A hands-on way to learn security by solving safe, organizer-made puzzles.
Today, we will look at what CTF players do, how this lab works, and two real challenge examples.
Credits: IERG 4851 course outline and Software Security reference by Professor Zhou Yajin · picoCTF / CyLab Security Academy · CTFtime task 9569 · Glory of the Garden writeup · OverFlow 0 writeup
The organizer gives you a file, program, website, or dataset. You look for clues, make a guess, test it in the allowed environment, and submit a flag.
The organizer gives you one isolated target and tells you the rules.
You might find them in code, files, logs, metadata, or program behaviour.
You make a sensible guess about what the clues are telling you.
You submit the exact string that proves your idea was right.
Here is all you get: a JPEG image and this line: “This garden contains more than it seems.”
We got an image, not a live website. The hint tells us there may be more here than we can see.
Search the supplied image for readable text. A JPEG can carry metadata, comments, or extra data.
In this verified file, the flag starts at byte 2,295,150. Look for the complete flag format, then submit it.
A file can hold more than its normal viewer shows. The useful habit is asking, “what else is in this file?”
This is the actual CTFtime listing. Before we pick a tool, the first question is always: what did the task give us?
The page gives the title, category, 100 points, the exact goal, a shell-server path, and a Source link.
Different Pwn tasks package resources differently. Some give a binary only; some also give source; some give a remote service. Read the task page first.
Open ~/pwn-basics and complete the six numbered tasks in order. This is not graded: it helps us understand the class's starting point.
Read the README.md in each folder and write a short answer for its questions. Use normal observation tools such as file, readelf, objdump, and gdb.
Submit your report on Blackboard by 23:59, 17 September, before the next class. This report is not graded.
Read the supplied program or binary. Record the command you used and a one- or two-sentence answer.
Use file and readelf -h. Is it ELF32 or ELF64? Which CPU architecture and entry point does it report?
Use objdump -d -M intel. Which registers carry arguments 1-6 on x86-64 Linux? Where is argument 7?
Inspect the conditional comparison in is_class_key. Which jump selects the non-matching path? Confirm with normal input.
These are still observation and reasoning tasks. We will teach exploitation techniques later in the term.
Break at inspect_stack. Where is greeting stored, and how much stack space did the compiler reserve?
Read the source. How many bytes can name hold, and why is an unbounded copy unsafe? Suggest a bounded replacement.
Use readelf -W -l. What permission does GNU_STACK show, and why is it relevant to this local demonstration?
Use the personal account created for you. Your work stays in your own home directory.
u + your student ID
Announced in class
Announced in class
Your personal home directory