Here are some explanations of concepts that relate to challenges if you'd like some help.
I wouldnt be mentioning anything if it didn't appear in the challenges at some point! Everything here is therefore useful.
Many challenges require logical skills, for example reversing some python or finding vulnerabilities in source code.
Googling skills are a must.
tineye and google images are good tools for reverse image searching.
Steganography is the practice of hiding secret data inside non-secret media that the recipient can then uncover.
For images, to start, finding plaintext strings in the image (e.g. by running the strings command or opening in notepad) is basic practice.
>>LSB<< - The idea behind this method of steganography is you hide data in the least significant bit of each pixel. James Stanley has a >>great tool<< for it.
Appending - a great way to hide data in images is simply to append it to the end of the image file in a zip. Opening the image in the normal way doesn't reveal anything, but a file archiver like 7zip will treat it like an archive and open inside the zip file.
Steghide - a program that hides data for you with its own method so can usually bypass some forms of detection - there is a good web version of it >>here<<
If you hear high pitched random noises, checking the spectogram might be a good idea. Sonic visualizer is a great tool for this.
Always check things like the source code and cookies, network tab etc.
Unfortunately since I'm using github pages I'm forced to only use static pages so I can't host PHP exploit challenges (which are my favourite type of web challenges) or any port services :(
A language used for web development that can be embedded into HTML. Has many vulnerabilities if you're not careful, including type juggling and insecure mt_rand which are fun (and surprisingly easy) to try and exploit.
To start, checking letter frequencies is always a good idea (assuming your plaintext is in english) since this can give you an idea as to what sort of cipher it is.
>>This site<< is a great one for cracking both substitution and vigenere ciphers.
>>This site<< is a great one for visualising columnar transposition ciphers.
And >>This site<< is just a great one.
Simple cipher, an example of a specific kind is the caesar cipher. Essentially the idea behind this cipher is running find and replace 26 times.
Letter frequencies stay the same, so if it matches that expected of english it's probably some form of transposition.
Read about how vigenere works >>here<<. Letter frequencies are changed, so if you perform frequency analysis and it matches that expected of normal english then it likely isn't vigenere.
Because of the way vigenere works, if you know some of the plaintext then it is easy to decrypt the rest of the message (see >>here<<).
>>Cyberchef<< is a great tool for many of the techniques mentioned in this tips page. You can load "recipes", aka operations, to perform on the input.
Base64 is an encoding scheme that you can find more information about by googling. It is useful for transferring data as the encoded message only consists of common characters, so non-printable bytes can be preserved.
As soon as you see a sequence of a mixture of alphanumeric characters followed by up to two equals signs (used for padding to make the message length a multiple of 3) your brain should instantly think base64 or similar, for example base32 or base85. You can play around in cyberchef to get a feel for what these messages look like.
How are passwords stored in databases? Answer: they are hashed, otherwise if an outsider got hold of the database they would know everyone's passwords.
Think of hashing as a one way function that you can pass any input to and that gives a unique output, but the input cannot be determined from the output - so obviously this is ideal for storing passwords.
However implementing password hashing / storage by yourself is a horrible idea since you will almost certainly get it wrong somehow (sorry!) and your passwords will inevitably end up being leaked to the internet in a horror story that you never thought was possible.
If we can pass any input to a hashing function and it gives a unique output, why don't we just try hashing loads of plaintext values until we get a hash that matches, then we would have found the plaintext? People do this (the process is called hash cracking) and the hashes of many common plaintext values e.g. "password123" are readily available in things called rainbow tables. A good site for this is >>crackstation<<, although often just googling the hash works as well.
Obviously rainbow tables are less of a problem the more secure/long plaintext we have. However rainbow tables can be protected against easily by >>salting<< your input.
Here is an insecure example hash for you to practice decrypting:
5d41402abc4b2a76b9719d911017c592
A classic asymmetric encryption method used by modern computers. Based on primes and the fact that multiplying two primes is easy but factorizing the result (if sufficiently large) is hard.
Has many potential weaknesses for example if n is too small then it can easily be factorized with something like >>this<< .
A good step by step walkthrough is >>here<< .
RSA is easily implemented in python or any programming language for example >>here<< .
There are many other cryptosystems such as AES which cyberchef has a good recipe for.
Created by dnzc | Bootstrap Template