Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I know that there are several hacking competitions, but I would like to know how to prepare for hacking competitions.

I know that there are several hacking courses, online and offline, but they only seem to prepare for basic stuffs.. Would taking OSCE/CTP courses provide sufficient preparation?

share|improve this question

closed as not a real question by Iszi, this.josh, Gilles, Scott Pack, LamonteCristo Nov 28 '12 at 17:53

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

I wouldn't consider any certification or course to be sufficient preparation for a hacking competition, assuming you're talking about the kind of Capture the Flag competitions that tend to run at conferences. They usually don't focus on any particular aspect of information security, but rather a broad range of technical skills.

At the last conference I attended, their CTF covered the following stuff:

  • Network capture analysis.
  • Web application penetration testing.
  • Reverse engineering.
  • Remote service vulnerability discovery.
  • Custom exploit development.
  • IPS evasion (only trivial rules, though)
  • Basic cryptanalysis.

This isn't the kind of stuff you can learn in a week (or a month, for that matter) at a course. Whilst the focus is on testing the technical skills of participants, a huge part of the success factor is intuition and experience. It's about having a breadth of experience in a variety of topics, with sufficient depth in some to craft complex solutions to problems.

share|improve this answer

It depends on the type of hacking competitions you want to take part in. There are bug hunts for webapps for which you would want to know about HTTP, browser, SQL injection, XSS (cross site scripting) and mainly javascript. Using some tools to brute force to crack a hash. You should know about public key and private key encryption.

If you are doing some application based hacking like finding bugs in a program. You would want to learn a lot linux commands like strace. You should be able to do reverse engineering.

If you are taking part in CTF kind of competitions you should know the basics of networks. Learn networking based linux commands or learn to use tools like nmap, wireshark.

As polynomial said you can't learn it in a defined time frame. You should practice and keep your ears open for the latest things that are happening in security.

share|improve this answer

To Train for hacking competitions, one must hack.

Polynomial is right when he says that the skills needed to be successful in a CTF or hacking competition are not learned in a day. The best way to get better is to find online CTFs and practice under the gun.

Here is a link to some Online CTFs. I would start with these. Defcon posts links to CTFs that you can participate in to qualify for their CTF. Defcon CTF Links

Next I would go to a Security Conference that allows anyone to compete in the CTF and compete. Smaller ones, bigger ones, medium sized ones all work. Practice there and afterwards go over the solutions people post to the problems you don't understand.

Like Polynomial said, a lot of different kinds of Security Knowledge is important. These CTFs are not won by 1 person. They are won by a team. At DerbyCon this year I recall talking to the winning team who was about 6 members. Some teams (depending on the CTF rules) have dozens of members offsite in order to aid the team and provide a bigger knowledge base. These larger teams are usually split into smaller teams that have specialties. This means learning everything can be valuable....but learning everything about one thing is also valuable if you are really badass at that one thing.

If you get more into the CTF/ConferenceSec community then you will likely end up becoming part of a team to actually have a shot at winning some of these bigger name CTFs.

Dig in. CTFs are fun whether you get first or last as long as you actually give it some effort .

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.