I am embarking on a new project with a good friend of mine. I have taken one of my older laptops and installed an insecure version of Windows XP onto it. The insecurity has a number of different levels, and includes some vulnerable third-party services as well. The goal of this is to give it to him for a week and have him break into it. I’ve even put some fake services up that give back fake banners and capture whatever he does to those services. Maybe in a few more weeks, he’ll set one up for me in similar fashion. If he breaks into the box, he has to show me how he did it. If he doesn’t, I’ll show him what I had in mind for an attack (i.e. there has to be a known and demonstratable attack vector).

The point of this little game will be not to stump each other by creating hardened systems or to try to find some 0day (we’re not that sophisticated by any means!), but rather to just practice what we know, be aware of how security holes are created and where to look for them, and show each other different tools and ways to do things. Maybe after I have done this I’ll post more details, but I certainly don’t intend to do something profound or amazing with this.