Beginner’s Guide to Capture the Flag (CTF)
What are Capture the flag(CTF) competitions?
In CTF competitions, the flag is typically a snippet of code, a piece of hardware on a network, or perhaps a file. In other cases, the competition may progress through a series of questions, like a race.
They can either be single events or ongoing challenges — and typically fall into three main categories: Jeopardy, Attack-Defense.
Category of Capture the flag (CTF)
Attack-Defense
This style of competition is much closer to the backyard capture the flag game than the Jeopardy style. In these types of events, teams defend a host PC while still trying to attack opposing teams’ target PCs. Each team starts off with an allotted time for patching and securing the PC, trying to discover as many vulnerabilities as possible before the opponent attacking teams can strike. The team with the most points wins.
Jeopardy CTF
Jeopardy-style CTFs present competitors with a set of questions that reveal clues that guide them in solving complex tasks in a specific order. By revealing clues, contestants learn the right direction regarding techniques and methodologies that are needed going forward. Teams receive points for each solved task. The more difficult the task, the more points you can earn upon its successful completion.
Ongoing, online CTF competitions are most likely to be Jeopardy style. It’s easier to play solo and requires less coordination among players than an Attack and Defend competition.
What to do in CTF?
If you’ve never experienced a CTF event before, don’t get frustrated or give up, because the key to any type of hacking is patience. While this is sometimes a difficult thing to have, the only way to learn is to persist and practice on your own.
Types of Challenges
Challenges are typically divided into 6 categories for ctf, common the types of challenges are:-
- Web: This type of challenges focus on finding and exploiting the vulnerabilities in web application. The maybe testing the participants’ knowledge on SQL Injection, XSS (Cross-Site Scripting), and many more.
2. Forensics: Participants need to investigate some sort of data, like do a packet analysis on .pcap file, memory dump analysis, and so on.
3. Cryptography: Challenges will focus on decrypting encrypted strings from various types of cryptography such as Substitution crypto, Caesar cipher, and many more.
4. Reversing (or Reverse Engineering): RE usually needs participants to explore a given binary file weather PE file, ELF file, APK, or some types of other executable binary. Participants need to find the key by decompilation, disassemble using static or dynamic analysis, or other reverse engineering tools.
5. OSINT: The OSINT idea is to see how much information is available to you and understand the underlying hint’s hidden in the challenges it-self with the help of google and bit problem-solving skills. So more tools like sherlock, and no focus on domain enumeration, etc.
6. Miscellaneous: Everything not listed else that is still relevant to Information Security is in this category. This need require Google-Fu skill. In short, you can say it can have anything.
Tricks to Win CTF?
· Practice alone
There are tons of ways you can practice for CTF competitions. Many old contests will upload their past flags and solutions. Folks will often also post writeups on their security blogs of particularly interesting challenges and puzzles they’ve solved.
· Follow the news
CTFs like to be trendy. Keeping up with what’s going on at other CTFs, security conferences, and the wider cybersecurity community can be important in giving you an idea on how to approach hacks and which vulnerabilities to try and exploit. If you see an interesting proof of concept hack or exploit online that you can replicate in your home lab, take the time to work through it and pick up new skills.
· Build a toolkit
Before you even get to a CTF you should know what tools you need to win. As you do practice exercises and go to CTFs, keep a list of tools you find yourself using and keep them stored in one place on your computer. Find an approach that works for you and be sure that you spend the bare minimum time at a CTF downloading and researching tools you’ve used in the past.
· Take care of yourself
Like at Hackathons, it’s important at a CTF to keep track of your personal well-being. If you need to sleep — do so.
· Make some friends
Take time to get to the know the other teams at the competition. Be friendly and approachable yourself. Reciprocate and be nice to people who approach you but try and keep strategically important information close.
How to Get Started
If you’re brand new to hacking, then find a good course to teach you the skills. You can start by setting up a Kali Linux / Parrot Security practice lab, so you can get hands-on experience immediately.
When you’re ready, work through the CTF challenges, review the write-ups, and maybe even enter a competition. By competing in these competitions and following the challenges, you not only strengthen your knowledge and understanding of how the technologies work, but also how to select the appropriate responses to a challenge.
If you’ve never experienced a CTF event before, don’t get frustrated or give up, because the key to any type of hacking is patience. While this is sometimes a difficult thing to have, the only way to learn is to persist and practice on your own (see this post further down on how to practice) and maybe next time you’ll score first place! One thing you can try to do during your first CTF event, if possible, is to find an experienced team that’s willing to let you join them. Make sure you’re clear that this is your first CTF event and you’d love for them to show you the ropes.
What I would recommend you use at your first CTF, in order of easiest to most difficult, would be one of the following:
1.Kali Linux
This distribution comes purpose-built for penetration testing. It’s packed with every tool imaginable and probably a ton more than you’ll never need to use.
2.BlackArch
This distribution is based on Arch Linux but comes pre-built, much like Kali does, with tons of security tools.
3.Arch Linux
This is a base Linux install that comes with standard Linux tools. If you choose this option, you’ll have to do the leg work of installing all the tools you can think of that you might need or at a very minimum ensure that you have access to an internet connection to allow you to quickly install the tools you require at the event.
Examples
If you are using windows then also don’t worry. What you can do is, you can install any of this OS in your VirtualBox Environnement and then Access the CTF through it and start solving the challenges
Also, here are some links that’ll help ya and tell you which tools to use for solving challenges more efficiently
https://www.yeahhub.com/top-10-essential-ctf-tools-solving-reversing-challenges/
https://github.com/JohnHammond/ctf-katana
https://apsdehal.in/awesome-ctf/
CTF Etiquette!
Before you go on to playing CTFs (and having the time of your life!), here are a few sacred rules of CTF participation that you should keep in mind.
First, absolutely do not post solutions and flags online! The purpose of CTFs is to help people become better hackers through the mental struggle of solving challenges. Giving solutions away is denying the chance for others to learn.
On the other hand, you also should not try to google solutions or ask for flags online. You can ask for help, discuss with others or even collaborate in solving a challenge, but asking or googling for solutions takes away from the experience. Even if you try to understand the solution, it is not the same as working hard to and finally finding the answer yourself!
Last but not least “ ALWAYS READ THE RULES”.
CTFs are a great hobby that ultimately makes you a better hacker. In fact, many of the most skilled hackers came from CTF backgrounds. I hope you’ll find the experience rewarding as well. Best of luck and have fun!
Resources
Tools and Resources to Prepare for a Hacker CTF Competition or Challenge
TryHackMe | Learn Cybersecurity
Hack The Box |Penetration Testing Labs
Hacksplaining
https://www.hacksplaining.com/
Practice CTF List / Permanent CTF List
https://captf.com/practice-ctf/
Register Now.
https://allevents.in/online/hackers-hour-ctf/80002817291964
Win Prize worth up to Rs.50000/-
How to Participate
Participants have to register as a team, so assemble your squad.
Any Individual or maximum 3 member can consist in a team.
We have limited slot for 100 Teams only, so Preference will be given to THM Members first (Rights of Admission Reserved)
Become a Member Today: https://forms.gle/pFRm7m75weHZT8DS7
Date: 27th -28th September 2020
Time: 10.00 AM — 12.00 AM
Website: www.TheHackersMeetup.com
CTF Online : www.HackersHour.org
Contact us: +91 8980808222 +91 8866827872
mail us on thehackersmeetup@gmail.com
#HackersHour #CTF #THMIndia #TheHackersMeetup
#OSINT #ApplicationSecurity #WebsitePentesting #BugBounty #HackFromHome #LearnFromHome #KeepHacking #THMExperts #EthicalHacking #CyberSecurity #SecurityVue #HackerSociety #MakingInternetSafe
