提 示 - : hammer_and_pick: OTA CTF成员提供的有用提示：

项目说明

Tips

Useful tips by OTA CTF members. PRs welcome!

Assembly

* Beginner's guide: [Learning to read \[AT&T\] assembly language]()
* Big PDF: The Art of Assembly
* Quickly see what assembly different compilers generate: Compiler Explorer
* Quickly disassemble raw bytes: ODA
* Quickly assemble x86: Defuse assembler
* Azeria's guide to ARM assembly: ARM Assembly Basics

Binary Exploitation Technique

* Modern Binary Exploitation
* Basic Return Oriented Programming
* Blind Return Oriented Programming
* Signature Return Oriented Programming
* ROP Practice Problems
* Heap O
* Pwntools Beginner Tutorial
* File Stream Oriented Programming

IDA

* Common hotkeys:

| Key | Effect |
|------------------|---------------------------------|
| Esc | Go back |
| Ctrl-Enter | Go forward |
| H, Q, B | View as decimal, hex, or binary |
| N/U | Name/Undefine symbol |
| D, C, P | Convert to data, code, function |
| Ctrl-w | Save |
* Learn to create and use structs.
* IDAPython is very powerful and worth learning.
* Use FLIRT whenever you see a static binary. You can save a ton of normally wasted time reverse engineering common functions.
* Code co and tracing analysis is a useful technique to assist with reverse engineering. IDA has built in co and trace highlighting capabilities features. Lighthouse is also a great plugin for co analysis.
* Keypatch is a useful plugin that offers extra features compared to the built-in assembler

Debugging

GDB

* Don't suffer through GDB. Use something like GEF, PEDA, or .
* You can also combine PEDA with Pwngdb, which is a powerful add-on that supports ad heap exploitation and FILE stream oriented exploitation features.
* Learn these!
* command <bp#> - Run commands when a bp is hit.
* ignore <bp#> <count> - Ignore the next _count_ occurrences of _bp_.
* watch|rwatch|awatch <addr> [thread <thread>] [mask <mask>] - Break when specified address is written to, read from, or either.
* hbreak <addr> - Set a hardware breakpoint.
* tbreak <addr> - Set a temporary breakpoint that disappears once hit.
* advance <addr> - Continue until the specified address.
* catch syscall [syscall] - Break on syscall (all or the specified).
* catch signal [signal] - Break on signal (all or the specified).
* bt - View stack frames (backtrace).
* up/down - Move up or down to a different stack frame.
* set follow-fork-mode <child|parent> - Tell gdb to either trace the parent or 'move' to the child on fork.
* set follow-exec-mode <same|new> - Tell gdb to either trace the original target or 'move' to the new process on exec*.

Redressing a Stripped Libc

* Often times when we do pwnables, we are given the pwnable along with a stripped of the libc that the pwnable is using on the remote server. If we want an easier time debugging with the provided libc preloaded, here are some steps we can take to add symbols back to the stripped libc. (dependencies: eu-unstrip)
1. run strings <stripped-libc> | grep glibc to determine the libc
1. download the associated debug symbol file (eg.)
1. merge stripped libc file with debug symbol file using eu-unstrip like so: eu-unstrip <stripped-libc> <symbol-file>
1. now <symbol-file> will be your newly redressed libc w/symbols!

Shell-fu

* file - Try to determine what type of file you have.
* strace - See which syscalls an executable executes.
* ltrace - See which library calls an executable executes.
* ldd - See which dynamic libraries an executable loads.
* nm - Dump a binary's symbols
* Learn to use pipes and redirection! When you want to script input, this is very handy, and doing it incorrectly can lead to successful payloads being unusable (e.g. spawning a shell whose _stdin_ is not connected to your terminal).
* To pipe output to an application, but regain access to _stdin_ after, use a subshell:

* cd - - Go back to your last working directory.
* !! - Repeats your last command. Can also be used as a parameter.

* Readline shortcuts are _super_ handy.

| Key | Effect |
|----------|------------------------------------|
| Ctrl-E | Go to end of line |
| Ctrl-A | Go to start of line |
| Ctrl-L | Clear terminal |
| Ctrl-U | Delete e left of cursor |
| Ctrl-K | Delete e right of cursor |
| Ctrl-W | Delete word left |
| Ctrl-Y | Paste last deleted text |
| Ctrl-F | Mo forward one char |
| Ctrl-B | Mo back one char |
| Ctrl-P | Move back one line in history |
| Ctrl-N | Mo one line in history |
| Ctrl-R | Search bash history (start typing) |
| Ctrl-G | Cancel history search |

Crypto

Quipquip : Online tool that will help you sol all subsituition cipher

Decode.fr : It contains ton of old school cipher

CyberChef : Try magic mode, it's real MAGIC!

kt.gy tools : Fast online tool to decode your string

Jail Challenges

Python Jails

Gynvael Python Jail tips

#### Useful functions
* eval() / exec() / compile(), execute any python code
* dir() / type()
* globals() / locals() / vars(), finding useful
* getattr() / setattr(), useful when you need to call object.banned(). You can do getattr(object, "ban"+"ned") or something along the lines

#### Interesting Behaviour
* "A""B" == "AB", useful when + is blocked

Bash Jails

#### Reading files
* Sometimes cat is filtered or banned, these are some alternatives
* fold
* nl (numbered)
* head (head portion of file)
* tail (tail portion of file)

_hooks

In libc, there are *_hook function pointers that are called that are writeable:

By default, these pointers are NULL. These function pointers are only called IF they are not NULL:

If you can o one of these pointers, you can control RIP the next time the associated libc function is called!
Useful if FULL RELRO is enabled/the GOT is read-only and we have a write-what-where!

Protips

* printf() actually calls malloc() if printing anything out with a width > 65535-32!
* any memory corruption error you trigger will call alloca()/__malloc_hook

Null Termination

#### Do NOT read past first null byte
* strcpy()
* strncpy()

#### Do read past first null byte
* read()
* gets()
* fgets()
* memcpy()
* scanf()

#### Does copy the terminating nullbyte from src to dst
* strcpy()

Hacking channel/stream/podcast/blog :

* Gynvael : youtube - A channel about computer, security, ctf, etc... Gynvael is GOD
* Li : youtube - This guy is actually hard working, smart and he explains his idea using animations making things easy to understand
* Socratica : youtube - It's not about security (directly), but it's a good channel for Math, you CAN'T escape MATH if you are doing ANYTHING with COMPUTERS. I learnt that the hard way, don't be like me.
* Ricardo Narvaja : youtube - If you are an old school cracker, you WOULD know this guy. HE is Brilliant. He also has IDA tutorials that taught me a lot about IDA, patching, unpacking...etc. It is orginally in Spanish (i guess so) but the English translated is a here drive
* SecurityTube : youtube - Good educational resources about Security.
* Murmus CTF: youtube - CTF player who li walkthroughs from ctfs.
* 360 Core Security : link a blog all about security research, 0day... of 360 Core Security Team. Very interesting and ad.

Stories

* Stuxnet : wired - A story about Stuxnet, the malware that wrecked havoc in Iran's nuclear power plant
* Mirai : wired - A story about Mirai, the IOT botnet that brought down the Internet
* Edward Snowden : wired - The untold story of Edward Snowden
* SilkRoad wired - A story about the rise and fall of Silk Road, an online drug marketplace by Ross Ulbricht(Dread Pirate Roberts)
* SilkRoad wired - A story about the Russian attacks on critical infrastructure of Ukraine
* Finfisher hack pastebin - A story by the person claiming to be Phineas Fisher who hacked a spyware company, pretty good read in my opinion
* HackingTeam hack pastebin - A story by the person claiming to be Phineas Fisher who hacked the Italian company HackingTeam and leaked their data, again a very good read
* Spanish Police hack vimeo - A video by Phineas Fisher showing how he hacked the Spanish Police because of their human rights

项目信息

开发语言：未知

Star 数：153

技术要点

该项目属于CTF思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕:hammer_and_pick: Useful tips by OTA CTF members :hammer_and_pick: 展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。