CTF Workshop

Learning Objectives

• Create and navigate a CTFd account and team.
• Recognize common Jeopardy categories and initial solving approaches.
• Use essential Linux commands during CTFs.
• Understand a basic SQL injection foothold and how to pulse a target with nmap.

A CTF (Capture The Flag) is a competition where participants find and submit flags by exploiting vulnerabilities to demonstrate cybersecurity skills.

CTFd is an open‑source platform to host and manage CTF competitions.

Steps to Join:

1. Visit torotech.tech
2. Create account / Join team
3. Open a challenge → read description
4. Submit flag flag{like_this}

Tip: Easy points first; read hints; mind the scoreboard.

Web Challenges

Explore common web-application vulnerabilities — authentication flaws, injection, XSS, insecure file uploads, and hidden endpoints. Learn how user input travels to servers, how to inspect requests/responses, and how to reason about attack surface in a controlled testing environment.

Learning objectives

• Identify vulnerable inputs (login forms, search boxes, upload endpoints).
• Use interception and fuzzing to discover hidden parameters and endpoints.
• Understand basic SQL injection and XSS payload mechanics and how to verify them safely.

Try first: ' OR '1'='1 -- in login inputs

Cryptography

Explore classical and modern cryptographic concepts used in CTFs and real-world systems — symmetric vs. asymmetric encryption, hashing, encoding, padding, and common misuses. Learn how to recognize weak or misapplied crypto, how to decode/transform common encodings, and how to approach basic cryptanalysis in a safe lab environment.

Learning objectives

• Recognize common primitives and misconfigurations (ECB vs CBC, weak key reuse, improper IV handling).
• Decode and convert between common encodings (Base64, hex, URL, ASCII) and use tools like CyberChef/OpenSSL to inspect data.
• Apply basic cryptanalysis techniques (frequency analysis, padding-oracle thinking, brute-force/hashing strategies) to recover secrets on lab targets.

Try first: echo 'c3RyaW5n' | base64 --decode

Forensics

Investigate digital evidence from disk images, memory captures, and log files to reconstruct events and recover artifacts. Learn how to preserve, extract, and analyze traces (file metadata, deleted files, browser history, timelines, and volatile memory) in a controlled lab environment.

Learning objectives

• Identify and extract key artifacts (file metadata, deleted files, browser history, registry entries, and system logs).
• Use forensic tools and techniques (Autopsy / Sleuth Kit, FTK Imager, Volatility, log parsing) to analyze images and memory captures.
• Reconstruct event timelines and validate integrity (file carving, timeline correlation, hashing, and basic chain-of-custody practices).

Try first: strings suspectfile | head -n 50

Reverse / Pwn

Analyze compiled binaries to find logic flaws, memory corruption, and input-parsing bugs you can exploit. Learn how to identify calling conventions, control-flow weaknesses, and vulnerable I/O paths in a safe CTF/lab environment.

Learning objectives

• Determine binary metadata (architecture, endianness, linkage, protections) and identify likely attack surfaces.
• Use static and dynamic analysis to trace input parsing, locate vulnerable functions, and discover exploitable conditions (buffer overflows, format strings, use-after-free).
• Build and test exploits: craft payloads, control instruction pointer or data flow, and validate exploitation with debuggers and instrumentation in a lab environment.

Try first: file challenge.bin; strings challenge.bin

Steganography

Hide and detect data concealed inside carrier files (images, audio, video, and archives). Learn common hiding techniques (LSB, metadata, appended payloads, and container formats) and reliable ways to reveal and extract hidden messages in a controlled CTF/lab environment.

Learning objectives

• Identify likely carriers and hiding methods (image LSB, metadata, appended data, audio stego, archive wrappers).
• Use inspection and analysis techniques to detect hidden data (file headers, file-size anomalies, entropy/statistical checks, and EXIF/metadata review).
• Extract and recover payloads using practical tools and workflows (strings, binwalk, exiftool, stegsolve/zsteg, steghide, and manual bit-level inspection when needed).

Try first: exiftool image.png

Networking / OSINT

Discover and map networked hosts, services, and publicly available information about targets. This category combines active network reconnaissance (port/service enumeration, banner grabbing) with passive OSINT (domain records, certificate transparency, public assets) to build a prioritized attack surface in a lab/CTF environment.

Learning objectives

• Enumerate hosts and services to identify exposed panels and potential entry points (HTTP, SSH, RDP, SMB, etc.).
• Correlate public OSINT signals (DNS, WHOIS, certs, subdomains, leaked metadata) to discover additional assets and pivot points.
• Prioritize targets by service version, exposure, and likelihood of misconfiguration; gather banners and service fingerprints to plan safe follow-up tests.

Try first: nmap -sC -sV -p- TARGET

Password / Hash cracking

Recover passwords from captured hashes using targeted wordlists, rules, and GPU-accelerated cracking where appropriate. Learn how to identify hash algorithms, choose efficient attack modes (wordlist, rule, mask, hybrid), and reason about salts, iterations, and defensive mitigations in a controlled lab/CTF environment.

Learning objectives

• Identify common hash algorithms and formats (MD5, SHA1, NTLM, bcrypt, PBKDF2) and know which are GPU-friendly vs intentionally slow.
• Use wordlists, rules, masks, and hybrid attacks effectively to increase cracking success (start with common lists like rockyou).
• Understand salting, iterations, and how they affect cracking strategy and expected runtime; know when to switch to targeted or offline analysis.

Try first: hashid hash.txt
john --wordlist=rockyou.txt hash.txt

Linux Fundamentals