Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DEFCON Capture the Flag Qualification Challenge #1

endgame.com

Post reply on HN
Print view View original

11–18 of 18 posts

Re: DEFCON Capture the Flag Qualification Challenge #1

#11

Post by pachacuti0 »

gear54rus wrote: post #8

Good God. Whenever I read these, I always get chills down my spine. Part of me wants to do the same, get better at it (I know tiny parts of many things including what is discussed here but not even remotely close to the author), the other one just wonders how does one get so good as to perform all this by themselves. Reverse engineering is beautiful :)

Exactly how I feel! It looks awesome, and quite understandable when explained step by step. But I feel that I wouldn't be able to get past the first few steps if I encountered these problems by myself.

Re: DEFCON Capture the Flag Qualification Challenge #1

#13

Post by demallien »

nutate wrote: post #9
gear54rus wrote: post #8

Good God. Whenever I read these, I always get chills down my spine. Part of me wants to do the same, get better at it (I know tiny parts of many things including what is discussed here but not even remotely close to the author), the other one just wonders how does one get so good as to perform all this by themselves. Reverse engineering is beautiful :)

He gave us a bit of a run-through presentation of his tactics for the latest shmoocon CTF. It seemed like it was a combination of time, skill, more time, patience... and skill? The world of reversing is so beyond my ken, but I love having people around who know how to do it. When I asked how to get started, he suggested I just jump into a CTF and try. [edit] I work at endgame (see my other comment), we're hiring, etc…

Http://crackmes.de They have lots of challenges, with difficulty levels going from 1-10, and each challenge has an annotated solution explaining how to crack the program.

Re: DEFCON Capture the Flag Qualification Challenge #1

#15

Post by burstmode »

Kiro wrote: post #14

I love the concept of CTFs but as a web developer (JS/PHP) this is like Greek to me. I presume you need to be a hardcore low-level security hacker to even consider doing CTFs.

Well, if there are people analyzing exploits then there must also be people creating them... :->

Re: DEFCON Capture the Flag Qualification Challenge #1

#16

Post by laichzeit0 »

Kiro wrote: post #14

I love the concept of CTFs but as a web developer (JS/PHP) this is like Greek to me. I presume you need to be a hardcore low-level security hacker to even consider doing CTFs.

I'm not a low-level security hacker but I've created and debugged enough C code in my career to follow exactly what is going on here.

I don't know if I would have been able to derive this solution on my own though, that's where the creativity comes in. However, I'm guessing these CTF challenges are usually kind of "similar" in the same way that ACM programming challenges are. If you do these sort or challenges often enough it should become easier.

Re: DEFCON Capture the Flag Qualification Challenge #1

#17

Post by Eiwatah4 »

Kiro wrote: post #14

I love the concept of CTFs but as a web developer (JS/PHP) this is like Greek to me. I presume you need to be a hardcore low-level security hacker to even consider doing CTFs.

The CTFs I've played usually had a good mix of web stuff and binary exploitation.

Also, the best way to learn this stuff is to do it. Even if this seems out of your league, I'd suggest to just join a team and start playing - if that kind of thing seems interesting to you.

Re: DEFCON Capture the Flag Qualification Challenge #1

#18

Post by hundt »

Kiro wrote: post #14

I love the concept of CTFs but as a web developer (JS/PHP) this is like Greek to me. I presume you need to be a hardcore low-level security hacker to even consider doing CTFs.

Try microcorruption.com--it's pretty accessible to anyone who understands basic C programming concepts (like stacks and null-terminated strings) and the challenges have a nice progression in difficulty and complexity.
Post reply on HN