CTFs, Bugbounty and your security career

Ibrahim M. El-Sayed
CTFs, BugBounty and
professional work

$whoami
• Professional work

• Pentester/RedTeam

• Security engineer

• Companies

• EGCert/QCert

• Secforce Deloitte

• Facebook

• CTFs

• BugBounty

• Capture The Flag competitions (CTFs)

• Bug bounty (BB)

• CTFs and Bug bounty vs career

• Questions
Outline

Capture The Flag (CTF)
History and Deﬁnition
• Definition

• Ethical hacking competitions where participants are expected
solve computer security challenges

• History

• 1996 ~24 years (Defcon)

• In 2010 started to be more popular

• Chaos Computer Club (CCC)
https://www.ccc.de/
https://defcon.org/

• Duration

• 24-48 hours (usually over weekend)

• Team size

• 4-8 for finals (on-site)

• Online qualifications (∞)

• The Flag is usually a string of a specific format

• e.g

• TMCTF[abcdefg12346]

• DC{abcdefgh123324324}

• But it can be any text as well :) or a combination of strings you will
build during the challenge

Types
• Jeopardy

• Attack and Defence

Types - Jeopardy
• Categories

• Pwn - Mobile - Web - Forensics - Reverse engineer - Network …

• Each category contains tasks

• Teams get points when the finish the task (get the flag)

• Team with most points win the competition

https://twitter.com/internetwache/status/697172252211683328/photo/1

Jeopardy - Categories
• (Pwn)able

• A service running usually written in a native language

• Flag: usually a file on the system

• Methodology:

• Usually binary is provided

• Reverse the binary

• Find a bug

• Write an exploit

Jeopardy - Categories
• Web

• Web application and you are expected to attack t

• Flag: file on the system, stored in the db, or in another user’s session

• Methodology

• Find a web bug (XSS, RCE, SQLi, etc)

• Exploit the bug to read the flag

Jeopardy - Categories - Web

Jeopardy - Categories - Reverse Engineering
• An application that has the flag but you need to understand how it
works to return the key

• e.g Enter password to return you the flag

• Can be native or a high-level language

Jeopardy - Categories - Forensics
• Memory dump, Disk image, Network capture, Some file format

• Flag: usually hidden inside the target file

• Methodology

• Depends on the file type

• Network: understand what is going and identify anomalies try to
find the flag

• Disk image: How data stored on the drive and how you can
restore deleted data

Jeopardy - Categories - Crypto
• Encrypted Blob

• Flag: decrypt the blob you will find the flag

• Methodology

• Understand how the encryption algorithm

Categories - Attack-Defence
• Machines running services

• Attackers try to attack the service and defend it

• Points are given for finding the bugs

• Time defending the services

• Each team own services

• Defend services

• Keep services running

• Attack others
• Standard Format

Team A Team B Team C
Machine A Machine B Machine C
Defend attack Defend

• King of the hill

• One or more services

• Teams attack and then defend the services

Team A
Team B
Team CMachine A
Team D

• Example CTFs

• Defcon finals

• TrendMicro finals

• Arab Cyber Security wargames

• iCTF

• RuCTFe

Arab Cyber Security wargames - mixed
• Style: mixed jeopardy and AD

• Team size: 3 - 5

• Duration: 2 days

• Qualifications and Finals

• Attack and defence style: teams attack machines, fix/defend them,
keep service running and access you get points

TrendMicro - Mixed
• Style: mixed jeopardy and AD

• Team size: 5

• Duration: 2 days

• Attack and defence style: teams attack machines, fix/defend them,
keep service running and access you get points

CTF - Attack and Defence - TM 2017 Finals

Attack-Defence - TrendMicro
source: https://www.twitter.com/TrendMicroCTF

What a good CTF look like?
• No guessing

• Diversity in categories

• Fair scoring

• Stable challenges

• Enough time

Top Teams
• Top Teams

• https://ctftime.org/stats/

• PPP

• DragonSector

• LC↯BC

• TrailOfBits

• Top players

• Geohot

• Lokihardt

• Hellman
pwning.net
https://dragonsector.pl/

QA
• Do I need a team to play CTFs?

• What are the best CTFs?

• How to start playing CTFs?

• Are they related to real life work/bugs?

Credits: Word Cloud by Epic Top 10

Bug bounty (BB)
Deﬁnition
• Companies allow researchers to test and find bugs in their products
for which they can reward them back

• Products:

• Software: web application

• Hardware: mobile devices

Bug bounty (BB)
History
• 1995: Netscape

"Netscape Bugs Bounty", a program that rewards users who help
Netscape find and report "bugs" in the beta versions of its recently
announced Netscape Navigator 2.0 software

Bug bounty (BB)
History
• 2002: iDefense

• Cash rewards up to $400

• Middleman between researcher and software vendor

• 2004: Mozzila

• Cash from $500

• 2005: Zero Day Initiative

• 2007: Pwn2Own

• 2010: Google for web application

• 2011: Facebook, BugCrowd

• 2012: PayPal, HackerOne,

Bug bounty (BB)
Facebook
• Started in 2011

• Started with focus on web and mobile applications

• Expanded to all products

• Expanded further to third party applications and data leaks

• Paid more than $6M in Bug bounty
Facebook, Inc. / Public domain

Bug bounty (BB)
Apple
• Covers all their products

• Focuses on hardwares e.g

• iPhones

• Apple Watch
Original: Rob Janoﬀ / Public domain

Bug bounty (BB)
Zero Day Initiative
• Covers any products on the Internet (as long as they have value)

• They acts as a middleman between the researcher and vendor
Trend Micro / Public domain

Bug bounty (BB)
How it works?
• Use the product

• Find bugs
Reward $$
• Reproduce the report

• Deduplicate

• Check originality

• Fix
Report to Facebook

Bug bounty (BB)
What is a good BB program?
• Time to triage?

• Time to reward?

• Time to fix?

• Minimum bounty

• scope

Bug bounty (BB)
Researchers
• Top researchers?

• How do you know it is a top researcher?

• What is a top researcher?

• Number of submissions

• Signal

• Creativity

Bug bounty (BB)
Researchers
• Snipers

• Research

• Find bugs in technology

• Find all BB programs that are affected
Photo by Annie Spratt on Unsplash

Bug bounty (BB)
Researchers
• Top researchers

• Michał Bentkowski (@SecurityMB)

• Masato Kinugawa (@kinugawamasato)

• Orange (@orange_8361)

• File Descriptor (@filedescriptor)

• Nicolas Grégoire (@Agarri_FR)

• Frans Rosen (@fransrosen)

Bug bounty (BB)
Researchers
• Recon masters

• Write tools to find the scope

• Find the weakest link

• Report issues
Photo by Franck V. on Unsplash

Bug bounty (BB)
Researchers
• Top researchers

• Mark Litchfield (@BugBountyHQ)

• @NahamSec

• @thedawgyg

Bug bounty (BB)
QA
• How to start bug bounty?

Career Image by Arek Socha from Pixabay

Career
Roles
• Offensive

• How to break?

• Identifying vulnerabilities

• Blackbox

• How to weaponize?

• Developing exploits

• Full stack

Career
Roles - Oﬀensive
• Vulnerability researcher

• Redteam/Pentest

• Exploit developer

Career
Roles
• Defensive

• How to break?

• Identifying vulnerabilities

• Whitebox

• Writing PoCs

• How to securely build?

• Fixing and prevent bugs

• Design systems/application

Career
Roles - Defensive
• Application security engineer

• Network security engineer

• Malware analyst

• Incident response engineer

Career
Roles vs Skillset
• Vulnerability researcher

• Redteam/Pentest

• Exploit developer

• App security engineer

• Network security engineer

• Malware analyst

• Incident response engineer
• Asset discovery (recon)

• OSINT

• Reverse engineering

• Exploitation

• Forensics

• Code review

• Coding

• System design - Code fixes

• Fuzzing

• application security (Web - Mobile)

Career
Roles vs CTFs and BB
Vulnerability
researcher
• Code review

• Fuzzing

• Application security

• Reverse Engineering
Reverse engineering
Web
Pwnable
CTF
BugBounty Web Application security

Career
Pentest
• Recon

• Application security
App securty (Web - Mobile)CTF
BugBounty
Recon
Web/Mobile

Career
Exploit
developer
• Exploitation

• Native security

• System Design
Pwnabel
Web
Native Security
CTF
BugBounty

Career
Malware
Analyst
• Reverse Engineering

• Code Review

• System Design

• Forensics
Reverse engineering
Code Review
Forensics
System Design - Code ﬁxes
CTF
BugBounty

Career
Diﬀerences between CTFs and BugBounty
• Real world challenges (superficial?)

• CVE-2019-11043 - PHP

• Andrew Danau from Wallarm (LC↯BC)

• Realworld CTF

• RCE

• CVE-2019-6690 - python-gnupg

• Alexander Kjäll and Stig Palmquist

• Insomni’hack

Career
• HITCON CTF 2016

• 3 Zerodays in SugarCRM

• LCBC, PPP, Cykorkinesis

• CVE-2012-1823 - PHP

• Endbazen

• Google CTF Finals 2019 - Suidbash

• https://www.youtube.com/watch?v=-wGtxJ8opa8

Career
• Bug bounty - Exploitation techniques

• Finding novel ways to exploit bugs => Reward

• Cross-site Leaks

• documented over a decade ago

• BB hunter exploited it

• Google Search XSS

• Owning The Clout Through Server Side Request Forgery

Career
• Reward

• Bugbounty $$$
Credits to Jericho (CC)

Career
• Reward

• CTF
Credits to Jericho (CC)
Public Domain(CC)

Sad loser / CC BY-SA
Career
• Experience - Holistic view

• BugBounty

Career
• Experience

• CTF
ArnoldReinhold / CC BY-SA
Alan Turing

Summary
Photo by Nathan Dumlao on Unsplash

One last slide
Personal view
Photo by Saketh Garuda on Unsplash

CTFs, Bugbounty and your security career

Recommended

Recommended

More Related Content

Similar to CTFs, Bugbounty and your security career

Similar to CTFs, Bugbounty and your security career (20)

Recently uploaded

Recently uploaded (20)

CTFs, Bugbounty and your security career