5 ms·

So what are the chances of someone who's never really dealt with web security capturing the flag? Last year's results don't make it seem too promising, 12k uni

by zheng 14y ago

So what are the chances of someone who's never really dealt with web security capturing the flag? Last year's results don't make it seem too promising, 12k unique IP's -> 250 captures.

bradfa 14y ago
Capturing the flag isn't everyone who participates' goal. In the first Stripe CTF, I played for the first 3 levels, learned some things, then stopped. But I considered it a success for myself. I'm sure others did similar things. Capturing the flag wasn't something most people could do in a short time, so having 250/12k even accomplish it I'd think was a rather high conversion rate.
daeken 14y ago
Last time it was all low-level vulnerabilities, which require some work to exploit (I even struggled with a couple of them, and I've been working on that sort of thing for many many years). This time around it's websec, which is considerably easier in most respects, and the main knowledge you need is pretty standard for any web developer. You just need to turn things around and look at it from the perspective of "what happens from input to output?"
- deleted 14y ago
  [deleted]
- apazzolini 14y ago
  Yes, the last one had some extremely hard problems. Can't wait for this one - I work on an ecommerce framework and this sorta stuff is way more applicable to what I do day to day
- benmmurphy 14y ago
  some of the websec exploits are quite tricky/involved like blind sql injection (https://www.owasp.org/index.php/Blind_SQL_Injection https://www.owasp.org/index.php/Blind_SQL_Injection). without tools like sql map you would need to write code in order to recover non-trivial amounts of data using blind sql injection.
collision 14y ago
It's definitely not intended that beginners can easily finish, but we hope that everyone can get something out of it. We were actually fairly happy with the conversion rate from start to finish last time. If everybody finishes, it presumably means the later levels weren't hard or interesting enough. We hope that people new to web security can solve the first few levels with some work and inspection, and the later levels with hints from others or a significant amount of research into the topics. At the end of the day, the point of the exercise is to expose realistic vulnerabilities for fun and education. We try to make them similar to how they'd be in the wild.
- daeken 14y ago
  I just want to say: Thank you for doing this. While I'm looking forward to doing this myself (always fun), I really appreciate you guys taking the time to do this for the impact it'll have on non-security folks. Anything that makes learning this stuff fun and interesting will be a very good thing for the development community.

by zheng 14y ago

So what are the chances of someone who's never really dealt with web security capturing the flag? Last year's results don't make it seem too promising, 12k unique IP's -> 250 captures.

bradfa 14y ago

Capturing the flag isn't everyone who participates' goal. In the first Stripe CTF, I played for the first 3 levels, learned some things, then stopped. But I considered it a success for myself. I'm sure others did similar things. Capturing the flag wasn't something most people could do in a short time, so having 250/12k even accomplish it I'd think was a rather high conversion rate.

daeken 14y ago

Last time it was all low-level vulnerabilities, which require some work to exploit (I even struggled with a couple of them, and I've been working on that sort of thing for many many years). This time around it's websec, which is considerably easier in most respects, and the main knowledge you need is pretty standard for any web developer. You just need to turn things around and look at it from the perspective of "what happens from input to output?"

deleted 14y ago
[deleted]
apazzolini 14y ago
Yes, the last one had some extremely hard problems. Can't wait for this one - I work on an ecommerce framework and this sorta stuff is way more applicable to what I do day to day
benmmurphy 14y ago
some of the websec exploits are quite tricky/involved like blind sql injection (https://www.owasp.org/index.php/Blind_SQL_Injection https://www.owasp.org/index.php/Blind_SQL_Injection). without tools like sql map you would need to write code in order to recover non-trivial amounts of data using blind sql injection.

collision 14y ago

It's definitely not intended that beginners can easily finish, but we hope that everyone can get something out of it. We were actually fairly happy with the conversion rate from start to finish last time. If everybody finishes, it presumably means the later levels weren't hard or interesting enough. We hope that people new to web security can solve the first few levels with some work and inspection, and the later levels with hints from others or a significant amount of research into the topics. At the end of the day, the point of the exercise is to expose realistic vulnerabilities for fun and education. We try to make them similar to how they'd be in the wild.

daeken 14y ago
I just want to say: Thank you for doing this. While I'm looking forward to doing this myself (always fun), I really appreciate you guys taking the time to do this for the impact it'll have on non-security folks. Anything that makes learning this stuff fun and interesting will be a very good thing for the development community.