OpenHack 4 (look back): Oracle down 2, Microsoft 0
eWeek | at | by Mike
I found this interesting article from the OpenHack 4 contest which was held 4 months ago, but I haven't posted anything about it back than, although the results are most interesting... Both Microsoft and Oracle were ask to developed eCommerce web applications for the hackers at large to attack. Microsoft off course was running on Windows 2000 Advanced Server with .NET Framework for ASP.NET and Oracle was running Red Hat Linux Advanced Server 2.1. The result of the competition were 46,800 hacks attempted, 2 succeeded on Oracle, were 82,500 hacks attempted, but 0 succeeded on Microsoft platform. Interesting...
On the very first day of the test, Jeremy Poteet, chief technology officer at IT consultancy Technology Partners Inc., in Chesterfield, Mo., discovered two places in the Oracle OpenHack test application where he could manipulate the application into sending arbitrary (and possibly malicious) JavaScript code back to a user.
Poteet describes how a functionality bug in the application tipped him off to a possible weakness in the code that he was later able to exploit. He was also able to perform a second cross-site scripting attack by manipulating a URL field to take advantage of the way the application checked unusual data types.
In both cases, Poteet was able to discover exactly where several undiscovered bugs lay in the application simply by careful observation combined with his own experience. He was also able to do this without access to source code.