Stealing Test Data from UVa Online Judge
Back when I was taking the Advanced Programming course, the professor liked using UVa problems for assignments and in-class exercises. But UVa was notoriously unstable — code submitted at the start of class would still be sitting in the judge queue by the end. Pretty frustrating. One day I got curious and Googled around, finding this post, which revealed that UVa hadn’t locked down outbound network access. The original author was able to email test data out from the judge server. The post described two methods for exfiltrating data — SSH into the machine or send it via SMTP as an email — but both required embedding credentials in the submission code. That’s not great. Then I realized this was similar to a technique I’d used in picoCTF, so I could use HTTP requests to exfiltrate the data instead. ...