[192.092] Capture The Flag (SE)

Don’t be a Security Tourist... BE A HACKER!

Info

Official course page on TISS.

The course is coordinated by:

• Marco Squarcina aka lavish, web twitter
• Georg Merzdovnik aka georg, twitter
• Mauro Tempesta aka MrStorm, twitter
• Michael Pucher aka cluosh

Communication and announcements on mattermost, please refer to this guide on how to use use Gitlab/Mattermost for collaboration during CTFs.

Send your questions - if any - to ctf@list.tuwien.ac.at.

Meetings

• 15/10, 18:00 - 20:00, FAV Hörsaal 1: Course intro, CTF intro
• 22/10, 17:00 - 20:00, FAV Hörsaal 1, Hack.lu CTF 2019
• 29/10, 17:00 - 20:00, FAV Hörsaal 1, Talks
• 12/11, 17:00 - 20:00, FAV Hörsaal 1, Talks
• 19/11, 17:00 - 20:00, FAV Hörsaal 1, RuCTFe preparation meeting
• 23/11, 10:00 - 20:00, SBA Research (Floragasse 7), RuCTFe 2019
• 26/11, 17:00 - 20:00, FAV Hörsaal 1, Talks
• 10/12, 15:00 - 18:00, GM 8/9 Hörsaal des Internationalen Wiener Motorensymposiums, Talks
• 17/12, 17:00 - 20:00, FAV Hörsaal 1, Talks

List of CTFs

• 19/10 - 20/10: SECCON 2019 CTF (on-line)
• 22/10 - 24/10: Hack.lu CTF 2019 (on-site)
• 26/10 - 27/10: TastelessCTF 2019 (on-line)
• 15/11 - 17/11: ASIS CTF Finals 2019 (on-line)
• 23/11: RuCTFe 2019 (on-site, mandatory attendance to the preparation meeting of November 19 and the entire CTF for those who want to participate)
• 30/11 - 01/12: CTFZone Quals 2019 (on-line)
• 01/12 - 26/12: OverTheWire Advent Bonanza 2019 (on-line, at least 4 different challenges must be played)
• 27/12 - 29/12: hxp 36C3 CTF (on-line)

CTF Participation

As specified in the Course intro, each student is required to attend at least 1 CTF on-site and 3 CTFs overall. On-line attendance is assessed via an individual detailed write-up reporting everything that has been done during the competition, including failed attempts at solving challenges. No write-up is required to prove on-site attendance.

Write-ups must be submitted directly on Gitlab under the directory writeups/<nickname>/ as a single Markdown file called after the CTF. Say, for instance, that your handle is l33th4ck3r and you want to submit the write-up for the SECCON'19 CTF, then just create the file writeups/l33th4ck3r/seccon19.md. If you need to store additional files to complement your write-up, such as scripts or screenshots, add a subfolder (such as writeups/l33th4ck3r/seccon19/) in your own directory and save those files there.

Your write-up file should provide an overall personal consideration of the CTF in retrospective and then a detailed technical analysis of the challenges that you attempted to solve, either successfully or not. A good example of detailed technical analysis of a challenge can be found here.

According to the ECTS breakdown in the lecture description on TISS, one should expect 20h for meetings and 130h of individual project work for preparing the talk (see below), playing CTFs and reporting on them. It follows that if you decide to play 3 CTFs overall, you should invest an average of 40h for each of them. We highly suggest to specify in your write-ups the time spent for each challenge you approached and reported on.

If you feel like one of the tasks you solved is particularly interesting, let us know and we will consider it for publication in the w0y website.

Talks

As part of the evaluation process you are also required to present the solution to a CTF challenge in one of the scheduled meetings. The presentation can be done either individually or as a team of 2 persons. Students teaming up are expected to present more complex challenges than those handled individually. The expected duration of the talk is defined as: * 15 minutes for individual presentations * 30 minutes for team presentations (15 minutes each student)

To book a slot for your talk in one of the meetings listed in the "Tentative Schedule", go to TISS and register in one of the available groups. Keep in mind anyway that there is a limited amount of slots per day, so start booking yours in one of the earliest dates if possible! To get it approved, send a mail to ctf@list.tuwien.ac.at to propose a challenge you would like to discuss along with the chosen date.

Some recommendations for your talk: * Provide an overview of the intended functionalities of the application * Describe all the attempts you made to find the vulnerabilities, including unsuccessful ones (time permitting) * Explain the exploitation steps in an understandable manner * If possible, describe the impact of this security threat in a realistic scenario and discuss possible countermeasures

We have created a public Github repository where you should upload your presentation after giving the talk. Add your slides/material to the directory <ctf_name>-<year>/<challenge_name>/ (e.g., hacklu-2019/rpdg) and issue a pull request when you are done with the changes! Don't forget to add a reference to your challenge in the main README.md file of the repository.

Evaluation

Talks are evaluated according to the following criteria: * adherence to the guidelines above * clarity of the presentation * correctness and understanding of the topic * time management

Similarly, write-ups are evaluated on: * clarity of the write-up * correctness and understanding of the topics * provided level of details