Introduction
Looking back on the many high school CTF challenges I’ve taken part in, I realized that this list of tips will be useful to others who are just getting started or who want to improve their team CTF skills. The most notable competitions I’ve won are the moreNET Missouri High School Cybersecurity Challenge in 2021 and 2022, and here are some suggestions I found helpful when approaching these CTF challenges and what I’ve learned.
Struggling is okay.
When you are first starting, you might find it hard or be frustrated at problems. Take time to learn material online and find your weak points. I found it challenging in the 2021 season when I was just starting, but I quickly identified my weak points and learned from it. You can always use your teammates to help you if you need a different way to view a problem or need them to try to solve it.
Understand That Solving the Hard Problems First Is Not Critical
Starting with the most challenging problems is not really the smartest move and will waste a lot of valuable time. I found this out when competing in the 2022 competition; looking at the hardest problems first and trying to solve them wasted a lot of our time as a team and could have cost us in the end. I found that working on challenges that might be easier and have low point values is way better in the end. This might sound like common sense, but it needs to be said.
Work to Your Skillset
In a team environment, understanding what each member is good at is important. Some people might be good at one single category and weak in others. Understanding this will allow you to give them a large portion of time on those challenges that work to their skillset and then provide a new mindset and approach to challenges they might not be strong in but other members might.
Challenge Hints Are Valuable
Trying to gain as much information from the hints listed on the challenge is very helpful; if they don’t cost anything, use them pretty much always. If they do, however, cost points, only use them as a last resort. In the 2022 competition, we were down to the wire with another team and had to use some points to gain a hint, which helped us solve the problem but at a COST.
Chain Problems Shouldn’t Be the Priority
I found that for challenges that have multiple parts to them, skipping this and going back to them later on is beneficial. This is because these challenges are broken into steps that might be progressively harder. A personal experience of this was in the 2021 competition, where a steganography challenge continued, leading to a new message once one was solved. This led to hours of effort used, which thankfully we worked on this problem later on, but if we had started it earlier, it could have used up time from solving other problems.
Ask Questions
This might be controversial, but if you are at an in-person event where asking questions is allowed, asking direct questions to the organizers might be helpful, as they might respond with something that might give you an advantage. This was one of my personal strategies that gave me an edge during competitions, and I’m kind of giving it away here. :)
A sample question I might ask in competition.
Q: I have tried scanning port 443 and know there is a web server hosted; given the CTF question, what am I missing?
R: Is all web servers traffic encrypted?
This pretty much just gave away that the web server hosted is unencrypted and I should try and scan port 80.
There Is Always Another Way
A given problem might have a direct solution, but most of the time there is always another way to solve it. There are multiple times I have solved CTF problems a different way than intended, and it helped to my advantage. The best example I can provide is in the 2022 competition when we were told we needed to crack a Windows password given an SAM file. I was able to find another way into the machine and reset the administrator password, giving me full access to the machine.
Read and Analyze Info Closely
When given a problem or information, read it very carefully—you could miss something that is important. There were many times when I didn’t read a question carefully, causing me to miss valuable information—something that really held me back as a beginner.
Let’s continue the sample scenario given in “THERE IS ALWAYS ANOTHER WAY”.
Q: There is a windows machine on the network, given this SAM file log into the desktop and gain the flag.
Given this scenario, the first thing people would normally think about is, “I just need to find the IP address and use a Windows SAM cracking tool on it to gain the password.”. This might be the general thought process, but as stated earlier, there is always another way. You might ask, “What version of Windows is running, and is it vulnerable to an exploit?”. When doing your port scanning, you could easily add a command flag to gain this information, allowing you to know if there is maybe an alternative way to solve it.
The main advantage that I had in the 2022 competition was being able to exploit EternalBlue on the Windows machine, as I was able to find out it was a vulnerable Windows 7 machine, then remote desktop into the machine to gain the flag. I found out later on that no one or very few were able to solve this problem.
Learning Is Important
The 2021 competition was vital in telling me what I need to learn. I took this competition as a good way to figure out what I needed to learn; in my case, it was definitely understanding networking fundamentals and reverse engineering code. As a beginner, you can use these experiences as a way to grow.
The 2022 competition was mainly about understanding the importance of detail. One of the CTF organizers named Jonathan gave us the hint, “You need to mass scan the network?” Even with this hint, not a single person in the competition room could solve the problem. When we went over the problems after the competition, we were told we needed to use a tool called “masscan” to scan the network faster and find the web server.
Conclusion
Competing in CTFs has made a huge impact on my career and is something I look back on constantly. By doing these competitions, you not only know how to work in a team environment but also gain skills like problem-solving, working under pressure, and, most of all, teamwork. So, remember that the path won’t always be easy, but if you continue learning and improving, it could be very rewarding.