> Markdown version of [/videos/416-capture-the-flag-101?t=744](https://www.wearedevelopers.com/videos/416-capture-the-flag-101?t=744). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Capture the Flag 101

Is a widely used package secretly compromising your Node.js runtime? Adopt a "hack yourself" mindset with Capture the Flag exercises to proactively exploit and patch hidden architectural vulnerabilities.

- **Speakers:** Micah Silverman
- **Event:** World Congress 2022
- **Published:** June 15, 2022
- **Duration:** 27:11
- **URL:** https://www.wearedevelopers.com/videos/416-capture-the-flag-101

## Summary

Application security transforms from a dry compliance checklist into an engaging puzzle when developers adopt a "hack yourself" mindset. Capture the Flag (CTF) exercises bridge the gap between building applications and breaking them, encouraging developers to serve as the critical first line of defense. By participating in hands-on challenges, engineering teams can organically learn how adversaries exploit common system flaws, converting abstract security concepts into tangible, cross-functional lessons.

Using an introductory Node.js web vulnerability challenge, the exploration methodology relies heavily on diligent information gathering and cross-stack awareness. Essential early steps involve analyzing application endpoints using tools like curl, intercepting HTTP methods, and identifying tainted data flows where un-sanitized user input is directly echoed back. Examining application configuration files provides necessary context for automated testing. By integrating vulnerability scanners like the Snyk CLI, developers can rapidly surface architectural weaknesses hidden deeply within project libraries.

The technical walkthrough highlights a specific prototype pollution vulnerability rooted within the widely adopted lodash package. Attackers can leverage the insecure lodash.merge function to inject malicious properties into base object prototypes, inadvertently altering execution behavior across the entire JavaScript runtime environment. Recreating this proof-of-concept emphasizes the severe implications of insecure data parsing and vividly reinforces the necessity of proactively auditing open-source dependencies before deployment.

**Keywords:** capture the flag, application security, developer security training, vulnerability scanning, snyk cli, prototype pollution, javascript security, node.js vulnerabilities, lodash merge exploit, tainted data flow, curl command line, http request manipulation, open-source dependency analysis, proof of concept exploit, cross-stack security

## Chapters

1. **Introduction to cloud-native application developer security** (00:05) — How shifting security to developers changes traditional approaches to application safety.
1. **Learning application security through capture the flag events** (04:16) — How complex cross-functional challenges encourage practical learning and out-of-the-box thinking.
1. **Understanding flags and collaborative rules of engagement** (06:24) — Finding alphanumeric solution codes while sharing progress without spoiling the challenge.
1. **Setting up the invisible ink web vulnerability challenge** (08:47) — Gathering provided files and interface hints to start solving the web application security puzzle.
1. **Utilizing basic HTTP verbs for security exploration** (11:07) — Reviewing get, post, and delete methods to understand how data interacts with the RESTful server.
1. **Interacting with payloads and content types using curl** (12:24) — Sending command line requests to test server responses and discover tainted data flows.
1. **Identifying prototype pollution vulnerabilities with scanning tools** (17:32) — Running a security scan against the package configuration to discover prototype pollution flaws.
1. **Exploiting lodash merge functions via prototype pollution** (19:26) — Using practical proof of concepts to inject arbitrary data into JavaScript object prototypes.

## Related Moments

- [Using intentionally vulnerable applications for practical security training](https://www.wearedevelopers.com/videos/1829-how-to-defend-against-data-manipulation-attacks-bozidar-spirovski-wekoslav-stefanovski) (from "How to Defend Against Data Manipulation Attacks - Bozidar Spirovski & Wekoslav Stefanovski")
- [Identifying underlying Node.js runtime vulnerabilities using fuzzing tools](https://www.wearedevelopers.com/videos/716-hack-proof-the-node-js-runtime-the-mechanics-and-defense-of-path-traversal-attacks) (from "Hack-Proof The Node.js runtime: The Mechanics and Defense of Path Traversal Attacks")
- [Exploring pathways to application security careers and research workflows](https://www.wearedevelopers.com/videos/346-stranger-danger-your-java-attack-surface-just-got-bigger) (from "Stranger Danger: Your Java Attack Surface Just Got Bigger")
- [Setting the stage for software security demos](https://www.wearedevelopers.com/videos/346-stranger-danger-your-java-attack-surface-just-got-bigger) (from "Stranger Danger: Your Java Attack Surface Just Got Bigger")
- [Improving developer education with realistic security training environments](https://www.wearedevelopers.com/videos/1450-how-github-secures-open-source) (from "How GitHub secures open source")
- [Exploring advanced security tooling and community dependency vetting](https://www.wearedevelopers.com/videos/1041-reviewing-3rd-party-library-security-easily-using-openssf-scorecard) (from "Reviewing 3rd party library security easily using OpenSSF Scorecard")

## Related Articles

- [Walking Into The Era of Supply Chain Risks](https://www.wearedevelopers.com/magazine/106-walking-into-the-era-of-supply-chain-risks)
- [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing)
- [Dev Digest 138 - Are you secure about this?](https://www.wearedevelopers.com/magazine/486-dev-digest-138-are-you-secure-about-this)
- [Dev Digest 188: CfP time, the risks of NPM and IKEA algorithms](https://www.wearedevelopers.com/magazine/635-dev-digest-188-cfp-time-the-risks-of-npm-and-ikea-algorithms)

## Related Jobs

- [Engineer, Offensive Security Organization](https://www.wearedevelopers.com/jobs/ext/1992296-engineer-offensive-security-organization) at **Twilio**
- [Staff Engineer - Offensive Security](https://www.wearedevelopers.com/jobs/ext/1226927-staff-engineer-offensive-security) at **Twilio**
- [Staff Developer Advocate, GitHub Security Lab](https://www.wearedevelopers.com/jobs/ext/1921051-staff-developer-advocate-github-security-lab) at **GitHub**
- [Penetration Tester / Red team Specialist](https://www.wearedevelopers.com/jobs/ext/293774-penetration-tester-red-team-specialist) at **Raiffeisen Bank International AG**
- [Senior Software Engineer, Fraud](https://www.wearedevelopers.com/jobs/ext/1280398-senior-software-engineer-fraud) at **Twilio**
- [Senior Software Engineer](https://www.wearedevelopers.com/jobs/ext/15942-senior-software-engineer) at **GitHub**