Train Your CTF Team with Roppers
The school year is starting and you know what that means: Time for CTF teams to start practicing again! Whether you are in college, high school, or middle school, this is an exciting time of the year. This document is my initial effort at describing how a CTF team at any level can use Ropper’s material to train their new members.
If your school doesn’t have a CTF team, check out this document: How to Start a CTF Team
If your school has a CTF team but you’ve never competed before, check out this document: How to Join a CTF Team
However, if you are on leadership for your team, maybe the Training Officer, or just are invested in making sure the new members of the team have a good time and get a strong start, this is the article for you.
First, let’s describe what is about to happen. School is going to start, you’re going to send out your interest emails, there will be a few club days to find new students, and you will be inundated with a ton of new members who are bright-eyed, bushy-tailed, and ready to learn. The downside is that your team probably hasn’t spent the summer working on the curriculum you were going to teach this September rush of young hackers. (If you did, let me know, because that is awesome!)
On the plus side for you, I did! Roppers was originally developed to be the training material for my CTF team back in college, and since day one has been designed with the brand new, completely non-technical student in mind. It’s free, completely asynchronous, and meant to be done remotely with minimal need for outside instruction. This means that you can focus on getting your returning members into the swing of things, while you maintain a really positive experience for the new members.
Our Computing Fundamentals and CTF curriculum takes a student with zero experience and get them all the way up to scoring well on CTFs, while in the meantime becoming pretty great with Linux, solid from the command line, and most importantly, confident in their ability. For new CTFers, it’s all about not scaring them off and getting them a great foundation on a supportive team… then you can start teaching them the hard things (If you’re a team that does 1337 buffer overflows the first week to scare off n00bs, I’m disappointed in you, be better).
What’s better? Have them all enroll in the Roppers Computing Fundamentals course. Let me know if your team takes me up on this offer so I can work with you to get access to their progress. This course basically teaches itself, so you can now let them work through this course asynchronously, and when they come to practices you can focus on answering questions instead of explaining what Ubuntu is. That doesn’t mean you don’t have to teach them (they’ll definitely need a little help with VM installations), but your team should make yourself available, and I will too.
When you are at practice, at least for the first few months, focus on talking to each other and building camaraderie. Roppers is great for remote, but if you are in person, focus on talking and doing things on a big screen as a group. One great thing to do is to have everyone come with lists of questions or concepts they don’t understand and do a Q&A session. Also you can use the Roppers Slack #techsupport channel if you need help, someone can always help out there.
Once they get through that Fundamentals course, have them do the walkthroughs in our Capture the Flag course. That’s what you were going to do anyway, but now it’s structured and they’re comfortable with Linux before you start making them try to figure things out.
To sweeten this deal where I give you a bunch of things and you in exchange teach the younglings, Ropper’s Academy will contribute to the hacker movie night pizza fund for any US-based CTF team that has more than 10 students complete the Computing Fundamentals Course through Advanced Linux. Contact me at my email for more information.
I am looking forward to a world where the new members of each CTF team each get the best possible introduction to security and fall in love with the field. I’d love for Roppers to be part of that, so let me know what I can do to help your team.
If you have any questions, comments, or thoughts on the subject, hit me at d.m.devey@gmail.com or on Slack.
Stay stoked, Dennis