Intro to Security CTFs for Beginners - Website Security Tutorial

Security CTFs? What are those? They are competitions with security challenges so that you can go out and practice your security skills! This video is a beginner tutorial for some easy and fun web security challenges! Find all 6 keys.
Leave a comment on what keys you've found (I kept the server up until February 2019. I will no longer host the server. You can check the source code.):
ctf.slothparadise.com
Allan Wirth developed these web security drills. Be sure to drop him a tweet because it's awesome that he developed these intro web security drills for everyone!
Allan_Wirth
Check out the source code after you have found all the keys:
github.com/allanlw/builds-hackme
Do you want to compete in security CTFs? Check out the upcoming security CTFs here and register for one:
ctftime.org/event/list/upcoming
Intro to CTFs (video at the beginning):
kzbin.info/www/bejne/mKnXXn2fmbVmmLc
EditThisCookie:
chrome.google.com/webstore/detail/editthiscookie/fngmhnnpilhplaeedifhccceomclgfbg?hl=en
First Key: 1:34
Second Key: 3:27
Third Key: 4:27
Fourth Key: 11:22
Fifth Key: 23:17
Sixth Key: 26:12
Intro to Crypto:
kzbin.info/www/bejne/iYaxknmknr2MpqM
Songs used:
soundcloud.com/aivisura/steven-universe-connie-piano-demo
soundcloud.com/jafunkofficial/jafunk-this-thing-1
kzbin.info/www/bejne/bpLZfn9-q7GqiLM
Outro song: kzbin.info/www/bejne/pqXYZp-am9dmjaM
Twitter: microwavesam

[@HCKDKU]

Thanks for the tutorial brother. And it was very easy to understand especially for the beginners.

[@shashankshukla5438]

Hello, unfortunately it's showing that the site is down and couldn't connect to it. Tried various proxy tunnels too but still didn't work.

[@De-tp5mq]

Dude read the video discription

[@ntnom25]

Thanks , this tutorial was cool to discover CTF

[@mohamed_bouallegue]

Thank you & Allan for this

[@anakinskywalkerrr]

Easy to follow tutorial, keep it up

[@Gladd0s]

Seems like you can get the Walled Garden key without that script, just had to type in "test" and submit, works every time

[@arabymo]

Thanks, that was great!

[@tomer2565]

How I can upload his source code to my localhost server/website? Thanks in advance

[@handsome7mateen]

"Open the developer console in your browser and view the network requests. Maybe there are weird requests on a page?" What clue does it leave behind?

[@asjidkalam]

port 22 is open and ssh is active, but creds found nowhere :(

[@aiahabudouleh4228]

You made my day :D

[@matthewsanetra]

I know quite a bit of programming languages, and mid way through the tutorial, I was scratching my head and thinking 'Why doesnt this dude use a for loop to do it x times?". Good job for beginners though.

[@thamedz777]

I thought of that too. But then you can notice that he shows his approach and what he does first include snippets of his final code meaning it would run a few times before actually deducing the complete code to find a solution. So the indefinite loop kinda makes sense.

[@ashuadhana1840]

actually using for loops give memory errors since that "x" is sometimes too large for the "for" loop to handle so generally while loops are used .but thats what i got to know while i used to write code but i can be wrong too.. iguess but its my opinion

[@MosnoAlMoseeki]

This was very cool, Thank you for the tutorial. I will have to try this out. Please let us know if you guys end up creating any more challenges. And Yes I did get the "HackThePlanet" reference, it was a great movie :)

[@Aquilachrysaetoscrow]

Can anyone help me? I've done until 10:44, but the python script never ends. Script is exactly the same as video's. I'm trying this on Ubuntu 14.04 on VirtualBox.

[@magick2006]

very nice video

[@dersg1freak]

Bro you can use break to exit a loop. The program will close when it's done.

[@nandomax3]

MicrowaveSam, if you submit anything to the walled gardem with the name "admin", you receive the same KEY! I tried this because of the hidden page hehe

[@beat461]

I don't understand why my python program is extremely slow. I used the same script as you except for the url, i tried putting the link to the about page there both with and without the http in front. I checked wheter it was running at all by seeing if the number on the page increments and it does apparently but very slowly, only about 4 or 5 refreshes per second. It's barely faster than than I can refresh by spamming f5. It it supposed to be so slowly? your script made it seem instantly but that's probably because you're refreshing localhost.

[@meetpatel275]

Is it possible that they could hide flags/keys in css files?

[@zukos321]

Hi Sam, Here are the keys I found on my own 1. KEY{YOURFIRSTKEY} 2. KEY{YourSecondKey} 3. KEY{999ProblemsButAReloadAint1} 4. KEY{HackThePlanet} 5. KEY{AllXMLIsGarbageXML} Overall this was pretty fun. Never done a CTF before but might start doing more of them as they were good practice. Only key I couldn't solve on my own was the captcha one but I still think I did pretty good for my first time (pretty creative way you got the key). On the about page I also wrote a python script however I used the requests library to accomplish it. Pretty much wrote a while loop to request the page 1000 times though it took a minute or 2 for it to complete. My code is linked in the pastebin link down below if you're curious about it. Anyways like I said this was pretty fun and hope to do more of these in the future. Do you know where I might find more beginner friendly CTFs? Thanks! About Python Code - pastebin.com/4UQeShBD

[@MicrowaveSam]

Zuko! I'm proud that you tried the challenge out! What a beast. I was trying something new with this interactive tutorial, and I think that people will certainly learn a lot from doing intro, fun exercises. Thanks for linking me your code. I'm always interested in how people implement their solutions! I have a plan to do a couple more interactive security tutorials in the future that will really get you interested in binary exploits and other security concepts. Beginner friendly CTFs are really hard to find unfortunately. This is why I liked Allan Wirth's Github repo so much! He's the most humble and understanding security researcher, so he created that awesome Github repo to introduce us to web security challenges in a CTF. He taught this workshop at my university a couple of years ago. Most CTFs have a ton of challenges, the majority of which are harder than the challenges in the tutorial. The topics are much more diverse and complex. In this video, I focused only on the most basic web security challenges, but even the web ones in an actual CTF tend to be much more difficult. Allan Wirth helps organize this CTF. But it is really hard! bostonkeyparty.net/ When I first competed in CTFs, Allan brought us and a group of newbies to an on-site CTF at MIT. On-site CTFs are much more approachable than virtual ones because we can ask the developers questions! MIT LL CTF 2013 was the first on-site CTF that I attended, but I don't think that they organize any more. It was super enlightening though: events.ll.mit.edu/mitllctf/ CSAW is a bit approachable, but there are a bunch of very difficult challenges. ctf.isis.poly.edu/ I think that a partly approachable CTF is iCTF organized by UC Santa Barbara, but like CSAW, there are many very hard ones. ictf.cs.ucsb.edu/ If you have Twitter, you should direct message Allan Wirth since he can give you better tips than I can! twitter.com/Allan_Wirth

[@zukos321]

Alright cool, thanks for the info. Not sure if you knew but I'm the one that sent that thank you tweet earlier mentioning both of you. Might try getting in contact with him to see if he can give me some pointers if he'll respond back. Again, thanks for this, really do appreciate it.

[@MicrowaveSam]

Lol I thought that it was you! I wasn't absolutely sure though. Good luck on your venture. Allan's a great, approachable guy, so he'd certainly be more than willing to answer any of your questions and especially point you to the right direction to get your security game up.

[@zukos321]

Haha Thanks, hope to see more videos like this in the future.

[@jasonjameson44]

KEY{GodIHopeYouScriptedThis} KEY{YOURFIRSTKEY}

[@olivepuffin6316]

One thing I found out in the walled garden is that you can put your name in, complete 1 captcha, then change your name to something else like "Bob" in the url and the key will appear

[@TheBsandrew123]

hi help im having a error traceback (most recent call last): File "last.py", line 3, in about_page = urllib.urlopen("****").read() NameError: name 'urllib' is not defined

[@jynns2556]

Who is still interested in solving should use the py libs request and bs4 They are perfect for this work in my opinion

[@motadaymane3262]

While true, and the if statement is supposed to stop once a "KEY" Pattern is found, so python is looking for "key" in the source code in the variable about_page, but how did it get to the 3000 visiting, knowing that it should stop immediately when finding one pattern, or all the available pattern in the source code, lol just caught my attention.

[@-dontrey5313]

you can try input " test " to name with Walled Garden

[@beat461]

for the walled garden part i actually put in 'test' as my name and instantly got the KEY. I don't think that was supposed to happen and is probably only there because the creator wanted to test some functionality. Maybe that should be changed to something which doesn't have a high chance of being the user input.

[@p5eudo883]

Same thing happened when I used "admin"

[@willblanton3120]

p5eudo nice! I'm betting someone had already used this name and the counter never resets so anyone else after that gets it on the first try.

[@sapiranimations]

There are supposed to be 20 keys it says so in the home page. I just don't know what else I can do about the ssh and the hardstuff.zip hidden files.

[@MicrowaveSam]

Hey Ron, I think that there are only 7 on the web page about. And then 3 more or something in the hardstuff.zip. Not 20. That was an old number.

[@Booming-letsplays]

Is there a reason you are not using Ubuntu in the first place?

[@rudihartono-jf8ws]

can you please elaborate this "Open the developer console in your browser and view the network requests. Maybe there are weird requests on a page?" one?

[@MindfulEnergies3]

I couldn't see any weird requests either but thought maybe that because I was running chrome in sandboxie however that should not really matter...

[@AniltonNeto]

with shell also is possible to extract the key :P

[@TheGiantHog]

The "control Z" at 8:10 isn't working with my Ubuntu, it prints ^Z in blue instead. Any help?

[@TheGiantHog]

I did "esc -> wq" Does that work? How is that different?

[@KooShnoo]

Shells use different keyboard shortcuts

[@jean-paulchristophermcnama3496]

It says there are more than "20 keys on this site", on the homepage, is it true?

[@MicrowaveSam]

No, that's not true. There's only about 7 on the website in total.

[@ryanmenghani32]

I have found *9 so far. I don't know if there are actually 20, though.

[@ryanmenghani32]

Nope, I didn't find anything for the ssh. I DMed Allan Wirth, but I haven't gotten a response yet.

[@p5eudo883]

I'm banging my head against the wall with that right now. I'm at 10 keys so far.

[@WolfJustWolf]

i found 6 before i watched the video , now i'm up to 9

[@ashidgr2814]

after vim about.py script cntrl z [1]+ Stopped vim about.py root@kali:~/python_start# ls root@kali:~/python_start# output is nothing root@kali:~/python_start# python about.py python: can't open file 'about.py': [Errno 2] No such file or directory please help me

[@ObieForceGaming]

wish this was still a thing. will need to google how to run the sourcecode on my localhost.

[@tranquocanh2953]

Here you go: KEY{YourSecondKey}

[@karmadlaswinmlsk8997]

can someone help me ? please whenever i try to launch my kali linux on windows 7 it says FATAL:Could not read from the boot medium! System halted.

[@oliviadrinkwine1411]

BrunoBANNONY AnnoNY what vm program are you using?

[@v380riMz]

You have to locate your .iso file

[@arturkarabekov1920]

you also could write break instead of the method

[@SahilSharma-ir7ix]

Is it possible to the loop using javascript? if so how would you do it? (not asking about the syntax. how would you run js through a terminal or something else). i tried making a javascript function in the console to refresh the page but it stops running the script after the first reload. which makes sense. i created a js script but not sure how to run it. sorry for the noob question, im new to web development and security

[@phurinatpuekkham8979]

use Node.js

[@abhii5852]

Nice work mate

[@lightin354]

Hi there, i find your videos very interesting even though it has been years after your upload, I have been facing this one problem about the python. After creating the VIM and exiting it via Ctrl Z, I cannot find my python script with ls my script didn't show up. can't open file about.py :[errno2] No such file or directory. I'm using the windows 10 bash.

[@---Geekdraz---]

You need to save it before; press ESC to exit from edit status and then :W (VIM command for write.) and ENTER

[@VishalRana-ix9ry]

@@---Geekdraz--- after that we have to type ctrl z in it ?

[@arjunbemarkar7414]

I’be made a beginner to intermediate difficulty ctf, i don’t make money off it, is it cool if i make a comment with the name of it?

[@ThePsycho24]

Website is down?

[@Ak1r4Yuk1]

For latest KEY u need to change tag on the source

[@RAGHAVENDRASINGH17]

I cant figure out how to use tools on github on windows 8.1 . Can you help please

[@locatingwizard9301]

I know this video old but has anybody been able to solve the scripts part of hardstuff.zip? I found the numbers and it says I have the right numbers but then freezes when converting it to a string. the numbers im using: arg1: -18243150071292141317265306851 arg2: -1

[@lion21297]

cuz it's not how you're supposed to do it: from numbers_helper import * bignumber = 202557564740749725343243267960623572731942487045 num = 18243150071292141317265306851 num2 = 18243150071292141317265306851 / 2 arg1 = int("2") arg2 = int("1") for c in range(2,int(num2)): if (num % c == 0): arg1 = int(c) arg2 = int(num / arg1) print(int2str(bignumber * arg1)) output is "KEY{AreYouAMathMajor?}"

[@MrGatlin98]

You have the right idea, but the wrong numbers. Find 2 other numbers that multiple to get 18243150071292141317265306851. Also make sure the numbers aren't negative, the conversion function doesn't like negative numbers.

[@lytelllytell7576]

The site doesn’t work for me. Has this site changed?

[@opposite342]

It had been closed

[@trevoraquino2956]

I found another key that I don't think was mentioned in your video: Key{WowSuchShibeWow} Found it in an image at ctf.slothparadise.com/images/shibe.jpg

[@MicrowaveSam]

You're right! I forgot about that one! Good job.

[@meltonsilva6870]

how did you find that one?

[@rage7658]

That damn SSH key, I still haven't got it. Anyone here got it yet?

[@asjidkalam]

anyone reversed the encryption on the encrypt.py file??? (hardstuff.zip)

[@BarYamin]

1. convert the Base64 String inside README to Ascii 2. convert every character in the string to its corresponding integer in the ascii table 3. XOR every number with the corresponding integer of the character '&' 4. Magic!

[@asjidkalam]

Bar Yamin, thanks a lot!!! How did you find the character to be '&' in XOR?

[@BarYamin]

Simply loop over all possible characters (there aren't that many options, just brute force it) until you hit something that looks like a key. I printed all possibilities to a file

[@p5eudo883]

Here's the script I wrote for it. pastebin.com/hMbPwvxY

[@polvalente]

Just adding my 2 cents here: We know that the key used is a single character, so each character of the encrypted string is E = K XOR C; I guessed that the first character would be C="K", and the second would be C="E" (because the plain string would with "KEY"); So, the first character XORed with "K" would give us the character needed to decrypt

[@marajonnamontesa591]

I cannot access the slothparadise.com

[@poa7487]

Mara Jonna Montesa got taken down read description

[@CatSmiling]

sites down?

[@nabilsalih2898]

yeaa

[@danielelmar8375]

The website wont load for me. ctf.slothparadise.com took too long to respond. ;-;

[@silvesterchaka9002]

Hie friend you can clone or download it from the link he provided in the information panel: github.com/allanlw/builds-hackme then run it on localhost: Because that link is no longer working from Feb 2019 as he stated in the information panel.

[@Power1482VIDSSTUDIOPOWER]

Is this page down?

[@liranbar1156]

Yep

[@kenichimori8533]

Probability return buffer.

[@InvertedBox]

I exist!

[@jetray5914]

is this site down?

[@arturkarabekov1920]

yes. read the description

[@jakeabel2548]

I only bothered to find 3. One was really easy. KEY{999ProblemsButAReloadAint1} KEY{GodIHopeYouScriptedThis} KEY{YourSecondKey} ?name=a&captcha= will give you the key but may say "Captcha incorrect"

[@typicalfreethinker3137]

hey, i restarted my machine @ 0:45

[@kenichimori8533]

思いますね。

[@danielalt7508]

Since when is this called hacking? I always called this kind of stuff cyber stalking of some kind. You are just using info publically available to get to next step. :(

[@h7x4]

Exactly. And that is on way to go about hacking. It's about getting unatuhorized access to things that are not meant to be available to you (but there's vulnerabilities that make the things available).

[@callekun]

Lol for the refresh site thing i made a c# app that refreshed the site unless the source code contained the number 1000 would have been easier your way XD

[@MoonfireSeco]

callekun He kind of did the same thing tho

[@SahilSharma-ir7ix]

I was only able to find 4 out of the 6 keys before i watched the solution! these are the keys: KEY{YourFirstKey} KEY{YourSecondKey} KEY{GodIHopeYouScriptedThis} (got this without scripting. i understand why i got this key by trying only once after the solution) KEY{AllXMLIsGarbageXML}

[@dylandatta834]

These are the keys I got. The XOR encryption was pretty hard, but the "scripts" one I just brute-forced. Site Keys: KEY{YOURFIRSTKEY} KEY{YourSecondKey} KEY{999ProblemsButAReloadAint1} KEY{GodIHopeYouScriptedThis} KEY{HackThePlanet} KEY{AllXMLIsGarbageXML} hardstuff.zip Keys: KEY{WelcomeToTheMatrix} KEY{SecretCodesWithXorsAren'tVerySecret} KEY{AreYouAMathMajor?}

[@arcticspacefox864]

Hey how did you bruteforce it? can you share your code ?

[@dylandatta834]

​@@arcticspacefox864 I just used a for loop from 2 to 182..., printed the int2str of that and broke out of the loop when the first characters were "KEY{". It took 152, 312 or so attempts

[@agustinfisher1056]

For walled garden I just entered “allanwirth” and it gave me the key

[@yashanand8200]

same i got the flag by using "test"

[@Ak1r4Yuk1]

u can get with the name u want

[@mithra7804]

Can u pls tell me how to find keys in png or jpg image plssss

[@robbie2044]

There is a possible bug with KEY{GodIHopeYouScriptedThis} if you use Name: admin and paste the captcha it will spit out the KEY. You can enter another captcha after that and it will still spit out the key. Also you can enter anything as captcha and it will still pring the key. PoC: i.imgur.com/CefkXAo.png Very fun challenge BTW!

[@joaomartins5114]

Most likely someone solved this key already with the "admin" name

[@joshuasolanke7265]

these me keys: 1: YOURFIRSTKEY 2:YourSecondKey 3:spent 4 hours trying to use javascripts setInterval(myTimer, 300); to beat the about thing

[@amanfromhelvetia7115]

lol

[@oliviadrinkwine1411]

or another way I found is using a Firefox plugin called grease monkey or I believe that is the name at least but it will let you edit the page hint hint

[@uhN0id]

what?

[@KhadijahCelestine]

I barely found any keys :-( KEY{YourSecondKey} KEY{AllXMLIsGarbageXML}

[@AbdulAziz-dt5qo]

HERE YOU GO BRO! 1. KEY{YOURFIRSTKEY} 2. KEY{YourSecondKey} 3. KEY{999ProblemsButAReloadAint1} 4. KEY{GodIHopeYouScriptedThis} 5. KEY{HackThePlanet} 6. KEY{AllXMLIsGarbageXML}

[@justapotota4330]

Keys I've found: KEY{YOURFIRSTKEY} KEY{YourSecondKey} KEY{GodIHopeYouScriptedThis} KEY{HackThePlanet} KEY{WelcomeToTheMatrix}

[@Susrek]

Keys found so far: in order: KEY{YOURFIRSTKEY} KEY{YourSecondKey} KEY{WowSuchShibeWow} KEY{GodIHopeYouScriptedThis} KEY{AllXMLIsGarbageXML} KEY{HackThePlanet} KEY{WelcomeToTheMatrix}

[@Susrek]

I did most of it in Opera on a Mac but some stuff errored out so I switched to Firefox on OpenSuse to get the rest. Absolute first time trying anything like this. Looking to get some foundational skills to try CTF at an event. Downloading Kali.......

[@nanorki20]

Hey jack I am a teenager into pen testing and I need a lot of help I am the best in my school tho But to you I will be no one I need your help please

[@hmei774]

🛀

[@keybash9676]

How he puted the website on localhost ???????? I can't python the website with the normal url

[@doritosy1121]

Keys I found KEY{HackThePlanet} KEY{GodIHopeYouScriptedThis} KEY{YourSecondKey}

[@fadyasaad1105]

KEYS: 1. KEY{YOURFIRSTKEY} 2. KEY{YourSecondKey} 3. KEY{999ProblemsButAReloadAint1} 4.KEY{GodIHopeYouScriptedThis} 5.KEY{WowSuchShibeWow} 6. KEY{AllXMLIsGarbageXML} 7.KEY{HackThePlanet} 8.KEY{SecretCodesWithXorsAren'tVerySecret} the key is '&'

[@mcgruff0972]

I appreciate the effort and agree you dont have to know how to code but not understanding while loops and how to exit them properly takes away your credibility.

[@s2taai]

Here are the keys that I found: 1) KEY{YOURFIRSTKEY} 2) KEY{YourSecondKey} 3) KEY{HackThePlanet} 4) KEY{AllXMLIsGarbageXML} 5) KEY{WelcomeToTheMatrix} 6) KEY{GodIHopeYouScriptedThis}

[@asjidkalam]

here are the keys i found: KEY{YOURFIRSTKEY} KEY{YourSecondKey} KEY{HackThePlanet} KEY{WelcomeToTheMatrix} KEY{GodIHopeYouScriptedThis} KEY{AllXMLIsGarbageXML} KEY{999ProblemsButAReloadAint1} KEY{WowSuchShibeWow} did anyone got the ssh creds?

[@anasboulbali5524]

these me keys: KEY{GodIHopeYouScriptedThis}

[@karmadlaswinmlsk8997]

Key 1 YourFirstKeyKey Key 2 YourSecondKey Key 3 HackThePlanet key 4 what else do you want to know?! key 5 You are the 1068th visitor to this page. Thanks so much for the vid you are awesome im preety sure i did it wrong its my first time doing this please write back what i did wrong THX i am very intrested in ctf sorry for bad eng im from Poland and tell me what you can do with the keys if you find THEM BB RESPOND PLEASE{:

[@MicrowaveSam]

The first 3 keys sound right! Finding the keys in the website is more about practice! Building your skills and introducing yourself to CTF competitions. If you want to get a broader variety of information about hacking in general, you should watch this guy's video. He goes into much more information and talks about broader security exploits: kzbin.info/www/bejne/rJiclIF8hbZ5p68

[@lman2710]

@@MicrowaveSam hi. I was curious and clicked on the link you sent, but it is down. Do you know where else can we find it ? Thanks in advance

[@MrSatyavinay]

I only got 3 KEY's by myself : KEY{AllXMLIsGarbageXML} KEY{YourSecondKey} KEY{GodIHopeYouScriptedThis}

[@lasiterkilworthy]

Here are the keys that I've found. KEY{YOURFIRSTKEY} KEY{YourSecondKey} KEY{GodIHopeYouScriptedThis}

[@_productivity__nill_1131]

2:58 haha, nobody does that

[@alejoesteban4032]

Well, now I feel like a genius xD KEY{YOURFIRSTKEY} KEY{YourSecondKey} KEY{GodIHopeYouScriptedThis} KEY{999ProblemsButAReloadAint1} KEY{AllXMLIsGarbageXML} KEY{HackThePlanet}

[@nathaly7969]

The last secret key is not a string... There is a jpeg file.

[@stillunt1tled321]

i got KEY{GodIHopeYouScriptedThis} without using scripting or typing a bunch of captchas :)

[@MicrowaveSam]

Lol :)

[@stillunt1tled321]

?php=20

[@mfootballmom3nts]

Well I literally wrote a single word and gave me the key, was I that lucky?? KEY{YOURFIRSTKEY} KEY{YourSecondKey} KEY{GodIHopeYouScriptedThis} KEY{999ProblemsButAReloadAint1} KEY{AllXMLIsGarbageXML} KEY{WowSuchShibeWow}

[@gingergoat3027]

I got this key in a way I don't think was intended but I don't know... KEY{GodIHopeYouScriptedThis} By changing the name to s and the captcha to whatever: ctf.slothparadise.com/walled_garden.php?name=s&captcha=

[@agustinfisher1056]

Yep, the site uses the name to keep track of who has done how many captchas, I used “allanwirth” and got the key

[@buglow8018]

that what i've fount far away :D KEY{YOURFIRSTKEY} KEY{YourSecondKey} KEY{HackThePlanet} KEY{WelcomeToTheMatrix} KEY{GodIHopeYouScriptedThis} KEY{AllXMLIsGarbageXML}