CTCS Internship Summary

Introduction

This blog post is a summary of my learning experiences and challenges that I came across when working an internship at the CT Corporate Services in an office environment as a GCSE level student. I also attempt to cover future improvements that I could attempt.

The main subject of work that I approached during this internship was cyber security and I learnt about both server sided and client sided vulnerabilities which can be exploited by hackers in a real world scenario. In order to be able to achieve this goal, I attempted various Capture the Flag challenges and coding tasks, which I will discuss in this blog.

Learning Experience

Overthewire.org

Having begun the internship with little to no experience regarding the new world of cybersecurity, I was very curious about the principles of the field. I was first introduced to the natas wargame constructed by OverTheWire.

Wargame Challenge Overview

The purpose of the Natas Wargame was to introduce people to the concept of finding exploits and vulnerabilities which may affect someone in a real world scenario. In short, there is a password hidden in each of the 35 levels of the wargame, and it is the player’s objective to somehow retrieve the password by exploiting intentional vulnerabilities in the website’s code using various different hacking techniques.

Many of the vulnerabilities are shown by oWasp, the Open Worldwide App Security Project, and PortSwigger¹, both of which provide immense levels of detail on each and every exploit that an attacker may attempt as well as how they are executed and the preventions for each method.

My Wargame Experience

You can read more about my natas wargame experience here.

Learning Git

To understand code, improve overall coding efficiency and host my own webpages, it was necessary for me to learn how to utilise github, github pages and git properly. I initially started off with the basic principles of git using learngitbranching.js.org, which taught the properties and functioning methods of Git through a visual interactive demonstration.

From this website, I was able to learn about and understand how git branching worked and how files were ‘uploaded’ (committed) to github and then hosted on github pages, which enabled me to create my own blog. This was done by importing a theme and editing the content using github desktop in conjunction to Android Desktop Studio, a desktop editor. Afterwards, I did some more research and managed to incorporate a comments section to my blog, via Disqus, which allows me to moderate and interact with the comments.

I used markdown and jekyll² to create my blogs along with npm enabling more aesthetic designs.

Followup

Continuing from this, I learnt about servers, mainly the Domain Name System, or DNS, and how users are directed to various different websites.

Starting with the URL, the user’s computer, or resolver, sends the target address to the system. The DNS recursor receives this initial transmission and, based off of the domain extension³, the recursor then makes additional requests to the root nameserver, the top level domain and finally the authoritative nameserver until the target URL is found and is translated into an internet protocol (IP) address. The IP is then sent all the way back to the user’s web browser, which directs the user to their desired website. In the case that the url is invalid, the resolver will not send out a request. Multiple addresses can be linked to the same root, likewise the same address can lead to a different page depending on the user.

Smash The Stack

The final challenge that I attempted during my internship was the wargame known as Smashthestack, or the IO wargame. This was an ssh based wargame which involved the usage of terminal far more than the previous. In addition to that being new, all the code was written in C, which was completely new to me. In order to approach the wargame, I explored the basics of C and C++ syntax in order to understand the source codes better. Having completed part of Smash the Stack, I’ve gained insight into how GDB/gnu debugger and radare2 can be used to debug and breakdown programs in a practical scenario to improve code and find hidden information.

My Future

Having completed my internship, I very much enjoyed the experience. As a student, I found that working in an office environment tackling tasks more difficult than those assigned by school was extremely enlightening as to what the future would be like and provided a great insight into web security. To carry on from the progress here, I would like to:

Familiarise myself further with C and JavaScript
Attempt more Wargames to gain additional experience
Start personal projects to help broaden skillset and continue updating the blog
Consolidate my current skillset regarding web security and related aspects covered during the intern

I hope to achieve these goals which I have just shared to be able to carry on with web security and programming in the future.

Footnotes

Portswigger is a free online training academy specifically regarding web security ↩
Markdown is a simplified version of hypertext markup language, or html. It allows the programmer to easily write blogs or articles due to the nature of its simplified syntax. Jekyll is one of many addons that can be used to enhance the webpage. ↩
The domain extension essentially is the last part of a url address - for example the dot com in google.com. ↩