CTF
Dalam keamanan komputer, Capture the Flag (CTF) adalah kompetisi keamanan komputer. Kontes CTF biasanya dirancang sebagai latihan pendidikan untuk memberikan pengalaman kepada peserta dalam mengamankan mesin, serta melakukan dan bereaksi terhadap jenis serangan yang ditemukan di dunia nyata. Reverse-engineering, network sniffing, protocol analysis, system administration, programming, dan cryptanalysis adalah semua keterampilan yang dibutuhkan oleh kontes CTF sebelumnya di DEF CON. Ada dua gaya utama kompetisi Capture the Flag:
- attack/defense
- jeopardy.
Kompetisi attack/defense, setiap tim diberi mesin (atau jaringan kecil) untuk bertahan di jaringan yang terisolasi. Tim dinilai atas keberhasilan mereka dalam mempertahankan mesin yang ditugaskan dan atas keberhasilan mereka dalam menyerang mesin tim lain. Bergantung pada sifat permainan CTF tertentu, tim dapat mencoba mengambil bendera lawan dari mesin mereka atau tim dapat mencoba memasang bendera mereka sendiri di mesin lawan. Dua dari CTF serangan/pertahanan yang lebih menonjol diadakan setiap tahun di DEF CON, konferensi peretas terbesar, dan NYU-CSAW (Cyber Security Awareness Week), kontes keamanan cyber pelajar terbesar
Kompetisi Jeopardy biasanya melibatkan beberapa kategori masalah, yang masing-masing berisi berbagai pertanyaan dengan nilai poin dan kesulitan yang berbeda. Tim berusaha untuk mendapatkan poin terbanyak dalam kerangka waktu kompetisi (misalnya 24 jam), tetapi tidak langsung menyerang satu sama lain. Daripada berlomba, gaya permainan ini mendorong meluangkan waktu untuk mengatasi tantangan dan memprioritaskan jumlah pengiriman jawaban yang benar dari waktu ke waktu.
Guide
- CTF: Beginner's Guide
- CTF: 8 Ways To Succeed In Your First Capture The Flag (CTF)
- CTF: How To Start With Security Capture The Flag Competitions
- CTF: Field Guide
Referensi
- https://github.com/apsdehal/awesome-ctf
- https://www.endgame.com/blog/how-get-started-ctf
- https://trailofbits.github.io/ctf/
- https://trailofbits.github.io/ctf/vulnerabilities/source.html
- http://ctfs.github.io/resources/
- https://www.vulnhub.com/entry/devrandom-relativity-v101,55/
- http://www.slideshare.net/null0x00/how-to-setup-a-pen-test-lab-and-how-to-play-ctf
- https://github.com/ctfs/resources
- https://github.com/ctfs/resources/tree/master/topics
- https://github.com/ctfs/resources/tree/master/tools
- http://ctfwriteups.blogspot.com/2013/12/basic-tips-on-hacking-challenges-in.html
- https://github.com/Ignitetechnologies/Vulnhub-CTF-Writeups
Latihan
- https://ctf101.org/ # OK buat belajar teori
- https://picoctf.com/ # OK buat belajar teori
- https://ctfacademy.github.io/web/index.htm # OK buat latihan
- https://tryhackme.com/dashboard # agak berat
- https://github.com/tryhackmeltd/docs.tryhackme.com
- https://github.com/Ignitetechnologies/TryHackMe-CTF-Writeups
- https://ctftime.org/
VM Latihan
- https://sourceforge.net/projects/metasploitable/
- https://www.vulnhub.com/?q=easy+CTF
- Stapler: 1 https://www.vulnhub.com/entry/stapler-1,150/
- PwnLab: init https://www.vulnhub.com/entry/pwnlab-init,158/
- hackfest2016: Quaoar https://www.vulnhub.com/entry/hackfest2016-quaoar,180/
- /dev/random: relativity (v1.0.1) https://www.vulnhub.com/entry/devrandom-relativity-v101,55/
- LORD OF THE ROOT: 1.0.1 https://www.vulnhub.com/entry/lord-of-the-root-101,129/
- SKYDOG: 1 https://www.vulnhub.com/entry/skydog-1,142/
- LAMPSECURITY: CTF4 https://www.vulnhub.com/entry/lampsecurity-ctf4,83/
Walkthrough
Stapler: 1
- https://www.vulnhub.com/entry/stapler-1,150/#walkthrough
- https://www.dotnetrussell.com/index.php/2017/05/09/vulnhub-stapler-vm-walkthrough/
- https://jhalon.github.io/vulnhub-stapler1/
- CTF Stapler: Walkthrough
PwnLab: init
- https://www.vulnhub.com/entry/pwnlab-init,158/#walkthrough
- https://www.abatchy.com/2016/11/pwnlab-init-walkthrough-vulnhub.html
- CTF PwnLab: init: Walkthrough
hackfest2016: Quaoar
- https://www.vulnhub.com/entry/hackfest2016-quaoar,180/#walkthrough
- https://habibiefaried.com/pentest-story-defeating-quaoar-vm-345bea40e111
- https://reedphish.wordpress.com/2017/04/02/hackfest-2016-quaoar-walkthrough/
- https://vicious-virus.blogspot.com/2017/04/quaoar-walkthrough.html
- CTF Quaoar: Walkthrough
/dev/random: relativity (v1.0.1)
- https://www.vulnhub.com/entry/devrandom-relativity-v101,55/#walkthrough
- https://chousensha.github.io/blog/2015/05/10/pentest-lab-relativity/
- https://blog.techorganic.com/2013/12/12/relativity-hacking-challenge/
- CTF /dev/random: Walkthrough
LORD OF THE ROOT: 1.0.1
- https://github.com/Hamza-Megahed/CTFs/blob/master/lord-of-the-root/README
- https://blog.geoda-security.com/2017/02/lord-of-r00t-walkthrough.html
- https://c0d3g33k.blogspot.com/2017/01/lotr.html
- CTF Lord of the root: Walkthrough
SKYDOG: 1
- https://syrion89.wordpress.com/2016/12/31/skydog-1-writeup/
- http://www.alickgardiner.com/skydog1/
- https://n13mant.wordpress.com/2016/07/25/skydog-con-ctf-the-legend-begins/
- CTF: SKYDOG 1: Walkthrough
DVWA
Metasploitable
- https://www.hackingarticles.in/comprehensive-guide-on-metasploitable-2/
- https://www.golinuxcloud.com/learn-hacking-using-metasploitable-2/
Running CTF Server
- Top 6 Platforms to Run your CTF Server
- https://github.com/pwning/docs/blob/master/suggestions-for-running-a-ctf.markdown
- https://medium.com/techloop/composing-ctf-challenge-b5828dba0feb
- https://github.com/topics/ctf-challenges
CTF Server
- https://cybertalents.com/blog/top-platforms-to-run-your-ctf
- https://julismail.staff.telkomuniversity.ac.id/membangun-server-ctf/
- https://github.com/Nakiami/mellivora
- https://github.com/IEEE-VIT/CTF-Frontend
- https://github.com/IEEE-VIT/CTF-Backend
- https://github.com/IEEE-VIT/IEEE-CTF-Questions
CTF Server OVA VirtualBox
CTFd
- https://github.com/CTFd/CTFd
- https://demo.ctfd.io/
- https://medium.com/csictf/self-hosting-a-ctf-platform-ctfd-90f3f1611587
- https://docs.ctfd.io/tutorials/challenges/creating-challenges
- https://docs.ctfd.io/tutorials/challenges/deploying-challenges
- https://github.com/CTFd/ctfcli
- https://github.com/bardiz12/ctfd-challenge-scraper
Web Shell & Backdoor
- Kali Linux:
- /usr/share/webshells
- /usr/share/webshells/php
- /usr/share/webshells/jsp
- WSO
- php reverse shell
- https://github.com/pentestmonkey/php-reverse-shell/blob/master/php-reverse-shell.php
- https://github.com/xl7dev/WebShell
- https://github.com/tutorial0/WebShell
- https://github.com/leonjza/wordpress-shell
- https://github.com/ClayHackerTeam/WSO-Shell-Backdoor
- https://github.com/bartblaze/PHP-backdoors
- https://github.com/Kkevsterrr/backdoorme
- https://github.com/backdoorhub/shell-backdoor-list
Youtube
- https://youtu.be/ZtuSAh5MeCo - OWP 20230127 CTF2023 ttg CTF for beginner
- https://youtu.be/4OQFArhhXoo - OWP 20230120 CTF2023 serangan CSRF
- https://youtu.be/wiBb3jFhx5c - OWP 20230106 CTF2023 OSINT
- https://youtu.be/xM2Nq3IpzEg - OWP 20221216 CTF2023 artificial intelligence cyber security
- https://youtu.be/edJOy9u7EC0 - OWP 20221102 CTF2023 pengenalan olimpiade hacking 2023
- https://youtu.be/1B1xgEs4EwE - OWP 20221122 CYBERACADEMY hacking fundamental 2
- https://youtu.be/Pd1ivuU9FhA - OWP 20221121 CYBERACADEMY hacking fundamental 1
- https://youtu.be/sOnpYIP7bbk - OWP 20221116 APTIKNAS cyber security
- https://youtu.be/xiJstpIlV2U - OWP 20221112 PEMALANG teknik cyber security
- https://youtu.be/EUl2INLjav4 - OWP 20221109 ITTS qsl injection ke DVWA 1.9
- https://youtu.be/pO23KGw6fWg - OWP 20221109 ITTS command injection 1
- https://youtu.be/Y63PZ0DOUTA - OWP 20221106 POLBENG cyber security 1
- https://youtu.be/XD3NPN_bIpI - OWP 20221030 ITS cyber security