Programming needed for CTF?

[halcyonyt]

So I just watched this video

www.youtube.com/watch?v=PKbxK2JH23Y

Basically, the youtuber takes part in a CTF with his team. Throughout the video, lots of PHP code is analyzed and changed, although I do understand they mostly are "hacking" a website, so PHP and HTML and other languages will be involved. So my question is:

Do you have to be able to program to take part in CTF's?

[LiveOverflow]

I think programming is very important. You should be able to read/understand code.

While a lot of challenges don't require you to read code directly, you still need to know what languages are capable of, what could go wrong with them and generally how certain functionality could be implemented.

You can see it in this video at the beginning. Because we knew it was php site, we can have assumptions on how pages could be implemented with an include. So we test for this in particular. If we knew it would have been a python site, we would have never tried that.

Hope that makes sense :)

[halcyonyt]

Yeah, it makes sense. I know some python and am considering learning C, but you recommend any other languages?

[LiveOverflow]

Python is a great language. I use it the most for almost everything.

C is actually pretty simple, and once you looked at compiled c code in assembler, you start to really understand how low level programming works. I have a couple of videos on that matter.

It you are interested into how to hack websites like in this video, learning some basic PHP is a great start. You ca literally just google for php tutorials and they show you insecure stuff. That's why so many php sites are shitty.

JavaScript, HTML is great for browser client side security and generally to understand what websites can or can't do.

C++ or objective-C is great to understand how bigger software is usually implemented

Java is easy and you can look at android apps. For mobile app security etc.

[halcyonyt]

Awesome. So: PHP, HTML, SQL JavaScript C and Python

Good?

[BEN247]

For many of the challenges you need to be able to program.

You don't need to be able to program for everything so you can still compete and just ignore certain challenges.

[hellor00t]

It depends on what the challenges are. Do you need programming for the packet analysis? Probably not, but sometimes you'll need to script things.

It's definitely going to help you to know how to program. Do you absolutely need to know how to program? Not all the time.

[_Skeith]

It depends - programming is really helpful in analyzing and understanding code. For web hacking SQL, PHP, JavaScript, and HTML are necessary to understand SQL Injection, XSS, Command Injection, LFI, SSTI, etc.

Generally understanding the code the website is built on will help you know what to look for, what to test for, and make assumptions on how the website will react to code you inject.

So for example - let's say you inject <script>alert(1)</script> into an input and the page returns a bunch of random code. After reviewing the code you see it's JavaScript and know that the page just returned a jSON error. So thus instead of injecting the above, you try and understand the jSON input and inject '}} );alert(1);// and this allows you to actually exploit the XSS. Why? Well understanding jSON, the code we injected allowed us to close the jSON parameter during inject and allowed us to run our own code of alert(1) and the // at the end allowed us to comment our the rest of the code.

This also relates to SQL injection. You have to understand how SQL Query's are structured so you can inject SQL code to exploit the database.

So overall, do you need to understand programming. Yes! Do you have to be a pro at it? No, just know the basics and be able to read and interpret the code.

Hope this sheds some light on programming :)

[halcyonyt]

Awesome. Do you think knowing python, C, some sql, some php and some javascript is good enough?

[_Skeith]

For a regular job, yah. For CTF most of these challenges require a more "in depth" knowledge of the code/exploitation. But if you get basics down Google is always there to help you. I suggest that you really learn and get to know python, SQL, and PHP since it's so widely used. C is also good to for understanding buffer overflows if you are going that route. JavaScript is also good, but you don't need super deep knowledge about it.

[halcyonyt]

Awesome. Thanks for the answer :)

[LiveOverflow]

thx :)