The goal is to find the flag, usually somethign unambiguous like "flag{some_lind_of_message}". There are generally no other rules to a CTF other than "don't run a scanner against us"/"don't brute force."

Analyzing and listing out ways to interact with the site will show you your surface area, although sometimes the interaction is so opaque you might have to check the "robots.txt" or other well known files.

The start button, the difficulty level, making a move, and the admin panel all offer ways to test different inputs to see if you can get unexpected output.

What inputs do they accept? What headers do they have? What encodings do they use? Are there any input checks done client side rather than server side?

Then it becomes a matter of thinking about what happens with these inputs/outputs. Did it ask for a file name? What if I feed it a file it doesn't expect. Might this input be used for a database query, how could I abuse that? Could my input or the output be marshaled? Could my input be passed to an exec somewhere? Can I find artifacts that tell me what programming languages/servers/libraries are being used? How can I probe for these things?

The people who do these for fun several times a month will often make writeups that offer hints of techniques to solve problems when the competition is done.

These are some related sites:

https://ctftime.org/

https://ctftime.org/writeups

https://owasp.org/www-project-top-ten/

I got to to prompt me for its own moves and fed it some invalid base64 and now it's completely broken unless I clear the session. That's as far as I'm really interested in going, but it was fun to play around.

I would guess the goal is to beat a world champion while playing black and get accused of cheating.

So, I solved this challenge the "intended" way instead of just using an engine. But I'm pretty sure that you could just use an engine for longer than they are. Behind the scenes it appears to just be running stockfish with a timeout of "10" (10s? Didn't check what units, seems faster than 10s so maybe 10ms or something).

It's milliseconds (well except for 0, which stockfish considers an edge case)

See: http://wbec-ridderkerk.nl/html/UCIProtocol.html , https://github.com/official-stockfish/Stockfish/issues/3720

That said I don't think a strong chess engine alone would be enough to pass this puzzle.

Mind that you're reading a comment written by a dude who got p0wned by Stockfish searching only depth 0. I mean, if you're going down the path of fighting against the AI, you do need an engine.

It's a pain in the ass

Well, I got the admin panel to show a completely blank page, instead of an Invalid Login message, so that's progress.

You got it to 500, which can be seen via the network dev tools console. (A place you can also right click and "Copy as cURL", to iterate on the command line faster) ^^

A 500 is almost always a good sign when it comes to hacking. Hacking is the art of finding the difference between intended behavior and actual behavior. That is pretty much the definition of a 500.

Well I got the admin menu to show up. Still lost the chess game though (my chess skills need work).

Any tips?

I tried brute forcing the login admin panel but no luck yet.

What username should I use? I tried all the basic ones and cant get it to display anything besides "Invalid Login!".

It sounds like you've tried [a-zA-Z]* usernames in an attempt to see if you could guess a username. It probably says "Invalid Login!" no matter what is guessed.

What do you imagine the code that takes the logins eventually does? It seems likely that the username and password will end up in a query against a database to see if the user is valid and (theoretically) if the hash of the password matches the stored value.

What kind of input could you try to see if that behavior is done securely?

This is a good site to start learning about security: https://owasp.org/www-project-top-ten/

Injection will be the most immediately relevant.

A little bit of python and some stockfish could probably improve your play dramatically!

https://github.com/official-stockfish/Stockfish

Lol I thought about it. Thanks for the reply.