Professional Documents
Culture Documents
Hacme Casino User Guide
Hacme Casino User Guide
http://slidepdf.com/reader/full/ib-hacme-casino-user-guide 1/31
7/21/2019 IB Hacme Casino User Guide
ntroduction
Foundstone Hacme Casino™ is a learning platform for secure software development and is
targeted at software developers, application penetration testers, software architects, and anyone
with an interest in application security. Hacme Casino is an extensible online casino platform and
demonstrates the security problems that can potentially arise in these applications.
Hacme Casino is built using Ruby on Rails. Ruby on Rails (sometimes called RoR or Rails is an
open!source web application framewor", built entirely in Ruby, which emphasi#es adherence to
the $odel!%iew!Controller($%C architecture and a principle of &R' (&ont Repeat 'ourself.
Hacme Casino utili#es some of the basic and some of the more advanced features of the Ruby on
Rails framewor". )t is meant to be representative of a typical Rails application, using standard
features such as *ctiveRecord. )t also includes functionality which incorporates *+*!style
interaction, which is ba"ed into the Rails framewor", and harnesses the -oginenerator, which is
supplied by the Rails community for creating code to perform authentication in an application.
$any of the vulnerabilities in Hacme Casino cannot be detected automatically / they must be
assessed by operate
applications a humanin.
who has an understanding of the business context online gaming
Hacme Casino is offered with the full source code under the *pache 0oftware Foundation -icense
%ersion 1.2. 3eing fully open!source allows Hacme Casino to be sub4ect to an unbiased peer
review process, which will be used to constantly improve the 5uality and accuracy of the
application.
ww w.fo u n d st o n e. c o m © 20 0 6 F o u n d s t o n e , In c . Al l Ri g h t s Res er v e d -2
http://slidepdf.com/reader/full/ib-hacme-casino-user-guide 2/31
7/21/2019 IB Hacme Casino User Guide
(rere)uisites
• ;he 7indows 3inary )nstaller only supports $icrosoft 7indows 12228<. =sers of other
operating systems can install Hacme 3oo"s by building the source code.
• ;he 7>3ric" server is distributed with Hacme Casino and runs by default on port ?222.
<lease ensure that no other applications are using this port.
&indows *inar% nstallation
• &ownload the Hacme Casino executable installer from
http688www.foundstone.com8resources8freetools.htm.
o &ouble!clic" on HacmeCasino0etup.exe.
o Figure 1 displays the license text, which is based on the *pache 1.2 -icense. 'ou
must agree to the terms of the license by clic"ing the I Agree button in order to
continue installation.
o Figure 2 displays a security warning from Foundstone regarding Hacme Casino.
Clic" Next if you understand the warning and choose to proceed.
o Figure 3 displays the desired installation folder. 'ou can edit the directory path or
leave
Figure
o
the default
4 is setting.
the last dialog.Clic"
+ustInstall to begin
clic" Close . installation of Hacme Casino.
• :nce installation is complete, you must start the Hacme Casino server (7>3Ric"6
0tart <rograms Foundstone Free ;ools Hacme Casino 0erver 0;*R;
• 7ait until the 7>3ric" server starts (should loo" li"e Figure 5
• ;o view Hacme Casino in Firefox @ (should loo" li"e Figure 66
0tart <rograms Foundstone Free ;ools Hacme 3oo"s
• =ninstalling Hacme 3oo"s is very easy6 there is an uninstall program available from the 0tart
$enu. Hacme 3oo"s may also be uninstalled using the *dd8Remove <rograms Control <anel.
@
Hint6 Foundstone recommends using Firefox or other standards!compliant browsers to view
Hacme Casino, as using )nternet >xplorer causes some display bugs.
ww w.fo u n d st o n e. c o m © 20 0 6 F o u n d s t o n e , In c . Al l Ri g h t s Res er v e d -3
http://slidepdf.com/reader/full/ib-hacme-casino-user-guide 3/31
7/21/2019 IB Hacme Casino User Guide
Figure 1
Figure 2
ww w.fo u n d st o n e. c o m © 20 0 6 F o u n d s t o n e , In c . Al l Ri g h t s Res er v e d -4
http://slidepdf.com/reader/full/ib-hacme-casino-user-guide 4/31
7/21/2019 IB Hacme Casino User Guide
Figure 3
Figure 4
ww w.fo u n d st o n e. c o m © 20 0 6 F o u n d s t o n e , In c . Al l Ri g h t s Res er v e d -5
http://slidepdf.com/reader/full/ib-hacme-casino-user-guide 5/31
7/21/2019 IB Hacme Casino User Guide
Figure 5
Figure 6
ww w.fo u n d st o n e. c o m © 20 0 6 F o u n d s t o n e , In c . Al l Ri g h t s Res er v e d -6
http://slidepdf.com/reader/full/ib-hacme-casino-user-guide 6/31
7/21/2019 IB Hacme Casino User Guide
+earning Guide
;here are two fundamental approaches to web application security testing6
7hitebox testing is always going to produce a more accurate result based on the fact that the
source code is available. ;esters are able to review data flows through the application from the
presentation tier all the way through to the data access tier. ;herefore, the results yielded from
whitebox testing are going to be far more precise than the results gathered from blac"box
testing.
For example, if there is a 0B- in4ection vulnerability discovered in 2 different areas of a web
application, a blac"box pen!tester will identify 2 vulnerabilities. However, there may be a single
library that ma"es the database calls, which a whitebox tester can identify as one vulnerability.
)n addition, a whitebox review can reveal vulnerabilities in configuration and integration points.
For instance, Hacme 3oo"s communicates with Hacme 3an" (a similar application written in
*0<.9>; to actually debit a boo" purchasers ban" account. * review of Hacme 3oo"s
configuration files may uncover the location of the Hacme 3an" web services endpoint, which you
might explore for additional vulnerabilities.
Foundstone suggests that anyone with a development bac"ground should perform a code review
first, and then perform the blac"box penetration test that is described in the rest of this
document. ;his will validate the earlier review. ;he source code for Hacme Casino is available
via anonymous C%0 at sourceforge.net8pro4ects8foundstone.
For this guide we will focus on the blac"box, or pen!test, approach. ;he code review
methodology is a much more intensive activity that we tac"le in Foundstones 7riting 0ecure
Code classes. For more information about Foundstones 7riting 0ecure Code classes, go to
www.foundstone.com8education.
ww w.fo u n d st o n e. c o m © 20 0 6 F o u n d s t o n e , In c . Al l Ri g h t s Res er v e d -
http://slidepdf.com/reader/full/ib-hacme-casino-user-guide 7/31
7/21/2019 IB Hacme Casino User Guide
;ry logging into Hacme Casino with an invalid username or an invalid password. &oesnt wor",
does itG ;hat ma"es sense, because the whole point of the Hacme Casino authentication scheme
is that you need to "now a valid username and the password to get in (or we could 4ust register,
but wheres the fun in thatG. 9otice that when we supply a bad username or password, we get a
pretty generic error message about the login being unsuccessful.
http://slidepdf.com/reader/full/ib-hacme-casino-user-guide 8/31
7/21/2019 IB Hacme Casino User Guide
However, as weve seen before in other Hacme applications, sometimes the login form doesnt
validate input that it passes to the database. *nd from that, we can do 0B- in4ection and have
our way with the application. 0ounds fun
-ets try our hallmar" 0B- in4ection detection string, I (single apostrophe, in the username field
(leave the password blan".
Hm. 0o we see we got an error that is different than a simple bad login, but we didnt get a
detailed 0B- error message. ;hats not good ;his is "nown as 3lind 0B- in4ection. 7e "now the
0B- in4ection is there because we can cause an error that loo"s different than 4ust a normal bad
login. 7e can infer that this single 5uote is causing the 5uery to fail and the application is
catching the 0B- error. 7e cant immediately find out how to ma"e our in4ection wor" by loo"ing
at the 5uery in the detailed error message in the response. However, what we C*9 try to do is
ma"e the 5uery succeed, with in4ected data. 7e will then be able to exploit the 5uery to perform
our will. 0o, lets try an old standby that wor"s for most login 5ueries, IJ :R JKJ!!.
7e get the exact same error message as Figure E. 0till not wor"ing. 7hat could be wrong hereG
*n attac"er might thin" several things6
http://slidepdf.com/reader/full/ib-hacme-casino-user-guide 9/31
7/21/2019 IB Hacme Casino User Guide
9ot to be defeated, we test our first hypothesis by adding a right parentheses after the single
5uote.
)t wor"ed 7ere in with the *ndy *ces user profile. 0o what happenedG
9ote the parentheses. ;hey arent necessary, but sometimes developers leave them in for clarity
in grouping li"e clauses.
ww w.fo u n d st o n e. c o m © 20 0 6 F o u n d s t o n e , In c . A l l R i g h t s Res er v e d - #0
http://slidepdf.com/reader/full/ib-hacme-casino-user-guide 10/31
7/21/2019 IB Hacme Casino User Guide
3lind 0B- in4ection can be tric"y to exploit if the 5uery is complicated. 'ou may need to reopen
the parentheses, such as in the case of trailing =9):90 which must be evaluated, to get the
5uery to execute. <lenty of documentation exists on 3lind 0B- in4ection, even some automated
tools can help out in exploiting these problems and retrieving entire database contents from
simples holes such as this.
ww w.fo u n d st o n e. c o m © 20 0 6 F o u n d s t o n e , In c . A l l R i g h t s Res er v e d - ##
http://slidepdf.com/reader/full/ib-hacme-casino-user-guide 11/31
7/21/2019 IB Hacme Casino User Guide
9ow that we have access to a valid account, we want to get some money so that we can start
gambling. 9ow, we could actually withdraw from our ban" account @, but that would cost us dear
precious dollars )nstead, lets try to use phishing tactics to get users to get other users to give
money to us.
Clic" on the :ptions lin" in the left sidebar. 'ou should see the screen below.
9otice that there is a functionality to transfer chips to a user. ;his seems awfully generous 7hat
if we could entice users to clic" on a lin" that would cause them execute this functionality
un"nowinglyG
ww w.fo u n d st o n e. c o m © 20 0 6 F o u n d s t o n e , In c . A l l R i g h t s Res er v e d - #2
http://slidepdf.com/reader/full/ib-hacme-casino-user-guide 12/31
7/21/2019 IB Hacme Casino User Guide
-ets loo" at how the transfer chips function wor"s by examining the H;$- source in the figure
below.
;he H;$- form shows that the action is 8account8transferPchips. ;here are also two arguments,
transfer and loginUV.
-ets get a better idea of how it wor"s by running the traffic through <aros, an http proxy. For a
detailed description of how to use the <aros <roxy, go to http688www.parosproxy.org.
-ets try to transfer 2 dollars to 3obby 3lac"4ac" using the web interface and intercept the traffic.
ww w.fo u n d st o n e. c o m © 20 0 6 F o u n d s t o n e , In c . A l l R i g h t s Res er v e d - #3
http://slidepdf.com/reader/full/ib-hacme-casino-user-guide 13/31
7/21/2019 IB Hacme Casino User Guide
7e can see here that the application is sending the transfer parameter with the amount and the
login argument =R-. -ets add these two parameters to our =R- to ma"e a >; re5uest which
performs the same action.
ttp+::lo-alost+3:a--ount:trans8er;-ips<trans8er(=login>?(bobby;bla-@a-@
=-oBBit(7rans8erCips
ww w.fo u n d st o n e. c o m © 20 0 6 F o u n d s t o n e , In c . A l l R i g h t s Res er v e d - #4
http://slidepdf.com/reader/full/ib-hacme-casino-user-guide 14/31
7/21/2019 IB Hacme Casino User Guide
Figure 13
;his results in an error (we cant send a non!positive number of chips. However, perhaps
instead of transferring 2 dollars to bobby, lets transfer WJ222 dollars to ourselves 7e will
change the =R- parameters appropriately6
http688localhost6?2228account8transferPchipsGtransferKJ222QloginUVKandyPacesQcommitK;ransf
erSChips
9ow when we clic" on this, we will try to transfer WJ222 dollars to ourselves. ;his results in the
same error message as Figure JL, because we dont have enough chips. ;hats not too
interesting. )nstead, we will email this lin" to other users for them to clic" on. -ets see what
would happen if we sent this lin" to 3obby 3lac"4ac" and he clic"ed it while logged into Hacme
Casino.
-og out of Hacme Casino by using the -og :ut lin" in the left hand side bar. -og in using the
username6 bobbyPblac"4ac" and the password6 twentyPone. 'ou should see the following screen.
9otice 3obby has J2,222 chips.
ww w.fo u n d st o n e. c o m © 20 0 6 F o u n d s t o n e , In c . A l l R i g h t s Res er v e d - #5
http://slidepdf.com/reader/full/ib-hacme-casino-user-guide 15/31
7/21/2019 IB Hacme Casino User Guide
*s 3obby, try clic"ing the lin" above that donates J222 chips to *ndy *ces. 'ou should see the
screen below.
Figure 15
ww w.fo u n d st o n e. c o m © 20 0 6 F o u n d s t o n e , In c . A l l R i g h t s Res er v e d - #6
http://slidepdf.com/reader/full/ib-hacme-casino-user-guide 16/31
7/21/2019 IB Hacme Casino User Guide
9otice the chip count has been decremented. )f we go and log bac" into our andyPaces account
(using 0B- in4ection of course, we now have some real money to play with
Figure 16
;he reason why this is a security issue because we can simply send the lin" to several users
(bobbyPblac"4ac" included and wait for them to clic" the lin" while logged in to Hacme Casino.
;hat way, we dont need to "now their credentials or log in as them.
<hishers use techni5ues such as these to cause unsuspecting users to perform actions without
being aware of it. 7e could send our lin" to several users (provided we "now their email
addresses with a bogus message about winning a pri#e. ;he lin" appears to come from the
Hacme Casino domain (even 00- would attest to this. )f they clic" on the lin" while they are
logged in to HacmeCasino, they give us their chips 7e can sit bac" and watch the chips roll in
ww w.fo u n d st o n e. c o m © 20 0 6 F o u n d s t o n e , In c . A l l R i g h t s Res er v e d - #
http://slidepdf.com/reader/full/ib-hacme-casino-user-guide 17/31
7/21/2019 IB Hacme Casino User Guide
9ow were in, and weve got some playing money. 7e could go and gamble it all away, but being
security!conscious, we dont li"e to ta"e unnecessary ris"s. )nstead, lets see if there are any
ways to improve our odds at the table.
7ell try to find problems with the betting protocol. )n the lobby, clic" on the blac"4ac" game.
'ou should see the screen below6
o ahead and try a couple of rounds, but dont lose all of your money 7e "now that blac"4ac"
gives an edge to the casinoX lets see if we cant do better.
)n a casino, once you place a bet, that money is gone until the game outcome is resolved. )f we
pay attention to our chip total and betting amount, we can see that the amount of the bet is not
ww w.fo u n d st o n e. c o m © 20 0 6 F o u n d s t o n e , In c . A l l R i g h t s Res er v e d - #!
http://slidepdf.com/reader/full/ib-hacme-casino-user-guide 18/31
7/21/2019 IB Hacme Casino User Guide
credited or debited until the game is over. ;hat means as long as the game doesnt end, we dont
lose our bet
-ets cut our losses. &eal a few hands until you get a hand you dont li"e ! J1!JT will do nicely.
9ow, instead of feebly hitting and busting, note your chip total and clic" the lobby lin" in the
sidebar. 0ee the figure below6
-ets see if it wor"ed / go bac" to the blac"4ac" game and see if your chip total has decreased. )t
shouldnt of, and you are free to bet again.
9ow you can really reduce your ris" by getting rid of bad hands. ;his means you can 5uit your
4ob and turn in to a full!time online blac"4ac" player, at least until this hole is fixed
:ne important thing to note here is that as a hac"er, you cant get caught up trying to use the
same hac"s time and time again. Creativity is "ey, and each application has its own uni5ue ways
of being exploited.
http://slidepdf.com/reader/full/ib-hacme-casino-user-guide 19/31
7/21/2019 IB Hacme Casino User Guide
*+* applications often use mlHttpRe5uests when regular 7eb J.2!style interactions would do.
;his can expose some sensitive areas of functionality. -ets loo" for examples of this that might
be security vulnerabilities.
-ets go to our blac"4ac" game. <lay a few hands until you win. 7inning feels good, doesnt itG )
wish the feeling never went away. 7hat would it be li"e if we could 4ust "eep on re!living that
momentG
;a"e a loo" more deeply into how blac"4ac" wor"s6 first, we ma"e a bet. )n the bac"ground an
*+* bet re5uest occurs. ;his is shown, as intercepted by <aros, in the figure below.
ww w.fo u n d st o n e. c o m © 20 0 6 F o u n d s t o n e , In c . A l l R i g h t s Res er v e d - 20
http://slidepdf.com/reader/full/ib-hacme-casino-user-guide 20/31
7/21/2019 IB Hacme Casino User Guide
;hen, we ma"e *+* hitPorPstay re5uest with the action parameter e5ual to hit until we are
close to 1J. 0ee figure below.
*ssuming we continue to hit and we dont bust, our next *+* re5uest to the server is
hitPorPstay with the action parameter e5ual to stay.
;he server then deals the dealer cards, calculates the winner, pays out and collects, and then
as"s if we want to play again.
;he last *+* re5uest is interesting, though, because it sets off a series of events on the server
that determine the payout. 7hat if we were to issue that *+* re5uest againG
;urns out, this causes the server to recalculate the winner and repay the winnings. 0o if we have
4ust won, we can win again by replaying the stay re5uest
ww w.fo u n d st o n e. c o m © 20 0 6 F o u n d s t o n e , In c . A l l R i g h t s Res er v e d - 2#
http://slidepdf.com/reader/full/ib-hacme-casino-user-guide 21/31
7/21/2019 IB Hacme Casino User Guide
-ets try it outX play a hand until you win. 9ow cause the traffic shown in Figure 11 to replayX
typing this =R-6 (http688localhost6?2228blac"4ac"8hitPorPstayGactK0 should do the tric". 9otice
that this causes only part of the blac"4ac" game to render, because that *+* re5uest was only
updating a small portion of our page. :ur chips "eep going up, because the server thin"s we
"eep on winning, even though its the same game.
9ote that this attac" isnt *+* specificX its 4ust something that is more li"ely to be in an *+*
application. )n typical web applications, 4ust loo"ing in the =R- bar or an inadvertent hit of the
bac" button will reveal these types of issues. 7ith *+*, it happens it the bac"ground, and is a
bit more subtle. Remember, 4ust because the re5uest endpoint isnt directly lin"ed from the page,
its still accessible.
9ot too bad[ thats more than enough chips to set sail to the 3ahamas next month. 3ut, 4ust for
fun, lets chec" out video po"er too.
ww w.fo u n d st o n e. c o m © 20 0 6 F o u n d s t o n e , In c . A l l R i g h t s Res er v e d - 22
http://slidepdf.com/reader/full/ib-hacme-casino-user-guide 22/31
7/21/2019 IB Hacme Casino User Guide
%ideo po"er is a great game. )t combines the ease of slots with the decision ma"ing of po"er.
o bac" to the lobby, and browse to %ideo <o"er.
Figure 22
*fter playing a few rounds, you might notice that %ideo <o"er doesnt give us very good odds.
7hat might help us here is if we could predict which cards were coming next. However, if we
were to loo" at the cards we were dealt for a long time, we probably wouldnt notice any
predictable patterns, as the cards are shuffled randomly and regularly. 0o lets see if we can Ytilt
the machineZ to get some additional help.
:ne thing to note is that Ruby on Rails is based on routing. 7hen you call videoPpo"er8show,
you are really re5uesting the YshowZ method of the YvideoPpo"erPcontrollerZ method to be
ww w.fo u n d st o n e. c o m © 20 0 6 F o u n d s t o n e , In c . A l l R i g h t s Res er v e d - 23
http://slidepdf.com/reader/full/ib-hacme-casino-user-guide 23/31
7/21/2019 IB Hacme Casino User Guide
called. ;his is all tied together via the Rails framewor". *n interesting thing here is that Rails
performs all this auto!magicallyX even if you dont have any H;$- lin"s to a method in your
controller, ) may still be able to call it if ) can guess the name.
Ruby on Rails encourages test!driven development. :ften times, left!behind test code can be a
hac"ers delight, giving access to resources unintentionally.
First, go to the lobby, and select %ideo <o"er. <lay a few hands to get the idea behind it. :nce
again, ma"e sure to save some money so that we can cheat[ahem[improve our odds later.
9ow, lets try to find are any test methods in the videoPpo"erPcontroller. 7e cant see what these
are from the client!side, so well have to guess.
;ry6
http688localhost6?2228videoPpo"er8test
http688localhost6?2228videoPpo"er8testPvideoPpo"er
http688localhost6?2228videoPpo"er8testPhand
[
http688localhost6?2228videoPpo"er8testPdeucesPwild
7ait a second, what was that last oneG 7e found an opening 7e *R> feeling luc"y. ;his may
seem unrealisticX however, this entire process of finding un!advertised methods in controllers
could be automated.
ww w.fo u n d st o n e. c o m © 20 0 6 F o u n d s t o n e , In c . A l l R i g h t s Res er v e d - 24
http://slidepdf.com/reader/full/ib-hacme-casino-user-guide 24/31
7/21/2019 IB Hacme Casino User Guide
=h oh, someone forgot to turn their detailed error messages off -ets loo" for goodies. First, go
bac" to video po"er and ma"e a bet.
ww w.fo u n d st o n e. c o m © 20 0 6 F o u n d s t o n e , In c . A l l R i g h t s Res er v e d - 25
http://slidepdf.com/reader/full/ib-hacme-casino-user-guide 25/31
7/21/2019 IB Hacme Casino User Guide
;hen, enter the =R- that causes the verbose error message (in a separate browser tab to avoid
losing this session. -oo" at the session dump tree (note6 your session will loo" different,
because the dec" and hand are in a different state6
ww w.fo u n d st o n e. c o m © 20 0 6 F o u n d s t o n e , In c . A l l R i g h t s Res er v e d - 26
http://slidepdf.com/reader/full/ib-hacme-casino-user-guide 26/31
7/21/2019 IB Hacme Casino User Guide
Hm, loo"ing at this data, we can see whats in our hand (user!Nhand!Ncards, and whats in the
dec" (vpgame!Ndealer!Ndec" 7ere not 5uite sure what the integer codes for suit and ran"
mean, though. -ets do some analysis.
0uit
Code *ctual %alue
2 0pades
J &iamonds
1 Hearts
? Clubs
Ran"
ww w.fo u n d st o n e. c o m © 20 0 6 F o u n d s t o n e , In c . A l l R i g h t s Res er v e d - 2
http://slidepdf.com/reader/full/ib-hacme-casino-user-guide 27/31
7/21/2019 IB Hacme Casino User Guide
Anowing this, we can figure out the next five cards in the dec" (at the bottom. ;hey are6
9ext Card J6 (E,1 !N J2 of Hearts
9ext Card 16 (D,J !N of &iamonds
9ext Card ?6 (L,1 !N T of Hearts
9ext Card L6 (,? !N D of Clubs
9ext Card 6 (,1 !N D of Hearts
)f we were to only "eep the six and the ten in our hand, we would get two pair. o bac" to the
game and try it (although ad4usting for your specific hand8dec".
Figure 26
ww w.fo u n d st o n e. c o m © 20 0 6 F o u n d s t o n e , In c . A l l R i g h t s Res er v e d - 2!
http://slidepdf.com/reader/full/ib-hacme-casino-user-guide 28/31
7/21/2019 IB Hacme Casino User Guide
*nd there we are. 7hat an impossibly good decision -ets also note that this could be "ind of
attac" could be automated to speed up our results.
0ometimes this hac" will help, such as in the case above, and sometimes it wont because there
may be no way to get a winning hand.
:ne thing to note is that Ruby on Rails by default has a very verbose error message in debug
mode. )n production mode, this "ind of information is limited. 3ut it wouldnt surprise most
hac"ers to find a debug system in production
;hats it, weve had enough[.lets cash out. :nce you have made J22,222 chips with , cash out
to your special account, number JJJ!JJJJ!JJJ (this re5uires a bit of hac"ing using a proxy. 'ou
will see a special message letting you "now youve won
http://slidepdf.com/reader/full/ib-hacme-casino-user-guide 29/31
7/21/2019 IB Hacme Casino User Guide
Foundstones 0trategic 0ecure 0oftware )nitiative (0?i™ services help organi#ations design and
engineer secure software. 3y building in security throughout the 0oftware &evelopment -ifecycle,
organi#ations can significantly reduce their ris" of malicious attac"s and minimi#e costly
remediation efforts. 0ervices include6
Foundstone 0?i training is designed to teach programmers and application developers how to
build secure software and to write secure code. Classes include6
• 3uilding
0ecure 0oftware
• 7riting
0ecure Code / +ava (+1>>
• 7riting
0ecure Code / *0<.9>; (C\
• =ltimate
7eb Hac"ing
ww w.fo u n d st o n e. c o m © 20 0 6 F o u n d s t o n e , In c . A l l R i g h t s Res er v e d - 30
http://slidepdf.com/reader/full/ib-hacme-casino-user-guide 30/31
7/21/2019 IB Hacme Casino User Guide
Ac3nowledgements
$any individuals at Foundstone contributed to the development and testing of Hacme Casino and
the production of this whitepaper. *lex 0molen was the primary contributor and author of
Hacme Casino J.2. )n addition, the rest of the YconZ group helped review the pro4ect and
prepare it for release. ;han"s guys
http://slidepdf.com/reader/full/ib-hacme-casino-user-guide 31/31