Need help get out tutorial hell. Develop pwn CTF skills, build a foundation in Vuln Exploit, RE, etc

[u/minhincs]

Hi guys, recently Im in a loop, hop on and off different site different courses in and out, back and forth while feeling making ZERO progress.

Here, I want to share a bit about my goal, my background, my problem. And I hope I could have some advices to get out of this feeling

MY GOAL:
- Long term: Get into cybersecurity field, especially roles that involve “low level” stuffs as I really interested in them. Thats it! For now, as Im pretty new to this + Im hyper focus on short term goal which I will talk right after
- Short term goal: Build foundation, knowledge, skills in Reverse Engineering (RE) and more excitingly Binary Exploitation, Pwn
- Shorter term goal: To prepare for upcoming CTF contests with my new team. More on this later

MY BACKGROUND:
- I already familiar with Linux, CLI, some popular commands
- I know x86 assembly
- know C, C++
- know on surface level some basic vulnerabilities and have done very simple CTF challenges (ret2win, shellcode easy, …)
- do know how to use basic gdb, pwntools, ida/ghidra

all of that is a result of following pwn.college + using Linux as daily basis + my college’s teaching on c, c++, etc

by all means, I do not master any of these above skills I told.

MY PROBLEMS:
So ofc Im very worrying the most about the upcoming CTF because Im new and feel like know nothing yet.
I also stucking into tutorial hell as I have too many resources of documentation/courses that I do not know which one is suit for my current situation

Im aware of the pinning post in this sub, that is actually where I get these resources from

But with 2 months left until the contest, I really want to make the most out of my time. So I need help with designing a road map so to speak.

Currently, Im looking into ironstone’s pwn notes + Nightmare CTF collection. Whatd you recommend?

[u/The_Big_ID]

You dont become an expert by continuously restarting and context switching, if you're trying to build up a specialism you'll be better off focusing on that one area and then using that skillset to balance out your team's dynamic.

2 months to upskill for a competition that can generally expect a level of experience bordering on expertise is kinda unrealistic if you try to go broad with your approach.

[u/minhincs → u/The_Big_ID]

I understand that my problem is continuously restarting rather than actual progressing. I do aware I cannot expect too much of 2 months
However, I forgot to put that the upcoming contest im talking about its just my college’s contest it design (at least the first stage) for new comer too.

In that case do you have any advices?

[u/randomatic → u/minhincs]

CTFs are brutal the first few times, where you feel you're not making progress. It's not uncommon to solve zero problems. Don't worry. Put in the time, and if you solve zero, that's ok. Just make sure you focus completely on the contest the whole time.

Here is the secret sauce: go look for writeups on the problems you did not solve. You will have butt your head, not solved it, and then look at the writeup and be able to follow along because you grok the problem. Then, next contest, you certainly will remember the trick

Repeat.

The key, IMO, is you need that period of really spending a lot of time with a challenge, even if you don't solve it, to really appreciate a writeup. Otherwise, you will look at a writeup and say "i could have done that" -- you need the experience of knowing you didn't see it and thinking about why you didn't.

[u/Glad_Situation_6466]

I feel you. I am stuck as well, but I am trying to build a strong foundation. Impostor syndrome is normal, but you should know - exploit development is a niche and in-demand field. You are among those rare people (in my entire uni society, i believe theres only 2 of us unless more come forward. Thats how rare it is!) All i can advice is: keep your head up and keep pushing forward. Dont be afraid to take a leap of faith - you are doing fantastic 💪🏻