Skip to content

README.md

Latest commit

 

History

History
137 lines (103 loc) · 5.29 KB

README.md

File metadata and controls

137 lines (103 loc) · 5.29 KB
Raw

Progressive Coding Challenge System

A security analysis coding challenge designed to test candidates' reverse engineering and vulnerability exploitation skills. This system presents itself as progressive programming problems but is intentionally designed to be "broken" through security analysis rather than conventional problem-solving.

🎯 Quick Start for Recruiters

Ready to use immediately:

  1. Download package.zip from this repository
  2. Send it to your candidate with these instructions:
    • "Analyze this security challenge system"
    • "Your goal is to decrypt tasks 2 and 3"
    • "Document your approach and findings"
  3. Evaluate their security analysis methodology and results

No setup required - the package is self-contained and ready for distribution.

🏗️ System Architecture

This repository contains a two-part challenge system:

Creator Tools (creator/)

  • Purpose: Generate and maintain the challenge environment
  • Key File: creator/README.md - Complete system documentation
  • Exploit: creator/exploit.py - Working solution demonstrating the intended attack

Candidate Package (package/)

  • Purpose: The challenge environment candidates receive
  • Key File: package/README.md - Instructions for candidates
  • Distribution: package.zip - Ready-to-send candidate package (26.5KB)

🔍 How It Works

The Challenge

Candidates receive what appears to be 3 progressive coding problems:

  1. Task 1: Array sum (visible)
  2. Task 2: Find missing number (encrypted)
  3. Task 3: Longest increasing subsequence (encrypted)

The Twist

The system contains intentional security vulnerabilities that make brute force attacks more effective than solving the problems:

  • Exposed key derivation algorithm in the validation system
  • Small output search spaces (typically 1-20 values)
  • Red herrings in validation data with incorrect expected outputs
  • No rate limiting or attack detection

Success Criteria

Strong candidates will:

  • Analyze the validation system code
  • Discover the key derivation vulnerability
  • Implement brute force attacks on encrypted test outputs
  • Use discovered outputs to generate decryption keys
  • Ignore misleading documentation and verify through code

📋 What Makes This Educational

Security Principles Taught

  • Don't trust surface information - Comments and docs can be wrong
  • Code behavior supersedes documentation - Verify empirically
  • Small search spaces enable brute force attacks
  • System analysis beats conventional problem-solving

Red Herring Examples

The validation data contains intentional misdirection:

  • Shows orig_expected_output: 7 but encrypts with 9
  • Shows orig_expected_output: 3 but encrypts with 15

This forces candidates to implement proper attacks rather than trusting comments.

📚 Documentation Guide

For Understanding the System

  1. Start here: CLAUDE.md - Comprehensive technical documentation
  2. Creator perspective: creator/README.md - How to generate and modify challenges
  3. Candidate perspective: package/README.md - What candidates see

For Testing and Development

  • creator/exploit.py - Working exploit demonstrating the attack
  • creator/create_challenge.py - Regenerate the candidate package
  • Test the system by copying the exploit to the package directory

🚀 Ready for Production

Immediate Use

  • Package: package.zip is ready for candidate distribution
  • Testing: Exploit solution verified to work on all tasks
  • Documentation: Complete system documentation provided

Maintenance

  • Modify challenges: Edit creator/templates/ and regenerate
  • Update test cases: Modify creator/templates/given_expected.json
  • Keep vulnerabilities: They're educational features, not bugs

🎖️ Evaluation Guidelines

Strong Candidate Indicators

  • Security mindset: Looked for vulnerabilities instead of solving problems
  • Code analysis skills: Understood the validation system architecture
  • Implementation ability: Created working brute force attacks
  • Clear documentation: Explained methodology and findings well

Red Flags

  • Tried to solve programming problems conventionally
  • Trusted misleading comments without verification
  • Couldn't identify the core encryption vulnerability
  • Poor explanation of approach

🔧 Technical Details

Dependencies

  • Python 3.11+
  • cryptography>=41.0.0 (included in package)
  • No additional setup required for candidates

Attack Success Rate

  • Task 1: 100% success (4/4 test cases)
  • Task 2: 100% success (4/4 test cases)
  • Task 3: 100% success (4/4 test cases)
  • Total time: Typically under 30 seconds

Vulnerability Type

Cryptographic implementation flaw: Encryption keys derived directly from easily guessable outputs, making brute force attacks practical and educational.

📖 Quick Reference

Need Look At
System overview This README
Technical details CLAUDE.md
Creating challenges creator/README.md
Candidate instructions package/README.md
Working exploit creator/exploit.py
Ready package package.zip

This system is production-ready and thoroughly tested. Send package.zip to candidates immediately.