Offensive Operations (Red Team CTF)

Overview

Offensive operations is a Capture The Flag (CTF) competition where you exploit intentionally vulnerable systems to extract flags. This tests your ability to identify, exploit, and document vulnerabilities across web applications, infrastructure, and network services.

Duration: 4 hours

Typical marks distribution:

• Web exploitation: 35-45%
• Infrastructure exploitation: 30-40%
• Privilege escalation: 15-20%
• Cryptography challenges: 5-10%

---

What You’ll Face

Web Exploitation

• SQL injection (error-based, UNION, blind)
• Cross-Site Scripting (reflected, stored, DOM)
• File upload vulnerabilities
• Directory traversal / LFI
• Authentication bypass
• SSRF, XXE, deserialization (international)

Infrastructure Exploitation

• Network reconnaissance (nmap, service enumeration)
• Brute forcing (SSH, RDP, web logins)
• SMB enumeration and exploitation
• Active Directory attacks (Kerberoasting, AS-REP roasting)
• Public exploit usage (searchsploit, Metasploit)

Privilege Escalation

• Linux: sudo abuse, SUID binaries, kernel exploits, capabilities
• Windows: unquoted service paths, DLL hijacking, token impersonation
• Post-exploitation: credential dumping, lateral movement

Cryptography

• Encoding vs encryption identification
• Base64, hex, rot13 decoding
• Hash cracking (MD5, SHA1, bcrypt)
• Weak crypto implementation exploitation

---

Competition Strategy

Time allocation:

• Web exploitation first (easiest flags, most marks)
• Infrastructure recon and quick wins (default creds, known CVEs)
• Privilege escalation only if needed for flags
• Skip crypto challenges if stuck (lowest marks)

Common pitfalls:

• Using automated tools without understanding (sqlmap, Metasploit)
• Spending too long on one challenge
• Not documenting exploitation steps
• Missing low-hanging fruit while chasing hard targets

---

Topics (Canonical Content)

Web Exploitation

• SQL Injection ✅ - Error-based, UNION, blind, auth bypass
• XSS - Reflected, stored, DOM-based
• File Upload - Unrestricted upload, filter bypass
• Web Reconnaissance - Directory fuzzing, parameter discovery

Infrastructure

• Network Reconnaissance - nmap, service enumeration
• Linux Privilege Escalation - sudo, SUID, capabilities
• Windows Privilege Escalation - Services, DLL hijacking
• Active Directory Attacks - Kerberoasting, BloodHound
• Post-Exploitation - Persistence, lateral movement

---

Competency by Level

Regional	National	International
Error-based SQLi	UNION-based SQLi (manual)	Blind SQLi, second-order
Basic XSS	XSS filter bypass	DOM-based XSS, CSP bypass
Sudo -l abuse	SUID binary exploitation	Linux capabilities, kernel exploits
Nmap basic scans	Service version exploitation	Zero-day-style thinking

---

Practice Resources

• Regional roadmap: offensive operations
• National roadmap: offensive operations
• SQL Injection Cheat Sheet ✅