HomeNewsFrench student cracks code for UT summer school CuriousU

French student cracks code for UT summer school CuriousU

CuriousU challenged students to hack or puzzle their way to a code that could then be used to sign up for summer school free of charge. The ‘hack the discount code’ challenge has now been completed, and the winner has been announced. A French student, Julien Robert, is the lucky winner of CuriousU. He won his prize by cracking the code. 

There were two ways to get a code. The first was by ‘brute force hacking’: in short, trying all possible combinations of the available characters to try and find the right code. The second way was by solving a puzzle hidden on the CuriousU-website; several students found the puzzle and tried their hand at it.

How was Julien able to crack the code? 

- I have firstly looked on the contest page and created a dictionary with "crunch" thanks to the hints: start with an X, 6 characters long. I was going to try to bruteforce the password. I have, however, assumed (due to the high number of possibilities) to try uppercase only which led us to 60 466 176 possibilities brute-forcing

 - Once I was on the validator page I've seen that there was only a html form so I have looked at the source code to figure out how does it work. Weirdly there was an <html></html> tag inside the page. I tried to figure out how the code was checked and, thanks to the Generate () function and the name of a JavaScript file (bcrypt.js), I have deduced that the hash variable was the bCrypt hash, was the hash of the code to be found.

 - I have chosen to use HashCat to crack this hash because it is the "World's fastest and most advanced GPGPU-based password recovery utility" (and way faster than John the Ripper). However, I was brute-forcing only at 47 words/s (with an i7 6500U).

 - Finally, thanks to another hint ("perhaps you might want to try a B as the last character") the number of possibilities decreased a lot which allowed me to crack the password in less than a day.

Anyway, thank you for that! I am so lucky to do a CuriousU then a Kick-in and finally a Bachelor at the University of Twente!

Julien Robert will soon be a student at UT: he will start his bachelor degree in Technical Computer Science after the kick-in in August 2016.

CuriousU

This festival-style summer school will be held for the second time in August, from the 14th until the 23rd. For more information, please go to www.utwente.nl/curiousu.

drs. J.G.M. van den Elshout (Janneke)
Press relations (available Mon-Fri)