---

This is a written version of my Technical talk at BEERCON2: rise of the rookies the video of the talk can be found here

---

A Beginner’s Guide To Hackathons & CTFs from Beginners

Who are we?

Chloe: Student currently studying cyber security and digital forensics at university. Needs to get a life.

Jen:  A literal god

Charlie: Cyber Security & Forensics Student – Has no idea what they are doing at any given moment.

List of Events:

• Hack The Police Lincoln – 2018
• Lincoln Hackathon – 2016 , 17, 18, 2019
• Hack The Police London – 2019
• Merseyside Hackathon – 2018
• Defcon
• HackTheBox
• Cyber security challenge UK
• CSAW 2020

What’s our talk about?

• Introduction to CTF’s & Hackathons
• Stories from past events
• Lessons we have learnt
• Getting started

What’s a ctf /hackathon

CTF
CTF (Capture The Flag) is a kind of information security competition that challenges contestants to solve a variety of tasks ranging from a scavenger hunt on wikipedia to basic programming exercises, to hacking your way into a server to steal data. In these challenges, the contestant is usually asked to find a specific piece of text that may be hidden on the server or behind a webpage. This goal is called the flag, hence the name!

Hackathon
Hackathon you try to use tech to hack into real world problem to solve them better. It’s a 24–72 hours product making competition where every team needs to develop a product from scratch during those pretty hours. A team size can vary from 2–6 depending on the organization who is organizing it.

How do they help the community ?

• Getting people to think in a different mindset
• Make new contacts
• Create better relationships between sponsors and people at the hackathons
• Develop new skills

CSCV challenge coin (team duck bear)

Back in December 2018 Lincolnshire Police held a Hackathon called “Hack The Police”.

In attendance at the Hackathon were some members of CSCV, one of them being native to Lincoln itself. Naturally the challenges that were presented were taken with a lot of enthusiasm, however, CSCV presented a side quest – “The Coin Challenge”.

According to sources, this challenge has been farmed out to quite a few organisations (within the UK and International) and have had quite a bit of difficulty with this challenge; putting it bluntly this challenge has been in the air for over a year now and still to this day, has not been solved.

CSCV challenge coin tools and techniques

Cyber Chef

Wireshark

Kleopatra

John The Ripper

GIMP

Recon CTF (DEF CON Safe Mode)

• Our first time competing in DEF CON
• Started later, begun on final day
• OSINT Challenge based
• CTF (Capture the flag)
• Our first time competing in OSINT

CTF tools and techniques

Wayback machine

• Go back to view a webpage when it was cached (handy for looking at stuff people think they deleted)

EXIF/Metadata

• See when and where an image was taken, handy for finding out when and where a person may have been in an area.

Social media

• Contact’s of others are occasionally weak links, they give away a persons location even if that person has their profile on lockdown
• Pictures posted on social media often have geotags

Google lens & Reverse image search

• Searching for information from an image

Hackathons tools and techniques

• Know who you are talking too
• Collaboration
• Learn from others
• Think outside the box
• Experiment with new technology

What was learnt from those events?

Time Management

• Event’s are time controlled
• Prioritizing tasks

Building Teams

• Working with people to achieve a goal
• Delegation of tasks

Asking Questions

• If you don’t know how to do something? ASK!
• Finding why someone would think that way

Practice for CTFs & Hackathons

Hack The Box

• Test skills against challenges created
• Has things from OSINT, to web challenges to machines to get root on.
• Challenges are submitted by user’s
• Free

Immersive Labs

• Walk’s people through the techniques needed to complete challenges on platforms like HTB.
• Has many different paths you can practice, such as OSINT, Wireshark, Cyber defence.
• Sadly is paid for.

“Tell your family you love them… You never know when the end is nigh”

• Charlie  (26/10/2020)

W҉h҉e҉r҉e҉ ҉T҉o҉ ҉F҉i҉n҉d҉ ҉U҉S҉

Jennifer Technically Possible
https://technicallypossible.carrd.co/
Twitter –  @Techypossible

Chloe Name aka ErrorByNight aka Clive
https://twitter.com/ErrorByNight

Twitter – @ErrorByNight

Charlie LostHawk
Twitter –  @Lottie1326

Has finally been located