congrats message plus the fact that the spaces were easy to guess. I still ended up with a few question marks but I still got to the bottom of it.
see below for the key and the cracked code.
04 = space
0D = H
0E = P
08 = a
26 = i?
2B = y?
2C = A
2D = I
2F = Y
4C = B
4E = R
4F = Z
52 = ‘
66 = e?
68 = C
6c = c
6D = k
6E = s
8C = D
8D = L
8E = T
AC = E
AD = M
AE = U
C5 = fullstop
CC = F
CD = N
CE = V
D2 = A
ea = W
EC = G
ED = O
EE = w
45 = ?
65 = ?
46 = ?
c6 = ?
A1 = ?
41 = ?
congratulations a youve found and completed the ???? challenge.
your pin code is cyber?security?challenge???????????. ?????lease
email this code to our team to media@Cybersecuritychallenge.org.uk
F YOU’re The First Person to do so and can prove you meet the eligibility
criteria ? ? British citizen currently resident in the ??? we will be in
touch to advise how to claim your prize.
Well done and good luck in the Cyber Security Challenge Competitions taking
place throughout the rest of the year.
Posted by admin on Jul 22, 2010 in Interviews
Landing a Dream Job
I’ve recently been interviewing for a Lead Tester to join my Team and I’ve been a little dismayed about how unprepared some of the candidates are for interviews be they telephone interviews or face-to-face interviews.
So I’ve decided to put together a few little hints and tips to hopefully help candidates in the job market land their dream job.
- Firstly make sure you customise your CV for each job you apply for. Never send a generic CV to a company and expect it to be good enough. Look through the job specification and list of requirements and tailor your CV to match what they are looking for. Go through your past roles and pick out the parts of the role that matches what you think match the Job Specification.
- Now lets take a look at the cover letter. They do have a bearing on if you will get noticed and virtually all potential employers will look at your cover letter before they look at the CV so make it count. It needs to be about you on a personal level as the CV will tell them all they need to know on a professional level. Hopefully you’ll be like myself and have a real passion for testing if that’s the case then you need to make sure that it comes across in the cover letter.
- Do your homework on the person who you be looking at your details and also the department where you would like to work for. Doing your homework on the company alone is not enough. Anyone can visit the company website and read the blurb however you need the edge so research as much as possible and then use all of that research to let them know you’ve taken the time and effort to find out more than the average Joe about what they do.
- If the Company in question has a Careers or Job offers page or sub site then make sure you register and upload your details before sending in your CV. Not only does it show your interested, it will also show them that your serious about working for them and you are not just sending in your details to every company that comes along.
- If you go to a Careers Fair make sure you have your customises CV with you. It should be no more than 1 page of A-4 you may use both sides if you must however try and bullet point to one side. This CV version is just for the company staff member or Test Manager to see if they think they would like to know more.
- At a careers fair tell them about you and not about your CV they can read the CV however what your CV will not say is what type of person you are and what things excite you.
- Make your CV results oriented. It will mean more if you state I did this and the positive result for the business was this, over I this this.
- Please show some emotion. You may not believe it, but it’s hard work interviewing all day. It makes it much easier on the both sides if the interviewer can see that the interviewee is excited about coming to work for their company.
- Remember not to be so nervous, I always tell interviewees that an interview is a two way process and that they should be interviewing us to see if we match up to their ideals as well as us interviewing them to see if I think that they would be a good fit into my Testing Team.
- Keep a note of who you have applied to and if you had a Telephone interview then during the conversation make sure you note down any keyword which you think may be relevant. You can relate these back to the interviewers in a face to face interview.
- Look into Forer Effect Statements / NLP / Confirmation Bias and Subjective Statements. However before you attempt to use any of these techniques make sure you know what your doing as they can work against you if you do not know how to use them correctly. Once mastered you’ll find them indispensable not only in interviews, they can help out also in every day business.
- Look for yourself in a Search Engine and make sure that what you find is suitable. This means that if a potential employer Googled you, would they get a positive result or not?.
- Salery Negotiation – Make sure you know how much it would take for you to leave the place you are currently working and if asked never answer with an “Urmmm” or “I’m looking for something around” . Let them know how much you would like and have a reason why you think that you are worth that amount.
- The most import and last one is BE HONEST.
Posted by admin on Jul 20, 2010 in code
How to fix the-selected-file-was-generated-by-mysqldump-and-cannot-be-restored-by-this-application error.
This post is here more of a reminder to myself. However I’m hoping that others will find it useful also.
I was testing out a piece of code which needed a new MYSQL InnoDB restored.
I had a slight issue ad when I attempted to restore the DB via the MySQL Administrator tool I got the following error message.
“The selected file was generated by mysqldump and cannot be restored by this application.”
This error is given usually when the Backup was taken via a batch job (or just a user who is using the command line).
Because of this the only way to restore the DB is again via the command line.
So carry out the following steps.
Firstly make sure that your .SQL backup file has the Database at the top
so it should read
find the MySQL.exe file, (this will usually be stored in the installation bin folder)
then run the following using the command line.
C:\Program Files\MySQL\MySQL Server 5.0\bin>mysql.exe -uusername -ppassword < “C:\DB Backups\nameofbackupfile.sql”
The -uusername should be something like -uroot
and the -ppassword should be something like -psecret
Hope it helps.
Posted by admin on Jul 5, 2010 in code
Visual Studio Webtest Logo
I use Visual Studio Team Testers Edition everyday at work and one of the things that seemed really strange to me was that Microsoft had missed so many tricks when they decided to release it.
Maybe they just decided to build in reasons for users to upgrade, knowing that there will always be another version of VSTS around the corner.
One of the things which is sorely missing is the ability to verify HTML source code against a datasource. Sure you can load a data source and then verify what is returned on the page when that row of the data-source is called however there is no functionality to check that the value of the row that you have submitted is returned somewhere in the HTML source (known as the response in VSTS).
So as per usual when you need something doing then, do it yourself, and hence I wrote a small piece of code that looks at the source code and then checks the value of the datasource row to make sure that the item you are submitting is returned in the HTML response.
All the data is dynamic from your source so you can’t just hard code validation rules, as there could be thousands of rows.
For an example take a Google search test. Imagine I want to check that my datasource of 10,000 records is retuned on every response.
So if I search for “System Testers” as a parameter value
“Parameter Name = q” and
“Parameter Value = Google DataSource.Directory_03062010#csv.SearchParams”
In the above QueryString Parameter you can see
the Datasource is called “Google DataSource”
the Actual FileName is “Directory_03062010″ (and it’s a CSV file)
the Column name is SearchParams
I’ve commented my code to make it easier to understand however if you need any help just ask.
‘Author = Martin Hall
‘Purpose = To load text from a DataSource and then to compare that text
‘ against the source code on the page your testing.
‘Date = 07th June 2010
Public Class RegressionAllHeadingLocationsRule
‘ Specify a name for use in the user interface.
‘ The user sees this name in the Add Validation dialog box.
Public Overrides ReadOnly Property RuleName() As String
‘ Specify a description for use in the user interface.
‘ The user sees this description in the Add Validation dialog box.
Public Overrides ReadOnly Property RuleDescription() As String
Return “This should Compare text from a datasource parameter in a CSV file against the page sourcecode.”
‘ The name of the expected string
Private ExpectedStringValue As String
Public Property ExpectedString() As String
Set(ByVal value As String)
ExpectedStringValue = value
‘ Validate is called with the test case Context and the request context.
‘ These allow the rule to examine both the request and the response.
Public Overrides Sub Validate(ByVal sender As Object, ByVal e As ValidationEventArgs)
Dim result2 As String
‘we only want request2 to match the source code on the returned web page.
‘the SourceCode could be different on the other pages.
result2 = (e.WebTest.Context(“Google DataSource.Directory_03062010#csv.SearchParams”).ToString())
‘This should check the response for text
‘The text in question is the ParamValue we are supplying as new fake
‘parameter name and value
If e.Response.BodyString.ToLower.Contains(result2) = False Then
e.IsValid = False
e.Message = (“fail – - “) & result2
If e.Response.BodyString.ToLower.Contains(result2) Then
e.IsValid = True
e.Message = (“pass – - “) & result2
Catch ex As Exception
The above script is in Visual Basic.Net and it should work for you and if you need any help in how to install and run it then either send an email or reply in the comments.
One last thing to mention is that the values from the data source are loaded in a fake Parameter Name (Just make one up) which will be ignored by the Website however it will show as a Context Name in the Visual Studio Web Test, so we are really just comparing two Context Names