Questions tagged [ctf]

Capture the Flag (CTF) is a form of hacking competition. Use for questions about the design and operation of such contests. Do not use for questions asking for help with winning contests.

CTF is the acronym of Capture the Flag, a type of computer security competition, usually involving teams who prove their own skills in fields including penetration testing, computer forensics, and reverse engineering. It is considered a way of training and showing significant skills in the computer security area, and it is practiced in several hacker conventions, such as Defcon.

There are two main types of capture the flag contest:

  • A jeopardy-style CTF provides teams with a variety of challenges in different areas, usually revolving around cryptography, steganography, reverse engineering, and forensics.

  • An attack and defence-style CTF involves teams who need to defend their own machine or network and, at the same time, attack the networks defended by the other teams. In this way, a wide variety of skills is practiced, including system administration, penetration testing, and digital forensics.

86 questions
82
votes
5 answers

What exactly is CTF and how can I as programmer prepare for a CTF with beginner-friendly people?

I reached out to an old friend of mine who was a terrific programmer back in my school days and he invited me to attend one of the CTF events with his university group. This group seems very beginner friendly and open to everyone, but I still fear…
MansNotHot
  • 823
  • 1
  • 7
  • 9
25
votes
4 answers

Reduce Noise when Penetration Testing

Recently I participated in a capture the flag competition which was attached with SOC analysis teams monitoring our traffic. There we were told that many tools were very noisy. Eg Sqlmap which has its full header. As all of us were new so we weren't…
Khopcha
  • 465
  • 5
  • 11
15
votes
1 answer

Steganography - JPEGsnoop

I am trying to overcome a CTF steganography challenge. I tried different methods to unhide the hidden data in the file without luck. I used JPEGsnoop on the image and I got this output: *** Decoding SCAN Data *** OFFSET: 0x0000026F Scan Decode…
Uriel Frankel
  • 251
  • 2
  • 6
15
votes
4 answers

How to build a hacking challenge that uses XSS?

Security conferences often have hacking challenges. My colleagues and I have built a number of these. We've not yet done one that includes a cross-site scripting vulnerability. I have seen challenges that do this. One approach was that a certain…
paj28
  • 32,736
  • 8
  • 92
  • 130
14
votes
6 answers

Designing a Capture The Flag target and game management system

I've attended several CTF contests and I'd like to implement a CTF system for my students. I asked Google about designing such system but it's fruitless. Any ideas?
anhldbk
  • 367
  • 1
  • 3
  • 10
11
votes
1 answer

Did DARPA's Cyber Grand Challenge winner actually discover previously unknown vulnerabilities?

DARPA announced a winner on August 4, 2016 of its Cyber Grand Challenge DARPA Cyber Grand Challenge. The contest was described as designed to accelerate the development of advanced, autonomous systems that can detect, evaluate, and patch software…
Dalton Bentley
  • 321
  • 1
  • 7
10
votes
2 answers

Understanding SQLMAP payload

I was participating in a CTF and there was a SQL Injection challenge. There is a Wordpress page with a vulnerable plugin parameter (let's call the website https://vulnerable.com/), and the solution comes from leaking values from the database. Using…
Michael Hoefler
  • 145
  • 2
  • 9
7
votes
1 answer

PHP Session Vulnerability

I'm trying to solve a challenge on a CTF, with PHP sessions. The goal is to make check.php echo $_PASSWORD. I do not have access to the files themselves, and therefore I cannot edit them. My proposed solution is: We want the session to be locked…
Roee H
  • 139
  • 1
  • 5
6
votes
4 answers

What is hacking hackable virtual machines useful for?

I was watching an ethical hacking course where the tutor taught me to hack into different virtual machines and also machines from Hack The Box. In the real world, how are these practices of hacking virtual machines useful? What do these virtual…
user235696
4
votes
3 answers

Break out or bypass php functions

I'm currently doing an online CTF and I have LFI an can read the source code of the upload function. In there I see the following line: shell_exec('rm -rf ' . directory/ . '*.p*'); So anytime I upload a .php file, it gets deleted. Is there a way to…
Nerotix
  • 191
  • 6
4
votes
1 answer

Are there any academic papers/books about hacking wargames?

I'm looking for sources (academic papers, books, articles from notable magazines) that can be used as reference for a Bachelor's Thesis, that should be about making an educational, gamified hacking wargame, to be used in Ethical Hacking courses at…
4
votes
0 answers

CSAW 2012 challenge2 can't get shell out side of gdb

I tried to solve this problem. I found FSB at 0x08048bfe _snprintf. I loaded shell code by \n. ssc function checks whether user input include /bin/sh. Most of shell code includes /bin/sh. I found ssc function checks only string before \n. I used…
Damotorie
  • 141
  • 2
4
votes
1 answer

Exploiting MD5/Salt Vulnerability in this PHP form?

I've been practicing security-related subjects and this challenge has befuddled me. Note: I can't access any PHP source code, nor can I edit it. I'm only able to view it. The following is given: I have two inputs, "user" and "pass" After 30 times…
Tom
  • 880
  • 1
  • 7
  • 14
4
votes
3 answers

Is this PHP code vulnerable SQL injection?

Im given control over the $vote variable (in the "challenge" function) Is there any way to sql inject the query? (BTW I can see/read whatever the challenge function returns e.g. the sql errors. I managed to inject the sql but was not able to find a…
Name
  • 81
  • 1
  • 6
3
votes
1 answer

Is there a way to exploit jquery 1.12.4 vulnerability?

According to https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=jquery+1.12.4 and https://snyk.io/test/npm/jquery/1.12.4, I see that jQuery 1.12.4 has medium serevrity vulnerability. I checked on exploit-db and searchsploit to see if there's known…
idkn
  • 133
  • 1
  • 1
  • 3
1
2 3 4 5 6