Written by Gábor Pék
Summer just started in 2011, when Gábor Pék, Buherátor and Bencsáth Boldizsár (aka “Boldi”) decided to do some nice hacking over the summer instead of going to splash in Lake Balaton all summer long. The annual international university hacking competition called iCTF was a big challenge with top competing teams. These guys needed to pull up their socks to have a chance.
The guys were not new in hacking, but they never considered to compete before. They were typical self-taught hackers, reading blogs and hacker news, never learnt hacking in the classroom. They wanted to get better, so they assembled a cherry-picked
a list of security topics to practice for the competition.
- Basic hacking tools: nessus, nmap, nikto, dirbuster, acunetix
- Operating system tools: bash, perl, python, process explorer, sysinternals tools
- Web hacking magic: sql injection, XSS, CSRF, cookie jacking, session hijacking
- Memory-based vulnerabilities: rop, bof, format string
- Hacks of the year: sony, anonymous, lulzsec
- Targeted attacks and APTs (advanced persistent threat)
- Malware disassembly
- Forensics: volatility
- Network handling: proxy, channeling
- Certificates, OTP
- Social network hacks: spear phishing, social spam
- Google hack DB
Most people were enjoying their vacation, but a small group of motivated students joined the effort. By September, the guys held regular meetings on Thursdays rigorously reviewing tools and hacks (with the help of some pizza and beer). The days of the iCTF 2011 competition came and the team finished 36th (named as Team.iCTF.CrySyS.A).
I think, this was the beginning of a beautiful friendship!
How did we get from this first CTF competition to compete twice at the DefCon finals? We will tell you in the next post.
In the meantime, we are creating awesome tutorial challenges for you to try some of these hacker tools. Check out the hacking tools above in the list and comment if you want to suggest some tools.
How can we make security education a whole lot more accessible and fun? The tutorial framework is the answer. In this article we dive into how to create interactive learning environments running inside containers. The Phantom Menace Something is not quite right with...
Containers have been around for over a decade. Yet before Docker’s explosive success beginning in 2013 they were not wide-spread or well-known. Long gone are the days of chroot, containers are all the rage, and with them we have a whole new set of development and...
Cybersecurity: a tough reality Cybersecurity is an inherently negative asset. As with any protective measure, the major challenge is to measure the value (or Return on Investment, ROI) of cybersecurity. It is significantly more difficult to make this value apparent to...