6 ms·
Overthewire.org
- nandkeypull 3y agoSome newer pedagogical resources with a good learning curve: * https://pwn.college/ https://pwn.college/ * https://dreamhack.io https://dreamhack.io * https://guyinatuxedo.github.io https://guyinatuxedo.github.io * https://www.picoctf.org/ https://www.picoctf.org/
- ghostfoxgod 3y agoCame across this site which was suggested by a friend of mine. After solving few of the problems, I have reached the moment of "wow I did not know about this at all" and it's exciting to learn more about Linux ecosystem in general. Would highly recommend anyone who is keen to learn and explore Linux. Shoot me a DM [1] if you wish to form a small group to solve and discuss these questions together once in a while. [1] https://twitter.com/akashwhocodes https://twitter.com/akashwhocodes
- runnerup 3y agoI don't use X but I'd be interested nonetheless. Can email me at HNrunnerup@protonmail.com
- asicsp 3y agoSee also: * https://linuxsurvival.com/ https://linuxsurvival.com/ * https://old.reddit.com/r/linuxupskillchallenge/ https://old.reddit.com/r/linuxupskillchallenge/ * https://github.com/learnbyexample/TUI-apps https://github.com/learnbyexample/TUI-apps (written by me, interactive exercises for grep, sed, awk, etc)
- ghostfoxgod 3y agoThanks for sharing these.
- rs_rs_rs_rs_rs 3y agoVery good wargames! Learned a lot from them. My suggestion for those wanting more is https://exploit.education/ https://exploit.education/
- jedimastert 3y agoAlso adding an absolute classic (at least in my mind): https://www.hackthissite.org/ https://www.hackthissite.org/
- d1str0 3y agoI used to be a dev for them. HTS is how i got started with computer science.
- natrys 3y agoSome more: https://pwnable.kr/play.php https://pwnable.kr/play.php
- junkypuppet 3y agoSomething similar for PowerShell: https://underthewire.tech/wargames https://underthewire.tech/wargames
- eqmvii 3y agohappy to see this every time it comes around
- em-bee 3y agoi hate it when sites are posted with out any descriptive title ;-) then i am curious, and end up getting drawn in. now i want to run: ssh level0 command to read pw1 | sshpass ssh level1 command to read pw2 | sshpass ssh level 2 ...
- ghostfoxgod 3y agoHahaha hop aboard, I am currently ssh-ing as well ;)
- ghostfoxgod 3y agoI'm also planning to jot down the approach and strategy into short form blogs as and when I keep solving them and publish it on my blogging site [1]. This will help me keep coming back to it and revise it more easily. [1]: https://akashrajpurohit.com/ https://akashrajpurohit.com/
- dijit 3y agoI've been sort-of adjacent to a lot of these groups when they were in their infancy (hackr.org darkdevelopments.com ssgroup.org etc;) and it's really cool how the majority of the kids who were running those sites in the 2000's are now so keen to create better environments for others to learn. Hackthissite and websec.fr are other excellent resources from the same pedigree of people
- mettamage 3y agoI trained a lot at hackthebox.eu
- mrmincent 3y agoI recently completed a grad Cert in cyber security, and a large initial part of the practicals were to just go through otw and complete some of the lessons. It’s a great resource, and had I known about it before hand I probably wouldn’t have bothered paying so much for the course and just completed the otw exercises instead :/
- ghostfoxgod 3y agoAsking out of curiosity, have you completed otw completely? How much of it do you feel it helped you in your course? I'm already learning so much from the bandit exercises itself (which I believe are for entry level folks) So completing all of it would be so fascinating.
- mrmincent 3y agoNice! I certainly haven’t completed all of them, just bandit, the web based one, and one of the mediumish ones, and maybe not even all of it, I can’t remember which one tbh. Definitely a fantastic learning resource, once my brain has had a bit of downtime from the course I’m planning on going back and doing more otw.
- asynchronous 3y agoReally I think that just speaks to the weakness of grad level certs. OTW and it’s offerings are fantastic but still entry level.
- mrmincent 3y agoYep, I definitely wouldn’t have done the grad Cert if I knew how weak it would be, was very expensive and very disappointing.
- beardedwizard 3y agoYou can't talk about OTW without talking about smash the stack. The best part of all of these communities was the accompanying irc channels, which are mostly dead now. Jduck, spender, many other known names hung out and you could really learn from the best if you could handle the abuse. The scene exists in kind of a zombie state now, the games are mostly up to date but ...
- lilboiluvr69 3y agoKnow of any modern communities with a similar spirit and ethos in the same scene?
- archgoon 3y agoThe ctf community is fairly active. Http://ctftime.org
- _def 3y ago> you could really learn from the best if you could handle the abuse Care to elaborate? I assume there was cliche rough tone and elitism going on, but I don't know
- beardedwizard 3y agoThe price for saying something ignorant was usually pretty high in the form of verbal abuse, and you had to be willing to cater to that elitist attitude in many cases. Infosec had, and continues to have a gate keeping problem. The strange thing to me is that the scene pretty much died, but these zombies live on, half alive but without a strong community talking about them. Btw not talking about spender or jduck here, just the scene overall.
- pooloo 3y agoThat was pretty much any IRC community
- dang 3y agoRelated: Wargames can help you to learn and practice security concepts through games - https://news.ycombinator.com/item?id=29724594 https://news.ycombinator.com/item?id=29724594 - Dec 2021 (26 comments) The Bandit Wargame - https://news.ycombinator.com/item?id=29708304 https://news.ycombinator.com/item?id=29708304 - Dec 2021 (1 comment) OverTheWire: Wargames to learn and practice security concepts - https://news.ycombinator.com/item?id=16252873 https://news.ycombinator.com/item?id=16252873 - Jan 2018 (23 comments) Wargames - https://news.ycombinator.com/item?id=9878302 https://news.ycombinator.com/item?id=9878302 - July 2015 (17 comments)
- throw1234651234 3y agoI treat overthewire as a practical bash refresher, rather than learning how to hack. I can't get past the easiest set of problems without spending a ton of time on it, but it's good to remember the basics now and again.
- rgovostes 3y agoCoincidentally I just found the lost sources to a binary reverse engineering challenge I wrote in 2010. Compile it without peeking (use the “modern” branch, follow README instructions for patching bomb.c). https://github.com/RPISEC/csci-4971-bomb https://github.com/RPISEC/csci-4971-bomb
- ajolly 3y agoThat was a great exercise when I was starting out. Thanks for designing it!
- jpfr 3y agoNice. I recall there were .txt files in the filesystem where you could leave your name and a shoutout after completing a level. Mostly „Kilroy was here“ equivalents. But it felt oh so 1337 hacker to add yourself. Quite the motivation boost for a teenager. :-) Also see https://microcorruption.com https://microcorruption.com. You don’t need Linux-specific knowledge. It directly goes to MSP430 assembly. A nice and compact introduction to exploiting binaries and embedded systems.
- dancosta0601 3y agoI have played it some years ago, it's very good to start learning about wargames and hacking competitions
- nickysielicki 3y agoIt's cool to go through how much these challenges are irrelevant in 2023 due to things like ASLR, better compiler warnings, etc.
- LordShredda 3y agoThey're irrelevant until you find a hospital cutting IT funding and the devs don't know what they're doing.
- grayhatter 3y agoI'm not sure I would consider any of these to be relevant... just because the exploits don't work doesn't mean the skills learned to complete them don't transfer. by that argument HTML is irrelevant because everyone uses [JavaScript-Framework] now.
- nickysielicki 3y agoDo the skills actually transfer? If your goal is to learn assembly and/or how a computer executes code, you can probably learn that more directly by spending an afternoon on godbolt. If your goal is to learn computer security, I'm not sure there's really much transfer to be had here. Most of the interesting computer security things to know are at a much higher elevation now. Many of these will simply not compile without explicitly disabling a compiler warning, and except in rare cases, the rop challenges are impossible. I'm just commenting on what a huge win I feel it is for the software industry that in the past 15 years these went from "copy the binary to your local machine and it works exactly the same, gcc doesn't even warn about this" to "it doesn't realistically have this vulnerability when run on your machine, nor will it build from source on your machine." edit: wikipedia is claiming linux has had ASLR since 2005 so maybe I'm wrong.
- jasonladuke0311 3y agoI bet quite a few IoT devices would fall to these irrelevant attacks
- Retr0id 3y agoThis criticism is largely irrelevant. Mitigations like ASLR are not a silver bullet, they are one layer of a defense-in-depth. You can't hope to exploit an ASLR'd executable without first understanding how to exploit a non-ASLR'd executable. If you want to exploit modern systems, you need to peel back those mitigations one by one (if you're lucky you can jump over multiple layers at once, but not always). Further, just because mitigations exist, it doesn't mean they're widely deployed. As a recent and prominent example, the Nintendo Switch bootrom was pwned through a classic stack-smash with shellcode-on-stack in ~2018 (or 2017, for those in-the-know). That said, there are more modern resources available these days, I'm also a fan of https://github.com/RPISEC/MBE https://github.com/RPISEC/MBE, which kinda speedruns you up to the state-of-the-art (although it too is getting kinda old at this point - but things haven't changed that radically since 2015)
- jslakro 3y agoI remember the Matasano challenges around cryptography https://cryptopals.com/ https://cryptopals.com/