Monday, October 13, 2014

Thoughtworks Placement

So the other day I attended the Thoughtworks placements held at KMEA college through Shreds.
If you haven't heard of Thoughtworks you should really check them out. It's a really cool company tailored for coders and enthusiasts of that field.

Let me start off by saying that, I didn't get the job. I reached till the top 12 (I think) before they kicked me out :) I later found out that Thoughtworks has one of the toughest placement processes with around 6 rounds of coding, logical test and interviews.

Despite how it sounds, the experience was amazing. Here's my brief perspective on how it went.

The process was split as two days. The first day consisted of coding and logical rounds.
If you're really good at coding, this is definitely the company you want to be working for.

The first round was a simple coding round. We had half an hour to solve 5 simple questions. The most exciting part about this was, you could use ANY language. Yes, ANY language.

The questions were something along the lines of,

1) Print numbers from 1-100 and for numbers that are divisible by 3 print "fizz" instead of the integer, divisible by 5 print "buzz" and those divisible by 3 and 5 print "fizzbuzz".

2) Implement numbers as words. Eg 123 as one two three.

3) Reverse a sentence. Eg. Hello World => World Hello

4) Enter a list of words and search for the keyword if it exists. Eg. Hello World Good Bye.
    Search for "Good" and print "True".

5) Find all palindrome prime numbers.

I solved questions 1 and 5. I got half of questions 2 and 4.
At the end of this round, they killed off a majority of the people with most people who passed solving around 2-3 questions. There was around 500 kids, and they chose around 50?

The following rounds, they killed off half of the people writing the test for that round.

So it went like
50 to 25 after the second round
and from 25 to 12 after the third round.

The second round was a logical round. You get a set of 11 logical questions in the form of a flowchart, in which you have to perform the operations specified in the chart.
I know it doesn't make sense, but just Google  "logical paper Thoughtworks" to see their sample papers.

It involves a LOT of concentration. A LOT. It's all about concentrating on the instructions, following the correctly over and over and over again. You should really try out some of the sample question papers online. It'll surely smooth up the process.

A lot of kids were studying and reading the flowchart sample papers before the 2nd round. I didn't. So it's not necessary to practice it before hand, but it does help.
I didn't really think i'd pass this round, but somehow I did :)

The third round consisted of pair coding. This was an interesting round, in which you got a question (I'm pretty sure they took it off from hackerrank.com) and then they give you one of their own developers to work with!
You were allowed to ask your Thoughtworks developer ANYTHING. Syntax errors, strategies, etc.
You just needed to code the output according to the question in the neatest and most organized way.
Sadly, I'm not super great with C++ like I am with C. So I couldn't really organize my program into classes and objects.
At the end of the day, I think it was the way I solved the problem that made me pass that round. I used a simple solution that reduced the complexity of the question, even though I didn't get 100% of the output nor was my code super "neat". But it was however, VERY SHORT.

That was the end of day 1.

For day 2, there were around 12 people remaining.
And there were 3 interviews.

So I got kicked out after the first interview.
I had two interviewers. The whole process took around maybe an hour. Mostly they ask on data structures and things on your resume.

My best advice for you is to make another resume for this round. Make it small and concise. Add the things that you know COMPLETELY on your resume, because they'll ask you every single detail of any topic on your resume.

They said I was out because my data structure skills were lacking. They gave me a problem to solve, and even though I did solve it in some ways, they weren't impressed as they were looking for a more better solution.

My second advice for this round is that REVISE AND REVISE your data structures. They want developers and if you don't know your data structures AND HOW TO APPLY THEM IN A PRACTICAL APPLICATION, they'll kick you out.

I don't know much around the second round, but it was technical so I guess it was similar to the first round.

The last round was a HR round. However i've heard that if you made it to this round, you'll definitely be a Thoughtworker by the end of the day.

Most of the 12 people who attended the interview got kicked out after the first round.

I'm proud to say that my classmate actually got the job after 3 rounds of intense interviews.
At the end they only selected 2 students out of the hundreds they came.

All I have to say is to work hard on your coding skills, learn your data structures and learn how to incorporate them efficiently. Good luck!

Saturday, October 4, 2014

Mix, match and exploit

On many sites we can see a php script, with a variable assigned to a value. Based on the value assigned to the variable, a page will load.

Example
products.php?category=1
products.php?category=2

Depending on the value 1 or 2, will a page load.


Now this may be prone to SQL injection. To check insert a ' at the end of the URL. If it IS prone, the page will load but seem disfigured.

That's how my page loaded. With a tiny missing link on the top left corner.
Now here comes the fun part. If you can find a table on the site, (which I've explained how to find in previous posts) we could view some sensitive information.
On this page, there was an "Enter your email to add your email to our mailing list". I just added a ' to cause a syntax error causing the message:
"Syntax error, could not add email to table MAIL"
Hence I found an email table on the site.

So on this page we have the table 'mail'
So lets start with UNION ALL SELECT NULL FROM MAIL, concatenate this to the end of the URL.
Most probably the page will load as shown above. This means that we haven't selected the correct amount of columns.
So lets try
UNION ALL SELECT  NULL,NULL FROM MAIL
keep incrementing the number of null values till it turns out like this
So in my case it took 4 NULL values to display something weird. Apparently it would be some value from the table. So now let's try
UNION ALL SELECT *,NULL,NULL,NULL FROM MAIL

This again, may or may not work. What we're trying to do is to find a column in which the values are in a text form. The weird icons you see are due to reading values that aren't exactly text.
 So lets rotate the value of * till we get something out of it.
UNION ALL SELECT NULL,*,NULL,NULL FROM MAIL
keep rotating the * value till you find something.
Like this.
Apparently the second column stored the email values! By using a * at the second position, we retrieved all values of the second column! Keep rotating the * around to see what other columns you can extract!

Hope this proved to be educational!