Skip to content

Commit

Permalink
Organization and Addition
Browse files Browse the repository at this point in the history
Changed the organization of the README's and added the start of writeups
for a couple topics
  • Loading branch information
cabreraalex committed Mar 17, 2014
1 parent 0f56d3e commit a126612
Show file tree
Hide file tree
Showing 11 changed files with 62 additions and 30 deletions.
2 changes: 1 addition & 1 deletion CONTRIBUTING.md
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
#Contributing

The general organization for this repository is `topic/subtopic/tech`. For example a page for HTTP would just be `web/http/README.md` while something like a Django topic would go under `web/cms/django/README.md`.
The general organization for this repository is `topic/tech`. For example a page for HTTP would be `web/http/README.md` while RSA would go in `crytography/rsa/README.md`.

Try to keep the writing in README files and section off parts with folders.
18 changes: 12 additions & 6 deletions README.md
Original file line number Diff line number Diff line change
@@ -1,24 +1,30 @@
#CTF Docs

This repository aims to be an archive of information, tools, and references on CTF competitions.
This repository aims to be an archive of information, tools, and references regarding CTF competitions.

CTFs, especially for beginners, can be very daunting and almost impossible to approach. With some general overviews of common CTF subjects and more in-depth research and explanation in specific topics both beginners and veterans can learn, contribute, and collaborate together.
CTFs, especially for beginners, can be very daunting and almost impossible to approach. With some general overviews of common CTF subjects and more in-depth research and explanation in specific topics both beginners and veterans can learn, contribute, and collaborate to learn and expand their knowledge.

##What is a CTF?

CTFs are computer security/hacking competitions which generally consist of participants breaking, investigating, reverse engineering and doing anything they can to reach the end goal, a "flag" which is usually found as a string of text.

[DEF CON](https://en.wikipedia.org/wiki/DEF_CON) hosts what is the most widely known CTF, as they occur annualy at the hacking conference in Las Vegas. Many different competitions have branched off since then, and numerous ones are available year round. One of the best places to see when CTFs are being scheduled is [ctftime](https://ctftime.org/), an active website which also includes team rankings.
[DEF CON](https://en.wikipedia.org/wiki/DEF_CON) hosts what is the most widely known and first major CTF, occuring annualy at the hacking conference in Las Vegas. Many different competitions have branched off since then, and numerous ones are available year round. One of the best places to see when CTFs are being scheduled is [ctftime](https://ctftime.org/), an active website with calendars and team rankings.

###Example

A very simple type of CTF challenge is looking at the source code of websites to find flags or information. For example, can you find the flag hidden on this page?
A very simple type of CTF challenge is looking at the source code of websites or programs to find flags and/or hints. For example, can you find the flag hidden on this page?

<!-- flag: 2_l33t_4_M3 -->

##Moving On
##Using these Docs

You may be able to solve some CTF challenges after looking through the documents in this repository and understanding the basics of the technologies and subjects covered, but you won't be very proficient or successful for long. To be an adept CTF competitor you have to be able to combine many different strategies and tools to find the flag. This aspect takes practice more than anything, and participating in numerous CTFs will allow you to expand your understanding, abilities, and success.
These docs are organized broadly along the lines by which CTF tasks are organized. Inside each folder is a README like this one explaining the basics of the technology and what the tasks generally involve. Alongside these READMES are folders with more information regarding specific technologies and topics.

The best way to use these docs is to participate in an actual CTF! Join a CTF or attempt some old tasks and try to solve them. Use the information in this repository to get you started solving them. If you feel like there is insufficient information to help you solve a task, bring up an issue on this repository or try googling the task hints.

###Moving On

You may be able to solve some CTF challenges after looking through the documents in this repository and understanding the basics of the technologies and subjects covered, but you won't be very proficient or successful for long. To be an adept CTF competitor you have to be able to combine many different strategies and tools to find the flag. Developing the ability to find flags quickly takes practice more than anything, and participating in numerous CTFs will allow you to expand your understanding, abilities, and success.

##Conclusion

Expand Down
7 changes: 5 additions & 2 deletions cryptography/README.md
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
#Cryptography

Cryptography [is the practice and study of techniques for secure communication in the presence of third parties ](https://en.wikipedia.org/wiki/Cryptography) and in the case of CTFs the goal is usually to crack or clone the cryptographic object to reach the flag.
Cryptography [is the practice and study of techniques for secure communication in the presence of third parties ](https://en.wikipedia.org/wiki/Cryptography) and in the case of CTFs the goal is usually to crack or clone cryptographic objects or algorithms to reach the flag.

###Example

Expand All @@ -12,6 +12,9 @@ Hint: Julius Caesar's favorite cipher
kxn iye lbedec
```

##Getting Started

##Sources/See More
[Wikipedia and Cryptography](https://en.wikipedia.org/wiki/Cryptography)

[Cryptography](https://en.wikipedia.org/wiki/Cryptography)

6 changes: 3 additions & 3 deletions cryptography/caesar-cipher/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -18,16 +18,16 @@ Doing so for the whole original string creates a jumbled mess of incomprehensibl

To give this to our friend, we would send him the final string with the instructions **right 3**, and either by hand, with a website, or with a script, he would be able to extract our extremely important message.

##Detection
##Detecting

Caesar ciphers are usually presented in very low-point tasks, if at all, and can be easy to detect and check for. Strings containing incomprehensibly jumbled letters can very likely be Caesar ciphers and should be checked.

##Solution
##Solving

There are many approaches to cracking Caesar ciphers, but most commonly the best way to solve them is to write a script or run the string through a website (Options presented below) which will print out all the possible shifts of a string. At that point the most comprehensible and logical solution can be chosen.

##Sources/See More

[Wikipedia and Caesar Ciphers](https://en.wikipedia.org/wiki/Caesar_cipher)
[Caesar Cipher](https://en.wikipedia.org/wiki/Caesar_cipher)

[Quick and Simple Decryption Tool](https://www.xarg.org/tools/caesar-cipher)
7 changes: 7 additions & 0 deletions cryptography/md5/README.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
#MD5 Hashing

MD5 is a [widely used cryptographic hash function producing a 128-bit (16-byte) hash value, typically expressed in text format as a 32 digit hexadecimal number](https://en.wikipedia.org/wiki/MD5). Commonly this system is used to check that a download is uncorrupted, as the algorithm represents a large amount of text or information in a short string of numbers. It is also used as security to check that files are not tampered with, as any slight change in data causes extremely different md5 hashes.

##Sources/See More

[MD5](https://en.wikipedia.org/wiki/MD5)
6 changes: 3 additions & 3 deletions miscellaneous/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -6,11 +6,11 @@ Many challenges in CTFs will be completely random and unprecedented, requiring s

In recent CTFs the sheer variety of miscellaneous tasks has been highly exemplified, for example:

* In the [Olympic CTF Sochi 2014](https://ctftime.org/event/130), there was [low-point miscellaneous challenge](https://github.com/ctfs/write-ups/tree/master/olympic-ctf-2014/crypting) which only provided a jumbled string of words. Instead of being a typical crypto challenge, the answer required competitors to draw out the word SOCHI on their keyboards.
* [RuCTF](https://ctftime.org/event/122) had a challenge which presented a [single picture of shredded strips of paper jumpled up in a random order](https://github.com/ctfs/write-ups/tree/master/ructf-2014-quals/misc-100). The best way of solving this was by hand! No computer knowledge was even needed for its completion.
* In the [Sochi Olympic CTF 2014](https://ctftime.org/event/130), there was a [low-point miscellaneous challenge](https://github.com/ctfs/write-ups/tree/master/olympic-ctf-2014/crypting) which only provided a jumbled string of words. Instead of being a typical crypto challenge, the answer required competitors to draw out the word SOCHI on their keyboards.
* [RuCTF](https://ctftime.org/event/122) had a challenge which presented a [single picture of shredded strips of paper jumpled up in a random order](https://github.com/ctfs/write-ups/tree/master/ructf-2014-quals/misc-100). The best way of solving this was by hand! No computer knowledge was even needed for its completion, only patience and a good eye.

##Sources/See More

[CTF Write-Ups](https://github.com/ctfs/write-ups)

[CTFTime Index](https://ctftime.org/ctfs)
[CTFTime](https://ctftime.org/ctfs)
9 changes: 4 additions & 5 deletions reversing/README.md
Original file line number Diff line number Diff line change
@@ -1,14 +1,13 @@
#Reversing

Reversing in the context of CTFs is usually the reverse engineering of software (executables/bin files) into assembly code and at times the original source to understand what is happening in a program, break a program (e.g. buffer overflows), or to decrypt encryptions done by a program.
Reversing in the context of CTFs is usually the reverse engineering of software (executables/bin files) into assembly code and at times the original source code to understand what is happening in a program, break a program (e.g. buffer overflows), or to decrypt encryptions done by a program.

##Detection
###Example

The easiest way to analyze a file for reversing is to use the `file` command in linux, which will tell you what any file is detected to be. For example most linux executables will be ELF files, while respective source files like `.c` or `.py` will be presented as their respective file-types.
*To-Do*

##Solution
##Getting Started

By far the most prominent tool for dealing with binaries is the tool [IDA](https://www.hex-rays.com/products/ida/). IDA is an extremely thorough tool which allows for a variety of interactions with binaries, but ultimately allows you to see the assembly for programs and how code blocks flow throughout a program.

##Sources/See More

Expand Down
11 changes: 10 additions & 1 deletion steganography/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -2,5 +2,14 @@

Steganography [is the art or practice of concealing a message, image, or file within another message, image, or file](https://en.wikipedia.org/wiki/Steganography), and in the context of CTFs usually means finding the hints and flags that have been hidden with steganography. Most commonly a picture or image file will be given as a task with no further instructions, and the participants have to be able to uncover the message that has been encoded in the media.

###Example

*To-Do*

##Getting Started

*To-Do*

##Sources/See More
[Steganography and Wikipedia](https://en.wikipedia.org/wiki/Steganography)

[Steganography](https://en.wikipedia.org/wiki/Steganography)
18 changes: 9 additions & 9 deletions web/README.md
Original file line number Diff line number Diff line change
@@ -1,25 +1,25 @@
#Web

Web challenges in CTF competitions usually involve the use of HTTP (or similar protocols) and technologies involved in information transfer and display over the internet like PHP, CMS's (e.g. Django), SQL, Javascript, and more. There are many tools used to access and interact with the tasks which are usually hosted on servers which are then connected to by the client, typically the competitor. Although web browsers are the most common and well known way of interacting with the internet, tools like `curl` and `nc` allow for extra options and parameters to be passed and utilized.
Web challenges in CTF competitions usually involve the use of HTTP (or similar protocols) and technologies involved in information transfer and display over the internet like PHP, CMS's (e.g. Django), SQL, Javascript, and more. There are many tools used to access and interact with the web tasks, and choosing the right one is a major facet of the challenges. Although web browsers are the most common and well known way of interacting with the internet, tools like `curl` and `nc` allow for extra options and parameters to be passed and utilized.

###Example

*Need a Server*
*To-Do (need a website/server)*

##Detection
##Getting Started

Web challenges are usually easy to find and reach, as they are always presented as either urls, `www.example.com`, or IP addresses, `127.0.0.1:8080`. Some may require special services like telnet or netcat, `nc`, to work correctly, but in general most work in the web browser.
###Command Line and the Web

##Command Line and the Web
If you are running linux and want extended functionality (like passing custom headers) in web challenges, bash (terminal) commands are your best bet. `cURL` is a simple but extensible [command-line tool for transferring data using various protocols](https://en.wikipedia.org/wiki/CURL), and allows users to use HTTP to interact with servers, including [POST and GET methods](https://en.wikipedia.org/wiki/HTTP#Request_methods).

If you are running linux and want extended functionality (like passing custom headers and parameters) in web challenges, bash (terminal) commands are your best bet. `cURL` is a simple but extensible [command-line tool for transferring data using various protocols](https://en.wikipedia.org/wiki/CURL), and allows users to use HTTP to interact with servers, including [POST and GET methods](https://en.wikipedia.org/wiki/HTTP#Request_methods).