Mastering Capture the Flag and Cloud Security Fundamentals for Beginners

SP SURESH MICHAEL PEIRIS
An introduction to
Capture the Flag and Cloud Security
What a CTF actually is, what to study before you compete, and the
cloud basics you need for the trials.

WHAT WE'LL COVER
Four parts, about ninety minutes
01
Capture the Flag
What it is, how scoring works.
02
Study before
The foundations, tools, and a method that works on any challenge.
03
Cloud basics
Identity, storage, and the metadata trick at the heart of the trials.
04
Live demo
Two real cloud slip-ups, walked from start to captured ﬂag.
SURESH MICHAEL PEIRIS

PART 01 — CAPTURE THE FLAG
A CTF is a security puzzle with a
hidden answer
Each challenge hides a secret string called a flag. You find it by
using a real security technique against a target that was
deliberately built to be broken.
Submit the flag, score points. It is legal, safe, and the fastest way
to learn security by doing.
FLAG FORMAT
CYPHER{ y0u_f0und_1t }
Find that string, paste it in, and the point
lands on the board.

PART 01 — CAPTURE THE FLAG
Why it's worth your time
Learn by doing
You build real skill by
solving, not by watching
lectures.
Maps to real jobs
The same skills used in
penetration testing, cloud
security, and incident
response.
A team sport
You compete in a team of
two to four and split the
work.
Start from zero
The trial is built so
beginners get early wins
and ramp up.

PART 01 — HOW IT WORKS
Flags, points, and the leaderboard
SUBMIT
Dynamic scoring
A challenge is worth more when fewer
teams solve it. Hard challenges carry the
most points.
BE FIRST
First blood
The first team to solve a challenge earns
a small bonus. Speed matters.
WATCH
Live leaderboard
Ranks update in real time. In the finals
the board freezes for the last stretch for
a tense finish.
Hints are free. Every challenge has one, and using it never costs you points.

PART 01 — THE LANDSCAPE
Formats and categories
FORMATS
Jeopardy. Independent challenges, each worth points.
This is what CYPHER uses.
Attack and defense. Teams attack each other while
patching their own systems, live.
COMMON CATEGORIES
Web Cryptography
Forensics Binary / pwn
Recon Cloud

PART 02 — STUDY BEFORE
The foundations to build ﬁrst
You do not need to be an expert. You need to be comfortable
with a handful of basics, and willing to look things up.
Linux and the shell. Move around, read ﬁles, run
commands.
Networking basics. IP, DNS, ports, and how
HTTP requests work.
The web. Requests, headers, cookies, and URLs.
A scripting language. Python is enough to
automate the boring parts.
Git. Clone, read history, spot what was
committed.

PART 02 — STUDY BEFORE
Your toolbox
Browser dev tools
Inspect requests,
responses, and hidden ﬁles
on any web target.
curl
Send raw HTTP requests
and read exactly what
comes back.
git
Recover source and secrets
from an exposed
repository.
gcloud & gsutil
The Google Cloud SDK. List
buckets, read identity,
query the cloud.
Everything here is free and runs on your laptop. Install and try them before the pre-task.

PART 02 — APPROACH
A method that works on any challenge
01
Read carefully
The description usually hints at the technique.
02
Recon the target
Look at everything before touching anything.
03
Enumerate
List ﬁles, endpoints, permissions, options.
04
Form a hypothesis
What is the likely weakness here?
05
Try the technique
Test it, adjust, repeat.
06
Submit and note it
Capture the ﬂag and write down how.

PART 02 — APPROACH
Habits that win
Take notes as you go. You will retrace steps; do not rely on memory.
Split the work. Divide challenges across your team, then compare.
Use the free hints early. They cost nothing and unstick you fast.
Persistence beats talent. Most solves come from not giving up.
Stuck for twenty minutes? Switch. Come back with fresh eyes and another challenge solved.

PART 02 — PRACTICE
Where to practice before the trials
picoCTF
Beginner-friendly CTF challenges,
always available.
TryHackMe
Guided rooms that teach as you go.
Hack The Box
Hands-on labs, from starting point to
hard.
OWASP
The reference for web vulnerabilities.
Google Cloud docs
Read how IAM, storage, and metadata
actually work.
This session's recording
Rewatch the demo before you compete.

PART 03 — CLOUD BASICS
The cloud is someone else's computers, rented by the
minute
Instead of owning servers, you rent compute, storage, identity, and networking from a
provider like Google Cloud. It is fast to set up and easy to misconﬁgure.
That gap between fast and secure is exactly where cloud CTF lives.

PART 03 — A KEY IDEA
Who secures what
THE PROVIDER SECURES
The physical data centre
The hardware and network
The core platform
YOU SECURE
Your data
Your identities and permissions
Your conﬁguration
Almost every cloud breach lives on your side of that line.

PART 03 — CLOUD BASICS
Five building blocks to know
01
Compute
VMs, containers,
and functions that
run your code.
02
Storage
Buckets that hold
objects and ﬁles.
03
Identity
IAM. Who is allowed
to do what.
04
Secrets
Keys and tokens
that unlock things.
05
Networking
What is exposed to
the internet.

PART 03 — IDENTITY
Identity is the heart of cloud
security
Nearly every cloud challenge comes back to one question: what is
this identity allowed to do?
Every action has an identity. A user or a service
account does it.
Identities get roles. Roles grant permissions.
Least privilege. Give only what the job needs.
Over-permission is the risk. It turns a small leak
into a full compromise.
This is the single most tested idea in the trials.

PART 03 — THE KEY TRICK
The metadata service
Every cloud VM can ask a special internal address who it is and hand over its credentials. Useful for the app.
Dangerous if an attacker can make the server ask on their behalf.
Attacker
Finds a feature that fetches a
URL.
The app (SSRF)
Is tricked into making the
request.
169.254.169.254
Metadata
The internal address answers.
Token
The VM's credentials leak out.
You will use this exact technique in the trials.

PART 03 — WHERE CLOUDS GO WRONG
The slip-ups you'll be hunting
Public buckets
Storage left open
for anyone to read.
Over-permissive
IAM
Identities that can
do far too much.
Exposed
metadata
SSRF reaching the
credential endpoint.
Leaked secrets
Keys in ﬁles, env
vars, or git history.
Open
dashboards
Admin panels and
APIs with no login.
Each of these is a real challenge waiting in the trials.

PART 04 — LIVE DEMO
Two real slip-ups, start to ﬂag
We will walk two challenges live. Follow along; you will solve versions of both in the trials.
DEMO ONE
The open bucket
Find a storage bucket left public and read the ﬁle that should not
be there.
DEMO TWO
SSRF to metadata
Trick an app into fetching the metadata address and leak the VM's
token.

PART 04 — DEMO ONE
The open bucket
01 List the bucket
Anyone can see its contents if permissions are open.
02 Spot the odd file
A backup or export that was never meant to be public.
03 Read the flag
Download it and the flag is inside.
WHAT YOU RUN
gsutil ls gs:./ceylon-kade-backups
gsutil cp gs:./.../export.txt .
cat export.txt

PART 04 — DEMO TWO
SSRF to the metadata service
01 Find the fetch feature
An input that makes the server request a URL for you.
02 Point it inward
Aim it at the metadata address instead of a website.
03 Read the token
The server hands back the VM's credentials.
04 Reach the ﬂag
Use the token to open what it protects.
THE REQUEST
GET /fetch?url=
http:./169.254.169.254/
computeMetadata/v1/...
The header the metadata server expects is part of the puzzle.

PART 04 — PUTTING IT TOGETHER
How a full cloud challenge chains together
01
Recon
Find what is exposed.
02
Foothold
Get an initial way in.
03
Escalate
Turn a small win into a bigger
one.
04
Objective
Reach the flag.
The finals mission is this shape, stretched across five stages.

PART 04 — BEFORE YOU GO
Mistakes to avoid
Guessing ﬂags. Read the challenge instead; the answer is earned, not typed.
Ignoring the hints. They are free. Use them the moment you stall.
Working alone. It is a team event; divide and compare.
Not taking notes. You will repeat work you already did.
Panicking on the clock. Keep calm and work the method.

TAKE THIS WITH YOU
Resources
PRACTICE
picoCTF picoctf.org
TryHackMe tryhackme.com
Hack The Box hackthebox.com
OWASP owasp.org
CLOUD & TOOLS
Google Cloud docs cloud.google.com/docs
Cloud SDK gcloud, gsutil
The command line curl, git
Session recording shared after today

Mastering Capture the Flag and Cloud Security Fundamentals for Beginners

Mastering Capture the Flag and Cloud Security Fundamentals for Beginners

More Related Content

Similar to Mastering Capture the Flag and Cloud Security Fundamentals for Beginners

More from Suresh Peiris

Recently uploaded

Mastering Capture the Flag and Cloud Security Fundamentals for Beginners