50

Updates:

  • Added first challenge to prepare
  • We have a CTFTime team, secse. Please join this.
  • We communicate over Slack. To get an invitation to the group you can contact Benoit Esnard, HamZa, Xavier59, Arminius or any other active team member. (We will need to know an email address to send the invitation to and a reference to your Security.SE profile.)

CTF TIME

CTF Time is a website dedicated to CTF challenges. We will subscribe a team and we will...

enter image description here

There are basically 4 types of challenges:

  • Exploiting
  • Web
  • Reversing
  • Forensics

And then there are also the occasional misc challenges. So basically we will have people working on each of the categories. Preferably a more experienced person in the field with less experienced people in the field so we can factor in some learning. To be good we should have about 4 people/challenge. A team of 16 people would be ideal. We can rotate the team

Basic Requierements

  • Have at least 400 rep on security.SE or have more than a combined 2000 rep on your network profile in related fields (Crypto, Stack Overflow, Webmasters, Server Fault, Reverse Engineering ...). Sites in an unrelated field (Arqade, The Workplace, etc.) do not count!
  • Understanding of basic TCP/IP
  • Understanding of at least 1 programming (Java, C, C++, C#) and 1 scripting language (preferably, PHP, Python, Perl or Ruby)
  • Have basic understanding of at least one of the topics (knowing what things like XSS or SQL injection are)

Things we need

(I should be able to provide this on my personal systems, but should SE have something like this it would be nice)

  • IRC server with a private channel or a private chatroom on SE
  • A Wiki to centralize all of our learnings.

How much time will this take of me?

You have to know most CTF's last 2 days, to be able to complete a challenge you will need to be able to commit around 4 - 6 hours at least.

Team

This is a team effort, don't expect this thing to be easy, it isn't. It will take a lot of time and might even give you some frustration, but when you are able to decipher a challenge you will be having a digital orgasm.

enter image description here

Code of Conduct

  • Common sense
  • Don't do or share anything illegal
  • Always follow the CTF challenges rules
27
  • Excellent idea. Sadly I'd be no use at this sort of thing any more.
    – Rory Alsop Mod
    Commented Dec 28, 2012 at 11:14
  • @RoryAlsop we can use a coordinator :3?
    – Lucas Kauffman
    Commented Dec 28, 2012 at 12:17
  • @RoryAlsop you can be team manager! :-)
    – AviD Mod
    Commented Dec 28, 2012 at 14:09
  • 4
    I'd be keen but I'm a serious noob. I'd do way more learning than helping :)
    – OJ.
    Commented Jan 2, 2013 at 5:26
  • I'd be interested in joining in, but my usefulness would largely depend on the nature of the challenges. Most of them (in my experience) tend to be reliant on development for Linux platforms, which I suck at.
    – Polynomial
    Commented Jan 2, 2013 at 11:52
  • I have some experience and would be glad to participate.
    – Cristian Dobre
    Commented Jan 3, 2013 at 17:42
  • 1
    I'd be interested depending on time and skill commitments needed
    – makerofthings7
    Commented Jan 3, 2013 at 20:44
  • I work as a Linux sysadmin and have little to offer in the way of security expertise. That said, I'm very eager to learn and would love to be part of this.
    – Kenny Rasschaert
    Commented Jan 3, 2013 at 20:45
  • As pentesting goes, I'm still pretty much in the n00b stage. But, I welcome a chance to learn. Let me know what I can do to help!
    – Iszi
    Commented Jan 3, 2013 at 21:11
  • I have no pentesting/blackhat or forensic experience, and I really need to work on that. I'd like to participate, if I can find the time.
    – Gilles 'SO- stop being evil'
    Commented Jan 3, 2013 at 23:49
  • I don't know how much time I could put towards such a thing, but it would be interesting to do something a bit more team oriented than messing around with hackthissite.org. Being a software architect, I don't get a whole lot of chances lately to practice.
    – AJ Henderson
    Commented Jan 4, 2013 at 3:21
  • I'd like to get in on this. Is it possible?
    – Everett
    Commented Jan 4, 2013 at 4:03
  • I would also like to participate.
    – Dinu
    Commented Jan 4, 2013 at 13:29
  • 2
    I'd quite like to get involved, but can I be like on the bench? As in, I don't always know what my time commitments are going to be like but I'd be happy to help out if I am free? (I might even change my name back to Ninefingers for this).
    – user2213
    Commented Jan 4, 2013 at 15:24
  • This sounds like fun. I've got mostly C# and C knowledge, and TCP/IP knowledge (used to work as a network admin). My security-related skills are in reverse engineering and binary exploit development (have found/reported holes in a couple things).
    – randomdude
    Commented Jan 10, 2013 at 17:16

6 Answers 6

Reset to default
10

Preparing Challenges:

  • This is the first challenge to prepare, it's very easy and requires some very basic crypto and scripting skills. What you need to do is to complete the blowfish level 1 of smash the stack. Go to ssh [email protected] -p 22 passwd: level1. I will submit the solution by the weekend. It took me about 1 hour to solve it, of which mostly was debugging my script. Solution is here.

Sign in on ctftime.org and apply to https://ctftime.org/team/ look for "security.se"

Upcoming CTF

7
  • For those who don't have access to SSH directly. The description of the challenge is that "GungJnfRnfl" is a simple substitution cypher of the password for Level 2.
    – AJ Henderson
    Commented Jan 10, 2013 at 20:29
  • Got it in about 15 minutes by hand. It was simple.:)
    – AJ Henderson
    Commented Jan 10, 2013 at 20:49
  • A couple of minutes using an online script. P.S. @Rory Alsop: I am now old enough to join the team (+400Rep) :).
    – Dinu
    Commented Jan 11, 2013 at 15:07
  • 3
    You don't want to know how fast I cracked that.
    – Jeff Ferland Mod
    Commented Jan 17, 2013 at 23:20
  • 2
    Any or all uses of this system and all files on this system may be intercepted, monitored, recorded, copied, audited, inspected, and disclosed to law enforcement personnel, as well as authorized officials of other agencies, both domestic and foreign. By using this system, the user consents to such interception, monitoring, recording, copying, auditing, inspection, and disclosure at the discretion of Sawbox Inc.
    – cat
    Commented Jun 13, 2017 at 21:28
  • 2
    Unauthorized or improper use of this system may result in administrative disciplinary action and civil and criminal penalties. By continuing to use this system you indicate your awareness of and consent to these terms and conditions of use. LOG OFF IMMEDIATELY if you do not agree to the conditions stated in this warning.
    – cat
    Commented Jun 13, 2017 at 21:28
  • but smashthestack.org appears to be working normally, I am thinking this ssh server no longer works?
    – cat
    Commented Jun 13, 2017 at 21:29
6

When we get to doing any competitions, I'll create a private channel for the team. I'm leaning toward retroactively putting the channels to "open" at the end of competitions for the sake of sharing knowledge but still giving us a way to compete effectively.

If we don't open things up at the end, it'll have to be an IRC server.

1
  • 7
    Yea I'm actually pro opening everything afterwards, I would also encourage doing writeups of the problems and post them on the blog.
    – Lucas Kauffman
    Commented Jan 4, 2013 at 6:57
2

Update

They seem to have merged the teams (good job Antony :)), so the links below are mostly dead. The team to join has all three names and can be found here. I am not yet a member - they didn't merge members, so I can't accept anyone to join :(

We have multiple ctftime.org teams :(

Can we all join one? Mostly just so we can have a decent total score, and a log of all our challenges. In the interest of me being lazy, I would like to suggest we all join secse because then I don't have to do anything, as I am already a member :) (it also has the highest score so far of the three teams!)

TLDR: go join https://ctftime.org/team/4193/

4
  • 1
    I've put in a request with CTFTime to see if we can merge the teams. Will update here when I have an answer.
    – user2213
    Commented Apr 24, 2013 at 15:29
  • You are now a member, welcome back :)
    – user2213
    Commented Apr 25, 2013 at 8:54
  • @AntonyVennard woo thanks, logo uploaded and default name changed :P
    – lynks
    Commented Apr 25, 2013 at 9:02
  • 2
    All but #3585 are 404
    – Avery3R
    Commented Apr 26, 2013 at 1:44
1

I can provide a IRC server/ Wiki at a sub domain of my website for the team , I would be interested in being involved but my be constricted by time: I work as a Linux Sysadmin. Can program in C and quite well entrenched in Bash.

1
  • I also have an IRC server as well as a Teamspeak3 and/or Mumble server that I can make available on my dedicated server. My IRC server is part of Dorksnet.
    – AJ Henderson
    Commented Jan 9, 2013 at 15:22
0

I would like to join too, although I am inexperienced in participating in the competitions I have a very good understanding of networks and protocols that are required.

0

I recommend documenting what you learn in a way that wont spoil the CTF for future participants. It might even make a nice blog post or series of blog posts.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .