InfoSec 101 — Part Three (b): Technical Resources for VMs, CTFs, and Online Challenges
Tags: Infosec101, Cybersecurity, Learning, Virtual Machine, Resources

CTFs, Vulnerable VMs, and Blue Team Challenges

CTFs

The Internet is a huge repository of knowledge and we’re so lucky to be in a community that enables and encourages sharing. The most efficient way I’ve been able to learn how to use Kali, or compete in CTFs, is to actually participate in it, but also read walkthroughs from people who have done this previously.

Before I hit you up with a number of useful resources, let me introduce some key concepts first. I’ve mentioned CTFs quite frequently throughout this series, but if you’re unaware of what it is, it stands for ‘Capture the Flag’. In Jeopardy style CTFs, the challenges are presented in categories that tackle a different skill, such as Binary Exploitation, Forensics, Steganography, Web Attacks etc. Your task is to find the flag, that’s usually in the format of “ctf{this_is_the_flag}”. Let’s go through one example together.

For this challenge, we’ve been given a file called “file” and the challenge description is “Grep: Can you find the flag in file? This would be really obnoxious to look through by hand, see if you can find a faster way”. Now, from experience I know that grep is a command line tool that we can use to search a file for a particular string. So let’s do that in our Kali VM:

This is a very basic example of a CTF challenge, where we were given a file and must find the flag. If we were to display the file on it’s own using the ‘cat’ command (this prints the contents of the file to your screen), you’d see what’s shown in the screenshot below. Obviously this isn’t an efficient way to find the flag as you’d have to read the entire contents, which is why grep is a useful tool for this challenge. It searches the file for you based on the search term you provide, which here was “pico”.

Clearly, CTFs can also help develop your Linux skills, which is why I wanted to introduce it here.

Here’s a list of CTFs that you can start practicing on:

The example above was from PicoCTF, which really caters for beginners.

OverTheWire, are a series of ‘wargames’ designed to teach these kinds of skills and lateral thinking. Try out the starter course called ‘Bandit’.

RingZero CTF have challenges in multiple categories that you can get your hands dirty with

CTF Challenges by CherryBlog.

Other resources:

CTFs that have been made available online: http://captf.com/practice-ctf/

All live CTFs are captured on https://ctftime.org/

awesome-ctf: Guide to CTF resources, libraries, tutorials etc.

Look out for CTFs that are run at your local security meet-up; a great way to learn from others!

Write ups are your friend. Google “<CTF name> writeup” and you should instantly find others who’ve written about their CTF experience, and how they’ve solved each challenge. Here’s an example for PicoCTF https://github.com/PlatyPew/picoctf-2018-writeup.

Vulnerable VMs

There are other ways of developing these kinds of skills, such as attempting to hack into vulnerable VMs. A little more difficult, sure, but still very enjoyable and rewarding. The idea is that someone has created a virtual machine that is intentional vulnerable to some kind of attack. Your job is to find this vulnerability, and then exploit it (generally using Kali Linux tools).

Generally, these VMs will be hosted online for you, but there are some services that allow you to download the VM and work off your host machine. Similar to CTF flags, these will be a phrase or a hash that’s provided when you’ve reached a certain stage, or successfully exploited the machine.

Let’s go through the resources:

VulnHub: this was one of the first websites that I came across when starting out in security, where you can download the vulnerable VM onto your host machine. Again, walkthrough’s saved my life. I’d recommend starting with Basic Pentesting 1, and here are the walkthrough’s; 1 and 2.

Hack the Box: a fantastic set of boxes that range from easy to difficult, in either Windows or Linux machines.

Pentester Lab: full disclosure, I’ve never used this myself. But with the amount of positive reviews I’ve heard first hand and by those online, this list would be incomplete without it. This is an affordable resource where you can learn offensive skills from step 1 to advanced.

Again, walkthrough’s are there for you whenever you get stuck, if you want to discover a new technique to achieve the same goal, or if you simply give up and need answers (not recommended, ahem, *try harder*).

Blue Team Challenges

These are for people like me that are thrilled whenever they see a .dd, .pcap, or an image file, or simply want to feel like an investigator. Even though Kali is mostly used for offensive capabilities, there are still tools native to Kali (if not, you can download them using ‘apt-get’) to find flags around forensics, steganography, or reverse engineering.

If this does interest you, here are the websites I’ve used in the past to skill up in different areas:

If you’re still with me for this last section, I wanted to quickly cover some alternate virtual machines that could be handy for these blue team challenges. FLARE VM was developed by the FLARE team from FireEye, and is a Windows-based VM to analyse malware, with static and dynamic analysis tools, and forensic and network utilities.

SIFT Workstation was created by SANS, which is much more focused on the practical applications of Incident Response and Forensics. With tools including log2timeline, volatility, rekall, and SleuthKit, you’re also able to learn the ins and outs of memory analysis, and how to parse forensic artefacts.

Finally, for anyone who has a particular curiosity towards network analysis, there’s a VM called Security Onion that specialises in IDS (intrusion detection system) and NSM (network security monitoring). There’s a particular tool called “Bro”, which has now been renamed to Zeek, which offers a really good opportunity to learn about different networking protocols. It captures traffic that’s running through your network, and separates the log files based on the protocol observed by Bro’s protocol analyser. You can also split a .pcap using Bro, but I’ll save that for another blog post!

Hope you got some use out of this, and thanks for reading. Until next time!