Overthewire.org | Hacker News Reader

Overthewire.org

overthewire.org

326 pointsghostfoxgod49 comments

Open articleView on HN

See also:

* https://linuxsurvival.com/

* https://old.reddit.com/r/linuxupskillchallenge/

* https://github.com/learnbyexample/TUI-apps (written by me, interactive exercises for grep, sed, awk, etc)

Thanks for sharing these.

You can't talk about OTW without talking about smash the stack. The best part of all of these communities was the accompanying irc channels, which are mostly dead now. Jduck, spender, many other known names hung out and you could really learn from the best if you could handle the abuse. The scene exists in kind of a zombie state now, the games are mostly up to date but ...

Know of any modern communities with a similar spirit and ethos in the same scene?

The ctf community is fairly active.

Http://ctftime.org

> you could really learn from the best if you could handle the abuse

Care to elaborate? I assume there was cliche rough tone and elitism going on, but I don't know

The price for saying something ignorant was usually pretty high in the form of verbal abuse, and you had to be willing to cater to that elitist attitude in many cases. Infosec had, and continues to have a gate keeping problem. The strange thing to me is that the scene pretty much died, but these zombies live on, half alive but without a strong community talking about them.

Btw not talking about spender or jduck here, just the scene overall.

That was pretty much any IRC community

There were always elitist channels but they'd be invite only.

The rest you could lurk in however much you wanted.

lol, been in #linux in the last.. say.. twenty years?

Or #c

Maybe a few years ago. I don't recall there being any on topic conversation

For sure, and still is in many cases. I'm used to it tbh, but the HN community has plenty of folks who don't understand and have no need to tolerate or adapt to that kind of stimulus.

>scene pretty much died

Did they finally have kids?

Community infosec does have an asshole problem, but not a gatekeeping problem.

Every single infosec community I grew up in was more than willing to share knowledge and the only requirements were a willingness to learn and ask questions. And skin thick enough to tolerate rudeness if there was any disagreement.

Unless I misunderstood what you meant by gatekeeping?

I regret to inform you these are exactly the same thing.

The fun was there until I got to the steganography challenge. I still avoid steganography during CTFs...

Wargames can help you to learn and practice security concepts through games - https://news.ycombinator.com/item?id=29724594 - Dec 2021 (26 comments)

The Bandit Wargame - https://news.ycombinator.com/item?id=29708304 - Dec 2021 (1 comment)

OverTheWire: Wargames to learn and practice security concepts - https://news.ycombinator.com/item?id=16252873 - Jan 2018 (23 comments)

Wargames - https://news.ycombinator.com/item?id=9878302 - July 2015 (17 comments)

I recently completed a grad Cert in cyber security, and a large initial part of the practicals were to just go through otw and complete some of the lessons. It’s a great resource, and had I known about it before hand I probably wouldn’t have bothered paying so much for the course and just completed the otw exercises instead :/

Asking out of curiosity, have you completed otw completely? How much of it do you feel it helped you in your course?

I'm already learning so much from the bandit exercises itself (which I believe are for entry level folks) So completing all of it would be so fascinating.

Nice! I certainly haven’t completed all of them, just bandit, the web based one, and one of the mediumish ones, and maybe not even all of it, I can’t remember which one tbh. Definitely a fantastic learning resource, once my brain has had a bit of downtime from the course I’m planning on going back and doing more otw.

Really I think that just speaks to the weakness of grad level certs. OTW and it’s offerings are fantastic but still entry level.

Yep, I definitely wouldn’t have done the grad Cert if I knew how weak it would be, was very expensive and very disappointing.

Some newer pedagogical resources with a good learning curve:

* https://pwn.college/

* https://dreamhack.io

* https://guyinatuxedo.github.io

* https://www.picoctf.org/

I've been sort-of adjacent to a lot of these groups when they were in their infancy (hackr.org darkdevelopments.com ssgroup.org etc;) and it's really cool how the majority of the kids who were running those sites in the 2000's are now so keen to create better environments for others to learn.

Hackthissite and websec.fr are other excellent resources from the same pedigree of people

Also adding an absolute classic (at least in my mind):

https://www.hackthissite.org/

I used to be a dev for them. HTS is how i got started with computer science.

Something similar for PowerShell:

https://underthewire.tech/wargames

Nice. I recall there were .txt files in the filesystem where you could leave your name and a shoutout after completing a level. Mostly „Kilroy was here“ equivalents. But it felt oh so 1337 hacker to add yourself. Quite the motivation boost for a teenager. :-)

Also see https://microcorruption.com. You don’t need Linux-specific knowledge. It directly goes to MSP430 assembly. A nice and compact introduction to exploiting binaries and embedded systems.

Coincidentally I just found the lost sources to a binary reverse engineering challenge I wrote in 2010. Compile it without peeking (use the “modern” branch, follow README instructions for patching bomb.c).

https://github.com/RPISEC/csci-4971-bomb

That was a great exercise when I was starting out. Thanks for designing it!

Came across this site which was suggested by a friend of mine. After solving few of the problems, I have reached the moment of "wow I did not know about this at all" and it's exciting to learn more about Linux ecosystem in general.

Would highly recommend anyone who is keen to learn and explore Linux.

Shoot me a DM [1] if you wish to form a small group to solve and discuss these questions together once in a while.

[1] https://twitter.com/akashwhocodes

I don't use X but I'd be interested nonetheless. Can email me at HNrunnerup@protonmail.com

Very good wargames! Learned a lot from them.

My suggestion for those wanting more is

https://exploit.education/

i hate it when sites are posted with out any descriptive title ;-) then i am curious, and end up getting drawn in.

now i want to run:

    ssh level0 command to read pw1 | sshpass ssh level1 command to read pw2 | sshpass ssh level 2 ...

Hahaha hop aboard, I am currently ssh-ing as well ;)

Some more: https://pwnable.kr/play.php

I remember the Matasano challenges around cryptography https://cryptopals.com/

I have played it some years ago, it's very good to start learning about wargames and hacking competitions

I trained a lot at hackthebox.eu

I treat overthewire as a practical bash refresher, rather than learning how to hack. I can't get past the easiest set of problems without spending a ton of time on it, but it's good to remember the basics now and again.

happy to see this every time it comes around

It's cool to go through how much these challenges are irrelevant in 2023 due to things like ASLR, better compiler warnings, etc.

They're irrelevant until you find a hospital cutting IT funding and the devs don't know what they're doing.

I'm not sure I would consider any of these to be relevant... just because the exploits don't work doesn't mean the skills learned to complete them don't transfer. by that argument HTML is irrelevant because everyone uses [JavaScript-Framework] now.

Do the skills actually transfer? If your goal is to learn assembly and/or how a computer executes code, you can probably learn that more directly by spending an afternoon on godbolt. If your goal is to learn computer security, I'm not sure there's really much transfer to be had here. Most of the interesting computer security things to know are at a much higher elevation now.

Many of these will simply not compile without explicitly disabling a compiler warning, and except in rare cases, the rop challenges are impossible.

I'm just commenting on what a huge win I feel it is for the software industry that in the past 15 years these went from "copy the binary to your local machine and it works exactly the same, gcc doesn't even warn about this" to "it doesn't realistically have this vulnerability when run on your machine, nor will it build from source on your machine."

edit: wikipedia is claiming linux has had ASLR since 2005 so maybe I'm wrong.

I bet quite a few IoT devices would fall to these irrelevant attacks

This criticism is largely irrelevant. Mitigations like ASLR are not a silver bullet, they are one layer of a defense-in-depth.

You can't hope to exploit an ASLR'd executable without first understanding how to exploit a non-ASLR'd executable. If you want to exploit modern systems, you need to peel back those mitigations one by one (if you're lucky you can jump over multiple layers at once, but not always).

Further, just because mitigations exist, it doesn't mean they're widely deployed. As a recent and prominent example, the Nintendo Switch bootrom was pwned through a classic stack-smash with shellcode-on-stack in ~2018 (or 2017, for those in-the-know).

That said, there are more modern resources available these days, I'm also a fan of https://github.com/RPISEC/MBE, which kinda speedruns you up to the state-of-the-art (although it too is getting kinda old at this point - but things haven't changed that radically since 2015)

I'm also planning to jot down the approach and strategy into short form blogs as and when I keep solving them and publish it on my blogging site [1]. This will help me keep coming back to it and revise it more easily.

[1]: https://akashrajpurohit.com/

Reply on news.ycombinator.com