Assistant
Capture The Flag (CTF) challenges are generally divided into several core categories, each testing a different set of skills:
1. Web Exploitation Focuses on finding vulnerabilities in websites and web applications. Common challenges involve manipulating HTTP requests, exploiting server-side logic, or breaking the client-side interface.
- Key concepts: SQL Injection, Cross-Site Scripting (XSS), Local/Remote File Inclusion (LFI/RFI), and IDOR.
2. Reverse Engineering (Rev) The process of analyzing a compiled binary (like an .exe or ELF file) to understand how it works and find the hidden flag. It is essentially "deconstructing" the program.
- Key tools: Ghidra, IDA Pro, GDB, OllyDbg.
3. Binary Exploitation (Pwn) While Rev is about understanding the program, Pwn is about breaking it. You find a bug that allows you to hijack the execution flow and force the program to give you the flag.
- Key concepts: Buffer Overflows, Format String vulnerabilities, Heap exploitation, and Return-Oriented Programming (ROP).
4. Cryptography (Crypto) The art of secret writing. These challenges involve decrypting a message or finding a pattern in a series of numbers to reveal the flag.
- Key concepts: RSA, AES, Elliptic Curve Cryptography (ECC), XOR, and Classical ciphers (Caesar, Vigenère).
5. Forensics The "detective work" of CTFs. You are given a file (image, packet capture, memory dump) and must extract the flag using various analysis tools.
- Key concepts: Wireshark (network), Volatility (memory), Steganography (hidden data in images/audio), and Hex editors.
6. Miscellaneous (Misc) A "catch-all" category for challenges that don't fit perfectly into the others. These often test general logic, programming skills, or a mix of several categories.
- Examples: OSINT (Open Source Intelligence), Esoteric languages (Brainfuck), or simple logic puzzles.