You may know what a CTF is already, but do you know what kind of skills you need? Skills pertaining to the computer, even physical security. In this episode, episode 2, we talk about what skills are needed to compete and be at least competitive for CTF. Let's get started. Hi everyone, my name is Grant Collins. This is episode 204. We'll redress the whole topic in the concept behind capture the flag. Capture the flag is an organized event or game used to sharpen your skills, learn, train, and use hands-on experience for different tools and different collaboration efforts with teams. Now you may be thinking, That's all great, but what kind of skills do you need in order to really be good at a CTF? The outline and episode 1 CTF pose challenges for students and professionals like ourselves. Different challenges ranging from programming to forensics to anything of that. Having a knowledge of various topics and types of attacks, vulnerabilities, things of that. There's a bunch of skills. What I'm trying to say here, there's a bunch of

skills that are required to be good for a CTF and to be really competitive in one for CTF. Here are some of the skills that you will need to have developed: programming knowledge, behind cryptography, familiarity in exploitation techniques, Linux distributions, an idea of forensics, and knowledge of the reverse engineering process. Let's break these down further. For programming, you need to have an understanding behind how to read syntax, understanding the logic behind a program, and attempt to reverse-engineer certain techniques. If you are wondering if you should learn programming for cybersecurity or resources to use and languages to learn, I recommend you check out my three-part episode series linked in the cards or in the description below. For cryptography, you need to have an understanding behind the fundamentals behind cryptography. You will have to decipher strings of texts and also understand how to encrypt and decrypt specific messages, so you're really going to need to be good at programming too for cryptography, as alarming as that may sound. So, programming is definitely an emphasis and something that I emphasize.

students start learning right now. There are several different types of exploitation techniques, including binary, web-based, network, and software. Each type of exploitation can be seen and utilized around each CTF, regardless of whether it's a jeopardy style or attack-defense CTF. So, having knowledge behind all of these different types of expectations is very important. Let's go ahead and address just a few examples of what each exploitation is, so you know just having a working understanding and a knowledge of what it is. So, let's go ahead and start with the binary exploitation. So, binary exploitation is commonly used through the attack method of memory corruptions, and a memory corruption is a common binary exploitation technique which can enable an attacker to gain unauthorized privileges to a system and inject their very own scripts. For web-based expectations, we have tons of attacks that we can use here. Just three examples, we have buffer overflow. While a program is a right-angle to a buffer, that buffer's boundaries overran and overwrites into the memory. We have SQL injections. SQL statements are inserted into an entry field of

execution in a database, also known as like a database dump or data dump. Trust site scripting, malicious scripts are injected into trusted app web applications and twigs. Give you an example of some tools we have: nmap, Wireshark, and Metasploit. And these are a few common exploitation tools worked for web front web-based vulnerabilities and attacks. We have Network Expo, a great example would be a denial-of-service attack, also known as a DDoS attack, which attempts to overload a resource with hundreds of botnets or hosts. We have worms, which are self-propagating malware, which exploits system vulnerabilities and spreads across the local network. We have ARP spoofing, which is a type of attack that sends falsified ARP messages over the local area network. And to conclude, we have software type expectations. The one that I could come up with really quickly was key loggers. Key loggers are software or hardware programs that track the activities of a keyboard. The next one is Linux distributions need to have a working knowledge behind Linux, as Linux comes in various variations of

operating systems. We're looking to hone our attention to penetration testing-like operating systems. These three systems include Kali Linux, Black Arch Linux, and Arch Linux. I recommend starting with Kali Linux, and if you want to advance on to more particular systems, you could always go into different Linux distributions which offered even more complex penetration testing tools. But honestly, Linux, Kali Linux, is really the way to go. So, forensics. For this skill, you will need to have an understanding behind how information is stored, how to look for certain files or information hidden with other file types. An example of this, a really basic example, could be a picture, right, with a hidden text file within and embedded within the picture. And then you're gonna have to be the one who looks for that text file within the picture. And then we have to have knowledge behind reverse engineering. The reverse engineering, you need to have a working understanding behind what the process is, how it works, how to conduct reverse engineering in the best way as possible. We'll need to utilize reverse engineering for all five of the skills.

above, I think a lot of people look at Engineering. It is not just itself a process, but you have to reverse-engineer programs, things of that nature. So, making sure that you have a knowledge of what reverse engineering is and the process is very important. These are the most common types of skills that you need to have in order to be successful, competitive in a game of CTF. In the next episode, episode 3, I address the platforms that I recommend students use as a starting, a stepping-stone to developing these skills. So, tune in to episode 3 for more information on that. [Music]

What Skills Do You Need in Capture the Flag for Cybersecurity | Capture the Flag Series

What Skills Do You Need in Capture the Flag for Cybersecurity | Capture the Flag Series