Cybersecurity/Capture the Flag exercise for students

[Michael Pawlik]

I've been wanting to put together a cybersecurity or capture the flag challenge, or even better find something already created, to allow students to put into practice what they have learned. However, I'm not sure where to begin. The system would have to be virtual to allow the use of certain tools and I would like it to be a multi-user challenge.
Is this something that you have tried? Were you successful? Is there something that has already been created, as I don't want to "recreate the wheel" or spend a lot of money?

Thank you for your input.

MP

 

[Rick Butler]

I would say you need to ping on @Allen Stubblefield for that one. I know he does that sort of thing for his students.

/r

 

[Michael Pawlik]

I would say you need to ping on @Allen Stubblefield for that one. I know he does that sort of thing for his students.

/r

I was going to ask during one of the A+ TTT sessions but it seemed out of place (at the time, @Allen Stubblefield has piqued my interest in the area and getting it on his radar is a good idea.
I was at a bSides conference here in Central Mississippi when some students brought in a CtF on a Raspberry Pi (or arduino; it had a small router and battery pack attached via electrical tape) and I sure wish I would have asked more questions then.
Thanks for the reply.

 

[Brian Ford]

I've been wanting to put together a cybersecurity or capture the flag challenge, or even better find something already created, to allow students to put into practice what they have learned. However, I'm not sure where to begin. The system would have to be virtual to allow the use of certain tools and I would like it to be a multi-user challenge.
Is this something that you have tried? Were you successful? Is there something that has already been created, as I don't want to "recreate the wheel" or spend a lot of money?

Thank you for your input.

MP

Check out these cyber ranges ...

https://www.virginiacyberrange.org/

https://www.uscyberrange.org/ (if it looks just like Virginia that's because it kind of is)

https://www.rangeforce.com/ and

Home | CYRIN

Welcome to the CYRIN Cyber Range! CYRIN is a next-generation cyber-range where you use real tools, real attacks, and real scenarios to hone your skills in a virtual environment. Secure a Linux server system, analyze the security of a web application, or respond to a denial of service attack in...

cyrin.atcorp.com

There are others including some that only cater to businesses and governments. The Virginia / US cyber range is a good reputable organization that has a library of exercises that an instructor can go through and introduce to their classes.

 

[Jarrel]

You can create 3 VMs.
- a windows server
- a windows client (preferably Win 7 or older, as they got more vulnerabilities)
- a Kali Linux machine (for attacking)

Connect the 3 VMs together, so as to create a single LAN, then explore the tools

 

[Lee McWhorter]

Check out:

Vulnerable By Design ~ VulnHub

VulnHub provides materials allowing anyone to gain practical hands-on experience with digital security, computer applications and network administration tasks.

www.vulnhub.com

I use this one in my program as a starter for Sec+ level stuff:

RickdiculouslyEasy: 1

RickdiculouslyEasy: 1, made by Luke. Download & walkthrough links are available.

www.vulnhub.com

 

[Stan Pieklo]

You can check out https://picoctf.org/. It is available year round.

 

[Liz Wannemacher]

I've been wanting to put together a cybersecurity or capture the flag challenge, or even better find something already created, to allow students to put into practice what they have learned. However, I'm not sure where to begin. The system would have to be virtual to allow the use of certain tools and I would like it to be a multi-user challenge.
Is this something that you have tried? Were you successful? Is there something that has already been created, as I don't want to "recreate the wheel" or spend a lot of money?

Thank you for your input.

MP

Have you checked out the National Cyber League's event? The CIN Network provides a discount to first-time instructors that register their class. Here's some more info: https://nationalcyberleague.org/comptia-advantage

 

[Sam Black]

PicoCTF is a great place for beginners and advanced students alike to get practice in a number of different categories and tasks.

If Blue Teaming is more your idea, Cyberpatriot (for high school students) or National Collegiate Cyber Defense Competition (for college students, obviously) is a great way to get hands-on experience