Capture the flag 2013 • Hacker News Board

Re: Capture the flag 2013

#21

Post by dkokelley » Tue, Jul 09, 2013, 3:35 PM UTC

mjolk wrote: post #10

This will be interesting to see when finished, but it would be better if each 'Fortress" had to offer services, instead of dictating that each camp has to run POP + Wordpress + some bullshit plugins. Also, this type of activity definitely will break terms of service for internet service and hosting providers, as well as potentially several laws.

> "...this type of activity definitely will break terms of service for internet service and hosting providers, as well as potentially several laws."

How so? Is the activity itself inherently against TOS or laws? It seems to me that by running the competition, ctf365 intends to have users purposefully exploit sandboxed systems.

Re: Capture the flag 2013

#22

Post by dkokelley » Tue, Jul 09, 2013, 3:38 PM UTC

Buzaga wrote: post #18

wish I knew anything about hacking to play this, just know development :( setting up the server would be some work to me already

It might be a great learning opportunity then. Check out some tutorials and see what sort of security considerations go into setting up and running a server.

Re: Capture the flag 2013

#23

Post by grey-area » Tue, Jul 09, 2013, 3:38 PM UTC

gailees wrote: post #9

Love it. But very janky website makes me worried about the quality.

It's a good illustration of a misuse of the webapp single-page formula for a simple informational site. This could have been simple HTML with a proper url for each page, so that you could actually link to the subpages, but instead they're trying to load the content in with js, and performing terribly with no feedback on clicks when I last looked.

The actual content is here (and loads pretty quick as it should):

http://ctf365.com/pages/game http://ctf365.com/pages/rules http://ctf365.com/pages/prize

Looks like a rails site, not sure what all the gmaps code is all about, perhaps backend pages?

A fun idea, but I'd prefer if they just specified a simple set of services that you have to support, say something like:

IMAP

Serve this json

Serve this html and let people edit it

Serve this information from any db and let people edit it

and leave the backends to people's imagination. It sounds like they're going to actually specify different CMSs etc, and installing browsers?!?, when they should be specifying what protocols and data are required - that would let you use whatever service and backend tools you wanted.

The maps on the blog look pretty though.

Re: Capture the flag 2013

#24

Post by Hello71 » Tue, Jul 09, 2013, 3:46 PM UTC

stephengillie wrote: post #20

Buzaga wrote: post #18

wish I knew anything about hacking to play this, just know development :( setting up the server would be some work to me already

Hopefully they'll at least link to good configuration sites for each service, to give new players at least a fighting chance. I wonder how long it would take someone to spin up a script to install all of these services... SMTP, POP, IMAP, FTP, etc., one CMS + specific plugins, 2 different internet browsers, 3 web applications & at least 2 different databases So...a mail server, file servers, multi-webhost, databases,…

curl and wget, right?

Re: Capture the flag 2013

#25

Post by talmand » Tue, Jul 09, 2013, 3:50 PM UTC

dkokelley wrote: post #21

mjolk wrote: post #10

This will be interesting to see when finished, but it would be better if each 'Fortress" had to offer services, instead of dictating that each camp has to run POP + Wordpress + some bullshit plugins. Also, this type of activity definitely will break terms of service for internet service and hosting providers, as well as potentially several laws.

> "...this type of activity definitely will break terms of service for internet service and hosting providers, as well as potentially several laws." How so? Is the activity itself inherently against TOS or laws? It seems to me that by running the competition, ctf365 intends to have users purposefully exploit sandboxed systems.

I would imagine one example could be a website hosted by a third party. Possibly you would have to inform the host of the situation and get their approval. Otherwise you might be breaking a generic law about gaining unauthorized access to a computer.

Re: Capture the flag 2013

#26

Post by talmand » Tue, Jul 09, 2013, 4:01 PM UTC

kyle_martin1 wrote: post #16

Interestingly, they're using the same technique for the cloud effect as that Japanese energy drink site that was posted here not too long ago.

I hope their use of imagery from the Captain America movie is covered under fair use or derivative work.

http://comicbookmarks.com/wp-content/uploads/2011/08/detail-...

Re: Capture the flag 2013

#27

Post by mjolk » Tue, Jul 09, 2013, 4:18 PM UTC

dkokelley wrote: post #21

mjolk wrote: post #10

This will be interesting to see when finished, but it would be better if each 'Fortress" had to offer services, instead of dictating that each camp has to run POP + Wordpress + some bullshit plugins. Also, this type of activity definitely will break terms of service for internet service and hosting providers, as well as potentially several laws.

> "...this type of activity definitely will break terms of service for internet service and hosting providers, as well as potentially several laws." How so? Is the activity itself inherently against TOS or laws? It seems to me that by running the competition, ctf365 intends to have users purposefully exploit sandboxed systems.

How do you define a 'sandboxed' system? What if I choose to run the Wordpress/Django/Drupal/Whatever-CMS on a shared host? Cracking tools don't often take into account the negative effects on non-target hosts, nor are they generally tolerated by shell providers.

For example, see 'Prohibited Usage' for Linode: https://www.linode.com/tos.cfm

Unless you're paying for raw bandwidth, you're subject to the ToS of each resource provider along the way.

Re: Capture the flag 2013

#28

Post by grimtrigger » Tue, Jul 09, 2013, 4:32 PM UTC

Is there anything to stop me from signing up random people's websites?

Re: Capture the flag 2013

#29

Post by Buzaga » Tue, Jul 09, 2013, 4:44 PM UTC

dkokelley wrote: post #22

Buzaga wrote: post #18

wish I knew anything about hacking to play this, just know development :( setting up the server would be some work to me already

It might be a great learning opportunity then. Check out some tutorials and see what sort of security considerations go into setting up and running a server.

sure I'd love to, but I wonder how do you guys keep up, I feel pretty swamped in news, own projects(maintaining 1, like 4 or 5 to start) and work :/

Re: Capture the flag 2013

#30

Post by joyeuse6701 » Tue, Jul 09, 2013, 4:50 PM UTC

I don't think there is anywhere on the website that explicitly tells you what the objective of this is, nor exactly what a flag is (even if it is more of a concept). As much as I can infer from it, in game instructions, they should be explicit.