Here, I’m going to talk about about what is capture the flag and how can you get started with it.
Many of you will have an idea about childhood’s play CTF. In which we had few teams looking for their flag. CTF for cybersecurity is almost the same as the “on-field” one. The Ancient Romans used a board game version of CTF games to train their children in war strategy and battle formations. In 2007 the US Army created the US Scouting Service Project, which tackles hypothetical scouting missions in a sandboxed environment.
The penetration of Information technology to such depths in common life has resulted in great convenience and service but they also present their own glitches, the threat to be hacked by wicked hackers.
So let us begin the war to save the world from the cyber attacks.
There are two types of CTFs:
- Attack-Defence
- Jeopardy
- Mixed
Let’s talk about all one by one.
1.Attack-Defence
As the name suggests, teams will attack other team’s system and also defend their own system. There are usually two rounds. In the first round, few teams will be an attacker and other teams will be the defender. In the second round, those teams will switch from attacker to defender or vice-versa. In the defender’s system, there are flags in the text file or picture or video or any other format, which the attacker teams have to find. The attacker’s team can use any hacking tools to compromise the other team’s system. But they must follow the rules to ensure that they are not taking advantage over the other team. At the same time, the defending teams can do anything to defend their machine while following the rules assigned for them. They are not allowed to disable any network connections or turn off the machines. If there is any rule violation, the team gets disqualified.
2.Jeopardy
In this type of competition, there are certain numbers of tasks or challenges the teams require to solve and get the flag. Sometimes there are chained challenges like you have to get the flag for the first challenge to move to the next one. The challenge can be related to Cryptography, Web Exploitation, Binary Exploitation(pwn), Forensic and Reversing. You have to use the techniques related to the above topics and find the flag. Let’s discuss what those topics are.
Cryptography:
It is a method of protecting information and communications through the use of codes so that only those for whom the information is intended can read and process it. In CTFs, they provide us any documents in a format like doc, pdf, etc. in which there will be an encrypted message. We simply have to decrypt it using crypto and get the flag or get the clue to move further in the challenge.
Web Exploitation:
Web exploitation is a very vast topic. In CTFs, they provide the link of the websites. We have to use some techniques to get the flag. We can check the source code, understand the logic behind how website response to our browser, can play with cookies, use several injections, etc. There are lots of methods to deal with the website and find vulnerability which actually leads us to the flag.
Binary Exploitation(PWN):
The objective of PWN challenges is for the player to acquire access to a target system without the system administrator’s permission. The targets can be personal computers, servers, websites, networking devices or applications. This type of challenge requires the knowledge of assembly language, how the compiler works also about networking.
Forensic:
This kind of challenges can include file format analysis, steganography, memory dump analysis, or network packet capture analysis. Any challenge to examine and process a hidden piece of information out of static data files (as opposed to executable programs or remote servers) could be considered a Forensics challenge. A real-world computer forensics task would hardly ever involve unraveling a scheme of cleverly encoded bytes, hidden data,files-within-files, or other such brain-teaser puzzles. One would typically not bust a criminal case by carefully reassembling a corrupted PNG file, revealing a photo of a QR code that decodes to a password for a zip archive.
Reverse Engineering:
Reverse Engineering is taking apart an object to see how it works in order to duplicate or enhance the object. The practice, taken from older industries, is now frequently used on computer hardware and software. In software reversing, we have to understand the code and write the code which performs the reverse task of the main code. This kind of challenges obviously requires a good knowledge of C, C++, Java and python language.
3.MIX
In mix type of challenges, there will be any combination of both types of challenges. Or there can be mainly attack-defense and jeopardy questions as a bonus.
So, there are lots of topics required for capture the flag.
You might be wondering…. Is it difficult?
The answer is unpredictable. Even in programming, if you know any computer language doesn’t mean you can solve competitive questions. Likewise knowing all the concepts doesn’t make you a hacker. You have to practice a lot. Here I will provide links from where you can learn or practice to capture the flag.
- CTFtime: CTFtime is a site where you will find all the information regarding upcoming CTF challenges, the writeups, ranking of the teams across the globe.
- picoCTF: It is a school-level competition but they keep the questions on the site for practice. This is the best site to start your journey in hacking.
- peaCTF: It is the same as picoCTF. Level of the questions are easy and moderate. You can practice at this site too.
Good luck!! If you have any doubt, you can comment below or contact us.
Thank you.
Team CEV!