r_u_alive_Start_here

Intro to CTF. What to do. What to look for. And oh, a flag!

Welcome to CSAW Quals 2023!

If you've played CTF before, the flag is at the end. If you haven't, this is intented to give you an idea of what's going on, in our words....

This is a hacking competition, also known as a cybersecurity competition. Cybersecurity is a vast field that covers many distint disiplins from cryptography, to reverse engineering, to creating tools, and so much more. Capture the flag (CTF) competitions such as this focus specifically on the mistakes people make when building websites (web), system applications (pwn, rev), cryptographic algorithms (crypto), and more (misc, forn). Outside of competition, these mistakes would be considered bugs. Due to the severity, side-effects, and consequences of these bugs they would also be considered vulnerabilities.

After this competition, you can turn your sights to real-world applications and possibly find bugs just like the ones in these challenges, and possibly be rewarded money for finding them through bug bounty programs! Be aware though, not all bugs are of consequence - often programmers can make mistakes that don't result in vulnerabilities. This is part of what makes cybersecurity hard (as in, NP-hard).

Anyways, most of the challenges you'll see this weekend are designed to teach you something....usually one specific thing. To that end, the scope of most of these challenges are extremely refined. This is part of what gamifies these challenges; since each challenge usually has one thing for you to find and exploit, they each serve as a small puzzle for you to solve. The solution to each of these puzzles is going to be a "flag," or a (hopefully) funny string of text for you to submit back to the website and earn points! They'll all follow the format csawctf{...} with the funny bit of text between the squiggly brackets. Submit the entire thing to the website, including csawctf and the squiggly brackets.

Depending on how you score, you might get invited to our finals event in New York City!

Some challenges are going to scale dynamically - that means the more people solve it, the fewer points it will be worth. If you're just starting off, you should start with challenges that are lower point values to try to get a handle of things before moving on to harder challenges (or challenges whose point score hasn't settled yet). I also recommend not getting too hung up on any one challenge. After a couple hours of cracking away at something, perhaps try moving on to other challenges.

Next week, after the competition's over, you'll be able to Google for walkthroughs (written by other teams playing in this CTF) of the various challenges. Right now, you can Google for walkthroughs for challenges from previous years! Some challenge types stay fairly similar year to year, so it could be a good help if you're stuck.

Now, since the challenges are limited in scope, the way you find solutions is limited in scope. This is defined more explicitly in the rules (which you can find on the website), but doxing the organizers, attacking the infrastructure (which includes brute forcing solutions - except when explicitly required!), and cheating are all examples of things that are out of scope.

If you have questions, please ask in our Discord server: https://discord.gg/csaw23 Revisions, hints, and other announcements will happen through the Discord server as well.

Good luck!

Flag is in the Discord in the rules