Capture The Flag 101 - Revision history

Ktamms: /* What is steganography? */

2021-05-05T08:44:21Z

What is steganography?

← Older revision		Revision as of 11:44, 5 May 2021
Line 165:		Line 165:
	Steganography is the art of hiding information in ways that prevent the detection of hidden messages. Steganography, derived from Greek, literally means “covered writing.” It includes a vast array of secret communications methods that conceal the message's very existence. These methods include invisible inks, microdots, character arrangement, digital signatures, covert channels, and spread spectrum communications.		Steganography is the art of hiding information in ways that prevent the detection of hidden messages. Steganography, derived from Greek, literally means “covered writing.” It includes a vast array of secret communications methods that conceal the message's very existence. These methods include invisible inks, microdots, character arrangement, digital signatures, covert channels, and spread spectrum communications.

	The least significant bit (LSB) insertion is a common, simple approach to embedding information in a cover file. Unfortunately, it is vulnerable to even a slight image manipulation. Converting an image from a format like GIF or BMP, which reconstructs the original message exactly (lossless compression) to a JPEG, which does not (lossy compression), and then back could destroy the information hidden in the LSBs.<ref>IEEE (1998) Available at:https://ieeexplore.ieee.org/abstract/document/4655281 Accessed 01-05-2021</ref> LSB works by changing the very last bit of a byte in a pixel. In a 24 bit image, each pixel represents 3 bytes and by changing the last bit of those bytes you create a very insignificant change in the image itself. Since the change is so small if you compare the modified image with the original one the human eye can not tell the difference. However, the modified file can be later decoded by a computer in order to reveal the hidden message.		The least significant bit (LSB) insertion is a common, simple approach to embedding information in a cover file. Unfortunately, it is vulnerable to even a slight image manipulation. Converting an image from a format like GIF or BMP, which reconstructs the original message exactly (lossless compression) to a JPEG, which does not (lossy compression), and then back could destroy the information hidden in the LSBs.<ref>IEEE (1998). Available at:https://ieeexplore.ieee.org/abstract/document/4655281 Accessed 01-05-2021</ref> LSB works by changing the very last bit of a byte in a pixel. In a 24 bit image, each pixel represents 3 bytes and by changing the last bit of those bytes you create a very insignificant change in the image itself. Since the change is so small if you compare the modified image with the original one the human eye can not tell the difference. However, the modified file can be later decoded by a computer in order to reveal the hidden message.
	In Bit Plane Complexity Segmentation (BPCS), a multi-valued image (P) consisting of n-bit pixels can be decomposed into set of n – binary pictures. Ordinary image data is represented by a pure binary code system which is commonly used in image processing. The important step in BPCS steganography is to find a "complex" region in the vessel image so that data from secret image can be hidden without any suspicion.<ref> Researchgate Available at: https://www.researchgate.net/publication/50346770_Review_Steganography_-_Bit_Plane_Complexity_Segmentation_BPCS_Technique Accessed 03-05-2021</ref> By finding the most complex part of the image the deterioration of the original image becomes even less significant than in the least significant bit insertion.		In Bit Plane Complexity Segmentation (BPCS), a multi-valued image (P) consisting of n-bit pixels can be decomposed into set of n – binary pictures. Ordinary image data is represented by a pure binary code system which is commonly used in image processing. The important step in BPCS steganography is to find a "complex" region in the vessel image so that data from secret image can be hidden without any suspicion.<ref> Researchgate. Available at: https://www.researchgate.net/publication/50346770_Review_Steganography_-_Bit_Plane_Complexity_Segmentation_BPCS_Technique Accessed 03-05-2021</ref> By finding the most complex part of the image the deterioration of the original image becomes even less significant than in the least significant bit insertion.
	A spectrogram is a photograph, image, or diagram of a spectrum. <ref>Available at: https://www.merriam-webster.com/dictionary/spectrogram Accessed 03-05-2021</ref> Messages can be inserted on top of a spectrogram of a normal audio file, and with minor tweaks and adjustments it is very hard if not impossible to tell the difference between the original file and a modified one. The only way to find out whether something is hidden in a file is to look at the file's spectrogram.		A spectrogram is a photograph, image, or diagram of a spectrum. <ref>Merriam Webster. Available at: https://www.merriam-webster.com/dictionary/spectrogram Accessed 03-05-2021</ref> Messages can be inserted on top of a spectrogram of a normal audio file, and with minor tweaks and adjustments it is very hard if not impossible to tell the difference between the original file and a modified one. The only way to find out whether something is hidden in a file is to look at the file's spectrogram.

	===Common steganography challenges in CTF's===		===Common steganography challenges in CTF's===

Ktamms: /* Packet analysis */

2021-05-05T08:43:53Z

Packet analysis

← Older revision		Revision as of 11:43, 5 May 2021
Line 149:		Line 149:
	==Network==		==Network==
	===Packet analysis===		===Packet analysis===
	A packet analyzer or packet sniffer is a computer program or computer hardware such as a packet capture appliance, that can intercept and log traffic that passes over a computer network or part of a network. Packet capture is the process of intercepting and logging traffic. As data streams flow across the network, the analyzer captures each packet and, if needed, decodes the packet's raw data, showing the values of various fields in the packet, and analyzes its content according to the appropriate RFC or other specifications.<ref>Available at: https://en.wikipedia.org/wiki/Packet_analyzer Accessed on 03-05-2021</ref>		A packet analyzer or packet sniffer is a computer program or computer hardware such as a packet capture appliance, that can intercept and log traffic that passes over a computer network or part of a network. Packet capture is the process of intercepting and logging traffic. As data streams flow across the network, the analyzer captures each packet and, if needed, decodes the packet's raw data, showing the values of various fields in the packet, and analyzes its content according to the appropriate RFC or other specifications.<ref>Wikipedia. Available at: https://en.wikipedia.org/wiki/Packet_analyzer Accessed on 03-05-2021</ref>
	A program like Wireshark is a packet analyzer and within it, you can look at all of the network traffic that is passing through your device. These kinds of programs are especially useful for a type of CTF that is called Attack/Defense CTF, in which the users are allowed to attack each other's devices in an attempt to slow the opposition down or to steal flags from them.		A program like Wireshark is a packet analyzer and within it, you can look at all of the network traffic that is passing through your device. These kinds of programs are especially useful for a type of CTF that is called Attack/Defense CTF, in which the users are allowed to attack each other's devices in an attempt to slow the opposition down or to steal flags from them.
	But even most regular CTF's have challenges in them that make use of packet analysis.		But even most regular CTF's have challenges in them that make use of packet analysis.

Vakirj: /* What is steganography? */

2021-05-05T08:39:08Z

What is steganography?

← Older revision		Revision as of 11:39, 5 May 2021
Line 167:		Line 167:
	The least significant bit (LSB) insertion is a common, simple approach to embedding information in a cover file. Unfortunately, it is vulnerable to even a slight image manipulation. Converting an image from a format like GIF or BMP, which reconstructs the original message exactly (lossless compression) to a JPEG, which does not (lossy compression), and then back could destroy the information hidden in the LSBs.<ref>IEEE (1998) Available at:https://ieeexplore.ieee.org/abstract/document/4655281 Accessed 01-05-2021</ref> LSB works by changing the very last bit of a byte in a pixel. In a 24 bit image, each pixel represents 3 bytes and by changing the last bit of those bytes you create a very insignificant change in the image itself. Since the change is so small if you compare the modified image with the original one the human eye can not tell the difference. However, the modified file can be later decoded by a computer in order to reveal the hidden message.		The least significant bit (LSB) insertion is a common, simple approach to embedding information in a cover file. Unfortunately, it is vulnerable to even a slight image manipulation. Converting an image from a format like GIF or BMP, which reconstructs the original message exactly (lossless compression) to a JPEG, which does not (lossy compression), and then back could destroy the information hidden in the LSBs.<ref>IEEE (1998) Available at:https://ieeexplore.ieee.org/abstract/document/4655281 Accessed 01-05-2021</ref> LSB works by changing the very last bit of a byte in a pixel. In a 24 bit image, each pixel represents 3 bytes and by changing the last bit of those bytes you create a very insignificant change in the image itself. Since the change is so small if you compare the modified image with the original one the human eye can not tell the difference. However, the modified file can be later decoded by a computer in order to reveal the hidden message.
	In Bit Plane Complexity Segmentation (BPCS), a multi-valued image (P) consisting of n-bit pixels can be decomposed into set of n – binary pictures. Ordinary image data is represented by a pure binary code system which is commonly used in image processing. The important step in BPCS steganography is to find a "complex" region in the vessel image so that data from secret image can be hidden without any suspicion.<ref> Researchgate Available at: https://www.researchgate.net/publication/50346770_Review_Steganography_-_Bit_Plane_Complexity_Segmentation_BPCS_Technique Accessed 03-05-2021</ref> By finding the most complex part of the image the deterioration of the original image becomes even less significant than in the least significant bit insertion.		In Bit Plane Complexity Segmentation (BPCS), a multi-valued image (P) consisting of n-bit pixels can be decomposed into set of n – binary pictures. Ordinary image data is represented by a pure binary code system which is commonly used in image processing. The important step in BPCS steganography is to find a "complex" region in the vessel image so that data from secret image can be hidden without any suspicion.<ref> Researchgate Available at: https://www.researchgate.net/publication/50346770_Review_Steganography_-_Bit_Plane_Complexity_Segmentation_BPCS_Technique Accessed 03-05-2021</ref> By finding the most complex part of the image the deterioration of the original image becomes even less significant than in the least significant bit insertion.
	A spectrogram is a photograph, image, or a diagram of a spectrum <ref>Available at: https://www.merriam-webster.com/dictionary/spectrogram Accessed 03-05-2021</ref> Messages can be inserted on top of a spectrogram of a normal audio file, and with minor tweaks and adjustments it is very hard if not impossible to tell the difference between the original file and a modified one. The only way to find out whether something is hidden in a file is to look at the file's spectrogram.		A spectrogram is a photograph, image, or diagram of a spectrum. <ref>Available at: https://www.merriam-webster.com/dictionary/spectrogram Accessed 03-05-2021</ref> Messages can be inserted on top of a spectrogram of a normal audio file, and with minor tweaks and adjustments it is very hard if not impossible to tell the difference between the original file and a modified one. The only way to find out whether something is hidden in a file is to look at the file's spectrogram.

	===Common steganography challenges in CTF's===		===Common steganography challenges in CTF's===

Vakirj: /* Packet analysis */

2021-05-05T08:38:40Z

Packet analysis

← Older revision		Revision as of 11:38, 5 May 2021
Line 149:		Line 149:
	==Network==		==Network==
	===Packet analysis===		===Packet analysis===
	A packet analyzer or packet sniffer is a computer program or computer hardware such as a packet capture appliance, that can intercept and log traffic that passes over a computer network or part of a network. Packet capture is the process of intercepting and logging traffic. As data streams flow across the network, the analyzer captures each packet and, if needed, decodes the packet's raw data, showing the values of various fields in the packet, and analyzes its content according to the appropriate RFC or other specifications. <ref>Available at: https://en.wikipedia.org/wiki/Packet_analyzer Accessed on 03-05-2021</ref>		A packet analyzer or packet sniffer is a computer program or computer hardware such as a packet capture appliance, that can intercept and log traffic that passes over a computer network or part of a network. Packet capture is the process of intercepting and logging traffic. As data streams flow across the network, the analyzer captures each packet and, if needed, decodes the packet's raw data, showing the values of various fields in the packet, and analyzes its content according to the appropriate RFC or other specifications.<ref>Available at: https://en.wikipedia.org/wiki/Packet_analyzer Accessed on 03-05-2021</ref>
	A program like Wireshark is a packet analyzer and within it, you can look at all of the network traffic that is passing through your device. These kinds of programs are especially useful for a type of CTF that is called Attack/Defense CTF, in which the users are allowed to attack each other's devices in an attempt to slow the opposition down or to steal flags from them.		A program like Wireshark is a packet analyzer and within it, you can look at all of the network traffic that is passing through your device. These kinds of programs are especially useful for a type of CTF that is called Attack/Defense CTF, in which the users are allowed to attack each other's devices in an attempt to slow the opposition down or to steal flags from them.
	But even most regular CTF's have challenges in them that make use of packet analysis.		But even most regular CTF's have challenges in them that make use of packet analysis.

Vakirj: /* What is "PWN"? */

2021-05-05T08:38:27Z

What is "PWN"?

← Older revision		Revision as of 11:38, 5 May 2021
Line 117:		Line 117:

	PWN is one of the genres of CTFs. It is a problem that exploits a vulnerability in a program to access and manipulate memory areas that are not normally accessible and obtain flags. It is also known as Exploit.		PWN is one of the genres of CTFs. It is a problem that exploits a vulnerability in a program to access and manipulate memory areas that are not normally accessible and obtain flags. It is also known as Exploit.
	The format of the problem is to connect to the server where the vulnerable program is located or running via ssh or nc and crack it. Since we cannot prepare a server for cracking this time, here is the source code of the program to be cracked. You can compile it at hand and try it. ~~Incidentally~~, the Pwn problem often shows the source code of vulnerable programs.		The format of the problem is to connect to the server where the vulnerable program is located or running via ssh or nc and crack it. Since we cannot prepare a server for cracking this time, here is the source code of the program to be cracked. You can compile it at hand and try it. Incidentally, the Pwn problem often shows the source code of vulnerable programs.

	=== Tool ===		=== Tool ===

Vakirj: /* Packet analysis */

2021-05-05T08:38:05Z

Packet analysis

← Older revision		Revision as of 11:38, 5 May 2021
Line 149:		Line 149:
	==Network==		==Network==
	===Packet analysis===		===Packet analysis===
	A packet analyzer or packet sniffer is a computer program or computer hardware such as a packet capture appliance, that can intercept and log traffic that passes over a computer network or part of a network.~~[1]~~ Packet capture is the process of intercepting and logging traffic. As data streams flow across the network, the analyzer captures each packet and, if needed, decodes the packet's raw data, showing the values of various fields in the packet, and analyzes its content according to the appropriate RFC or other specifications. <ref>Available at: https://en.wikipedia.org/wiki/Packet_analyzer Accessed on 03-05-2021</ref>		A packet analyzer or packet sniffer is a computer program or computer hardware such as a packet capture appliance, that can intercept and log traffic that passes over a computer network or part of a network. Packet capture is the process of intercepting and logging traffic. As data streams flow across the network, the analyzer captures each packet and, if needed, decodes the packet's raw data, showing the values of various fields in the packet, and analyzes its content according to the appropriate RFC or other specifications. <ref>Available at: https://en.wikipedia.org/wiki/Packet_analyzer Accessed on 03-05-2021</ref>
	A program like Wireshark is a packet analyzer and within it, you can look at all of the network traffic that is passing through your device. These kinds of programs are especially useful for a type of CTF that is called Attack/Defense CTF, in which the users are allowed to attack each other's devices in an attempt to slow the opposition down or to steal flags from them.		A program like Wireshark is a packet analyzer and within it, you can look at all of the network traffic that is passing through your device. These kinds of programs are especially useful for a type of CTF that is called Attack/Defense CTF, in which the users are allowed to attack each other's devices in an attempt to slow the opposition down or to steal flags from them.
	But even most regular CTF's have challenges in them that make use of packet analysis.		But even most regular CTF's have challenges in them that make use of packet analysis.

Vakirj: /* Sample Problem */

2021-05-05T08:37:50Z

Sample Problem

← Older revision		Revision as of 11:37, 5 May 2021
Line 137:		Line 137:

	We can see that this program works right way if the value of secret is 0xc0deface. However, the value of secret is 0. Moreover, there is no code to rewrite it. How do I rewrite it?		We can see that this program works right way if the value of secret is 0xc0deface. However, the value of secret is 0. Moreover, there is no code to rewrite it. How do I rewrite it?
	As the name of the problem implies, we make it overflow. In line 8, you do strcpy, which rewrites the outside of buf when the input size is larger than the size of buf. Let's actually give it a value of 16 bytes or more.		As the name of the problem implies, we make it overflow. In line 8, you do strcpy, which rewrites the outside of buf when the input size is larger than the size of buf. Let's actually give it a value of 16 bytes or more.
	[[File:Image5 oevrflow1.png]]		[[File:Image5 oevrflow1.png]]

Vakirj: /* Sample Problem */

2021-05-05T08:37:28Z

Sample Problem

← Older revision		Revision as of 11:37, 5 May 2021
Line 89:		Line 89:

	File and String Commands		File and String Commands
	Let's take an example of a file whose file format is ~~not known~~, and check the output of the ~~File~~ command.		Let's take an example of a file whose file format is unknown, and check the output of the ''file'' command.

	[[File:image1 file.png]]		[[File:image1 file.png]]

	When we execute the ~~File~~ command, we get the following output. Let's interpret the result. First of all, the "PE32 executable" part indicates the format of the executable file. The PE format is an executable file format used in Windows. The "Intel 80386 MS Windows" part indicates the supported CPU architecture and OS. We can see that they are for i386 and Windows, respectively.		When we execute the command, we get the following output. Let's interpret the result. First of all, the ''PE32 executable'' part indicates the format of the executable file. The PE format is an executable file format used in Windows. The ''Intel 80386 MS Windows'' part indicates the supported CPU architecture and OS. We can see that they are for i386 and Windows, respectively.

	Extracting strings can also increase your knowledge of the binary being analyzed. In the case of ~~very beginner~~ CTF problems, the string extracted from the file may contain FLAGs as is. For example, if you see the string "Correct!" or "Wrong...", you can guess that there might be a correct/incorrect question in the vicinity ~~to get the FLAG. If you see "Wrong! If you see "Wrong...", you can guess that there might be a correct/incorrect question~~ to get the FLAG.		Extracting strings can also increase your knowledge of the binary being analyzed. In the case of newbie CTF problems, the string extracted from the file may contain FLAGs as is. For example, if you see the string "Correct!" or "Wrong...", you can guess that there might be a correct/incorrect question in the vicinity to get the FLAG.
	~~For example, if you use~~ the ~~String~~ command to answer the question "Can you read? ~~which~~ was asked in CTF for beginners~~, let~~'s try to explain it using ~~the String~~ command.		You could have used the ''string'' command to answer the question "Can you read?" that was asked in a CTF for beginners. Let's try to explain it using this command.

	[[File:image2 string.png]]		[[File:image2 string.png]]

	Many of the strings are meaningless because they are image files.		Many of the strings are meaningless because they are image files.
	We know in advance that the flags are all in the form ctf4B{FLAG}.		We know in advance that the flags are all in the form ''ctf4B{FLAG}''.
	Let's use the ~~Grep~~ command to extract the string starting with "ctf4b".		Let's use the ''grep'' command to extract the string starting with "ctf4b".

	[[File:image3 string grep.png]]		[[File:image3 string grep.png]]

Kekonn: /* Sample Problem */

2021-05-05T08:33:31Z

Sample Problem

← Older revision		Revision as of 11:33, 5 May 2021
Line 136:		Line 136:
	[[File:image4 c.png]]		[[File:image4 c.png]]

	We can see that this ~~problem is good~~ if the value of secret is 0xc0deface. However, the value of secret is 0. Moreover, there is no code to rewrite it. How do I rewrite it?		We can see that this program works right way if the value of secret is 0xc0deface. However, the value of secret is 0. Moreover, there is no code to rewrite it. How do I rewrite it?
	As the name of the problem implies, we make it overflow. In line 8, you do strcpy, which rewrites the outside of buf when the input size is larger than the size of buf. Let's actually give it a value of 16 bytes or more.		As the name of the problem implies, we make it overflow. In line 8, you do strcpy, which rewrites the outside of buf when the input size is larger than the size of buf. Let's actually give it a value of 16 bytes or more.
	[[File:Image5 oevrflow1.png]]		[[File:Image5 oevrflow1.png]]

Kekonn: /* Sample Problem */

2021-05-05T08:32:28Z

Sample Problem

← Older revision		Revision as of 11:32, 5 May 2021
Line 128:		Line 128:
	=== Sample Problem ===		=== Sample Problem ===

	This time, I'm referring to a problem from ~~a permanent~~ CTF called PicoCTF.		This time, I'm referring to a problem from CTF web site called PicoCTF.
	PicoCTF is a CTF that is designed for beginners, and it is a great place to learn CTF.		PicoCTF is a CTF that is designed for beginners, and it is a great place to learn CTF.
	If you want to try CTF, you should definitely try it.		If you want to try CTF, you should definitely try it.