CTF101 Documentation

The following tools are commonly used for reverse engineering and disassembly:

• IDA: A highly versatile disassembler supporting most file formats.
• Binary Ninja: An interactive platform for disassembly, decompilation, and debugging.
• GNU Debugger (GDB): A free, open-source debugger used for both disassembly and dynamic analysis.
• radare2: A command-line framework for reverse engineering.
• Hopper: A disassembler and decompiler.

In Capture The Flag (CTF) competitions, cryptography challenges often focus on breaking encryption schemes that have been improperly implemented. While modern cryptography relies on complex mathematical algorithms (such as those derived from modular arithmetic), many vulnerabilities arise from implementation flaws rather than the underlying math itself.

Key concepts to understand for CTF cryptography:

• Modular Arithmetic: The foundation for most modern cryptographic systems.
• Security by Design: Using mathematical problems that are computationally difficult to solve (e.g., the difficulty of factoring large numbers in the RSA algorithm).
• Post-Quantum Cryptography: New standards (released by NIST in August 2024) designed to resist threats from quantum computing.

CTF101 is a documentation site designed to teach the fundamental methodologies and techniques required to participate in Capture The Flag (CTF) competitions. It is maintained by the OSIRIS Lab at New York University in collaboration with CTFd. The handbook covers several core security domains including:

• Forensics
• Cryptography
• Web Exploitation
• Reverse Engineering
• Binary Exploitation

C is a low-level programming language designed to be close to assembly, making it ideal for operating systems and embedded systems. It compiles directly into machine code using compilers like gcc or clang. In the context of CTFs (Capture The Flag), C is frequently used for reverse engineering and exploitation challenges because it lacks many high-level safeguards, requiring developers to manage memory manually.

Commonly used compilers:

• gcc
• clang

#include <stdio.h>
int main()
{
   printf("Hello, World!");
   return 0;
}

The DotNet challenge focuses on two primary technical areas:

1. Disassemblers: Understanding how to translate machine code or bytecode back into human-readable assembly or high-level code.
2. XOR: Understanding the XOR (Exclusive OR) cryptographic operation, which is frequently used in malware and CTF challenges for simple obfuscation or encryption.

When choosing a framework for running a CTF, consider the following options based on your deployment needs:

Open Source Frameworks

• CTFd: Easy to spin up via Docker; suitable for quick local or small-scale instances.
• kCTF: A Google-developed framework built on Kubernetes, featuring built-in load balancing at the platform level.
• rCTF: Developed by redPWN, featuring a dedicated CI/CD module for challenge deployment.

Paid Hosting Services

• CTFd Enterprise: A tiered pricing service providing hosting and on-call support, designed for professional workshops and industry security exercises.
• Hack the Box CTF: A commercial hosting option for CTF competitions.

Binary Security involves using specific tools and methodologies to protect programs from manipulation and exploitation. While no single method is infallible, implementing a combination of these protections significantly increases the difficulty for an attacker to successfully exploit a vulnerability.

Key defensive methods include:

• No eXecute (NX): Prevents code execution in certain memory regions (like the stack or heap).
• Address Space Layout Randomization (ASLR): Randomizes the memory addresses used by key areas of a process to make predicting target addresses harder.
• Relocation Read-Only (RELRO): Protects certain sections of a binary (like the Global Offset Table) from being overwritten.
• Stack Canaries/Cookies: Places a small value on the stack before the return address to detect buffer overflows.