HackThisSite

Template:Infobox computer underground

HackThisSite.org, commonly referred to as HTS, is a popular online hacking and security website. The organization is currently the largest online hacking community in the world^{[citation needed]} with a userbase of well over 190,000.^[1] It aims to provide users and teams with a way to learn and practice basic and advanced "hacking" skills through a series of challenges, in a safe and legal environment. Per its size, many HTS users have begun their own HTS-based local hacker groups.

HackThisSite involves a small, loose team of developers and moderators who maintain its network of websites, IRC server, and related projects. It produces an e-zine which it releases at various hacker conventions and through its hackbloc portal. Hard copies of the zine are published by Microcosm and Quimbys. It also has a short news/blog section run by devs.

HackThisSite's website, as well as HackThisSite's forum (criticalsecurity.net) and rootthisbox, are all currently down for more than 3 days, reasons are unknown.

History

HackThisSite was originally founded in 2002 when it was then known as Hulla-ballo. It consisted originally of a series of small hacking challenges (hacker wargames) and limited users before it moved to a dedicated server run by C aka BIG a new co-founder in 2003. The site then took on the now famous domain name hackthissite.org which lead to its rapid rise in popularity and subsequent expansion as well as the increased growth of its user base. This new incarnation was known as HTSv2 and proved to be the most widely popular and active version of the site.

IRC and Forums

HackThisSite is known for its IRC network where many of its users congregate. Within this network, users converse on a plethora of topics ranging from current-day politics to technical issues with programming and Unix-based operating systems. Mostly, the HackThisSite IRC network serves as a social gathering of like-minded people to discuss just about anything. Although there are many channels on the IRC network, the main channel #hackthissite has a +z flag which requires users to connect using SSL. This requirement is for several reasons, including encouraging people in the how and why to learn to use SSL encrypted communications, as well as being an unofficial 'idiot challenge'. Other official channels include #help, along with #criticalsecurity for forums members (though anyone can be there). Hackbloc also has its own IRC channel (at #hackbloc)

File:Hackbloc hacking ninja ecnp.png

De facto motto of the Hackbloc Collective

HackThisSite also has two sets of forums, the main one being at CriticalSecurity.net and the Hackbloc Forums. The CriticalSecurity.net forums has most HTS discussion, specifically related to help with the challenges on the site as well as basic hacking questions. The Hackbloc forums are more for focused hacktivist discussion as well as a place for people to discuss news and plan future projects. Many people criticize the forums as being too 'newbish' compared to IRC, most likely because many new users visit the forums to ask for help with the challenges.

Recently IRC has become infested with forum users as the installation of IRC clients with SSL has become easier.

Articles and Text

HTS members contribute original texts to the articles area of the site. This area is broken down into different sections on a range of topics. Some of these sections include Ethics, Tutorials, and Politics. Most of these were aimed to provide newcomers with the basic skills to navigate the community. HackThisSite had one of the largest collection of texts on various hacking and related subjects^{[citation needed]}. These texts were almost entirely user-submitted and were linked directly to HTS user accounts. Following the major revision to HTSv3, the inability to accurately attribute author to article resulted in the loss of this archive, a move from which its Article section has yet to recover.

Mission Challenges

HackThisSite is also host to a series of "missions" aimed at simulating real world hacks. These range from ten basic missions where one attempts to exploit relatively simple server-side scripting errors, to difficult encryption and application cracking missions. The missions works on a system of points where users are awarded scores based on their completion of missions. In general, the missions become steadily more difficult as the user advances through a particular mission category.

Basic and Realistic Challenges

The Web hacking challenges includes ten Basic Web Challenges. Each challenge consists of an authentication page with a password entry box, plus other files which are to be exploited or attacked in order to gain the correct password. Successful authentication to the main challenge page will advance the user to the next challenge. These challenges are typically considered simple and are used as an introduction to hacking. There are sixteen Realistic Missions which attempt to mimic real, moderate to difficult hacking, in real life situations. Each mission is a complete web site featuring multiple pages and scripts. Users must successfully exploit one or more of the web sites pages to gain access to required data or to produce changes.

Encryption Challenges

Encryption challenges remain open for a limited period of time during which time users may attempt to decrypt a given code. Points are awarded to a limited number of users who complete each task before the deadline.

Encryption challenges are history for now, but future updates may bring them back.

Programming Challenges

A Programming Challenges section also exists. This section currently consists of nine challenges charging the user to write a program which will perform a specified function within a certain amount of seconds after activation. These programming challenges range from simple missions such as parsing an XML file, and graphically displaying the contents, to reverse-engineering an encryption algorithm. These help users develop and practice on-the-go programming skills.

Application Challenges

The goal of application challenges is generally to extract a key from an application, usually involving some form of reverse-engineering. But other challenges involve program manipulation.

Root This Box

HackThisSite also ran a series of live hacking challenges called RootThisBox.org where people configured their systems to be used as target boxes. Players then attempted to gain access to these boxes and defend them from other hackers, similar to past 'king of the hill' styled hacking competitions. The project is still in its developmental stage but open to registration.

Controversy

There has been criticism that HackThisSite's self-description as a "hacker training ground" encourages people to break the law. Many people related to the site state that although some of the skills taught can be used for illegal activities, HTS does not participate in or support such activities. Despite this, several individual members have been arrested and convicted for illegal activity (most notably Jeremy Hammond, founder of HackThisSite). However there is little evidence to suggest that HackThisSite was related.

phpBB/HowDark incident

In November of 2004 the [defunct] HTS-based HowDark Security Group, co-founded by former staff-member, Jessica Soules, notified the phpBB Group, makers of the popular phpBB bulletin software, of a serious vulnerability^[2]^[3]^[4] in the product. The vulnerability was kept under wraps while it was brought to the attention of the phpBB admins, who after reviewing, proceeded to downplay its risks.^[5] Unhappy with the Groups' failure to take action, HowDark then published the bug on the bugtraq mailing-list. Malicious users found and exploited the vulnerability which led to the takedown of several phpBB-based bulletin boards and websites. Only then did the admins take notice and release a fix.^[6]^[7] Slowness to patch the vulnerability by end-users led to an implementation of the exploit in the Perl/Santy worm (read full article) which defaced upwards of 40,000 websites and bulletin boards within a few hours of its release.

Following the negative fallout and controversy over her handling of the case, Jessica resigned from the hacking and "security scene".^[8]

Protest Warrior Incident

In early 2006 Jeremy Hammond of HackThisSite was arrested following an FBI investigation into an alleged hacking of conservative political activist group Protest Warrior. The federal government claimed that a select group of HTS hackers gained access to the ProtestWarrior user database, procured user credit-card information and conspired to run scripts that would automatically wire money to a slew of non-profit organizations. The plot was uncovered when a hacker said to have been disgruntled with the progress of the activities turned informant. ^[9]

Disputes and Internal Problems

Moderators, Developers, and Ops on HTS and its forums successor Critical Security.NET are arranged in a democratic but highly anarchical fashion. While this structure appears to work most times, when disputes arise, loyalties tend to become very confusing. Subsequently, HTS has a long history of mods, ops, and devs turning darkside and severely impairing or completely taking down the site.^[10]^[11] In one of the most notorious incidents and the last major attack to occur, several blackhat dissidents gained root-level access to the website and proceeded to "rm -rf" the entire site.^[12] This led to HTS being down for months as it was rebuilt as HTSv3.