May Journal: Looking Forward and Backward

A little bit of background about myself if it’s not obvious, I’m studying IT like going to uni and all that because for some reasons I’m a paranoid that got a revelation about the Big Data industry. Basically that got me to cyber security. But ever since my freshman year, I feel like that field is just not for me. I don’t know, I feel like I’m just wasting time trying to crack CTF problems that don’t translate to necessary real life skills. This has been a recurring theme in my journey to study cyber security on my own.

There was a time when I was watching a lot of CTF walkthroughs and then I got to this one forensics challenge where the whole premise of the challenge is to just run it through a steganography brute forcing script to determine the flag. That left a very bad taste in my mouth, even 2 years after I first watched that video. Well first thing first, that’s not forensics at all. I don’t think an APT is going to hide their malicious injection into a fucking image, or that an important CEO is going to hide their API access key like that. But also, I know not all challenges are like that and maybe I haven’t gotten lucky in finding good quality CTFs or even just platform to learn about stuffs like that.

I played a bunch of CTFs in the past and I can confidently say only 2 events made me feel like I’m closer to learning something new, which is concerning (and both of them are corporate events, which are harder but for some odd reasons my brain likes it more, maybe because they’re more realistic?). Most of the ones I played are low quality shit.

And this is sadly how you get to “build” your cyber security portofolio. Well, you can go the long and hard route of going from Networking -> System administration -> Infrastructure management -> Security. But then, you’re going to lose a lot of time that’s not really directly connected to security. I mean I kinda get it, you’re not going to hack NASA just to prove to your potential employer that you’re a fit candidate for their Penetration Testing group. And it’s actually hard to set up and maintain free, high quality labs, for kids you can’t trust online.

I think this is one of the reasons why cyber security is considered to be a “hard” field in IT. Take an example of software engineering or data science/AI. For the former, you can start from making a simple fullstack Javascript web application and then maybe go to mobile app development, or even game development. The latter, you have Kaggle and it’s quite a hot topic now so a lot of people will offer affordable bootcamps geared towards this field lol. In both cases, you’re not breaking anything, you’re creating something. It’s easier to create something than to break it, right? Because in order to break shit you have to understand how it works first… AND most importantly, you don’t have to contain anything, make mitigation plans, etc, just to make sure the breaking is in reasonable limits (aka the script kiddies learning how to hack on your platform will NOT be able to pwn your whole infrastructure). Just my observation though, you could also say cyber security is also creating something, creating fear and mistrust :>

Jokes aside, right now I’m approaching it in a much slower pace. This means, learning about the basics first. In other words, taking the long and hard route. Because you can’t expect me to just muscle-memorize running a BOF script to pwn a web server. I need to learn the background of these attacks. Also, I’m not trying to be the master of all categories. I’m focusing on the categories that are less guess-y, like reverse engineering, web exploitation, and (real) forensics (or in rare cases TI&IR). I took this route because eventually I’m aiming for a malware analyst career path (the web exploitation is there for the funsies). But it’s too slow… if my end goal is to just win some CTFS. Honestly that’s not a decent goal, and I keep reminding myself I’m on the right track for focusing forward and backward but not sideways.

So far some resources that do help me gain those skills include:

• A paid student subscription of HackTheBox. For its price, HTB is good but they’re super focused on web attacks, less on other areas (system vulnerability, reverse engineering). They do have forensics modules that are actually forensics (like digging into your Windows logs to find traces of malware), and a dedicated Intro to Malware Analysis module that also covers static and dynamic debugging!
• (Should be) paid subscription of TryHackMe. This has more variety than HTB and it’s also more step by step. I only tried the free rooms for trial purposes but even just from the free rooms I can say they’re really nice, although the content available is pretty basic and it won’t get you somewhere. I’m guessing the premium rooms will be even better.
• pwn.college. This one’s free and hands on. But in my opinion it has the tendency to be CTF-y in a sense that sometimes the direction/clue/instructions of the challenges are kinda stupid and some modules test unnecessary skills (more guess-y than needed).

My studying pipeline usually consists of: learning the basics/theories from either HTB or THM -> finish their skill assesments at the end of each module -> try the ones in pwn.college

I haven’t tried these before but some people said they’re also good:

• crackme. This one’s for reverse engineering and maybe eventually pwn.
• natas. OverTheWire’s Natas series is a good one if you need hands on practice on web vulnerabilities. I was planning to use this but turns out HTB has a bunch of in-depth web vulnerability modules for the subscription that I got so I just did that instead. Maybe in the future I will give it a try.

I know that this is suppose to be an art persona, but I’ve made peace with trying to pick sides between the paranoid scientist and the vulnerable artist. I guess I am both, and you will eventually hear me yap about music compositition or animation.