Difference between revisions of "Ctf-evenings"
Line 13: | Line 13: | ||
== Training evenings == | == Training evenings == | ||
+ | * [http://wiki.techinc.nl/index.php/CTF-practice-evening:2014-01-13 13 January, 2014] - Intro to web hacking + Certified Secure | ||
+ | * [http://wiki.techinc.nl/index.php/CTF-practice-evening:2014-01-06 6 January, 2014] - Wireshark Jumpstart + GitS teaser (Armorall - VNC pcap) | ||
+ | * [http://wiki.techinc.nl/index.php/CTF-practice-evening:2013-12-23 23 December, 2013] - Intro to x86 disassembly + I/O Smash the Stack war-game | ||
* [http://wiki.techinc.nl/index.php/CTF-practice-evening:2013-12-09 9 December, 2013] - UNIX + Bandit wargame | * [http://wiki.techinc.nl/index.php/CTF-practice-evening:2013-12-09 9 December, 2013] - UNIX + Bandit wargame | ||
− | |||
− | |||
− | |||
== Competitions == | == Competitions == |
Revision as of 15:35, 26 January 2014
Projects | |
---|---|
Participants | MRieback |
Skills | Hacking, forensics, problem solving |
Status | Active |
Niche | Software |
Purpose | Fun |
Welcome to the Tech Inc Capture the Flag (CTF) training event series!
The format of this series is likely to evolve over time, but I currently assume that these evenings will feature a combination of web-based challenges, online competitions, and general-purpose learning/workshop evenings covering a variety of computer security (i.e. hacking, defensive) topics. Everyone of all skill levels is welcome!!!!
Contents
Past Activities
Training evenings
- 13 January, 2014 - Intro to web hacking + Certified Secure
- 6 January, 2014 - Wireshark Jumpstart + GitS teaser (Armorall - VNC pcap)
- 23 December, 2013 - Intro to x86 disassembly + I/O Smash the Stack war-game
- 9 December, 2013 - UNIX + Bandit wargame
Competitions
- Positive Hack Days Qualifiers 2014 - 25-27 January, 2014
About the CTF Training Evenings
Types of evenings
I envision the following 3 kinds of CTF training evenings:
- 1 - Workshop/learning evenings - network analysis/forensics (Wireshark), filesystem forensics, reversing(Ollydbg, etc..)/Pwnables, code deobfuscation, pen testing (Kali-Backtrack/Metasploit/buffer overflows), cryptanalysis, web security (XSS, SQL injection, etc..), stegonography, Commandline kung-fu, recon/trivia/etc..
- Example: I've got a whole slew of Wireshark training videos - we can watch them together!
- We could also occasionally screen Defcon/CCC/Other videos on fun topics!
- 2 - Challenge website evenings
- I setup a Scoreboard, so we can keep track of who's done which challenges
- 3 - Actual CTF events
- Possible team name: Knuffelhackers
Other things that we can do
- Setup a vulnerable server (Damn Vulnerable Linux, Metasploitable, etc..) and attack it
- Other examples: http://exploit-exercises.com/
- Preparing for competitions
- Setup Etherpad (or another online "multiplayer notepad") so people can make notes and work together for each challenge
- We're currently using: Riseup Pad
- Preparing tools (Backtrack VM, other VM images with different tools)
- Being able to emulate weird architectures for binaries
- Being able to test shellcode on our own system
- Maybe we can do something with hardware in the space (i have no idea what the status is of VMWare cluster in space, but i think we have one..)
- Setup Etherpad (or another online "multiplayer notepad") so people can make notes and work together for each challenge
- Brainsmoke could talk about binary exploitation
- We can also look at gdb / objdump / IDA / Hex-Rays
Challenge websites
Link to the Tech Inc Challenge Website Scoreboard: TechInc-CTF-Scoreboard
- http://captf.com/practice-ctf/
- http://ctf.forgottensec.com/wiki/
- http://www.overthewire.org/wargames/ (Bandit is good for beginners)
- https://www.certifiedsecure.com
- http://io.smashthestack.org
- http://ismellpackets.com/
- http://www.kroosec.com/?m=1
- http://exploit-exercises.com/fusion
- http://exploit-exercises.com/protostar
- http://opensecuritytraining.info/Training.html
- http://www.securitytreasurehunt.com/
- http://forensicscontest.com/
- http://ebctf.nl/challenges
- http://sourceforge.net/projects/owaspshepherd/files/ - VM
- http://www.hackthissite.org
Reversing and Exploitation
- GDB Tips - Some beginning tips for how to use GDB
- https://www.securecoding.cert.org/confluence/display/seccode/CERT+C+Coding+Standard - Helpful for finding C constructs that can be exploited
- http://sourceware.org/gdb/current/onlinedocs/gdb/index.html - GDB manual
- http://sourceware.org/binutils/docs-2.24/binutils/index.html - GNU Binutils manual
- http://www.youtube.com/watch?v=gYOy7CGpPIU - The Making of Atlas: from Script Kiddie to Hacker in 5 Sleepless Nights (video)
- Hacking: The Art of Exploitation (book)
- Reversing: Secrets of Reverse Engineering (book)
- http://www.woodmann.com/fravia/howto1.htm
- http://www.woodmann.com/crackz/Orc.htm
Tools: objdump, readelf, gdb, ktrace/kdump
Web hacking
- https://www.owasp.org/index.php/Category:Attack
- https://www.owasp.org/index.php/OWASP_Testing_Guide_v4_Table_of_Contents
- http://w3schools.com
- http://yehg.net/lab/#toolbox
- https://hackvertor.co.uk/public
- Burp Suite
- fuzzdb
Network challenges
- For VNC: rfbproxy / Rfbplayer
- chaosreader
Steganography
- http://www.jjtc.com/Steganography/tools.html
- http://www.slideshare.net/null0x00/nullcon-2010-steganography-stegananalysis-a-technical-psychological-perspective
Setting up a CTF
Other stuff
- http://ctftime.org/ - Event listings and write-ups
- http://hackflag.org/forum/
- http://sysexit.wordpress.com/category/writeups/
- http://www.hackers.nl/about/introduktie/
- http://www.enigmagroup.org/pages/basics/
- http://shell-storm.org/repo/CTF/ - Archive of previous CTFs
- http://mitrecyberacademy.org/stem/moodle/course/view.php?id=13
- http://opensecuritytraining.info/Training.html