From Vulnerability to CTF

Ron Bowes opens with his background in open-source tooling and security research, then explains what capture-the-flag events are and why he values them. He argues that CTFs offer hands-on practice many newer practitioners never get on real systems, and that write-ups help lessons spread. He also notes that bugs found during client work can inspire teaching challenges once customer details are removed.

The middle of the talk covers several vulnerabilities he has worked on or followed. They include an F5 BIG-IP authentication bypass where a Connection header led a proxy to strip a token before the backend checked it, and a Windows service permission flaw in a Cisco WebEx updater that allowed code to run as SYSTEM. Other examples are a Diablo II item duplication bug, a Game Boy Pokemon use-after-free triggered by the Old Man glitch, and a weak substitution cipher in a point-of-sale config file. For each, he explains how the flaw became a challenge, with practical reversing tips such as checking strings in a binary.

He closes by noting that some real bugs translate well into challenges, while others are too hard, too fragile or too tied to customer work to rebuild. Platforms such as Windows services and cloud-hosted targets proved difficult to run reliably as CTF infrastructure. The overall takeaway is that a good challenge distills a real flaw into a clear lesson.