A security analysis coding challenge designed to test candidates' reverse engineering and vulnerability exploitation skills. This system presents itself as progressive programming problems but is intentionally designed to be "broken" through security analysis rather than conventional problem-solving.
Ready to use immediately:
- Download
package.zipfrom this repository - Send it to your candidate with these instructions:
- "Analyze this security challenge system"
- "Your goal is to decrypt tasks 2 and 3"
- "Document your approach and findings"
- Evaluate their security analysis methodology and results
No setup required - the package is self-contained and ready for distribution.
This repository contains a two-part challenge system:
- Purpose: Generate and maintain the challenge environment
- Key File:
creator/README.md- Complete system documentation - Exploit:
creator/exploit.py- Working solution demonstrating the intended attack
- Purpose: The challenge environment candidates receive
- Key File:
package/README.md- Instructions for candidates - Distribution:
package.zip- Ready-to-send candidate package (26.5KB)
Candidates receive what appears to be 3 progressive coding problems:
- Task 1: Array sum (visible)
- Task 2: Find missing number (encrypted)
- Task 3: Longest increasing subsequence (encrypted)
The system contains intentional security vulnerabilities that make brute force attacks more effective than solving the problems:
- Exposed key derivation algorithm in the validation system
- Small output search spaces (typically 1-20 values)
- Red herrings in validation data with incorrect expected outputs
- No rate limiting or attack detection
Strong candidates will:
- Analyze the validation system code
- Discover the key derivation vulnerability
- Implement brute force attacks on encrypted test outputs
- Use discovered outputs to generate decryption keys
- Ignore misleading documentation and verify through code
- Don't trust surface information - Comments and docs can be wrong
- Code behavior supersedes documentation - Verify empirically
- Small search spaces enable brute force attacks
- System analysis beats conventional problem-solving
The validation data contains intentional misdirection:
- Shows
orig_expected_output: 7but encrypts with9 - Shows
orig_expected_output: 3but encrypts with15
This forces candidates to implement proper attacks rather than trusting comments.
- Start here:
CLAUDE.md- Comprehensive technical documentation - Creator perspective:
creator/README.md- How to generate and modify challenges - Candidate perspective:
package/README.md- What candidates see
creator/exploit.py- Working exploit demonstrating the attackcreator/create_challenge.py- Regenerate the candidate package- Test the system by copying the exploit to the package directory
- Package:
package.zipis ready for candidate distribution - Testing: Exploit solution verified to work on all tasks
- Documentation: Complete system documentation provided
- Modify challenges: Edit
creator/templates/and regenerate - Update test cases: Modify
creator/templates/given_expected.json - Keep vulnerabilities: They're educational features, not bugs
- Security mindset: Looked for vulnerabilities instead of solving problems
- Code analysis skills: Understood the validation system architecture
- Implementation ability: Created working brute force attacks
- Clear documentation: Explained methodology and findings well
- Tried to solve programming problems conventionally
- Trusted misleading comments without verification
- Couldn't identify the core encryption vulnerability
- Poor explanation of approach
- Python 3.11+
cryptography>=41.0.0(included in package)- No additional setup required for candidates
- Task 1: 100% success (4/4 test cases)
- Task 2: 100% success (4/4 test cases)
- Task 3: 100% success (4/4 test cases)
- Total time: Typically under 30 seconds
Cryptographic implementation flaw: Encryption keys derived directly from easily guessable outputs, making brute force attacks practical and educational.
| Need | Look At |
|---|---|
| System overview | This README |
| Technical details | CLAUDE.md |
| Creating challenges | creator/README.md |
| Candidate instructions | package/README.md |
| Working exploit | creator/exploit.py |
| Ready package | package.zip |
This system is production-ready and thoroughly tested. Send package.zip to candidates immediately.