Ask HN: Anyone Interested in Capture the Flag (CTF) Events?

there have been some great CTF[0][1] links here in the past[2] but many of them are from 5 or even 7 years ago[1].

Anyone still actively playing CTF in 2019 and if so what is your experience? Anyone here hosting CTF themselves? Anyone providing advanced puzzles (hardened systems that have no built in flaws?) Anyone building CTF puzzles for IoT? E.g. focus on gateway level protocols such as MQTT, COAP etc?

I played a few times until 2009 but then had other things on my plate. What are the latest & greatest communities today?

thanks ^_^

[0] https://trailofbits.github.io/ctf/intro/

[1] https://media.ccc.de/v/35c3-9989-what_the_flag_is_ctf

[2] https://hn.algolia.com/?query=capture%20the%20flag&sort=byPopularity&prefix&page=0&dateRange=all&type=all

CCC, which you linked to, still actively does CTFs every year, although only when Congress is in session. I found it incredibly difficult but maybe I just suck :) I think most events (ShmooCon, Blackhat, Defcon, BSides, etc) run CTFs during the conference which are accessible to all. I've found https://ctftime.org/ to be a good resource for finding competitions, not so much teams though.

I played HackVent (https://www.hacking-lab.com) in December 2018 and it was a lot of fun. The same site also does HackyEaster which is coming up in a couple of months.

To find CTFs, https://ctftime.org/ is good and has already been mentioned. I've learned about a few on https://www.reddit.com/r/securityCTF/

If you are looking to learn - I highly recommend LiveOverflow's youtube series - https://www.youtube.com/watch?v=iyAyN3GFM7A&list=PLhixgUqwRT...

And a few good places to practice: http://overthewire.org/wargames/ and https://365.csaw.io/

This year's SANS holiday hack was pretty fun, and quite varied: https://www.holidayhackchallenge.com/2018/

Also, http://overthewire.org/ is fun, and https://www.wechall.net/ has a list of several CTFs.

I'm a semi-active member of the Dragon Sector CTF team [1]. We're a competitive security CTF team that's #1 on the ctftime.org ranking for 2018.

CTFs are as active as ever, but a lot of the high-stake ones (at least per ctftime.org) are very much focused on hard core exploitation challenges, and more and more actually include 0days and real-life challenges like browser expolitation (for instance, the 35C3 CTF had a VirtualBox 0day (GL acceleration bug), a logrotate 0day (race condition) and a patched Webkit and Chromium to exploit.

Honestly, the rising exploitation difficulty is what's slowly driving me away from traditional binary challenges - and so, I'm mostly focusing on either obscure architectures, hardware or other weird challenges.

There's more and more 'IoT' challenges as well - like exploiting vulnerable ESP8266 or ARM microcontroller code. I've created a somewhat 'IoT' challenge [2] for WCTF 2018, where you have to exploit a hardware flaw in a remote RISC-V device.

A lot of CTF people are on IRC - try #pwning on Freenode (PPP's channel), or #dragonsector :). If you have a local hackerspace, they might have a CTF team you can join.

[1] - https://dragonsector.pl/

[2] - https://hardflag.q3k.org/