Updates:

  • Added first challenge to prepare
  • We now have an IRC channel! Join us in #SecSE-CTF on Freenode: chat.freenode.net:6667
  • We have a CTFTime team, secse. Please join this.
  • We have a chat room on chat.se which will be closed during competitions to all but team members then re-opened when we have finished for all to see.

So I'm participating in my first CTF at the moment, the biggest challenge is getting a good team together. CTF's contain multiple challenges which are often too much for one, two or three people.

So I was wondering if people were interested in forming a Security Stackexchange CTF team. Nothing competitive, just to have fun and learn from each other.

Currently we have:

CTF TIME

CTF Time is a website dedicated to CTF challenges. We will subscribe a team and we will...

enter image description here

There are basically 4 types of challenges:

  • Exploiting
  • Web
  • Reversing
  • Forensics

And then there are also the occasional misc challenges. So basically we will have people working on each of the categories. Preferably a more experienced person in the field with less experienced people in the field so we can factor in some learning. To be good we should have about 4 people/challenge. A team of 16 people would be ideal. We can rotate the team

Basic Requierements

  • Have at least 400 rep on security.SE or have more than a combined 2000 rep on your network profile in related fields (Crypto,Stackoverflow, Webmasters, Serverfault,... ) sites in an unrelated field (Arqade, The Workplace, ...) do not count!
  • Understanding of Basic TCP/IP
  • Understanding of at least 1 programing (java,c,c++,c#) and 1 scripting language (preferably, php, python, perl or ruby)
  • Have basic understanding of at least one of the topics (knowing what things like XSS or SQL injection are)

Things we need

(I should be able to provide this on my personal systems, but should SE have something like this it would be nice)

  • IRC server with a private channel or a private chatroom on SE
  • A Wiki to centralize all of our learnings.

How much time will this take of me?

You have to know most CTF's last 2 days, to be able to complete a challenge you will need to be able to commit around 4 - 6 hours at least.

Team

This is a team effort, don't expect this thing to be easy, it isn't. It will take a lot of time and might even give you some frustration, but when you are able to decipher a challenge you will be having a digital orgasm.

enter image description here

Code of Conduct

  • Common sense
  • Don't do or share anything illegal
  • Always follow the CTF challenges rules
share
    
Excellent idea. Sadly I'd be no use at this sort of thing any more. –  Rory Alsop Dec 28 '12 at 11:14
    
@RoryAlsop we can use a coordinator :3? –  Lucas Kauffman Dec 28 '12 at 12:17
    
@RoryAlsop you can be team manager! :-) –  AviD Dec 28 '12 at 14:09
    
I'd be keen but I'm a serious noob. I'd do way more learning than helping :) –  OJ. Jan 2 '13 at 5:26
    
I'd be interested in joining in, but my usefulness would largely depend on the nature of the challenges. Most of them (in my experience) tend to be reliant on development for Linux platforms, which I suck at. –  Polynomial Jan 2 '13 at 11:52
    
I have some experience and would be glad to participate. –  Cristian Dobre Jan 3 '13 at 17:42
1  
I'd be interested depending on time and skill commitments needed –  makerofthings7 Jan 3 '13 at 20:44
    
I work as a Linux sysadmin and have little to offer in the way of security expertise. That said, I'm very eager to learn and would love to be part of this. –  Kenny Rasschaert Jan 3 '13 at 20:45
    
As pentesting goes, I'm still pretty much in the n00b stage. But, I welcome a chance to learn. Let me know what I can do to help! –  Iszi Jan 3 '13 at 21:11
    
I have no pentesting/blackhat or forensic experience, and I really need to work on that. I'd like to participate, if I can find the time. –  Gilles Jan 3 '13 at 23:49
    
I don't know how much time I could put towards such a thing, but it would be interesting to do something a bit more team oriented than messing around with hackthissite.org. Being a software architect, I don't get a whole lot of chances lately to practice. –  AJ Henderson Jan 4 '13 at 3:21
    
I'd like to get in on this. Is it possible? –  Everett Jan 4 '13 at 4:03
    
I would also like to participate. –  Dinu S Jan 4 '13 at 13:29
2  
I'd quite like to get involved, but can I be like on the bench? As in, I don't always know what my time commitments are going to be like but I'd be happy to help out if I am free? (I might even change my name back to Ninefingers for this). –  user2213 Jan 4 '13 at 15:24
    
This sounds like fun. I've got mostly C# and C knowledge, and TCP/IP knowledge (used to work as a network admin). My security-related skills are in reverse engineering and binary exploit development (have found/reported holes in a couple things). –  randomdude Jan 10 '13 at 17:16
show 10 more comments

6 Answers

When we get to doing any competitions, I'll create a private channel for the team. I'm leaning toward retroactively putting the channels to "open" at the end of competitions for the sake of sharing knowledge but still giving us a way to compete effectively.

If we don't open things up at the end, it'll have to be an IRC server.

share
6  
Yea I'm actually pro opening everything afterwards, I would also encourage doing writeups of the problems and post them on the blog. –  Lucas Kauffman Jan 4 '13 at 6:57
add comment

Preparing Challenges:

  • This is the first challenge to prepare, it's very easy and requires some very basic crypto and scripting skills. What you need to do is to complete the blowfish level 1 of smash the stack. Go to ssh level1@blowfish.smashthestack.org -p 22 passwd: level1. I will submit the solution by the weekend. It took me about 1 hour to solve it, of which mostly was debugging my script. Solution is here.

Sign in on ctftime.org and apply to https://ctftime.org/team/ look for "security.se"

Upcoming CTF

share
    
For those who don't have access to SSH directly. The description of the challenge is that "GungJnfRnfl" is a simple substitution cypher of the password for Level 2. –  AJ Henderson Jan 10 '13 at 20:29
    
Got it in about 15 minutes by hand. It was simple.:) –  AJ Henderson Jan 10 '13 at 20:49
    
A couple of minutes using an online script. P.S. @Rory Alsop: I am now old enough to join the team (+400Rep) :). –  Dinu S Jan 11 '13 at 15:07
1  
You don't want to know how fast I cracked that. –  Jeff Ferland Jan 17 '13 at 23:20
add comment

Update

They seem to have merged the teams (good job Antony :)), so the links below are mostly dead. The team to join has all three names and can be found here. I am not yet a member - they didn't merge members, so I can't accept anyone to join :(


We have multiple ctftime.org teams :(

Can we all join one? Mostly just so we can have a decent total score, and a log of all our challenges. In the interest of me being lazy, I would like to suggest we all join secse because then I don't have to do anything, as I am already a member :) (it also has the highest score so far of the three teams!)


TLDR: go join https://ctftime.org/team/4193/

share
1  
I've put in a request with CTFTime to see if we can merge the teams. Will update here when I have an answer. –  user2213 Apr 24 '13 at 15:29
1  
In the interest of you being lazy, I've added myself to secse. In the interest of you being a bit less lazy, please confirm my request. :P –  TildalWave Apr 25 '13 at 7:01
    
You are now a member, welcome back :) –  user2213 Apr 25 '13 at 8:54
    
@AntonyVennard woo thanks, logo uploaded and default name changed :P –  lynks Apr 25 '13 at 9:02
    
All but #3585 are 404 –  MMavipc Apr 26 '13 at 1:44
    
As has @MMavipc already pointed out, the teams were merged under the ID 3585. Not sure if the team name was before any different for this ID, but it's now secse (with aliases security.SE and security-SE), so all is fine. My request is still pending tho (and possibly others?). :( –  TildalWave Apr 27 '13 at 15:28
add comment

I can provide a IRC server/ Wiki at a sub domain of my website for the team , I would be interested in being involved but my be constricted by time: I work as a Linux Sysadmin. Can program in C and quite well entrenched in Bash.

share
    
I also have an IRC server as well as a Teamspeak3 and/or Mumble server that I can make available on my dedicated server. My IRC server is part of Dorksnet. –  AJ Henderson Jan 9 '13 at 15:22
add comment

I would like to join too, although I am inexperienced in participating in the competitions I have a very good understanding of networks and protocols that are required.

share
add comment

I recommend documenting what you learn in a way that wont spoil the CTF for future participants. It might even make a nice blog post or series of blog posts.

share
add comment

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .