Building Engineering Culture Through Capture the Flag Activities

#VJMEJOH&OHJOFFSJOH$VMUVSF 5ISPVHI$BQUVSFUIF'MBH"DUJWJUJFT .BUUIFX#BJMFZ

&OHJOFFSJOH$VMUVSF 8IBUJT$BQUVSFUIF'MBH $5' 8IBU$BO8F-FBSO $POOFDUJPOUP&OHJOFFSJOH$VMUVSF
0VS3PMFBT.BOBHFST 8IBU$BO:PV%P "HFOEB

3FTQPOTJCMFGPSEFWFMPQNFOUBOE PQFSBUJPOPGUIF4UJDLFSNFTTBHFGFBUVSF JOUIF-*/&"QQMJDBUJPO -*/&$PSQPSBUJPO 4FSWFS4JEF&OHJOFFS -*/&$PSQPSBUJPO &OHJOFFSJOH.BOBHFS
-:$PSQPSBUJPO &OHJOFFSJOH.BOBHFS -:$PSQPSBUJPO 4FOJPS&OHJOFFSJOH .BOBHFS "CPVU .F .BUUIF X #BJMFZ

8IFSF%PFT:PVS&OHJOFFSJOH$VMUVSF 0SJHJOBUF'SPN *XJMMTIBSFIPXTPNFPGPVSFOHJOFFSJOH DVMUVSFPSJHJOBUFEJOUFBNNFNCFSDSFBUJWJUZ &OHJOFFSJOH$VMUVSF ⎯ $PNQBOZ7BMVFT ⎯ 0SHBOJ[BUJPOBM-FBEFSTIJQ ⎯
5FBN.FNCFS$SFBUJWJUZ

"T.BOBHFST *MMFYQMBJOPOFXBZUIBUXFXPSLFEUPBDIJFWF UIJT &OHJOFFSJOH$VMUVSF ⎯ 8FXBOUUPTVQQPSUPVSUFBN ⎯ 8FXBOUUPFOBCMFCPUUPNVQJOJUJBUJWFTBOEBWPJE CFDPNJOHBCPUUMFOFDL ⎯
8FXBOUUPFODPVSBHFBTVQQPSUJWFFOWJSPONFOUJO XIJDINFNCFSTPGBMMFYQFSJFODFMFWFMTBOE CBDLHSPVOETDBOXPSLDPNGPSUBCMZ

• *OWFTUJHBUFBTBNQMFBQQMJDBUJPOPS GFBUVSF • &YQMPJUBTFDVSJUZWVMOFSBCJMJUZUPGJOEB TFDSFUTUSJOHDBMMFEB GMBH • *GUIFEJTDPWFSFETUSJOHJTDPSSFDU UIJTJT
QSPPGUIBUUIFQBSUJDJQBOUTVDDFTTGVMMZ GPVOEBOEVTFEBTFDVSJUZWVMOFSBCJMJUZ • 5IJTJT)BDLJOH1SBDUJDFBOEDBOCF VTFEUPUSBJOBXBSFOFTTPGTFDVSJUZ DPODFQUT 8IBUJT$BQUVSF5IF'MBH $5' 4FDVSJUZ4LJMM%FWFMPQNFOU

&YBNQMF$5' Context • You don't know the password Mission •
Login successfully and find the flag

&YBNQMF$5'

&YBNQMF$5' - The flag is displayed after successful login -
In CTF events that contain multiple challenges, there is often a common prefix for flags, in this case "techverse_", and this prefix can serve as a hint to participants

&YBNQMF$5' - The flag value is confirmed by the facilitator,
or by a judge server - In the case of a judge server and multiple teams participating in the event, you can make a scoreboard etc. - If there is a scoreboard, it's common to reward more points for more difficult challenges Facilitator Judge Server

&YBNQMF$5' What do we learn as engineers? - View Source
feature - Develop in a way that prevents testing code from going into production

4FDVSJUZBOE&OHJOFFSJOH4LJMMT 0UIFS4LJMMT 8IBU#FOFGJUT$BO8F(FU ⎯ 4FDVSJUZ"XBSFOFTT ⎯ *OWFTUJHBUJPOBOE%FCVHHJOH ⎯ 5FTU&OWJSPONFOU4FUVQ ⎯
Problem Solving ⎯ Critical Thinking ⎯ Time Management

CTF as an equalizer • No matter how much experience
you have, there's always something you haven't learned or tried before • Experienced team members don't have all the answers • CTF can demonstrate this • Experienced team members can guide about how to learn and investigate Preparation •CTF can help us be prepared for real work scenarios Creativity •Not only solving, but also making interesting CTF challenges requires creativity $POOFDUJPOUP&OHJOFFSJOH$VMUVSF

• Capture the Flag events are active and represent "do"
as compared to "tell" • The facilitator learns how to give hints and guidance without giving the answer • Effective hints are often given as questions that need to be answered, rather than as statements about the challenge • Participants learn the engineering and security concepts needed to solve the challenge, and also learn "what questions to ask" when doing an investigation $POOFDUJPOUP&OHJOFFSJOH$VMUVSF

&YBNQMFT'SPN0VS0SHBOJ[BUJPO

4VNNBSZ - 4UBSUXJUIBQBDLFUDBQUVSF GSPNBTFSWFS"1*XIJDI DPNNVOJDBUFTPWFS6%1 XJUIEBUBUIBUJTOPUIVNBO SFBEBCMFJOUIFQBDLFU - *EFOUJGZUIF"1* QSPUPDPM
BOEXIBUJUJTEPJOH - $SFBUFBDMJFOUUIBUXJMM DPOOFDUUPUIF"1*BOE EPXOMPBEB1%'GJMFXJUIUIF GMBHJOJU 1BDLFU"OBMZTJT -FBSOJOHT - 1BDLFUDBQUVSFBOBMZTJT - 6%1CBTJDT - $SFBUJPOPGBDMJFOUUIBUVTFT B6%1DPOOFDUJPO - "HHSFHBUFEPXOMPBEFEEBUB JOUPBGJMF

4VNNBSZ - 4UBSUXJUIBCJOBSZUIBUDBOOPUCF SVOPOZPVSPXODPNQVUFS - "TBIJOU QBSUJBMTPVSDFDPEFJT QSPWJEFECVUBLFZNFUIPETDPOUFOUT BSFPNJUUFE -
*EFOUJGZUIBUUIFCJOBSZJTGPSBO*#. 4ZTUFNNBJOGSBNF - 6TFWJSUVBMJ[BUJPOUFDIOPMPHZUP DSFBUFBOFYFDVUJPOFOWJSPONFOUGPS UIFCJOBSZ - 6TFBEFCVHHFSTVDIBT(%#UP JOTQFDUUIFNFNPSZPGUIF BQQMJDBUJPOBOEFYUSBDUUIFGMBH 7JSUVBMJ[BUJPO -FBSOJOHT - 6TFPGWJSUVBMJ[BUJPOUFDIOPMPHZUPTFU VQB7.XJUIBEJGGFSFOUBSDIJUFDUVSF - 6OEFSTUBOEIPXBOEXIZUIFSFBSF EJGGFSFOUCJOBSJFTGPSEJGGFSFOU BSDIJUFDUVSFT - 6OEFSTUBOEUIBUUIFGMBHJTJONFNPSZ BOEIPXUPJOTQFDUBOEBDDFTTJU

• 8FEJEBMBSHFUFBNXPSLTIPQJO JODMVEJOHdDIBMMFOHFT SFMBUFEUPUIFGPMMPXJOHUPQJDT 5FBN8PSLTIPQ .POHP%# $FOUSBM %PHNB MySQL Heap
Analysis Application Metrics Cryptography Protocol Analysis JWT

0VSFGGPSUTCFHBOBTBCPUUPNVQJOJUJBUJWF OPUUPQEPXO .FNCFSTXFSFJOUFSFTUFEJOTFDVSJUZ BOEJOMFBSOJOHUISPVHI$5'DIBMMFOHFT 0VSUFBNTFMGPSHBOJ[FEUIFFWFOUTBOEEFWFMPQFEUIFDIBMMFOHFTPVSTFMWFTBU UIFUFBNNFNCFSMFWFM 5IF GJSTU BDUJWJUZXBTGPSBOPGGJDJBMUFBNFWFOU CVUBGUFSUIBUNFNCFSTTUBSUFE
PSHBOJ[JOHNBOZBEIPD$5'T 8IZ 8F %JE 5IJT

1BSUJDJQBUF • +PJOUIF$5'TBTBQBSUJDJQBOU • 4USVHHMFXJUIUIFDIBMMFOHFT MFBSO BOEIBWFGVO • 4IPXUIFUFBNUIBUJUT0,UPOPULOPXUIJOHT &ODPVSBHF
• 1SFQBSJOHBOEKPJOJOH$5'TUBLFTUJNFBOEFGGPSU • 3FDPHOJ[FUIFWBMVFJOUIJTBOEFODPVSBHFNFNCFST • 1SFTFOUDPOUSJCVUJPOUPPSHBOJ[BUJPOBMDVMUVSFBTBDBSFFSPQQPSUVOJUZ $POUSJCVUF • %FWFMPQDIBMMFOHFTZPVSTFMGBOEHVJEFUIFUFBN 8IBU4IPVME8F%P"T.BOBHFST

.BOBHFST • 5SZJU.BLFBTJNQMF$5'XIJDIJTSFMBUFEUPZPVSPSHBOJ[BUJPOPSUIFUFDIOPMPHZ ZPVVTF • (FUUFBNNFNCFSTJOWPMWFE • 4FUUIFFYQFDUBUJPOUIBUJUT0,UPVTFUJNFGPSMFBSOJOHJOUIJTXBZ • &ODPVSBHFUIFUFBNUPTUBSUUPEFWFMPQBOEGBDJMJUBUFUIFJSPXO$5'T5IFJS
DSFBUJWJUZNBZTVSQSJTFZPV BOEZPVXJMMQSPCBCMZTUSVHHMFUPTPMWFXIBUUIFZ DSFBUFEr BOEUIBUT0,?@? /PO.BOBHFST • 5SZJU • 5FMMZPVSNBOBHFSZPVUIJOLJUTJNQPSUBOU PS UFMMZPVSNBOBHFSXIBUZPVUIJOL JTJNQPSUBOU 5IFZXBOUUPLOPX 8IBU4IPVME:PV%P/FYU

5P:PVGPS-JTUFOJOH?@? 5P.Z5FBNGPS"MM5IFJS&GGPSUT 5IBOL:PV

Building Engineering Culture Through Capture th...

Building Engineering Culture Through Capture the Flag Activities

LINEヤフーTech (LY Corporation Tech) PRO

More Decks by LINEヤフーTech (LY Corporation Tech)

Other Decks in Business

Featured

Transcript

#VJMEJOH&OHJOFFSJOH$VMUVSF 5ISPVHI$BQUVSFUIF'MBH"DUJWJUJFT .BUUIFX#BJMFZ

&OHJOFFSJOH$VMUVSF 8IBUJT$BQUVSFUIF'MBH $5' 8IBU$BO8F-FBSO $POOFDUJPOUP&OHJOFFSJOH$VMUVSF

3FTQPOTJCMFGPSEFWFMPQNFOUBOE PQFSBUJPOPGUIF4UJDLFSNFTTBHFGFBUVSF JOUIF-/&"QQMJDBUJPO -/&$PSQPSBUJPO 4FSWFS4JEF&OHJOFFS -*/&$PSQPSBUJPO &OHJOFFSJOH.BOBHFS

8IFSF%PFT:PVS&OHJOFFSJOH$VMUVSF 0SJHJOBUF'SPN *XJMMTIBSFIPXTPNFPGPVSFOHJOFFSJOH DVMUVSFPSJHJOBUFEJOUFBNNFNCFSDSFBUJWJUZ &OHJOFFSJOH$VMUVSF ⎯ $PNQBOZ7BMVFT ⎯ 0SHBOJ[BUJPOBM-FBEFSTIJQ ⎯

"T.BOBHFST *MMFYQMBJOPOFXBZUIBUXFXPSLFEUPBDIJFWF UIJT &OHJOFFSJOH$VMUVSF ⎯ 8FXBOUUPTVQQPSUPVSUFBN ⎯ 8FXBOUUPFOBCMFCPUUPNVQJOJUJBUJWFTBOEBWPJE CFDPNJOHBCPUUMFOFDL ⎯

• OWFTUJHBUFBTBNQMFBQQMJDBUJPOPS GFBUVSF • &YQMPJUBTFDVSJUZWVMOFSBCJMJUZUPGJOEB TFDSFUTUSJOHDBMMFEB GMBH • GUIFEJTDPWFSFETUSJOHJTDPSSFDU UIJTJT

&YBNQMF$5' Context • You don't know the password Mission •

&YBNQMF$5'

&YBNQMF$5' - The flag is displayed after successful login -

&YBNQMF$5' - The flag value is confirmed by the facilitator,

&YBNQMF$5' What do we learn as engineers? - View Source

4FDVSJUZBOE&OHJOFFSJOH4LJMMT 0UIFS4LJMMT 8IBU#FOFGJUT$BO8F(FU ⎯ 4FDVSJUZ"XBSFOFTT ⎯ *OWFTUJHBUJPOBOE%FCVHHJOH ⎯ 5FTU&OWJSPONFOU4FUVQ ⎯

CTF as an equalizer • No matter how much experience

• Capture the Flag events are active and represent "do"

&YBNQMFT'SPN0VS0SHBOJ[BUJPO

4VNNBSZ - 4UBSUXJUIBQBDLFUDBQUVSF GSPNBTFSWFS"1XIJDI DPNNVOJDBUFTPWFS6%1 XJUIEBUBUIBUJTOPUIVNBO SFBEBCMFJOUIFQBDLFU - EFOUJGZUIF"1* QSPUPDPM

4VNNBSZ - 4UBSUXJUIBCJOBSZUIBUDBOOPUCF SVOPOZPVSPXODPNQVUFS - "TBIJOU QBSUJBMTPVSDFDPEFJT QSPWJEFECVUBLFZNFUIPETDPOUFOUT BSFPNJUUFE -

• 8FEJEBMBSHFUFBNXPSLTIPQJO JODMVEJOHdDIBMMFOHFT SFMBUFEUPUIFGPMMPXJOHUPQJDT 5FBN8PSLTIPQ .POHP%# $FOUSBM %PHNB MySQL Heap

0VSFGGPSUTCFHBOBTBCPUUPNVQJOJUJBUJWF OPUUPQEPXO .FNCFSTXFSFJOUFSFTUFEJOTFDVSJUZ BOEJOMFBSOJOHUISPVHI$5'DIBMMFOHFT 0VSUFBNTFMGPSHBOJ[FEUIFFWFOUTBOEEFWFMPQFEUIFDIBMMFOHFTPVSTFMWFTBU UIFUFBNNFNCFSMFWFM 5IF GJSTU BDUJWJUZXBTGPSBOPGGJDJBMUFBNFWFOU CVUBGUFSUIBUNFNCFSTTUBSUFE

1BSUJDJQBUF • +PJOUIF$5'TBTBQBSUJDJQBOU • 4USVHHMFXJUIUIFDIBMMFOHFT MFBSO BOEIBWFGVO • 4IPXUIFUFBNUIBUJUT0,UPOPULOPXUIJOHT &ODPVSBHF

.BOBHFST • 5SZJU.BLFBTJNQMF$5'XIJDIJTSFMBUFEUPZPVSPSHBOJ[BUJPOPSUIFUFDIOPMPHZ ZPVVTF • (FUUFBNNFNCFSTJOWPMWFE • 4FUUIFFYQFDUBUJPOUIBUJUT0,UPVTFUJNFGPSMFBSOJOHJOUIJTXBZ • &ODPVSBHFUIFUFBNUPTUBSUUPEFWFMPQBOEGBDJMJUBUFUIFJSPXO$5'T5IFJS

5P:PVGPS-JTUFOJOH?@? 5P.Z5FBNGPS"MM5IFJS&GGPSUT 5IBOL:PV