hkcert ctf 2021 webinar 01
TRANSCRIPT
HKCERT CTF 2021Webinar 01
Black Bauhinia8th Oct, 2021
Who am I?
harrier
● Founding member @ Black Bauhinia
● RE / Crypto player
● Security Software Engineer
Who am I?
Byron Wai
● Founding member @ Black Bauhinia
● HITCON 2020 Speaker
● Forensic / MISC Player
Who are we?
@blackb6a
@blackb6a
/team/83678
b6a.black
Table of Content
● What is CTF?● Ethical Hacking● Career Prospect● Personal Experience● CTF 101
○ Web○ Cryptography
● Tools for playing CTF● Training Platform Release
What is CTF?
Capture the flag
CTF (Capture the flag)
● Competitors steal flags
○ from organizers (jeopardy), or
○ from other competitors (attack & defense)
● Originated from DEFCON in 1993
● Served as a security training, or exchange of ideas
● Competitors need to exploit the systems to find the flags
● CTF is not an examination but a learning process.
● You are not expected to
○ know everything prior the game starts
○ solve all of the challenges when the game ends
Jeopardy-style CTF
Jeopardy-style CTF
● Team’s gain points for every task solved, with more complicated
tasks earning more points.
● At the end of the game, the team with the most points wins!
Jeopardy-style CTF
Attack-Defense
● Each team works to protect their own services, earning points for
successfully defending it and keeping the service alive.
● Each team also works to hack opponents services, earning points
for successful attacks.
● The team with the most points wins!
How Fun
● Brain teaser
● Just like solving riddles or puzzles, but on computers○ https://oddpawn.com/
● Puzzle Hunt
○ Gold-bug Defcon
● Recover audio from muted video○ https://www.youtube.com/watch?v=FKXOucXB4a8
What you can get from playing CTF?
● Be attentive: The devil is hidden in the details
● Be creative: What you learn from school may not help… think out
of the box
● Be absorbing: Read write-ups from players and challenge authors
● Be a team player: Team up! No one is an island nor all-rounded
● Don’t worry to fail: We compete to learn in CTFs
Application
Famous CTF Competitions
● DEF CON
● HITCON
● ASIS CTF
● HITB
● …
● HKCERT CTF
Famous CTF Players
● Orange
● angelboy
Famous CTF Teams
● Geohot
● Bamboofox / Balsn / 217 / …
● 0ops / AAA / ****** / EEE
● ...
Code of Ethics
Types of Hackers
Same methodologies, different purpose
● White Hat Hackers
○ work with the permission of system administrators
○ improve cyber defenses
● Black Hat Hackers
○ steal data, criminal purposes
○ without authorization
○ illegal
MIT hackers abide by a written code of ethics that is painted on the wall of an MIT basement.
Cap. 200 Crimes Ordinance
161.Access to computer with criminal or dishonest intent
(1) Any person who obtains access to a computer—(a) with intent to commit an offence;(b) with a dishonest intent to deceive;(c) with a view to dishonest gain for himself or another; or(d) with a dishonest intent to cause loss to another,
whether on the same occasion as he obtains such access or on any future occasion, commits an offence and is liable on conviction upon indictment to imprisonment for 5 years.
(2) For the purposes of subsection (1) gain (獲益) and loss (損失) are to be construed as extending not only to gain or loss in money or other property, but as extending to any such gain or loss whether temporary or permanent; and—
(a) gain (獲益) includes a gain by keeping what one has, as well as a gain by getting what one has not; and
(b) loss (損失) includes a loss by not getting what one might get, as well as a loss by parting with what one has.
(Added 23 of 1993 s. 5)
Career Prospect
Career Prospect
● Red Team
● Blue Team
● IT Auditor
● Penetration tester (pentester)
● R & D Engineer
● Security Researcher
● Bug Hunter
● Chief Information Security Officer
● Future Study
Career Prospect - White Hat Hacker
Personal Experience
CTF into Real Life
● CTF requires...○ basic / fundamental knowledge○ also ability to research
● CTF helps…○ Understand vulnerabilities in-depth○ Explore new territories and expand your skill set○ Cultivate critical thinking○ Test and enrich your know-how○ Meet friends and community
CTF Categories
Jeopardy-style CTF Categories
● Web
● Cryptography
● Pwn (Binary Analysis)
● Reverse Engineering
● Misc. (Forensic, Steganography, etc.)
CTF - Web
● Hack a website!
● Involve common web vulnerability (e.g. XSS / injection / …)
● Steal password (from admin)!
● Read arbitrary file in the system!
● Run arbitrary command in the system!
● (Relate to bug bounty / pentest more as most software today are
website)
CTF - Cryptography
● Attack cryptosystem
● Maybe encryption, decryption, signature, hashes
● Common crypto used in real life
● Cryptanalysis: Is the system flawed?
● Implementation issue? Side channel?
● Randomness: Is it predictable?
CTF - Reverse Engineering
● Given an binary / executable / software (without source code),
understand what the software actual do
● Is the program hiding something?
● Can I patch the program to change logic?
● Is there bugs / error in the program that I can use? (Game hack etc)
● Reverse the logic: What input do I need to “get flag”?
CTF - Pwn (Binary Exploitation)
● Attack an service with an binary / executable / software!
● Most of the time you have the binary
● Find vulnerability
● Craft and fire exploit to get access to remote service!
CTF - Misc.
● Forensics
○ Find target data (flag, important document, ...) in (disk, usb,
phone image, drones...)
○ Photo / Audio / Video analysis: any information hid inside?
(Steganography)
● Programming Language: how interesting feature in programming
language can be used in hacking
● Professional Programming & Coding (PPC): Coding challenges
In Depth Discussion - Web
Web Browsing 101
https://developer.mozilla.org/en-US/docs/Learn/Server-side/First_steps/Client-Server_overview
8.0
OWASP Top 10
Will focus on Injection and XSS
SQL Injection
SQL (Structured Query Language)
● standard language for … in databases
○ storing
○ manipulating
○ retrieving data
SQL Query
SQL Query
https://www.w3schools.com/sql/trysql.asp?filename=trysql_select_columns
SQL Injection (SQLi)
<?php
$username = $_POST['username'];
$password = $_POST['password'];
$result = mysql_query("SELECT * FROM customers
WHERE username='$username' AND password='$password'");
// ...
SQL Injection (SQLi)
SELECT * FROM customers
WHERE
username = 'admin'
AND
password = 'my_very_password'
SQL Injection (SQLi)
SELECT * FROM customers
WHERE
username = 'admin'
AND
password = '' OR '1'='1'
Demo
http://jupiter.challenges.picoctf.org:44979/index.php
http://jupiter.challenges.picoctf.org:44979/filter.php
SQL Injection in a nutshell
https://xkcd.com/327/
XSS (Cross-Site Scripting)
● XSS in CTF: Capture the flag inside Cookies
● Cookies?
● The objective of XSS attack is to manipulate a webpage and send it to a victim to execute
malicious script in the victim’s browser, like stealing the Cookies.
● Typically, Cookies will contain the session tokens used in the website, and stealing the
Cookies could mean taking over the user account on that website.
XSS (Cross-Site Scripting)
● Try it yourself / Demo
http://xss-game.appspot.com/
● Reference
https://portswigger.net/web-security/cross-site-scripting
In Depth Discussion - Cryptography
Cipher
● Cryptography – the process to keep a message secret from unintended audiences
● Cryptanalysis – the process to obtain original text from encrypted message without
knowing the methods/keys
● Encoding / Decoding – convert data from one form to another form
● Encryption – encodes plain text into cipher text (with a key)
● Decryption – the reverse of encryption
● Hashing – Return a fixed length string (“digest”) from any input data
○ Easy to compute but hard to reverse (“Trapdoor”)
○ Small changes in input results in big changes in output (“Avalanche Effect”)
○ Different to find two different input with the same output (“Collision
Resistance”)
Block Cipher
● One major type of modern cipher
● encrypts block by block
Misuse of Cryptography
https://xkcd.com/1286/
Modes of Operation
XOR
- Binary addition without carry
- Used everywhere in cyberworld
01110000 <Input 10100101 <Key11010101 <Result
Cipher Block Chaining (CBC)
● Not Blockchain….
● Use XOR to chain blocks
Tools
Online Resource
● Wikis
○ https://ctf101.org/
○ https://ctf-wiki.org/en/
● Course
○ https://pwn.college/
● Wargame
○ https://picoctf.org/
● VTuber
○ https://www.youtube.com/c/kurenaif
Tools List for CTF on Github
https://github.com/zardus/ctf-tools
General Tools for CTF
● Virtual Machines
○ VirtualBox, VMWare, ...
○ Kali Linux, Ubuntu, ...
● Search Engine
○ Google, Bing, …
○ Search for past write-up
● Basic Programming Skills
○ Python, C++, PHP, JavaScript, ...
General Tools for CTF
● General○ netcat, pwntools
● Web○ Web Browser, cURL, Burp Suite, …
● Pwn / Reverse○ IDA, Ghidra, Angr / z3, Radare2, ...○ objdump, Vim, gdb, …
● Cryptography○ quipqiup, hashcat, pkcrack, yafu, ...
● Forensic / MISC○ Wireshark, binwalk, stegsolve, ...
Training Platform
Discussion Channel
Discord will be use as the official channel
https://discord.gg/2WfrZFGK9m
Feel free to discuss and ask questions
Q&A
Thank You