Silent Signal retired its “Mushroom” pentester recruitment challenge and published the full solution, along with what nine years and 14 hires taught them about candidates. Applicants got 72 hours to attack a small Flask application with an Oracle backend and write a report as if for a real client, followed by an in-person interview about their findings. The bugs were textbook: a reflected XSS behind a regex deny-list, SQL injection through a Base64-encoded JSON parameter, and unsalted MD5 password hashes. Still, two thirds of the OSCP holders who submitted a report never got as far as reading tables through the SQL injection. Mushroom replaced the company’s first challenge from 2015, a two-week assessment of three hosts where most applicants leaned on automated scanners and only one report found the XSS. So much for certifications as a hiring filter.
