This document is a presentation by Hussein Muhaisen, detailing various types of Capture The Flag (CTF) challenges, prerequisites for participation, and specific areas of focus including cryptography, web exploitation, reverse engineering, forensics, and binary exploitation. It includes resources for getting started in CTF competitions and outlines essential knowledge required in scripting, Linux commands, and various programming languages. Additionally, it provides examples of specific topics within each area, such as SQL injection and memory analysis.

1. CTF Road Map
Hussein Muhaisen AKA System ExploitedCTF Road Map
Hussein Muhaisen AKA System Exploited
1
This Presentation Is Made by Hussein Muhaisen AKA System
Exploited

2. Types Of CTFs
•1. Normal CTFs
Types: web , crypto , binary-exploitation, forensics, reverse
engineering, mobile hacking.
These CTF Challenges Are in Some Sort Of Chains.
Flag Examples : Flag{FoUnd_Me_AyI}
2
This Presentation Is Made by Hussein Muhaisen AKA System
Exploited

3. Types of CTFs #2
•2. Attack and Defense
. Each Team Has His own vulnerable Machine ( Box )
. Patch Your System
. Exploit Your Enemy's System
So When The game starts the teams need to start attacking and
protecting the machines.
3
This Presentation Is Made by Hussein Muhaisen AKA System
Exploited

4. How To Find a CTF ?
4
This Presentation Is Made by Hussein Muhaisen AKA System
Exploited

5. Pre-requisites
• Scripting ---> Python , and Bash.
• Linux Commands -
https://overthewire.org/wargames/bandit/
https://tryhackme.com/room/zthlinux
• Web Fundamentals
• Networking Fundamentals
• Understanding Number Bases : Binary , Hex , Octa , etc.
5
This Presentation Is Made by Hussein Muhaisen AKA System
Exploited

6. Cryptography
• What is Cryptography ?
Ciphers That are needed to be used or broken.
Encoding vs Encryption vs Hashing
Symmetric and Asymmetric Encryption.
6
This Presentation Is Made by Hussein Muhaisen AKA System
Exploited

7. Cryptography Topics
• Base 64
• Caesar cipher , ROT13
• XOR Encryption
• MD5 Hashing
• RSA
• Frequency Analysis
• Atbash cipher
7
This Presentation Is Made by Hussein Muhaisen AKA System
Exploited

8. Web Exploitation
• Given a Web Server or Website Link and you need to find the certain
bug in order to exploit it and retrieve the flags.
•What Do You Need to Know ?
• HTML , CSS , Java Script
• Cookies
• Databases , SQL
• Robots.txt ( Web directories )
8
This Presentation Is Made by Hussein Muhaisen AKA System
Exploited

9. Web Exploitation Topics
• Inspect Element
• Cookie-based authentication
• SQLinjection , SQLmap
• XSS
• Burp Suite
• Remote Code Execution ( RCE )
• Fuzzing ( Dirbuster , GoBuster , Dirb )
• Networking Protocols ( HTTP , HTTPS )
• Jason Web Tokens
• Local File Inclusion ( LFI )
• Server Side and Client Side Authentication
9
This Presentation Is Made by Hussein Muhaisen AKA System
Exploited

10. Reverse Engineering
• Reverse Engineering is the process of knowing how
an executable work.
• What Do You Need to Know ?
• C/C++
• Java
• Assembly
10
This Presentation Is Made by Hussein Muhaisen AKA System
Exploited

11. Reverse Engineering Topics
• PE File Format
• ELF Binary Format
• System Calls
• Windows Internals and Linux Internals
• Tools To Know:
Ghidra
IDA Pro
Binary Ninja
Radare2
11
This Presentation Is Made by Hussein Muhaisen AKA System
Exploited

12. Forensics
• File Format Analysis:
Corrupt File Fixing
File Extensions and File Types
Hidden Files inside other files
• Steganography:
Hidden Text , Files , Images , Ciphers.
• Memory Analysis:
Dumps of Disk Images or Memories To analyze.
• Packet Analysis :
Analyze Network Packets such as wireshark pcap files
12
This Presentation Is Made by Hussein Muhaisen AKA System
Exploited

13. Forensics Topics
• File Extensions and File Types
• Metadata and Exiftools
• NTFS and FAT32 Formats
• LSB Steganography
• Disk Imaging
• Wireshark Packets
• Steghide , stegcracker , stegsolve , openstego , zsteg , jsteg
13
This Presentation Is Made by Hussein Muhaisen AKA System
Exploited

14. Binary Exploitation
• Binary exploitation is the process of subverting a compiled
application such that it violates some trust boundary in a way that is
advantageous to you, the attacker.
• Topics Needed :
• Buffer Overflows
• How processes work like RAM etc
• Memory Exploitation
• Learn How to Use Python to Exploit
14
This Presentation Is Made by Hussein Muhaisen AKA System
Exploited

15. Resources to Get started
• https://blog.tryhackme.com/free_path/
• https://hackthebox.eu
• https://overthewire.org/
• https://ctftime.org/
• HackerSploit
• John Hammond
• The Cyber Mentor
• IppSec
• LiveOverFlow
• zSecurity
• Joe Helle
• Network Chuck
• https://picoctf.org
• https://ringzer0ctf.com/challenges
• https://ctf.hacker101.com/
15
This Presentation Is Made by Hussein Muhaisen AKA System
Exploited

16. 16
This Presentation Is Made by Hussein Muhaisen AKA System
Exploited