picoCTF Learning Materials

Getting Started

• What is a Hacker?

Binary Exploitation

Binary exploitation is the art of bending a computer program to your will.

• Binary Demo

Forensics

Ever wanted to resurrect deleted files from your system? Computer forensics is the analysis, discovery, and recovery of data in a computer system.

• Networking 101 – Wireshark

• Networking 101 – The Basics of Protocols

Cryptography

The word cryptography comes from the Greek for secret writing. Cryptography is all about sending messages that can only be read by those you choose. In this section we will go over some of the terminology, a few simple ciphers (and how to break them), and how to encrypt your secrets safely!

• Cryptography Field Guide
• Substitution Cipher

• Basic Cryptography

• Goals of Cryptography

Source: https://picoctf.com/learn

How To Monitor a Remote Computer For Free

Do you want to monitor a remote computer for free? If the answer is yes,….. YOU CAN DO IT! This article is full of tricks and tips that you can use to monitor a remote computer for FREE.

1. Monitor a Computer Remotely with Ammy Admin

 

Ammy admin is a popular software used for remote system administration and educational purposes. You can easily turn this innocent looking software into a spy that allows you to see what’s going on at a remote PC.

Here is how to do it:

1. Download Ammy Admin. 

[If the link is not working, use this MediaFire link: Download Ammy Admin]

2. Run the program on the computer you want to monitor. A window will appear:

3. Remember or write down the ID of the PC which is shown in the green field “Your ID”. Then go to Ammy > Settings. Another window will popup:

4. Uncheck all the checkboxes except the first one (see the above image). Then click on “Access Permissions” button. (If you want to test the video performance, use the “Video system speed test” button). Another window will popup:

5. Uncheck “Protect these settings from remote computer” and then click on the plus button. A small window will appear:

6. Enter a password and then confirm the password. Click on the “OK” button. Then click “OK” again to save the access permissions.

7. In the main menu, go to Ammy > Service > Install. Ammy Admin will display a message like this:

8. Go to Ammy  > Service > Start. Then close the application. Ammy admin will will automatically run in hidden mode when Windows starts up.

9. Run Ammy Admin on the the computer from which you want to monitor the remote PC.

10. Enter the ID of the child computer on the “client ID/IP” field. Then check “View only” box and click on the “Connect” button.

11. Ammy admin will display a password box:

12. Enter the password that you set up while configuring remote PC and then click on “OK” button.

13. Wait for some time, it will establish a connection to the remote PC and display the live screen:

If you want to listen what’s going on at remote PC, click “voice chat” button on the control panel of remote desktop window.

You can also access files in the remote PC by using the “File Manager” button.

You can also turn your PC into a wireless remote control of the distant computer by unchecking the “View only” option.

Let’s move onto the technique #2

 

2.  Monitor a Computer Remotely with ActivTrak

ActivTrack is a cloud based monitoring service that you can use to spy on children, employees or spouse. The company also offers paid plans, but here we are using a free account!

Let’s start!

1. Go to activtrak.com. You will see a page like the below one:

2. Enter your email address and then click on “Free Secure Signup”. Wait for some seconds, you will see a pop up box like this:

3. Enter your name, password, and organization name,  and click on “OK”. Then download the ActivTrak Agent (click on the “Download ActivTrak Agent” button).

4. After downloading the ActivTrak Agent.msi, install it on the remote computers you want to monitor.

5. Done! go to your computer and then visit https://app.activtrak.com/Account/login. Login with your email and password.

You will see the real time activities of the remote computer:

You can also use this free account as a remote control for your distant PC, but with less features compared to Ammy Admin.

Problems with the free account are, limited screenshots, “only 3 agents”, “only for one user” and 3GB limited storage. But if you are ready to pay for the service, you can get features like unlimited screenshots, unlimited users, unlimited storage, remote installer, support by phone, data export and ad free experience.

So, if you are going to upgrade your account or create a premium account, click on the below banner (It will help us to pay our bills):

If you have a suspicion that you are being monitored, check all the processes in the task manager and then use Detekt to scan your computer.

Also use an on-screen keyboard to enter usernames and passwords.

NISTFOIA: FOIA for NIST documents related to the design of Dual EC DRBG

---

nistfoia

---

Results of a recent FOIA for NIST documents related to the design of Dual EC DRBG.

These FOIA results are the combined result of two separate requests. Thanks to the following requestors:

• Matthew Stoller and Rep. Alan Grayson
• Andrew Crocker and Nate Cardozo of EFF

I have contributed only OCR and hosting. Happy hunting,

Matt Green, 6/5/2014

---

		1.15.2015 production/10.1.2.3.5 Generating Pseudorandom Bist Using Hash_DRBG.pdf
		1.15.2015 production/9.1.2 Keyless Hash Function DRBG.pdf
		1.15.2015 production/ANSI X9.82 Discussions.pdf
		1.15.2015 production/ANSI X9.82, Part 3 DRBGs Powers point July 20, 2004.pdf
		1.15.2015 production/Appendix E_ DRBG Selection.pdf
		1.15.2015 production/Comments on X9.82, Part 4_Constructions.pdf
		1.15.2015 production/E1 Choosing a DRBG Algorithm.pdf
		1.15.2015 production/Five DRBG Algorithms Kelsey, July 2004.pdf
		1.15.2015 production/Hash Funciton chart.pdf
		1.15.2015 production/Letter of transmittal 1.15.2015 .pdf
		1.15.2015 production/Part 4_Constructions for Building and Validating RBG Mechanisms.pdf
		1.15.2015 production/Scan_2015_01_27_13_05_55_026.pdf
		1.15.2015 production/Validation Testing and NIST Statistical Test Suite July 22, 2004.pdf
		1.22.2015 production/10.1.2 Hash function DRBG Using HMAC.pdf
		1.22.2015 production/10.1.3 KHF_DRBG.pdf
		1.22.2015 production/8.6.7 Nonce.pdf
		1.22.2015 production/8.7 Prediction Resistance and Backtracking Resistance.pdf
		1.22.2015 production/ANSI X9.82 Part 3 Draft July 2004.pdf
		1.22.2015 production/Annex G_Informative DRBG mechanism Security Properties.pdf
		1.22.2015 production/Appendix G Informative DRBG Selection.pdf
		1.22.2015 production/Comments on X9.82 Part 1, Barker May 18, 2005.pdf
		1.22.2015 production/Cryptographic security of Dual_EC_DRBG.pdf
		1.22.2015 production/D.1 Choosing a DRBG Algorithm.pdf
		1.22.2015 production/DRBG Issues Power Point July 20, 2004.pdf
		1.22.2015 production/Draft X9.82 Part 3 Draft May 2005.pdf
		1.22.2015 production/E.1 Choosing a DRBG Algorithm (2).pdf
		1.22.2015 production/E.1 Choosing a DRBG Algorithm.pdf
		1.22.2015 production/Final SP 800-90 Barker May 26, 2006.pdf
		1.22.2015 production/Fwd_Final SP 800-90 Barker May 26, 2006.pdf
		1.22.2015 production/Kelsey comments on SP April 12, 2006.pdf
		1.22.2015 production/Latest SP 800-90 Barker May 5, 2006.pdf
		1.22.2015 production/Letter of transmittal 1.22.2015.pdf
		1.22.2015 production/SP 800-90 Barker June 28, 2006.pdf
		1.22.2015 production/SP 800-90_pre-werb version> Barker May 9, 2006.pdf
		1.22.2015 production/Terse Description of two new hash-based DRGBs Kelsey, January 2004.pdf
		1.22.2015 production/Two New proposed DRBG Algorithms Kelsey January 2004.pdf
		1.22.2015 production/X9.82, RGB, Issues for the Workshop.pdf
		6.4.2014 production/001 – Dec 2005 -NIST Recomm Random No. Gen (Barker-Kelsey).pdf
		6.4.2014 production/002 – Dec 2005 – NIST Recomm Random No. Gen (Barker-Kelsey)(2).pdf
		6.4.2014 production/003 – Sept 2005 – NIST Recomm Random No. Gen (Barker-Kelsey).pdf
		6.4.2014 production/004 – Jan 2004 – Terse Descr. of Two New Hash-Based DRBGs.pdf
		6.4.2014 production/005 – Proposed Changes to X9.82 Pt. 3 (Slides).pdf
		6.4.2014 production/006 – NIST Chart 1.pdf
		6.4.2014 production/007 – RNG Standard (Under Dev. ANSI X9F1) – Barker.pdf
		6.4.2014 production/008 – Random Bit Gen. Requirements.pdf
		6.4.2014 production/009 – Seed File Use.pdf
		6.4.2014 production/010 – NIST Chart 2.pdf
		6.4.2014 production/011 – 9.12 Choosing a DRBG Algorithm.pdf
		6.4.2014 production/012 – May 14 2005 – Comments on ASC X9.82 Pt. 1 – Barker.pdf
		6.4.2014 production/013 – X9.82 Pt. 2 – Non-Deterministic Random Bit Generators.pdf

---

More info you can find on: https://github.com/matthewdgreen/nistfoia

---

650.445: PRACTICAL CRYPTOGRAPHIC SYSTEMS

---

READINGS & SUGGESTED PRESENTATION TOPICS

---

Protocols

1. • Crosby, Goldberg, Johnson, Song, Wagner: Cryptanalyzing HDCP (2001)

2. • Wagner, Schneier: Analysis of the SSL 3.0 Protocol

3. • Lucks, Schuler, Tews, Weinmann, Wenzel: Security of DECT
   

4. • Kohno: Analysis of WinZip Encryption
   

5. • Stubblefield, Ioannidis, Rubin: Breaking WEP

6. • Bellare, Kohno, Namprempre: Breaking and Repairing SSH

7. • Burrows, Abadi and Needham: A Logic of Authentication

8. • DTLA: DTCP Additional Localization Protocol

Side Channel Attacks

1. • Bar-el: Introduction to Side Channel Attacks (white paper)
   

2. • Kocher: Timing attack on RSA & DL systems
   

3. • Brumley, Boneh: Remote Timing Attacks are Practical
   

4. • Bernstein: Cache Timing Attack on AES.  Osvik, Shamir, Tromer: Attacks and Countermeasures
   

5. • Eisenbarth, Kasper, Moradi, Paar, Salmasizadeh, Shalmani: Attacking KeeLoq (SpringerLink)
   

6. • Shamir, Tromer: Acoustic Cryptanalysis
   

7. • Pellegrini, Bertacco, Austin: Fault-Based Attack of RSA Authentication
   

8. • Aciicmez, Koc, Seifert: Branch Prediction Analysis (very advanced)

Dictionary Attacks: Optimization & Mitigation

1. • Alexander: Password Protection for Modern OSes

2. • RSA Laboratories: PKCS #5 2.0: Password-Based Cryptography Standard

3. • Provos and Mazières: “Future-adaptable” password schemes
   

4. • Stamp: Once Upon a Time Space Tradeoff
   

5. • Oeschslin: Rainbow Tables (includes papers & demo)
   

6. • Canetti, Halevi, Steiner: Mitigating (offline) Dictionary Attacks with Reverse-Turing Tests

   Securing Internet Infrastructure

7. • Jackson, Barth, Bortz, Shao, Boneh: Protecting Browsers from DNS Rebinding Attacks

8. • Kaminsky: It’s the End of the (DNS) Cache As We Know It (Black Hat 2008 – 101MB)

9. • DNSSEC.net: DNS Security Extensions (standards & resources)

10. • Ptacek: A case against DNSSEC

11. • Kent, Lynn and Seo: Secure BGP

12. • BBN.com: Secure BGP resources

Digital Rights Management & Conditional Access

1. • Lawson: Designing and Attacking DRM (presentation)

2. • Edwards: A technical description of the Content Scrambling System (CSS)
   

3. • Henry, Sui, Zhong: Overview of AACS — and full AACS Specification

4. • ISE: A Comparison of SPDC (technology behind BD+) and AACS (2005)
   

5. • Craver, Wu, Liu, Stubblefield, Swartzlander, Wallach, Dean, Felten: Watermarking & SDMI
   

6. • Kuhn: Analysis of the Nagravision Video Scrambling Method (analog scrambling)
   

7. • Naor, Naor and Lotspiech: Revocation and Tracing Schemes for Stateless Receivers
   

Software, Physical Security, Backdoors

1. • Halderman et al.: Cold Boot Attacks on Encryption Keys & RSA Key Reconstruction

2. • Young, Yung: Cryptovirology: extortion-based security threats and countermeasures (IEEE)
   

3. • Dowd: Application-Specific Attacks: Leveraging the ActionScript Virtual Machine

4. • Steil: 17 Mistakes Microsoft Made in the XBox Security (2005)

5. • Bartolozzo et al.: Attacking and Fixing PKCS#11 Security Tokens

6. • Bardou et al.: Efficient Padding Oracle Attacks on Cryptographic Hardware

Privacy and Anonymity

1. • Dingledine, Mathewson, Syverson: Tor: The Second Generation Onion Router
   

2. • McCoy, Bauer, Grunwald, Kohno, Sicker: Analyzing Tor Usage

3. • Murdoch, Danezis: Low-cost Traffic Analysis of Tor

4. • Murdoch: Hot Or Not: Using clock skew to locate hidden services

5. • Wang, Chen, Jajodia: Tracking Anonymized VoIP Calls

Hash Functions and Random Oracles

1. • Coron, Dodis, Malinaud, Puniya: Merkle-Damgård Revisited

2. • Wang, Yu: How to break MD5 and other hash functions

3. • Stevens, Lenstra, de Weger: Target collisions for MD5

4. • Kaminsky: MD5 To Be Considered Harmful Someday

5. • Sotirov et al.: MD5 considered harmful today (building a rogue CA cert)
   

6. • Wang, Yin, Yu: SHA1 broken (at least, on its way…)
   

7. • NIST: “SHA3” competition: list of first round candidates (December 2008)
   

8. • Canetti, Goldreich, Halevi: Random oracles revisited, and…

9. • Bellare, Boldyreva, Palacio: A more natural uninstantiable Random-Oracle-Model scheme
   

10. • Coron, Patarin, Seurin: The random oracle model and the ideal cipher model are equivalent

11. • Bellare, Canetti, Krawczyk: HMAC

Symmetric Crypto

1. • Bellare, Namprempre: Authenticated encryption, generic composition

2. • Ferguson: Authentication weaknesses in GCM.  McGrew, Viega: Response & Update.

Public Key Crypto

Bleichenbacher: CCA Attacks against Protocols (SSL) based on PKCS #1

Bellare, Rogaway: Optimal Asymmetric Encryption Padding (OAEP)

Manger: CCA Attacks against Implementations of OAEP

Bernstein: An Introduction to Post-Quantum Cryptography

Random Number Generation

1. • Dorrendorf, Gutterman, Pinkas: RNG Weaknesses in Windows 2000

2. • Gutterman, Pinkas: Flaws in the Linux RNG

3. • Barker, Kelsey: NIST Special Pub. 800-90: Recommendations for PRNGs

4. • Kelsey, Schneier, Wagner, Hall: Cryptanalytic attacks on PRNGs

5. • Schoenmakers, Sidorenko: Dual EC not kosher
   

6. • Shumow, Ferguson: There May Be a Backdoor in Dual EC.

7. • Keller: ANSI X9.31 (Block cipher-based PRNG). Various artists: FIPS 186-2 (see Appendix 3)

Implementation Issues

1. • Gutmann: Lessons Learned in Implementing and Deploying Crypto Software
   

2. • Berson: Security Evaluation of Skype (2005, conducted at Skype’s request)

3. • Biondi, Desclaux: Silver Needle in the Skype (2006, REing of Skype binary)

Financial Services

1. • Berkman, Ostrovsky: The Unbearable Lightness of PIN cracking
   

2. • Bond, Zieliński: Decimalisation table attacks for PIN cracking

3. • Murdoch, Drimer, Anderson, Bond: Chip and PIN is Broken

RFID and Wireless

1. • Nohl, Evans, Starbug, Plötz: Reverse-Engineering a Cryptographic RFID Tag
   

2. • Bono, Green, Stubblefield, Juels, Rubin, Szydlo: Security Analysis of TI DST Tags

Misc.

1. • Halperin et al.: Pacemakers and ICDs (no crypto)
   

2. • Ellis: Non-secret Encryption (historically very interesting)
   

3. • TheGrugq: Opsec for Freedom Fighters