I’ve given many talks on cyber security and ethical hacking over the past few years and one of the things I tend to say a lot is: “There is no such thing as cheating in hacking”.
What I mean by this is that as long as you are learning you are not cheating. It’s only when you take shortcuts and learn nothing in the process that you are cheating yourself.
So when attempting a CTF or Hack the Box or Try Hack Me machine and you get stuck and you have exhausted every technique and trick that you know and nothing is working, sure, go search for a writeup or forum posts on how to progress. Read just enough to get yourself unstuck and then keep going. Learn the technique, tool, or whatever you needed to know to progress. Add it to your knowledge-base.
This is learning not cheating. Finding the answer but not learning how and why it worked is just cheating yourself.
Recently I found myself stuck on a CTF that I was taking part in for fun. It was brand new so there were no writeups or forum articles to peek at. And I was stuck. In theory I could just move on to the next challenge and come back to this one later, time allowing, but I was having fun and I wanted to figure out why my solution wasn’t working. I wanted to learn, now.
I decided to see if AI could help. I’ve been playing around with the free version of ChatGPT recently and wondered if I could make use of it in this situation. I gave it a copy of the code from a program I had disassembled as part of the CTF and asked it to tell me what the code was doing. It did, in great detail. I then asked it how I could extract certain data that the program was storing in memory. It gave me detailed instructions using a tool that I was unfamiliar with. I asked if if I could do the same with another tool I was familiar with. It kindly said no and offered to teach me how to use the tool it recommended. I agreed and learned how to use the tool and managed to make progress.
I then continued hacking at the CTF asking ChatGPT for assistance when required. Although technically cheating, I was constantly learning throughout, and allthough I managed to get some virtual points on a virtual scoreboard, they were worthless in the real world, but the knowledge I gained from hacking with ChatGPT was priceless.
So now when I get really stuck and I’ve exhausted everything I know, I turn to ChatGPT as my AI hacking buddy. Only after I’ve finished the challenge, or both ChatGPT and I have failed to come up with a solution do I go looking for a writeup.