
Explore advanced web exploits for cyber competitions in CTF 201, a deep dive into the web category, with setup guidance to follow along.
Understand how the course aligns with the OWASP top ten and why dynamic web challenges reward programming and web development experience. Practice with categorized example challenges and setup guidance.
Set up a dedicated Linux virtual machine to practice CTF challenges, using Kali Linux with prepackaged tools. Use VirtualBox or VMware (and optionally WSL) to keep your environment isolated.
Learn how to use Docker to create and run challenge containers within a Kali Linux VM, including building, launching on port 1337, and managing containers.
Navigate the browser and its developer tools to inspect the DOM, use the console, and analyze network requests, cookies, local storage, and IndexedDB.
Master curl to send and receive http requests from the command line, inspect request and response headers, and test web challenges quickly in ctf competitions.
Learn to use DirBuster and GoBuster to scan websites for hidden content, including hidden files and API endpoints, with word lists and DNS and Vhost enumeration, within competition rules.
Leads learners through SQLMap, an automated Kali Linux tool for identifying and exploiting SQL injection, enumerating databases and tables, and dumping data, while stressing rule checks and responsible use.
Use wfuzz to brute-force test web apps by iterating usernames, passwords, or numeric IDs across URLs, cookies, and post data, and identify 200 responses that reveal valid targets.
Explore how JWT tokens work, including header, payload, and signature, and learn to use JWT tool to test misconfigurations and tampering in web authentication, including cookies.
Learn to use Ngrok to create a reverse proxy tunnel from a remote server back to your local machine, enabling HTTP or TCP listeners for CTF challenges and shell access.
Visual Studio Code as a versatile integrated development environment that supports multiple languages, offers syntax highlighting, autocomplete, and plugins to aid web analysis and vulnerability identification in source code.
Explore cyber chef, a government-backed tool that builds data processing recipes transforming input to output. Decode base64 and URL data, convert to hex, and decode payloads for web challenges.
Master HTML, hypertext markup language that builds web pages with tags, doctype, html, head, and body, and explore W3Schools for HTML, CSS, JavaScript, and cross-site scripting basics for web challenges.
Explore the frontend and backend layers of web apps, including HTML, CSS, JavaScript, and server‑side languages like PHP, Java, Python, and Node.js, to identify attack paths.
Explore enumeration for web ctf challenges by inspecting the site and source code, using essential tools to note login, registration, and file upload features to reveal vulnerabilities and exploitation paths.
Analyze web challenge code to locate the flag, assess how sources, Dockerfile, and app technologies reveal vulnerabilities, and plan exploits to access the flag.
Enumerate how CTF challenge design hides the flag in functional components, noting that file upload or download features are intentional exploit targets while decorative links matter less.
Please download the attached ZIP file for example challenge for this lesson.
Please download the attached ZIP file for example challenge for this lesson.
Please download the attached ZIP file for example challenge for this lesson.
Please download the attached ZIP file for example challenge for this lesson.
Please download the attached ZIP file for example challenge for this lesson.
Please download the attached ZIP file for example challenge for this lesson.
Updated: Jan. 13th, 2025 - Challenge downloads have been split up into zip files for each lecture so you don't have to redownload the entire course worth each time there is an update.
The cybersecurity industry is one of the most rapidly-changing today, and practitioners needs to be able to keep up. Learning new skills and techniques is vital to staying up-to-date with trends that can make the difference between advancement in your career, or possibly missing out. Thousands of hackers around the globe have discovered the power of gamifying their learning experience by taking part in cyber competitions. They are constantly sharpening their skills against each other in a test of wits that often also has a positive effect on their work performance as well. However, for beginners, it may seem difficult to learn how to actually get started in the realm of cyber competitions.
As an advanced CTF University course, CTF 201 will expand on the lessons taught in the lower-level CTF 101 course, and focus specifically on the Web category. Cybersecurity expert and US Cyber Team CTF Coach Jacob Elliott will lead you through lessons in common web exploits, categorized by OWASP Top 10, that you can expect to apply in cyber competitions as well as as a web app pentester on the job. Content will be added regularly with new example challenges and walkthroughs that you can follow along with to apply the skills that you learn in the course.