Introduction to CTFs

beginner20 minWriteup

What are CTFs and how to get started

Learning Objectives

  • Understand CTF formats
  • Know major CTF platforms
  • Set up your CTF environment
  • Learn CTF etiquette

Capture The Flag (CTF) competitions are cybersecurity challenges where you find hidden "flags" by exploiting vulnerabilities, solving puzzles, and thinking creatively. Think of it as a legal, gamified way to practice hacking skills that would otherwise land you in prison!

CTFs are the gym of cybersecurity. Just like athletes train for competitions, security professionals sharpen their skills through CTFs. Many top security researchers started their careers winning CTFs!

CTF Formats

Jeopardy Style

The most common format. Challenges are organized by category (Web, Crypto, Forensics, etc.) with different point values. Harder challenges = more points. Teams compete for the highest score.

1606070;"># Typical Jeopardy categories:
2606070;"># - Web: SQL injection, XSS, authentication bypass
3606070;"># - Crypto: Break ciphers, RSA attacks, hash cracking
4606070;"># - Forensics: Analyze files, memory dumps, network captures
5606070;"># - Reverse Engineering: Analyze binaries, find hidden functionality
6606070;"># - Pwn/Binary: Buffer overflows, heap exploits
7606070;"># - Misc: OSINT, trivia, programming challenges
8 
9606070;"># Point values usually: 50, 100, 200, 300, 400, 500
10606070;"># Some CTFs use dynamic scoring (points decrease as more teams solve)

Attack-Defense

Each team has vulnerable services to defend while attacking opponents. You earn points by capturing other teams' flags AND keeping yours safe.

King of the Hill

Compete to maintain control of a target system. Once you "own" a box, you must defend it against other teams trying to take over.

CTF Platforms

1606070;"># Always-Available Platforms (Practice Anytime)
2 
3606070;"># TryHackMe (tryhackme.com)
4606070;"># - Guided rooms with hints
5606070;"># - Great for beginners
6606070;"># - Monthly challenges
7 
8606070;"># HackTheBox (hackthebox.com)
9606070;"># - More challenging machines
10606070;"># - Active and retired boxes
11606070;"># - Competitive ranking
12 
13606070;"># PicoCTF (picoctf.org)
14606070;"># - Carnegie Mellon's CTF for students
15606070;"># - Always-available challenges from past years
16606070;"># - Perfect for beginners
17 
18606070;"># OverTheWire (overthewire.org)
19606070;"># - Classic wargames (Bandit, Narnia, etc.)
20606070;"># - Progressive difficulty
21606070;"># - Free!
22 
23606070;"># CTFtime (ctftime.org)
24606070;"># - Calendar of upcoming CTFs
25606070;"># - Team rankings
26606070;"># - Writeup archive

Start Here

If you're brand new, start with PicoCTF or TryHackMe. Both offer guided challenges with hints. Once comfortable, graduate to HackTheBox and time-limited CTFs.

Setting Up Your Environment

bash
1606070;"># Essential setup:
2 
3606070;"># 1. Kali Linux (or Parrot OS)
4606070;"># Download from kali.org
5606070;"># Use VM (VirtualBox/VMware) or WSL2
6 
7606070;"># 2. Basic tools (pre-installed on Kali)
8sudo apt update
9sudo apt install -y \
10    nmap \
11    gobuster \
12    burpsuite \
13    python3-pip \
14    gdb \
15    binwalk \
16    steghide \
17    foremost \
18    wireshark
19 
20606070;"># 3. Python tools
21pip3 install pwntools requests pycryptodome
22 
23606070;"># 4. Browser extensions
24606070;"># - Cookie Editor
25606070;"># - HackBar
26606070;"># - Wappalyzer
27 
28606070;"># 5. Note-taking
29606070;"># - Cherry Tree
30606070;"># - Obsidian
31606070;"># - Notion

Quick Start Guide

1
Install VM SoftwareDownload VirtualBox or VMware
2
Get Kali LinuxDownload pre-built VM from kali.org
3
Allocate ResourcesGive VM at least 4GB RAM, 2 CPU cores
4
Update SystemRun apt update && apt upgrade
5
Create AccountSign up on TryHackMe or PicoCTF

CTF Methodology

1606070;"># General approach to any challenge:
2 
31. READ THE CHALLENGE
4   - Title often hints at the technique
5   - Description may contain clues
6   - Look at file types provided
7 
82. GATHER INFORMATION
9   - What type of challenge is this?
10   - What tools apply to this category?
11   - Have you seen similar challenges before?
12 
133. TRY THE OBVIOUS
14   - Check source code
15   - Look for comments
16   - Try default credentials
17   - Google error messages
18 
194. DIG DEEPER
20   - Apply category-specific techniques
21   - Use appropriate tools
22   - Think about what the challenge creator intended
23 
245. THINK OUTSIDE THE BOX
25   - Challenges often have 606070;">#a5d6ff;">"tricks"
26   - Read the challenge name again
27   - Look for hidden meanings
28 
296. DOCUMENT EVERYTHING
30   - Take notes as you go
31   - Screenshot important findings
32   - This helps for writeups later!

CTF Etiquette

CTF rules exist for good reasons. Breaking them can get you banned from competitions and damage your reputation in the security community.
1606070;"># DO:
2✓ Work with your team
3✓ Ask organizers for hints (if allowed)
4✓ Take notes for writeups
5✓ Share writeups AFTER the CTF ends
6✓ Report bugs to organizers
7✓ Have fun!
8 
9606070;"># DON'T:
10✗ Share flags during the competition
11✗ Attack CTF infrastructure
12✗ DoS other teams
13✗ Use automated scanners against shared infra
14✗ Plagiarize writeups
15✗ Be toxic in chat/forums
The CTF community is generally friendly and helpful. Many teams share writeups after events, which is a great way to learn techniques you missed!

Knowledge Check

Quick Quiz
Question 1 of 2

Which CTF format involves both attacking and defending services?

Key Takeaways

  • CTFs are gamified security challenges - legal hacking practice
  • Jeopardy is the most common format with categorized challenges
  • Start with beginner-friendly platforms like PicoCTF or TryHackMe
  • Read challenges carefully - titles and descriptions contain hints
  • Never share flags during active competitions
  • Take notes and write writeups to solidify your learning