Unlocking the Secrets of Capture The Flag (CTF) Competitions: A Beginner's Guide

welcome back to another video and today we're going to be talking about Capture the Flag or ctfs whether they're good

bad and how to get started if you're interested I've spent quite a lot of years doing these on and off and for me

I think they helped a lot in terms of my technical development and troubleshooting skills but they're not

for everybody and it's definitely not a requirement but if you are interested then there are some benefits to be had

as always if you enjoy the video don't forget to like And subscribe and let's dive in so first up what's the point why

bother with capture the flag at all well there are a number of reasons why I think capture the flags are great they

develop our troubleshooting skills it helps you learn new things about underlying technologies that you're

working with and they enable you to learn in an engaging and fun way and also usually in a safe environment and

finally if you're a PVP kind of person they can be quite competitive too this can be a good source of motivation for

some people a big part of application security is really getting to grips with how applications respond and behave in

unusual circumstances and during ctfs you'll encounter a lot of this which will improve your hacking intuition as

well as your ability to solve complex problems sound good well how do we even get started well realistically with the

right attitude you can just dive into beginner level ctfs and learn as you go there's literally nothing wrong with

that and we'll take a look at some beginner ctfs later that you can jump straight into so that you know where to

go but if you're the kind of person who likes to be prepared then I'd recommend having some basic scripting skills

something like python is fine and know how to use some common tools like bub Suite wi shark and nmap and these are

pretty helpful when you're coming up against challenges and probably one tool that I couldn't live without that I use

on almost every CTF is cyers chef.io in fact let's take a quick look at cyberchef right now all right so here we

are at rvm and I'm just going to open up my browser and come over to cyers chef.io and it takes a second to load

and here we are at the application so first up when you're dealing with ctfs especially web challenges you'll see a

lot of things in base 64 or somehow base encoded so if we just have some text let's say please like And

subscribe and if we want to convert this 2 base 64 we just drag in the 2 Bas 64 and it's quite common in ctfs to also

encode things multiple times so if you want to do it twice for example or three times we can stack things too and then

if we have this for example let's say we given this string and we want to decode it we can put it in here switch this off

and do from base 64 and here we can easily decode as well so very basic encoding decoding but this is something

that you have to do a lot of when you're dealing with CTF challenges and if you're feeling brave and want to start

diving into the crypto challenges something that you will see is please like and

subcribe is the Caesar Cipher so this is a very basic Cipher where all of the characters are shifted by three and it's

also known as uh rot as well so here we have rot 13 but we can change this to three for example so P becomes s l

becomes o and once again we can reverse this as well by changing our input and output and the amount of characters we

want to do this by and finally I'm going to paste this one in because uh you don't want to sit here and watch me

typing things out for 20 minutes but we can also do things like Rex so if we just search for Rex and here what I want

to do is I want to match all of the IP addresses pop this in and as as you can see we can easily see all of the IP

addresses in the text and if we want to list them we can just come down here list matches and here we have a nice

list so if you're working with Big Blocks of text or you want to sift through some data very quickly and you

don't want to write scripts to do it then cyers chef.io has your back and you're good to go so what I'd recommend

is that you give each category a try so try web reversing crypto forensics everything except stego because I don't

know only strange people like stenography but Jokes Aside do what you find interesting and don't hesitate to

collaborate even if it's in a category that you're not that familiar with or that you don't usually participate in A

New Perspective on a challenge can make the difference between being really close to solving it and actually getting

the points if you're already a CTF player by the way and you want to share some of your key tools that get you

through time after time then let us know down in the comments below sharing is of course caring and it's always good to

hear about what the wider Community is using so for beginner friendly ctfs you want to build some confidence and a good

place to start is with some solo challenges I'm a big fan of over thewire pctto CTF and root me I go back quite a

long way with root me so it's pretty nostalgic whenever I go back and visit it and some of the challenges are really

really excellent so here we are at Roots me and as you can see you can sign up a free account and all you need to do is

sign up uh visitor access and you can train for free on various exercises you can see Solutions posted by other

members and you can contribute as well and as we scroll down you can see that there are 536 challenges this is a lot

of challenges um 171 virtual environments and more than 5,000 and solutions and this goes back to having

multiple solutions for a given problem or multiple ways of approaching a different situation it's always worth

exploring how other people solved a problem and not just assuming that your solution is the best one we're always

open to learning new things and a different approach might apply in a different situation quite all of these

challenges as well are pretty fundamental in terms of web hacking and building skills that allow you to

interact with technology efficiently and troubleshoot and find issues and then go and exploit them so it's a great website

and I highly recommend you give it a try at first though you might be feeling a little bit overwhelmed and really what

you want to do is give a challenge a go set yourself a timer let's say 30 minutes or 40 minutes and if you're

stuck by the end of that time and you've made no meaningful progress then take a look at a write up or a hint or get some

help from somebody else and then carry on this is going to help you improve your persistence and troubleshooting

skills but not let you waste a whole day on a single problem and once you're ready to dive in CTF time is probably

the best place to find upcoming events team information and much much more and probably the best advice I can give you

which I should leave to the end because you know it's a YouTube video and watch time and all that but hey is that once

you've done a CTF read all of the writeups and find out what you missed even the challenges you solved there

might be different ways to solve it easier ways to solve it or alternative Solutions more often than not if you

didn't manage to solve it it's just because it's something that you haven't seen before and after a while you'll

start to pick up patterns common challenges and even though the scenario might be a little bit different you'll

still be able to solve that challenge and for our final section we're going to talk about continuous learning there are

some things we can do to help us stay motivated and first up if you can find some like-minded people or a Discord

community that regularly does CTF challenges then you're much more likely to keep up in the long run so to wrap up

here are the key points get the fundamentals down builds both some scripting skills and also get used to

using basic tools take on some beginner CTF challenges read lots and lots of writeups and use them to help you solve

challenges that you're stuck on and if you can seek out a group of likeminded people hopefully I'll see you on the

scoreboard in some CTF competition at some point in the future and that's it for this video so as always if you

enjoyed the video don't forget to like And subscribe and if you have other tips to share for newcomers to CTF let us

know down in the comments below and I will catch you next time