 Hello everyone, and thank you so much for tuning into this talk. I am super excited to be here with you all at Vulncon, at least digitally. I'm a little bummed that I can't be here with you all in person right now, but hey, hopefully sometime soon in the future. Anyway, I am really flattered and really pleased to be able to bring this to you. This is a talk titled Advanced Tips and Tricks for Capture the Flag and this is with me, John Hammond. So without further ado, let's go ahead and dive in. I'm gonna try and break this down as simple as I can here. So we're gonna get into some kind of fun mental exercises, I hope, and hopefully I can introduce to you that in a fun way. So let's get this bare-boned basics easy idea first out of the way. Let's say there's you as one being one person, one human individual out in the world, and you want to try and improve your security skills. You want to get better at cyber security, you're interested in hacking, you want to be on the keyboard, being an operator, doing the really cool and doing the fun stuff. So how do you go about doing that though? That's super hard. And I've kind of talked about this and if you know me, you know that I, you know, sing the praises of it and shout from the rooftops the real value in playing Capture the Flag. I think that's the best way to learn and get your hands on with real cyber security tasks and problems to solve and new challenges to uncover and face. And you can improve your skills by doing that. So let's define you a little bit more and kind of who you are, what you can do and what actions you might be able to take to get better. Here's an idea. Here's you kind of defined as a class. And you can see that I'm very clearly kind of distilling this down into the bare-boned basics. Let's just say you exist with a certain property, such as your skill level. And right as you get started, right when you're taking on this challenge, you're going on this adventure to learn more and sharpen your skills. You're going to try and start off with the skill level starting at zero. Now, just like, you know, in a video game, just like we're trying to level up what we could do and who we are and everything that we can accomplish. We want to improve that skill level. So how can we do that? Well, let's build out another function or another capability. And let's say that you can play capture the flag or play CTF. And now that will increase your skill level. We're just going to add one to that number zero up here. So your skill level increases. Now, obviously that is super duper distilled down. I'm sure a ton of you know that it doesn't work all the time that way. Maybe when you're first getting started, everything that you play, everything that you interact with and you gain exposure to, maybe you'll be learning and you're it's like the fire hoses is facing you, right? Everything that you're going to learn comes from the capture, the flag that you play. But obviously in the real world, there are a lot more variables at play. There are a lot of other dependent circumstances or or a lot of other potential factors and how you increase your skill level, how you get better at what you do. So let's fill this out a little bit, right? But first, bear with that initial idea that you exist and your skill level after you play a CTF will increase. And when you're just getting started out, that's awesome. That's all that you want to do. You want to keep increasing your skill level. So you'll play a CTF over and over and over again. Let's say, OK, let's just loop this real quick. Let's play about 10 different capture, the flag events, all these different exercises. And now at the end of the day, after you've played so many CTF events, your skill level has gone up. Now you're not sitting at zero anymore. Maybe you're all the way up to 11 and you could extrapolate this idea as much as you want, right? But we know that this this whole thought, this whole idea isn't exactly fleshed out just yet. There are dependencies and other variables at play that we aren't considering. So that's the that's the beginning thought, right? Though at the very, very start of the game of the world, at the beginning of your adventure, you're going to play capture the flag so you can keep amping up your skill level and you'll get better and you'll learn at the end of the day, though, you're having fun. You're enjoying yourself. You love the fact that you can play CTFs and you can level up your skills. You can get better. Next, you want to tackle some harder capture the flag games and exercises. You want to play some advanced or more difficult CTFs. So let's kind of switch up our functionality here. Let's go back to this you idea and let's change up our play CTF functionality here. And let's say that we could supply a difficulty or how difficult the CTF that you might play actually is. Now your skill level will increase by the difficulty. And again, you know, OK, that might not be completely realistic, right? Again, there are a lot of other variables and factors at play. I'm just trying to distill this down. I'm just trying to get this thought across because if you were to play difficult CTFs and hard CTFs, let's say you're super excited about this. Let's say that you want to go tackle and you want to go play the hardest CTF that you can. Let's go and play a CTF with this humongous difficulty. It's super duper hard. We could try it. We could go play that CTF with some large, ginormous difficulty value. Except, oh, that's not going to work. That's going to be super duper hard, right? You're going to be banging your head against the wall and maybe you can't solve anything. Maybe you can't accomplish any of those tasks. You can't beat any of those challenges. And it really drags you down, right? Like that's tough. That's way over your head. That difficulty, that was too hard. And we sort of got an overflow, an information overload, and we just couldn't handle it. We couldn't play that CTF. So we weren't able to increase our skill level. We weren't able to get better. It was just a slap in the face. Well, how can we avoid this, right? We need to know that some difficult CTFs are way too hard and we can't tackle them on our own, or at least not yet, not at the moment. But how are we going to increase our difficulty? How are we going to get better? Let's keep expanding on this, right? Let's change up our play CTF idea and the functionality here. So if we were to supply a difficulty, if we were to play maybe a more difficult CTF, here's the thought. If the difficulty is more or greater than our current skill level, well, then it won't work. We'll get an error and be like, hey, this CTF is just too hard. We can't get better at it. It's too difficult for us. That's the idea. That could at least protect us or stop us from really beating ourselves up when we just fail or can't solve anything in a capture-the-flag game or exercise. So now we go back out into the world. We take a look at our skill level. We see where we are. We see, we kind of take inventory on everything that we know and we've learned about. And we go play another capture-the-flag event. But when we look back at ourselves and we take a look at our skill level, we see that we haven't really improved. Our skill level hasn't gone up. And you say, what the heck? Why isn't this working? When I was playing capture-the-flag earlier, I was improving, my skill level was increasing. So you play another CTF and you play another CTF and you play more capture-the-flag and you still aren't seeing your skill level increase. You keep playing capture-the-flag, but nothing is happening. You've plateaued because we didn't play a more difficult CTF. We just sort of plateaued. And I'm sure a lot of you know that feeling where, okay, you play one capture-the-flag, but all this or at least a lot of it is already still within your knowledge realm and you haven't picked up or learned anything new. It's not stretching you or pulling you out of your comfort zone. So you aren't growing. You aren't improving. You aren't bettering yourself and increasing your skill level, right? So our idea, or at least it's current implementation right now, still isn't right. It still isn't accurate. We know we're gonna bump into the wall if we play a capture-the-flag game that's too difficult, way too hard. But if we don't increase our skill level, all we do, if all we do is we play easy games or kind of simple bare-bone basics, beginner capture-the-flag events, we aren't going to improve. So how do we find this middle ground, right? Let's expand on our idea. Now let's look at how we can kind of abstract this idea of playing a CTF. Now we supply a difficulty or what we might be up against. And we also add a new kind of variable at play here, where we kind of consider how we're gonna end up playing this capture-the-flag. Maybe we'll supply the way or the manner that we go about it. Are we gonna play like a pro player? Are we gonna play like a beginner? Are we gonna play like someone who's never seen a capture-the-flag game before? Now we still have our original difficulty check. If the difficulty is above our skill level, then we'll still get this error or we'll hurt, right? It won't work. This CTF will be too hard and we won't be able to play. But there's a new condition here at play. If depending on how we play the game, then we could still increase our skill level. If we were to play this game in a smarter way, we could still grow and learn and improve our skill level depending on the difficulty of the capture-the-flag game. Now sure, it might be at a different threshold. We're not going to be increasing like linearly by one every single time. Now it's dependent on the difficulty and maybe we'll only get just a small factor, just a small portion of what we would have gained otherwise. But we're still stretching ourselves. We're still learning and we're playing more difficult capture-the-flag challenges. But there's still a problem. We look at ourselves. We look at our skill level. We see we still haven't proved that we're at that same value and we try to go play another capture-the-flag event that's a little bit more difficult or has a greater difficulty than our current skill level. And again, we see our big scary error message where this doesn't work. This CTF is just too hard. We didn't specify how we're gonna play that capture-the-flag. We didn't want to come across and act like a pro player. We didn't want to get into some better techniques. So let's expand on this even more. Now we look at ourselves. We're still at our 11 value skill level and we go play a capture-the-flag event with a greater difficulty, that difficulty of 12 once again. But now how we play is different. We're gonna supply that how argument and add that parameter, add that in the mix and we're gonna play like an advanced player. That's an idea. That's a thought. Now we should be able to at least somewhat improve our skill level, right? Well, does anyone notice anything that might potentially be wrong here? You guys are gonna hate me for this. You guys, this is gonna be a bummer, right? Check it out. Ooh. Our advanced playstyle is undefined. It's not gonna work. It errors once again. So I wanna get this idea across, right? And again, this is a bummer, right? This is the call to action that we don't wanna hear but we have to. There is no such thing as playing with advanced tips and tricks. You can't be advanced when you play a capture-the-flag. It doesn't exist and it's so weird, right? I think that this boils down to one idea. This boils down to the same bare-bone basics that you play capture-the-flag. When you play a capture-the-flag and you think there's some good practices or there are the basics that we could do, we could of course, we could prepare for a capture-the-flag event. We could practice and keep getting better and we can pile up. And I'll expand on each of those ideas or each of those different pedestals that we could stand on to help make us better. But we wanna address that as the basics. So here's the thought. Playing like an advanced player or using some advanced capture-the-flag techniques, all that really is is just doing more of the basics, hyper-focusing on the stuff that you should do every single time you get ready for a capture-the-flag event and just amping that up even more and more and more. It's basics times two, times three, times four, times five, you just keep doing the basics and you keep doing them better and you improve your process. You prepare, you practice and you keep piling up everything that you're learning every time you go through a game. That's the idea. It boils down to the advanced. All that advanced play style is that's just taking the basics and doing them more and more and more. The advanced being an advanced player depends on how you do the basics. So let's zoom in on this, right? Let's say, again, there's you, that individual, this our player, right? And you can prepare. That's a new function or some new action, some new verb that we can do with any specific sort of resource. And if you prepare, no matter what you do, how you do it, as long as you prepare, you are still increasing your skill level. You're still getting yourself ready for an upcoming game or a new capsule flag event that you really wanna take seriously. You really wanna play and you wanna hard charge against that game. If you prepare, you'll be ready and your skill level will go up just simply by doing it, by going through the act of preparing. Now, there's one example idea here, right? How do you prepare? Of course, go ahead and read write-ups. The great example of this is over at ctftime.org where you of course would sign up and learn and know all about these upcoming games. But over in their write-ups section, you can learn and read about other capsule flag events, what challenges were present, what tasks were there, what problems did the players have to solve? So you could read those write-ups and while you play capsule the flag or even while you're reading these write-ups, you could try and recreate that challenge. You could write your own write-ups and that's the best way to learn, right? You wanna try and document and know your solutions. Maybe you could write a blog post, you could share an article, you could put it out on the internet, you could put it on Medium, you could put it on LinkedIn, you could put it on your GitHub. It doesn't matter anywhere as long as you do it, as long as you are reading write-ups to learn about other problems and new tools and new vulnerabilities and tax and exploits, that helps you grow. That increases your skill level. If you write write-ups, even better. Your skill level might increase even more than that. We'll have to add that into our little functionality here. If you share the knowledge, if you keep spreading the wealth for everything that you're learning, whether or not it be in a blog post or whether or not it be in a video format, you just wanna share your screen and maybe add commentary over what you're doing and how you're doing it, explaining it to the people that play, to the people that are watching or reading this write-up so that they can recreate it and they learn the same gems that you learned. You are increasing your skill level. You're getting better. When you prepare for other Capture the Flag events and exercises you might play in the future by even just going back and looking at other CTFs, you get better. And that's part of being an advanced player or using the advanced tips and tricks for Capture the Flag. Here's another thought, right? How else can you prepare other than write-ups and other than solutions and sharing? You wanna know your tools. You wanna know what is in your arsenal and how it works and what can be used for what because those are ultimately what you're gonna go to the battlefield with, right? What are the flags to end map or what do you need with Hydra or what can you do with the PyCryptoDome library to solve these things or how can you take advantage of these format string vulnerabilities in a print F function call in a C program, et cetera, et cetera. You wanna know what your tools can do and how you can use them and maximize their potential. And then once those tools don't work for you or if you know that you're gonna be in a new environment if maybe this is a repeat game or it's a special flare or they've discussed what is going to be pertinent in that Capture the Flag competition build your own tools. Prepare your own toolkit so you can come to the fight. If you know it's going to be some red team versus blue team maybe attack and defense game, well, try and get some exploit scripts ready or at the very least just templates that you could use and patch in, load up any of the specific syntax you might need in the moment. So build your own tools along with knowing the tools that you have. I think taking the time to prepare and get ready scripts, functions, programs, command and control beacons, whatever it is, whatever you think is necessary, taking the time preemptively before the game ahead of time to build your own tools that is another part of being an advanced player or having stuff ready for war. Some of you might have seen a recent video out from Live Overflow where he was showing raw footage from his Capture the Flag team playing the Google CTF finals this year and it's like how hacking actually looks. And if you were to take a look at this video and notice a two and a half hour timeline but it's this whole time lapse of them preparing, playing, getting ready for the game and if you'll notice Live Overflow talks about how his team members and everyone that had spent 50 to 70 hours just preparing, building tools, getting ready to come with an arsenal, a whole framework so that they can collaborate, so that they can share what they're doing so that they can fine tune and debug what might be happening in web sockets or proxies or other techniques that might be necessary, they prepared by building their own tools. And I wanna drive that home. That is how you can be advanced. And of course we gotta practice, right? Preparing is one thing but we still have to practice like we play, right? You have to train, you have to keep sharpening that skill and getting the skill level better. Even if it's not an active online weekend Capture the Flag competition but if you take one online resource maybe a war game or anything specific and you practice with that, again, your skill level will increase. You will get better. Sure, this is abstracted away, there are of course other variables and factors and dependencies at play but let me get this straight. Simply doing it, trying, putting in the effort that will help, that helps you grow. So what do you practice with? What are those resources you can actually use to practice? Well, there is a long, long list and I've shared this before, right? Over the wire I think puts out incredible stuff to get smart and up to speed on the Linux command line that you can get into even more binary exploitation stuff. You can do stack smashing and of course smash the stack will showcase a lot of that. exploit.education you get to do more of the binary engineering, binary exploitation. Try hack me and hack the box. They're fantastic for red teaming, penetration testing stuff and of course, a little bit of blue team, a little bit of defensive alongside all the offensive and cryptography, right? There's the Matasano crypto challengers, there's crypto hack.org all in this flair and flavor of capture the flag or gamified security education. These things all help you learn just by practicing, exploring and tinkering with all of these and this list goes on and on and on. There's stuff specific to web, there's stuff specific to reverse engineering or any other realm here, mobile applications, steganography, more and more the list goes on and on and there's even more. This is not completely comprehensive and here's the next thought. Here's the third piece of the pie or the three pieces, the three P's, right? Practice, prepare, pile up, pile up that will still help you grow. Pile up resources and that adds just a little bit to your skill level because you're building out your repertoire, your archive, everything that you might have seen when you write write ups, when you discover a new tool, when you understand a new technique or read through some new programming paradigms, whatever the case may be, pile up all that information and save it for yourself so that you can use later in the future. So what do I mean by that, right? Take notes, write things down, save your solutions. Even if you don't end up writing a write up, you still wanna have the breadcrumbs, the pieces, some of the syntax that you might have used that gets complex and long and maybe you forget it in the future and along with that, keep a library, keep track of all of the tools that you use and what purpose you might have used them for. Are you looking at some web challenge or are you looking at a mobile challenge? Well, what are you gonna end up using right away? You could build out your own sort of checklist or your own cheat sheet of all the things that you might think of and help you remember if you don't think of them in the future. Having that whole reference, being able to pile up all that information, that is what's gonna help you. That is what keeps you growing and what makes you more of an advanced player using the advanced tips and tricks. And personally, I think that is the sweet spot. I think those are the secret ingredients to help make you better, to help you grow. So as long as you exist, right? As long as you want to keep playing, capture the flag and growing and learning, while you are in the world, right? I think you should practice. I think you should prepare. I think you should pile up all that information and I think you should play, capture the flag, put it all to the test. Now you could put whatever difficulty you want in here, you could play a hard CTF, you could play a beginner CTF, you could do whatever you'd like. But this loop right here, right? This iterative process, that is what is going to keep you growing. If you practice, prepare, pile up, and it doesn't matter what order these are in, right? You could move this up and down and left and right as long as you do it with whatever resource that you find most comfortable with however way you do it, get hub, blog post, videos, try hack me, hack the box, et cetera, et cetera, et cetera. As long as you practice, prepare, and pile up, when you go to play a CTF, you're gonna be playing like an advanced player. And that's the way to do it. Once you do this enough, you could take on whatever CTF you might like. You could take on that super hard, insane, incredible, difficult, capture the flag that you wanted to play. You get to choose. It is entirely up to your own input and how you're gonna play. Well, you're gonna play like an advanced player because you took the basics, you took the bare-bone essentials, what you should do when you're playing smart, what you wanna get better, and you just kept doing it over and over and over again. You loop it, prepare, practice, pile up, and when you play, you play like a winner and an advanced player. Okay, well, hey, that is all I've got for you guys. Thank you so, so much for tuning in. I know, hey, maybe this was a let down. Maybe this was a bummer. Maybe you were looking for the secrets. You were looking for the one-stop shop to make you an advanced player and advanced capture the flag hacker, or red teamer, or penetration tester, and no, there is no shortcut. It's just putting in the work. It's playing and preparing and gathering all of that information. Stockpiling everything you learn so that you can use it again in the future and you keep getting better. You keep increasing your skill level. But hey, if you guys have any questions for me, don't be a stranger. I am more than happy to chat. Go ahead and reach out. You can find me. There's my email up there, johnhammon010 at gmail.com. Of course, I have a pretty cheesy YouTube channel where I showcase a lot of capture the flag video writeups and a lot of security events and war games and conferences and talks and other fun stuff. So I hope you could please go check out that YouTube channel. I am, of course, on Twitter. There's my GitHub. There's LinkedIn. I, by no means, a hermit. So if you wanted to cyber-stalk me, you can definitely track me down. But thank you so, so much for tuning in and listening to this talk, everyone. I hope you got at least a little gem. Some nuggets out of this. I know it wasn't some earth-shattering thing how to be an advanced player, but it boils down to the basics. It boils down to what we know we should always be doing, but sometimes we just let it slip by. You keep on the grind. You keep playing. You keep practicing and you grow. That's how you do it. Thank you so much, everybody. I hope you enjoyed the rest of Vulcan and I will see you. It sounds so funny. It's like a YouTube video outro, right? I'll see you next time. Wee-oo-oo-oo-oo-oo-oo-oo-oo!