Jeopardy CTF Format Deep Dive
A detailed breakdown of Jeopardy-style CTF scoring, challenge types, and strategy.
Jeopardy CTF Format Deep Dive
Jeopardy-style CTFs are the most common online format: a board of independent challenges organized into categories (web, crypto, pwn, forensics, etc.). Each challenge contains a flag (a short token or string); submitting the correct flag awards points to the submitting team on a shared scoreboard. Events are typically time-limited, teams may be individual or multi-member, and organizers can vary scoring mechanics (static, dynamic, first-blood bonuses) to shape strategy.
Types of CTFs
- Jeopardy: Independent, category-based challenges where teams solve for flags and earn points; this page focuses on Jeopardy-style formats.
- Attack–Defense: Teams both defend services they control and attack opponents' services to capture flags; score comes from service uptime and captured flags.
- King of the Hill (KoTH): Teams compete to control a resource or service; scoring is typically time-based for how long a team holds control.
- Mixed/Hybrid: Events that combine Jeopardy rounds with Attack–Defense or live challenges, sometimes across multiple days or phases.
- Specialized (OSINT, IoT, Blockchain, etc.): Domain-focused CTFs that emphasize particular skill sets and tooling.
Scoring Systems
| Aspect | Static Scoring | Dynamic Scoring |
|---|---|---|
| Definition | Each challenge has a fixed point value regardless of how many teams solve it. | Challenge point values decrease as more teams solve them. Rewards solving early or solving challenges others find hard. |
| Example Values | Easy Web: 100 pts, Medium Crypto: 300 pts, Hard Pwn: 500 pts | Formula: score = max(min_pts, initial_pts - decay × solves) With initial=500, decay=20, min=50: 0 solves → 500 pts, 5 solves → 400 pts, 15 solves → 200 pts, 25 solves → 50 pts |
| Advantages | • Predictable - you know exactly what a solve is worth • No incentive to race (no early-solve bonus) • Simpler to organize | • Self-calibrating difficulty - popular easy challenges are worth less • Rewards speed and hard solves equally • Keeps competition interesting throughout |
| Used by | Smaller CTFs, educational competitions | Most competitive CTFs |
| Strategy | Steady point accumulation; order doesn't matter much | Solve easy challenges first to maximize points before decay. A 500-point challenge solved at solve #1 is worth far more than the same challenge at solve #30. |
Example Scoreboards
Static Scoring:
────────────────────────────────
Team Points Solves
HackersR 4250 23
CTF_Elite 3900 21
Pwned Inc 3400 18Dynamic Scoring: Strategy matters - early solves capture maximum points before decay kicks in.
Blood System
| Order | Name | Reward |
|---|---|---|
| 1st solve | First blood 🩸 | Bonus points, badge, prestige |
| 2nd solve | Second blood | Sometimes a smaller bonus |
| 3rd solve | Third blood | Acknowledgment |
First blood is worth chasing if your team is fast in a category. In dynamic scoring, it also captures maximum point value before decay.
Challenge Categories
| Category | What You Get | What to Look For |
|---|---|---|
| Pwn / Binary Exploitation | An ELF binary + nc host port connection to remote service | Buffer overflows, format string bugs, use-after-free, heap mismanagement. Run checksec on binary first to see enabled protections (NX, PIE, RELRO, canaries). |
| Web | A URL to a running web application | SQLi in login forms, XSS in inputs, SSRF via URL parameters, IDOR in user IDs, JWT manipulation, path traversal. Always check source, headers, cookies, /robots.txt first. |
| Cryptography | Ciphertext + sometimes encryption script (Python) | Weak RSA (small e, shared modulus, common factor), broken IV handling in AES, predictable nonces, XOR with repeating key. The script is your biggest clue. |
| Reversing | A compiled binary - no running service | Load into Ghidra. Find main(), trace string comparisons, identify password/flag check. Use strings, ltrace, strace for quick recon before decompiling. |
| Forensics | A file - PCAP, disk image, memory dump, or archive | file to identify type, binwalk for embedded files, exiftool for metadata, Wireshark for PCAP, Volatility for memory dumps. Deleted files recoverable with foremost. |
| Steganography | An image, audio file, or other media | LSB steganography (zsteg for PNG, steghide for JPEG), spectrograms in audio (Audacity/Sonic Visualizer), appended data after EOF, metadata with exiftool. Use Aperisolve for automated scan. |
| OSINT | A question about a real-world person, place, or thing | Question usually implies the source. Username → social media enumeration. Image → reverse image search + EXIF. Location → GeoGuessr + Google Maps. Start broad and narrow down. |
| Misc | Anything - esoteric interpreters, jail escapes, puzzles, blockchain | Read description carefully. Misc challenges hide approach in flavor text. Try file, strings, CyberChef on any file attachment. |
Reading Challenge Descriptions
Challenge descriptions almost always contain hints:
| Description says... | Likely means... |
|---|---|
| "Something smells fishy about this image" | Steganography |
| "We found this on the suspect's computer" | Forensics / crypto |
| "Can you speak to the server?" | Pwn / socket challenge |
| "Look closely at what's hidden in plain sight" | Steg, whitespace, Unicode tricks |
| "My friend wrote a custom cipher" | Classical crypto, ROT, XOR |
Read descriptions multiple times - hints only click after you understand what the challenge is.
Strategy for Maximum Points
Hour 1 - Triage
Open all challenges. Note point values. Match categories to teammate strengths. Claim and solve easy challenges immediately - points per minute are highest at the start.
Hours 2–4 - Medium challenges
Focus on medium-difficulty challenges. Avoid committing the whole team to any single hard challenge. If stuck after 30 minutes, switch approaches or ask a teammate.
Hours 5+ - Hard challenges
Deep dive on hard challenges with strict 30–60 minute time boxes per person. If still stuck, swap who's working on it. Fresh eyes help.
Final 30 min - Polish
Return to nearly-solved challenges. Re-read descriptions for missed hints. Don't start anything new that takes longer than 30 minutes.
Common Mistakes
Over-investing in one challenge
Spending 6 hours on a single 500-point challenge instead of solving six 100-point challenges is almost always a losing trade. Set a time box (30-60 min) and rotate.
Wrong flag format
Submitting flag{...} when the CTF uses CTF{...} wastes time. Check the format in the rules before the competition starts.
Missing the obvious
The flag is sometimes literally in the binary (strings ./binary | grep flag), in the HTTP response headers, or in a comment in the source. Always check the obvious before going deep.
Not using past writeups
If a challenge looks similar to something you've seen before, search CTFtime writeups. Organizers recycle techniques. A 15-minute search can save 3 hours.
Not submitting partial progress
Some CTFs accept partial flags for partial points. If you've recovered part of the flag, submit it. Check the scoreboard for partial credit rules.
Last updated on