The ethics of hacking

So this blog is fairly new, and my first capture the flag exercise was published the other day. Fortunately, the CTF seems to have been fairly successful, and I have had a number of different questions and feedback provided by various people.

When I first published this blog, I wondered whether I would observe an increased number of cyber attack attempts to my server, due to the type of audience that would be visiting the website.

Interestingly, I’ve already found a number of different IP addresses performing scans/hacking attempts on my server, that have also downloaded my Capture the Flag exercise in full. These scans looks different to the usual noise you see in server logs.

I am sure (and hope) that the majority of the users who download my CTF exercises use their skills for good reasons, potentially leading to or improving their careers in white-hat cyber security.

I strongly encourage anyone learning these skills to use them wisely, and for legitimate purposes only. There’s not a lot I can do if you choose otherwise, but scanning and attempting to brute force a server from your domestic internet connection without any attempt at anonymity is not particularly the most intelligent thing I’ve seen.

To everyone else playing by the rules, thank you, and good luck with my CTF – I look forward to hearing your feedback.

CTF's My CTF's

Credit Card Scammers CTF

This is my first Capture the Flag exercise and covers a number of different techniques.

Download Now

The back story: Scammers are taking advantage of people and various fake shopping websites have been setup, but people are finding their orders never arrive. We have identified one scam website which we believe is harvesting credit card details from victims. Your objective is to take down the scam website by gaining root access, and identify the 3 flags on their server. Our intelligence suggests the scammers are actively reviewing all orders to quickly make use of the credit card information.

The types of vulnerability used in this CTF can be seen below (they are intentionally hidden by default):

You can download the Capture the Flag here. This has been tested using VirtualBox but may work with other virtualisation platforms. DHCP is enabled, and it is recommended you run this in host-only network mode.

Please feel free to leave me feedback in the comments. I am keen to see what people thought about it and how easy/difficult they thought it was.

SHA-256: e840abca18c81bb269a02247a99416b0f63261f3a62d4b17b9436fb3387f70e7