Labs and CTFs: What are the Differences?
As I write this, I’m knee-deep in creating the launch CTF for Capture the Talent. I’ll be honest, I approached this, initially, with some degree of apprehension. I’ve never designed a CTF to this scale before. In the past, I’ve designed shed-loads of machines, labs, and vulnerable artefacts, but never for a CTF.
I assumed, going into this, that I could leverage my previous experiences of a) being Head of Content at Hack the Box for just under a couple of years and b) having almost thirteen years of teaching experience under my belt. And to some degree this is true. But, during this process, I’ve really understood the difference between creating a lab and a CTF. Oftentimes, people assume these are the ‘same thing’ – abstractly, they are; vulnerable artefacts for you to hack away at. But are they really the same? Let’s dive in…
Real World Applicability
Casting my mind back to when I created the ever-popular Dante Pro Lab for Hack The Box, I had a few core criteria I set myself: ensure beginners are not intimidated by the lab, make it as fun as possible, and ensure it is as close to real-life as possible. What does this mean? Well, am I likely, as a penetration tester, to encounter these configurations, technologies, artefacts and vulnerabilities as part of my day-to-day job? If the answer to this question is a firm ‘yes’, we can consider them ‘lab’ material. If I’m creating or undertaking a lab, I expect to see content I have either seen or expect to see in the field.
Conversely, a CTF is probably the antithesis of this concept! For example, I have just created a challenge for the launch CTF that features a file, hidden within another file, featuring some text encoded in a certain way, which is just a flag. Now, would you see this in the field? I guess if you’re working in a certain niche area of security.. perhaps. But if you’re a bog-standard everyday pen tester? Definitely not.
Fun and Learning
Before you make any assumptions based on the subtitle, both labs and CTFs have to be fun! Undertaking a CTF is usually a very sociable event. It’s a bit like going to see your favourite sports team play, going to the cinema or seeing an old friend. You’re with other people, other players, and you’re all there for the same reason; to have a bit of fun and to see how you fare against others, maybe for a weekend if it’s a long CTF. Maybe you’ll play in a team and have a laugh and joke along the way, solving endless challenges, racking your collective brains.
If we look at a lab through the same lens, it doesn’t really have the same characteristics. Many people undertake lab environments – such as the fantastic Certified Red Team Professional course by Pentester Academy/INE – over a longer term, with some training providers offering lab subscriptions for up to a year. The aforementioned CRTP course offers a subscription for up to three months, before you are ultimately invited to sit the exam. This is not a social event, rather a purposeful, solo mission to learn and grow in a specific area of offensive security. A lab should offer an educational outcome for the learner, where as a CTF assumes you have these skills already to-boot.
Eclectic Variety
Picture this; you sign up to a CTF and… woah… There’s only one category of challenges, and it’s not the one you wanted, nor is it a category you are particularly strong in. I’d imagine you’re a bit disappointed. You’ve been looking forward to this for ages. And you’ve even paid an entry fee. Does this sound like fun? Nope.
This is why the Capture the Talent CTF is the exact opposite: loads of categories at varying levels of assumed skill. We’ve got everything from Cryptography to Trivia, Web App to Pwn, Forensics to OSINT, and more… so there genuinely is something for everyone!
Recommended by LinkedIn
Now if we were looking at a lab, and we logged in and saw it had all sorts of categories, would that be useful for us? Probably not. It’s great from the perspective that you’re potentially getting exposure to more areas of offensive security than you’d anticipated, and sure it might be fun, but are you actually going to be taking a deep dive into anything and learning?!
A lab guides you through a process from start to finish, with a clear purpose in mind for you as a student, catering to the goal of growing your knowledge and enriching you with new skills within a ‘safe’ environment. Usually, labs don’t have a ton of variety, and you’ll certainly not see any trivia questions in there but what does feature is laser-precision content with the aim of growing the end user’s capabilities or proving what they can do!
The Marketing Spiel
At Capture the Talent, our labs are designed with a few tenets:
We produce labs that have specific goals to help organisations understand the capabilities of their potential candidates or their current staff, helping to reduce risk within the hiring process, adding value for employers and doing so with integrity.
If you’re hiring offensive security professionals and want to hear more about how Capture the Talent could help your business, get in touch with myself or Amy and we'd love to have a chat with you to discuss further...! And if you haven't already, get yourself signed up to our CTF... tickets are £20 each, we've got a whole range of exciting challenges and ALL profits will be going to the Innocent Lives Foundation.