Encoding and encryption – the difference that solves crypto-tacks
Before breaking something, you need to clearly separate two concepts. The confusion between coding and encryption is the cause of the lost watch on every second CTF. Read more in our guide to creating ctf tasks.
Coding is the...
Installation and first launch of Burp Suite Community
Burp Suite Community Edition is free and covers everything you need for CTF: Proxy with interception, Repeater, Intruder (with speed limit), Decoder, Comparer. The installer swings with portswigger.net and already includes Java - you do not...
Why compare TryHackMe and Hack The Box
Virtual security laboratories are dozens: VulnHub, PentesterLab, PortSwigger Academy, OverTheWire. But TryHackMe and Hack The Box are the only two CTF platforms for beginners that cover the entire path of the pentester from “what is a terminal” to the...
How does OS command injection occur in web applications
OS command injection occurs when a web application transmits custom input directly to a system call without sanitization. In terms of MITRE ATT&CK, a successful command is the Exploit Public-Facing Application (T1190, Initial Access)...
Why Write Bash Scripts for CTF Instead of Ready-Made Frameworks
Three situations in which bash wins against any Python framework or specialized tool. More information in our material about creating ctf tasks.
There is nothing but shell on the target machine. Minimum containers, stripped Docker...
How is path traversal different from LFI
Confusion between these two classes is classics on the CTF. The difference is fundamental, and the choice of payload depends on it.
Path traversal (bypass of directories) – the ability to go beyond the allowed directory and read an arbitrary file on the...
SSRF confirmation: from suspicion to proof-of-concept
Before you go through bypass techniques, prove that the server is running outwards at all at the address from user input. Two scenarios: classic SSRF (the response of the internal service is visible in the application's HTTP response) and...
System checklist: the order of analysis of any stego-task
Russian-language guides on steganography in the CTF usually give a list of utilities: “here is steghide, here is a binwalk, here is an exiftool.” The problem is that the beginner does not understand the order of launch and the moment of...
Three versions of netcat is the first thing to check
Netcat (nc) is a utility for reading and writing data through TCP and UDP connections. On Jeopardy-CTF it is literally the first team: the organizers raise a vulnerable binary, participants are given a string of connection of the species nc...
How to detect serialized data in a CTF task
The first step is to learn how to recognize serialized objects in HTTP traffic. In CTF web, deserialization vulnerabilities hide in cookies, POST parameters, hidden form fields, and custom headlines. Sometimes in the most unexpected places - I once...
Linux Access Rights for Beginners: Base Before Attack
Before you break, you need to understand how the protection is arranged. In Linux, each file and directory has three rights groups: the owner (user), the group (group), the rest (others). Each group receives a combination of three...
How to recognize deserialization vulnerabilities in CTF assignment
Before you build a gadget chain or run yoserial, you need to understand that you have a deserialization. In CTF, this is the first and often decisive step – the authors of the task rarely hang the “unserialize” plaque here. You...
First 60 seconds with pcap: where to start network traffic analysis
Opening a pcap and starting to leaf through the packets from top to bottom is like reading a dictionary from crust to crust to find one word. In CTF tasks on the network of forensics, the file can contain thousands of packages...
Types of SQL injections in web CTF tasks
SQL injections in CTF directly correspond to the third line OWASP Top 10 (A03:2021 – Injection) and consistently occupy the first place in the frequency of appearance in the web-category of competitions. But if three years ago was enough ' OR 1=1 --, now...
OpenAI is taking its dedicated cyber tools to one of the world's most attacked infrastructures. The company will give Ukrainian professionals access to the Daybreak program to speed up the search for vulnerabilities and protect civilian critical infrastructure.
OpenAI has signed an agreement...
The monitoring system, which should monitor the corporate infrastructure, itself can open the attacking road inside the network. SolarWinds has closed a critical vulnerability in Observability Self-Hosted, allowing you to remotely run code without a password and account.
The problem was...
Two billion parameters are now placed not in the server rack and not even in the smartphone, but right in the frame of the glasses. PrismML showed the Bonsai multimodal model, which locally works on smart glasses with the Qualcomm Snapdragon AR1 Gen 1 platform and is able to analyze in real time...
The public form for collecting leads was enough for someone else's instruction to get inside Salesforce and forced the corporate AI agent to withdraw CRM data without a single employee click. Zenity Labs has revealed the SalesBleed chain of three Agentforce issues, where the Web-to-Lead external...
European officials are increasingly looking at the work computer as part of the strategic infrastructure, and the Netherlands decided to collect for civil servants their own alternative to the usual Windows, Microsoft 365 and foreign clouds. The country develops Digitaal Autonome Werkomgeving...
Google has released Chrome 154 with one of the largest security patches in recent years. The developers closed 108 vulnerabilities, and 11 of them received a critical level of danger. The update is already distributed to Windows, MacOS and Linux users.
Critical errors affect several important...
