https://www.enisa.europa.eu/news/enisa-news/capture-the-flag...
which requires really solid theoretical knowledge and hands-on experience from various computer related topics like:
cryptography, reverse engineering, web, low lvl programming, operating systems, networks, protocols, etc, etc.
Top competitors tend to work at e.g Google for Project Zero or other big institutions like CERT (https://en.wikipedia.org/wiki/Computer_emergency_response_te...) or Banks
Until 2020 they were almost always around top3 and a few times top1 teams in the world according to https://ctftime.org/
but in 2021/2022 I don't see them
It's hard for an individual to maintain that level of commitment over time, especially if their personal responsibilities increase (getting a full-time job, starting a family, etc.). Responsibilities aside, people also just get bored and/or burnt out (after a point, most challenges are just variations on something you've seen before).
For a team to stay competitive over time, they either need enough members to fill the gaps, or a sustainable influx of new members.
2022-07-23 18:58:31 = -ENOCHEAT
> I also saw once a player trying to swipe a piece of paper with configuration (user/password) details of another team on an Attack&Defense style CTF. They were caught in the act and their team got some penalty for it.
We did exactly that at the Nuit du Hack CTF finals in 2014 to snatch the win against you folks (Dragon Sector). Since there was a flag specifically designed around shoulder surfing (taped to the network switch on each team's table) we asked organizers whether swiping the config credentials was fair game, and they said it was completely fine. Absurd, but hey, I don't make the rules :)Poor sports, I’ve always struggled to understand people who’d partake in hacking competitions and then get upset because someone got onto their computer and took all the flags.
The sport is about everyone racing to solve the same puzzles. If one team is sabotaging the puzzles in the process, it's a different kind of competition than the players expected. Frustration is warranted.
It would be like signing up for the 100m dash but then having your competitors throw obstacles into your lane. That wasn't the intent of the competition.
CTFs are (usually) hacking competitions for hackers, what else would you expect?
Simply because the context is hacking does not mean that performing additional hacking outside of the context of the competition is in the same spirit. Breaking the rules isn't hacking better than another team, it's breaking the rules.
That said, I have no idea what this guy is talking about. I thought he was talking about gaming but the more I read, the more confused I get. Especially the facebook part. What is going on here?
edit: thanks, Retr0id
I found it to be some of the most fun ctfs I played, partially because it was extremely time-bound. Rounds were 20 to 30 minutes each. It meant that you still had the rest of your conference time for other activities, rather than taking over your entire weekend.
Back in like 2014 we were competing in RuCTF and some other team hacked our vulnbox and just shut down the rng, making the box effectively inaccessible via ssh and slow as molasses on tls-enabled services (besides capturing all of our flags).
It was an enlightening experience.
Now granted, ructf was pf a particularly spectacular violence… but still, it’s been an experience that has taught me a lot.
Is finding a single proxy in a country that hard that you need to do that? I would assume proxy lists including each country would already exist.
Note that I'm using 50 as a random example number here, not an actual measurement.
How is "insert into found_flag (team_id, flag_id, found_at) values ($1, $2, now()) on conflict do nothing" slower than this 4 step race-condition-prone operation? (To get the score, "select count(1) from found_flag where team_id=$1".) You don't even need transactions for this, as long as you can't transition from found to not found somehow ("delete from found_flag where team_id=$1 and flag_id=$2").
The only problem I see with this is where validating the correct answer is expensive; without another piece of data to show that validation has started, you can overload the checker by submitting your answer before the first validation routine succeeds. But that is also easy to track, with a timeout even, and you still don't need transactions.
The enemy's gate is down!