How to Approach HTS Challenges
By: fourteenlines

[Introduction]

This article is meant to be a guide for new members. In short, it is
a list of ways to ask for help. The ways are divided into levels,
to help new members understand exactly how, where, and when they should
seek help.

[Level One] You (15-30 Minutes)
[Level Two] IRC !help command (30 Minutes)
[Level Three] HTS general articles (15-30 minutes)
[Level Four] Challenge specific forums/specific articles (30 minutes)
[Level Five] IRC members (30 minutes)

[Question List]

[Question: What are the levels?]
When solving a mission, you start on level one. Whenever possible, you should try
to solve the challenge without moving up a level. Be reluctant to move up a level,
but if you really need to, don't waste valuable time staying on a lower level.

[Question: When should I move up a level?]
You should only move up a level when you have spent a significant amount of time
working at your current level. The significant amount of times for each level
are listed above next to each level.

[Question: Where did you get the significant amount of time values from?]
We'll first let me say that these times vary depending on what mission you
are doing. I think that they are a big overestimate for most of the basic
missions, and for a few of the really hard realistic and application missions
they are an underestimate. They do not really apply to the programming
challenges because everyone programs at their own speed.

Let's do a quick analysis of the times that I listed. So you start a challenge
and you have no idea what to do. If you spend about fifteen minutes (up to thirty
if you are looking at a website since you should be reading all the source
code) and are still stuck, you are not likely to progress farther, since you
probably lack some key knowledge. Logging on to IRC and getting a hint from moo
should give you a direction and some things to research. For example, if moo tells
you that you need to use java<b></b>script to edit a form value, then you should spend about
thirty minutes reading up on java<b></b>script and testing what you find out. If you are
still having problems after that, reading some general HTS articles on java<b></b>script
should help you out. General articles can be found at (http://www.hackthissite.org/articles/)
and they are the ones that do not talk about a specific challenge, but rather about a
technique. If the articles doesn't help, you lack some pretty significant knowledge
and need more help. Continuing to try to do something you don't know how to do is
just a waste of time. The next step is to read a specific article about the challenge
you are working on and/or consulting the challenge specific forum for a tutorial.
Specific articles can be found at (http://www.hackthissite.org/articles/), they are the
ones that are targets to a specific challenge, and the challenge specific forums can
be found at (http://www.criticalsecurity.net/index.php?showforum=12). If you can't
finish the challenge after all of that, it is time to ask for help from a person
in IRC (the #help channel). Ask specific, targeted questions. Explain what you tried,
and people will be more responsive. If you follow my guidelines, you will have spent
anywhere from an hour and a half to two hours working on the challenge, so you should
have plenty to explain to the person that is helping you. The person should be able
to figure out what you are missing and guide you to finishing the challenge.

[Question: What, two hours?! I don't have that kind of time!]

Sorry guys, but that's the price you have to pay to truly understand what is going
on. Hacking is not just something that you pick up instantly. Experts estimate that
it takes on average several years for an adult to fully learn a programming language
for the first time with no previous computer experience. True, kids can learn
things easier than adults, and true, the type of people on HTS are more computer
oriented than most, but the point is that learning takes a long time. The results
will be rewarding though, there is nothing quite like succeeding on a problem that
you just worked on for several hours, finally figuring out the last minor detail
that allows you to break in.

[Question: So what do the different levels mean?]

I've written a detailed explanation of each level which can be found below.

[Question: Are there any more questions?]

No! Go read the rest of the article!

[The Levels in Depth]

[Level One] You

The biggest resource you have is yourself. Whenever possible, you should always rely
on your own skills and expertise to get yourself though. Because let's face it, when
it comes down to it, all you have is yourself. Eventually, if you keep pursuing hacking,
you will end up in a situation where there is no documentation, no how-to guides, and
no helpful IRC members to give you a push. Even if you are completely new to hacking
you should be able to solve at least one mission in every three without asking for help.
Yes, it will take longer if you don't ask for help, but what do you care about? Do you
want to learn the material, or do you just care about the meaningless points that
beating each challenge gives you? If you only care about the points, then we are done,
I have nothing more to say to you. But if you care about learning, then trust me, the
best way to gain knowledge is to learn how to accomplish the challenges by yourself.

Now when I say "by yourself", it does not really mean that you are without help. You are
allowed to use resources that are commonly available. Things that are excluded are things
that are specific to the problem you are working on. If you are trying to finish a challenge
by yourself that needs java<b></b>script, it is perfectly ok to Google a tutorial on java<b></b>script!
What you shouldn't do (at least not right away) is log onto the forums and search for the
specific java<b></b>script that you need (and you probably won’t find it anyway).

[Level Two] IRC !help command

To use this you need to have an IRC client, and you need to connect to the HTS IRC server,
which has the following information:

Sever: irc.hackthissite.org
Non-SSL Port: 6667
SSL Port: 6697 or 7000

Once you've connected, type '/join #help' to join the help channel. If you are having
trouble logging on to the server, consult the help manual of your IRC client for more
specific instructions with how to connect. If you need an IRC client, I suggest using
Chatzilla (http://www.mozilla.org/projects/rt-messaging/chatzilla/). It requires a
Mozilla based web browser, but it is flexible and newbie friendly.

After joining the #help channel, you can use the help command to get tips from moo,
HTS's IRC bot. Type !help [type] [number] where [type] is either basic, real, or app,
and number is the actual number, not the word typed out. Some challenges have more
than one help tip, so if the first one does not help you, type in the help command
a few times more to get additional tips. The tips are meant to give you a general
direction when pursuing a problem, if moo tells you to do something like edit or
steal a cookie, use Google to find information on how to do it.

[Level Three] HTS General Articles

Even if moo helped you figure out what to do, sometimes Google just does not cut
it when trying to find out information about hacking techniques. You should still
learn how to look for information on your own though, that's why you should have spent
around 30 minutes crawling Google, looking for answers. However, if your search yields
nothing (and it sometimes will), you still have other options. One of those is searching
through HTS's collection of articles for an article teaching you how to do whatever
it is that you want to do. It is important, though, to avoid reading any article written
specifically for your challenge. It is unrealistic that you will be able to find such an
article if you are doing real hacking, so instead stick to articles that describe
general techniques, since those are much more common and something that you might actually
find when undertaking a project. Once you locate an article describing what you want
to do, give it a try and see if it helps you solve the challenge.

Articles can be found at: http://www.hackthissite.org/articles/
Avoid the ones having to do with your specific challenge!

[Level Four] Challenge specific forums/specific articles

If you have reached this level, it should be pretty clear that general knowledge
just doesn't cut it. Perhaps you don't have enough hacking experience, or perhaps
it's just one of those challenges that you just can't get past. Either way, HTS
has two resources that can help you out. One of them is the article database.
Remember those specific articles that you weren't supposed to look at? Now you can. Also,
there are challenge specific forums hosted on HTS's forums (http:\www.criticalsecurity.net)
that often contain tutorials and other helpful hints. An important detail about the forums,
people will often put critical information under spoiler tags, meaning that you can to click
the spoiler tag to reveal the information. Use these with care! Only click on the spoiler
tag if you really need to.

Articles can be found at: http://www.hackthissite.org/articles/
Specific articles are OK!
Challenge specific forums can be found at: http://www.criticalsecurity.net/index.php?showforum=12
Remember about the spoiler tag!

[Level Five] IRC Members

This is your last resort. As a frequent visitor to the #help channel, believe me when I
say it is easy to tell the difference between people that need legitimate help, and people
that are just being lazy. If you are lazy and ask for help on IRC right away without
working yourself, don't expect to get a positive response. However, if you do the work
and make your way through the levels I described, IRC members will be able to work
you through the rest of the challenge. The instructions for connecting to IRC are the
same as described in level two.

[Conclusion]

I hope this helps new memebers understand how, when, and where to ask for help. Please
leave feedback and comments!

~fourteenlines