What is a CTF?
An introduction to Capture The Flag competitions, formats, and how to get started.
What is a CTF?
Capture The Flag (CTF) is a competitive cybersecurity game where teams/players solve security challenges across multiple categories (Web, Crypto, Pwn, Reversing, Forensics, OSINT) to extract secret strings, which is called as flags and submit them for points on a scoreboard. How it works: Jeopardy-style CTFs present standalone challenges organized by difficulty; teams solve puzzles independently; harder challenges award more points; first team to solve ("first blood") earns a bonus; attack-and-defense CTFs give identical servers to each team for simultaneous offense/defense rounds. Why it matters: Practical hands-on training for offensive/defensive security without passive learning; teaches real exploitation, reverse engineering, cryptanalysis; career preparation through competition; most effective security education method beyond formal coursework.
Types of CTF Competitions
Jeopardy-Style (Most Common)
Challenges are organized into categories (Web, Crypto, Reversing, Pwn, Forensics, OSINT, Steg, Misc). Teams solve individual standalone puzzles, earning points per flag. This wiki focuses entirely on Jeopardy-style CTFs.
- Challenges are independent of each other
- More points for harder challenges
- Dynamic scoring is common - point values decrease as more teams solve, and the first solve earns a first blood 🩸 bonus
Attack & Defense
Each team receives an identical server environment called a Gamebox. Teams attack opponents' services to steal flags while patching their own to avoid losing points. Usually offline, ~48 hours, and highly team-intensive.
Basic Rules:
- All teams start with equal points.
- Each round, the organizer designates which service holds the live flag.
- Stealing a flag from an opponent earns you points and costs them points.
- Keeping your service running prevents point loss; successful defense may earn bonus points.
- A downed service loses points distributed to teams still running. Double deductions apply if a flag is stolen from a downed service.
- Attacking the competition platform or obtaining root on a Gamebox results in immediate disqualification.
Network Setup:
Teams are assigned Gameboxes in a shared subnet. The organizer provides a team-ID-to-IP mapping. Players get ~30 minutes before competition to review the environment and prepare defenses - no attacking during this window.
King of the Hill / Mixed
Combines formats or adds persistent access, lateral movement, and patching elements.
Challenge Categories (Jeopardy)
| Category | What You Do |
|---|---|
| Web | Find and exploit vulnerabilities in web applications (SQLi, XSS, SSRF, etc.) |
| Pwn | Exploit memory vulnerabilities in compiled programs to get a shell or read a flag |
| Reversing | Analyze compiled binaries to understand what they do and extract flags |
| Cryptography | Break ciphers, find implementation flaws, recover plaintexts |
| Forensics | Analyze files, disk images, PCAPs, memory dumps for hidden data |
| Steganography | Find data hidden inside images, audio, or other files |
| OSINT | Use public internet sources to answer investigative questions |
| Misc | Jails, esoteric languages, programming puzzles |
The Flag Format
Most CTFs use a team-specific flag format. Common examples:
flag{example_flag_here}
CTF{s0m3_c00l_fl4g}
OSINTCTF{this_is_a_flag}Always read the event rules - the format is announced before the competition starts.
Scoring
- Static scoring: Each challenge has a fixed number of points.
- Dynamic scoring: Points decrease as more teams solve. The first solve (first blood 🩸) often earns a bonus.
- The team with the most points at the end of the time window wins.
Last updated on