Capture The Flag(CTF)

Published on Jun 18, 2024

·

~ 7 min read

Have you ever wondered how ethical hacking works? How cyber security people become who they are? That's still a long distance road but what about, how do you find exploits in softwares and programs which cyber attackers(hackers, bad guys) find just by analysing it, even after so much Security Testings done to it.

What if I could try implementing those, reverse enginerring, web exploitation, etc. but in a small scale? Well CTF is your answer.

CTF? What's that?

'Capture The Flag' is like a digital treasure hunt in which players would face challenges related to finding hidden flags in cybersecurity challenges. It is a great way to hone your skills in the fields such as hacking, cybersecurity, reverse engineering, binary and web exploitations and many more related topics.

So how do we play it? Well in simple words-

  • You get a problem statement

  • You look around the machine/code given to you

  • You try to find vulnerabilities you can exploit

  • You get the flag of some format, like CTF{some_text_1234}

That's it! But that's the illusion, the hardest part is to find the vulnerability, and that's the whole game. You may need to create your own codes to crack the problem, think of unthinkable ideas to implement(basically see the solution), brute force you way in, use neat tricks and what not. All this comes from experience and practise.

CTF practising is amazing

Practising CTF is something very refreshing and side by side super irritating. The satisfaction of getting a flag is equally frustrating when you can't figure it out. But that's what drives you, the satisfaction and hunger to learn the method to solve.

In my experience, I learnt so much about Terminal, shell scripting, usages of cookies, about assembly and computer architecture and what not. These gives you lots of experience, making you better and better at CTF.

Here are some tips you can do while practising CTF-

  • Maintain your own repository where you store all tricks, tips, commands, Payloads, etc. to use. This helps you look for exploits which you may not be able to think on the spot.

  • Don't give up. Read the code properly. Try all possibilities which comes to your head and your repo shows you.

  • Think outside the box. See the exploits you can try based on the language the code is written. For example, strcmp has vulnerability when compared to empty array [], C language has finite numbers hence overflow can be used as an exploit.

  • Get comfortable with the tools that you are using. Knowing what your weapon does comes in handy. You never know the solution shows another usage of your favuorite tool

There are various benifits of practising CTF apart from what I just told. These are -

  1. Enhances problem-solving skills: CTFs challenge participants to think creatively and analytically, improving their ability to solve complex problems.

  2. Improves understanding of cybersecurity concepts: Practicing CTFs help in gaining a deeper understanding of various cybersecurity principles and techniques.

  3. Builds experience with real-world tools and technologies: Participants often encounter a wide range of tools and technologies during CTFs, providing valuable hands-on experience.

  4. Develops teamwork and communication skills: Many CTF challenges require collaboration, fostering teamwork and effective communication among team members.

  5. Prepares for career opportunities: Competing in CTFs can make candidates more attractive to employers in the cybersecurity field by demonstrating their practical skills and passion for security.

To learn abour CTF's, you must have resources to read and competitions to try on. Most of the experience and knowledge you gain is from practising only. Having initial knowledge of languages, computer architure, servers and pentesting, etc. always helps.

Resources & Competition

Participating in Capture The Flag (CTF) competitions is a popular way for individuals interested in cybersecurity to test their skills against real-world scenarios. These competitions offer a blend of jeopardy-style and attack-defense formats, challenging participants to find vulnerabilities, exploit them, and secure systems from attacks. The benefits of participating in CTFs are manifold, including enhancing problem-solving abilities, deepening knowledge of cybersecurity concepts, and preparing for professional opportunities in the field.

Resources for Self-Learning and Preparation

For those looking to get started with CTFs or improve their skills, there are numerous resources available:

  1. Online Courses: Platforms like Coursera, Udemy, and edX offer courses on cybersecurity fundamentals, ethical hacking, and specific aspects of CTFs.

  2. Books: Titles such as "Metasploit: The Penetration Tester’s Guide" and "Hacking: The Art of Exploitation" provide in-depth knowledge on penetration testing and exploitation techniques.

  3. **Practice Websites: Websites like TryHackMe, OverTheWire, and PicoCTF offer beginner-friendly platforms to practice CTF challenges without the pressure of competition.

  4. Community Forums: Reddit communities, Discord servers, and forums like Stack Overflow are invaluable for asking questions, sharing knowledge, and staying updated on the latest cybersecurity trends.

  5. Open Source Tools: Tools like Metasploit, Wireshark, and Burp Suite are essential for practicing and mastering various aspects of CTFs.

Apart from these, practising and trying out competitions is also really important.

CTF Competitions

CTF competitions range from local events organized by universities and hacker conferences to online global competitions. Participating in these competitions provides several benefits:

  • Real-World Experience: CTFs imulate real-world scenarios, offering participants the opportunity to apply theoretical knowledge in practical situations.

  • Skill Development: They help in developing a broad set of skills, including reverse engineering, cryptography, binary exploitation, and web application security.

  • Networking Opportunities: Competitions often attract professionals and enthusiasts from around the world, providing networking opportunities and insights into the industry.

  • Career Advancement: Demonstrating success in CTFs can be a significant advantage when applying for jobs in cybersecurity, showcasing one's problem-solving abilities and dedication to continuous learning.

Gained Experience: The most important learning

The experience gained from participating in CTFs is invaluable. It goes beyond the immediate satisfaction of solving challenges; it fosters a mindset of curiosity, resilience, and adaptability. Participants learn how to approach problems systematically, think critically, and work collaboratively under pressure.

This experience translates well into other areas of life and careers, making CTF enthusiasts not only better at cybersecurity but also more adept at tackling complex challenges in any domain.

Practise places

You can practise CTF's from various websites. These may include online websites, downloading a machine and hacking it in your computer, ssh'ing to a server and finding flag there, downloading files and breaking into them, etc.

Some of the websites you can practise on are-

  1. TryHackMe (THM)

  2. Google CTF

  3. OverTheWire

  4. Hack The Box

  5. PicoCTF

  6. CyberChef

  7. VulnHub

  8. Capture The Flag with Hacker101

  9. WebSec Academy

  10. OWASP Juice Shop

  11. Hackerrank

There are various more places, but for beginning stages, these websites provide a great place to start from. The difficulty level ranges as points awarded to a problem increases.

Kali linux

Kali Linux is a Debian-based Linux distribution designed specifically for cybersecurity professionals and enthusiasts. It comes pre-installed with a vast array of tools aimed at various information security tasks such as penetration testing, security research, computer forensics, and reverse engineering. The operating system is built on top of the robust Debian infrastructure and includes hundreds of open-source tools focused on security auditing.

For Capture The Flag (CTF) competitions, Kali Linux is incredibly valuable due to its comprehensive toolkit. These competitions involve solving challenges related to cryptography, binary exploitation, web application vulnerabilities, and more. Participants often need to use a wide range of tools to analyze network traffic, exploit software bugs, crack passwords, and perform other security-related tasks. Kali Linux provides all these tools out of the box, making it an essential tool for participants looking to succeed in CTF events. Its extensive collection of utilities simplifies the process of gathering evidence, exploiting systems, and analyzing data, which are crucial aspects of both cybersecurity practice and CTF competitions.

Writeups

When you are practising CTF and not in a competition, you may wanna see a solution to the problem since you can't solve it. And hence, there exists kind spirits who write their solutions with pictures and walkthroughs, which is called "writeup" of a CTF.

There are various websites, github repositories, youtube videos, discord channels, etc. maintained by people which have Writeups of various problems from websites, competitions and other sources.

You should read multiple of them since not everyone finds the same solution. Now that you have given up on the problem, better to gain more knowledge as a student than see a solution and be done with it. That's called cheating then not seeing a solution and learning from it. It's all about "your" intentions and not what you show the world.

Summary

Capture The Flag (CTF) competitions offer a hands-on way to practice skills like reverse engineering, web exploitation, and more. This article explores the basics of CTFs, tips for practicing, and the benefits of participating in these digital treasure hunts. It also provides resources for self-learning, lists popular CTF practice websites, and highlights the importance of writeups for learning from others' solutions. Dive in to enhance your problem-solving skills, deepen your cybersecurity knowledge, and prepare for career opportunities in the field.

I maintain my repository at: https://github.com/AnirudhG07/CTF-Central07 and I recommend everyone to make their own.

Good luck for solving CTF's!