SlideShare une entreprise Scribd logo
1  sur  11
Télécharger pour lire hors ligne
Morten Juhl Jørgensen
Mads Angelbo Pedersen
          29/09/2011
   What is CFT
   Game Style Overview
   Info
   Alternatives
   Demo
   Questions
Capture The Flag
   The task is to maintain a server running
    multiple services, while simultaneously trying
    to get access to the other team's servers.
    Each successful penetration gains points, as
    well as keeping services up and functional
    during the course of the game.
   The exercise consists of multiple teams, each
    hosting a server that has multiple services
    running,
   The services contain typical security
    vulnerabilities that allow to compromise the
    server to a certain extend.
   The goal is to maintain the services up,
    functional and uncompromised for the duration
    of the game.
   Additional scores can be gained by patching the
    vulnerabilities of the services and exploiting the
    knowledge of the found weaknesses at the other
    team's servers.
   There are some alternatives to CFT like:

    ◦ WarGames : a Typical server program or VM the you
      can Download and attack without any Time
      pressure

    ◦ Crakme’s : Programs where you try to Reverse
      Engineer and make a Serial number generator

    ◦ Non safe Applikations : ” Damn vulnerable Linux” ”
      Web Goat ”
Will be non


   
   http://www.the-
    playground.dk/index.php?page=wargames
   http://sourceforge.net/projects/ctfd/
   http://prosa-ctf.the-playground.dk/
   http://www.cipher-
    ctf.org/CaptureTheFlag.php
   http://mirrors.dotsrc.org/blivklogere/njlug/2
    010-09-16_CTF/ctf.pdf
   http://inctf.in/ctf/what/

Contenu connexe

En vedette

It security
It securityIt security
It security
Mutten
 
El Humanismo Pedagogico En Francia Edad Moderna
El Humanismo Pedagogico En Francia Edad ModernaEl Humanismo Pedagogico En Francia Edad Moderna
El Humanismo Pedagogico En Francia Edad Moderna
Wilber Ramos
 

En vedette (10)

Prl
PrlPrl
Prl
 
A CTF Hackers Toolbox
A CTF Hackers ToolboxA CTF Hackers Toolbox
A CTF Hackers Toolbox
 
Capture The Flag - Azerbaijan
Capture The Flag - AzerbaijanCapture The Flag - Azerbaijan
Capture The Flag - Azerbaijan
 
It security
It securityIt security
It security
 
Humanismo Frances
Humanismo FrancesHumanismo Frances
Humanismo Frances
 
El Humanismo Pedagogico En Francia Edad Moderna
El Humanismo Pedagogico En Francia Edad ModernaEl Humanismo Pedagogico En Francia Edad Moderna
El Humanismo Pedagogico En Francia Edad Moderna
 
Npc14
Npc14Npc14
Npc14
 
Humanismo Frances
Humanismo FrancesHumanismo Frances
Humanismo Frances
 
ITFT - IP adressing
 ITFT - IP adressing ITFT - IP adressing
ITFT - IP adressing
 
Hacking the Creative Brain
Hacking the Creative BrainHacking the Creative Brain
Hacking the Creative Brain
 

Similaire à It security cft

Application Of A Server Hardening Essay
Application Of A Server Hardening EssayApplication Of A Server Hardening Essay
Application Of A Server Hardening Essay
Winstina Kennedy
 
Research Assignment For Active Directory
Research Assignment For Active DirectoryResearch Assignment For Active Directory
Research Assignment For Active Directory
Jessica Myers
 
Shytikov on NTLM Authentication
Shytikov on NTLM AuthenticationShytikov on NTLM Authentication
Shytikov on NTLM Authentication
shytikov
 
metaploit framework
metaploit frameworkmetaploit framework
metaploit framework
Le Quyen
 

Similaire à It security cft (20)

Fuzzing_with_Xen.pdf
Fuzzing_with_Xen.pdfFuzzing_with_Xen.pdf
Fuzzing_with_Xen.pdf
 
OffensiveCon2022: Case Studies of Fuzzing with Xen
OffensiveCon2022: Case Studies of Fuzzing with XenOffensiveCon2022: Case Studies of Fuzzing with Xen
OffensiveCon2022: Case Studies of Fuzzing with Xen
 
Hacker bootcamp
Hacker bootcampHacker bootcamp
Hacker bootcamp
 
Project ACRN CSE Virtualization
Project ACRN CSE VirtualizationProject ACRN CSE Virtualization
Project ACRN CSE Virtualization
 
Democratizing Serverless: the New Open Source, Cloud Agnostic Functions Platf...
Democratizing Serverless: the New Open Source, Cloud Agnostic Functions Platf...Democratizing Serverless: the New Open Source, Cloud Agnostic Functions Platf...
Democratizing Serverless: the New Open Source, Cloud Agnostic Functions Platf...
 
Application Of A Server Hardening Essay
Application Of A Server Hardening EssayApplication Of A Server Hardening Essay
Application Of A Server Hardening Essay
 
Research Assignment For Active Directory
Research Assignment For Active DirectoryResearch Assignment For Active Directory
Research Assignment For Active Directory
 
rsa-usa-2019-keynote-paula-januszkiewicz
rsa-usa-2019-keynote-paula-januszkiewiczrsa-usa-2019-keynote-paula-januszkiewicz
rsa-usa-2019-keynote-paula-januszkiewicz
 
Shytikov on NTLM Authentication
Shytikov on NTLM AuthenticationShytikov on NTLM Authentication
Shytikov on NTLM Authentication
 
Web Apps Security
Web Apps SecurityWeb Apps Security
Web Apps Security
 
FreeBSD and Hardening Web Server
FreeBSD and Hardening Web ServerFreeBSD and Hardening Web Server
FreeBSD and Hardening Web Server
 
metaploit framework
metaploit frameworkmetaploit framework
metaploit framework
 
Typhoon Managed Execution Toolkit
Typhoon Managed Execution ToolkitTyphoon Managed Execution Toolkit
Typhoon Managed Execution Toolkit
 
Chromium os architecture report
Chromium os  architecture reportChromium os  architecture report
Chromium os architecture report
 
Top 10 Ways To Make Hackers Excited: All About The Shortcuts Not Worth Taking
Top 10 Ways To Make Hackers Excited: All About The Shortcuts Not Worth TakingTop 10 Ways To Make Hackers Excited: All About The Shortcuts Not Worth Taking
Top 10 Ways To Make Hackers Excited: All About The Shortcuts Not Worth Taking
 
It gilde 20150209
It gilde 20150209It gilde 20150209
It gilde 20150209
 
ARMITAGE-THE CYBER ATTACK MANAGEMENT
ARMITAGE-THE CYBER ATTACK MANAGEMENTARMITAGE-THE CYBER ATTACK MANAGEMENT
ARMITAGE-THE CYBER ATTACK MANAGEMENT
 
Secure programming with php
Secure programming with phpSecure programming with php
Secure programming with php
 
Optimizing windows 8 for virtual desktops - teched 2013 Jeff Stokes
Optimizing windows 8 for virtual desktops - teched 2013 Jeff StokesOptimizing windows 8 for virtual desktops - teched 2013 Jeff Stokes
Optimizing windows 8 for virtual desktops - teched 2013 Jeff Stokes
 
KCD Munich - Cloud Native Platform Dilemma - Turning it into an Opportunity
KCD Munich - Cloud Native Platform Dilemma - Turning it into an OpportunityKCD Munich - Cloud Native Platform Dilemma - Turning it into an Opportunity
KCD Munich - Cloud Native Platform Dilemma - Turning it into an Opportunity
 

Dernier

Artificial Intelligence: Facts and Myths
Artificial Intelligence: Facts and MythsArtificial Intelligence: Facts and Myths
Artificial Intelligence: Facts and Myths
Joaquim Jorge
 
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
?#DUbAI#??##{{(☎️+971_581248768%)**%*]'#abortion pills for sale in dubai@
 
Why Teams call analytics are critical to your entire business
Why Teams call analytics are critical to your entire businessWhy Teams call analytics are critical to your entire business
Why Teams call analytics are critical to your entire business
panagenda
 

Dernier (20)

Strategies for Landing an Oracle DBA Job as a Fresher
Strategies for Landing an Oracle DBA Job as a FresherStrategies for Landing an Oracle DBA Job as a Fresher
Strategies for Landing an Oracle DBA Job as a Fresher
 
Deploy with confidence: VMware Cloud Foundation 5.1 on next gen Dell PowerEdg...
Deploy with confidence: VMware Cloud Foundation 5.1 on next gen Dell PowerEdg...Deploy with confidence: VMware Cloud Foundation 5.1 on next gen Dell PowerEdg...
Deploy with confidence: VMware Cloud Foundation 5.1 on next gen Dell PowerEdg...
 
Artificial Intelligence: Facts and Myths
Artificial Intelligence: Facts and MythsArtificial Intelligence: Facts and Myths
Artificial Intelligence: Facts and Myths
 
Automating Google Workspace (GWS) & more with Apps Script
Automating Google Workspace (GWS) & more with Apps ScriptAutomating Google Workspace (GWS) & more with Apps Script
Automating Google Workspace (GWS) & more with Apps Script
 
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
 
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
 
Boost PC performance: How more available memory can improve productivity
Boost PC performance: How more available memory can improve productivityBoost PC performance: How more available memory can improve productivity
Boost PC performance: How more available memory can improve productivity
 
🐬 The future of MySQL is Postgres 🐘
🐬  The future of MySQL is Postgres   🐘🐬  The future of MySQL is Postgres   🐘
🐬 The future of MySQL is Postgres 🐘
 
Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
Strategize a Smooth Tenant-to-tenant Migration and Copilot TakeoffStrategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
 
Apidays New York 2024 - The value of a flexible API Management solution for O...
Apidays New York 2024 - The value of a flexible API Management solution for O...Apidays New York 2024 - The value of a flexible API Management solution for O...
Apidays New York 2024 - The value of a flexible API Management solution for O...
 
From Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time AutomationFrom Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time Automation
 
Powerful Google developer tools for immediate impact! (2023-24 C)
Powerful Google developer tools for immediate impact! (2023-24 C)Powerful Google developer tools for immediate impact! (2023-24 C)
Powerful Google developer tools for immediate impact! (2023-24 C)
 
HTML Injection Attacks: Impact and Mitigation Strategies
HTML Injection Attacks: Impact and Mitigation StrategiesHTML Injection Attacks: Impact and Mitigation Strategies
HTML Injection Attacks: Impact and Mitigation Strategies
 
Axa Assurance Maroc - Insurer Innovation Award 2024
Axa Assurance Maroc - Insurer Innovation Award 2024Axa Assurance Maroc - Insurer Innovation Award 2024
Axa Assurance Maroc - Insurer Innovation Award 2024
 
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
 
The 7 Things I Know About Cyber Security After 25 Years | April 2024
The 7 Things I Know About Cyber Security After 25 Years | April 2024The 7 Things I Know About Cyber Security After 25 Years | April 2024
The 7 Things I Know About Cyber Security After 25 Years | April 2024
 
2024: Domino Containers - The Next Step. News from the Domino Container commu...
2024: Domino Containers - The Next Step. News from the Domino Container commu...2024: Domino Containers - The Next Step. News from the Domino Container commu...
2024: Domino Containers - The Next Step. News from the Domino Container commu...
 
GenAI Risks & Security Meetup 01052024.pdf
GenAI Risks & Security Meetup 01052024.pdfGenAI Risks & Security Meetup 01052024.pdf
GenAI Risks & Security Meetup 01052024.pdf
 
Why Teams call analytics are critical to your entire business
Why Teams call analytics are critical to your entire businessWhy Teams call analytics are critical to your entire business
Why Teams call analytics are critical to your entire business
 
Exploring the Future Potential of AI-Enabled Smartphone Processors
Exploring the Future Potential of AI-Enabled Smartphone ProcessorsExploring the Future Potential of AI-Enabled Smartphone Processors
Exploring the Future Potential of AI-Enabled Smartphone Processors
 

It security cft

  • 1. Morten Juhl Jørgensen Mads Angelbo Pedersen 29/09/2011
  • 2. What is CFT  Game Style Overview  Info  Alternatives  Demo  Questions
  • 4. The task is to maintain a server running multiple services, while simultaneously trying to get access to the other team's servers. Each successful penetration gains points, as well as keeping services up and functional during the course of the game.
  • 5.
  • 6. The exercise consists of multiple teams, each hosting a server that has multiple services running,  The services contain typical security vulnerabilities that allow to compromise the server to a certain extend.  The goal is to maintain the services up, functional and uncompromised for the duration of the game.  Additional scores can be gained by patching the vulnerabilities of the services and exploiting the knowledge of the found weaknesses at the other team's servers.
  • 7.
  • 8. There are some alternatives to CFT like: ◦ WarGames : a Typical server program or VM the you can Download and attack without any Time pressure ◦ Crakme’s : Programs where you try to Reverse Engineer and make a Serial number generator ◦ Non safe Applikations : ” Damn vulnerable Linux” ” Web Goat ”
  • 10.
  • 11. http://www.the- playground.dk/index.php?page=wargames  http://sourceforge.net/projects/ctfd/  http://prosa-ctf.the-playground.dk/  http://www.cipher- ctf.org/CaptureTheFlag.php  http://mirrors.dotsrc.org/blivklogere/njlug/2 010-09-16_CTF/ctf.pdf  http://inctf.in/ctf/what/