PicoCTF

What is picoCTF?

picoCTF is a cybersecurity competition and learning platform created by Carnegie Mellon University (CMU). It started as a CTF aimed at middle and high school students, but today people of every age and level use it to take their first steps in hacking. Its standout feature is the picoGym: a year-round practice area with hundreds of challenges from past editions, sorted by category and difficulty.

A CTF (Capture The Flag) is a competition where each challenge hides a string of text, the flag, that proves you solved it. On picoCTF flags look like picoCTF{...}.

What picoCTF is used for

• Starting from zero: the first challenges only ask you to open a terminal or read a file.
• Sampling every branch of hacking before specialising: web, crypto, forensics, reversing and binary exploitation.
• Learning Linux and scripting hands-on, since almost every challenge is solved in a terminal with a bit of Python.
• Competing in the annual event, solo or as a team.
• Teaching: many teachers use it as course material because it is free and well graded.

Getting started with picoCTF

1. Create a free account at picoctf.org.
2. Open the picoGym and filter by category. Start with General Skills, which covers terminal basics, encodings and tooling.
3. Sort challenges by number of solves: the most-solved ones are usually the most approachable.
4. Read the description, download the files or connect to the listed service, and hunt for the flag.
5. If you get stuck, use the hints many challenges include before reaching for a writeup.

You do not need to install anything: the platform provides a webshell, an in-browser Linux terminal with the usual tools. Still, in the medium term it pays to work from your own Linux machine (Kali, Parrot OS or any distro) to get comfortable in your own environment.

Challenge categories

Category	What you practise
General Skills	Linux terminal, encodings, Git, basic scripting
Web Exploitation	Cookies, page source, injections, web app logic
Cryptography	Classical ciphers, RSA, XOR, encodings
Forensics	Metadata, hidden files, packet captures, disk images
Reverse Engineering	Reading code and binaries to work out what they do
Binary Exploitation	Buffer overflows, format strings and other memory bugs

How to use picoCTF: practical examples

These are the commands you will type again and again in the early challenges.

Find the flag inside a file

file challenge
strings challenge | grep picoCTF
grep -r "picoCTF" .

file tells you what a file really is (extensions can lie) and strings pulls readable text out of a binary.

Decode things

echo 'cGljb0NURnt0ZXN0fQ==' | base64 -d
echo 'cvpbPGS{grfg}' | tr 'A-Za-z' 'N-ZA-Mn-za-m'

The first decodes Base64 and the second applies ROT13. For messier strings, CyberChef is the Swiss Army knife.

Connect to a remote service

nc challenge-host.picoctf.net 12345

Many challenges give you a host and port: nc (netcat) opens the connection so you can interact with the program. Always use the host and port the challenge gives you, and do not attack any other part of the platform's infrastructure.

Basic forensics

exiftool image.jpg
binwalk -e file.png

exiftool shows metadata and Binwalk detects and extracts files embedded inside other files.

Automate with Python

When a challenge needs the same operation repeated many times, write a short script. For networking and binary exploitation challenges, the pwntools library makes talking to remote services far easier.

Pro tips

• Keep a technique notebook: log every new trick (a command, a tool, a cipher type). CTF patterns repeat a lot.
• Go easy on writeups: give each challenge a serious attempt first. If you do read one, solve the challenge again on your own later.
• Master the terminal: if General Skills feels hard, build up Linux with OverTheWire Bandit.
• Play as a team in the annual event: splitting categories is how real CTF teams work.
• Read each edition's rules; prizes usually come with eligibility requirements, though anyone can take part and learn.

Pros and cons

Pros	Cons
Completely free	Small, isolated challenges rather than full machines
Difficulty very well graded for beginners	Falls short at advanced levels
Webshell: nothing to install	Writeups exist for almost everything, tempting you to copy
Covers every classic CTF category	Older challenges can occasionally break

picoCTF alternatives

• OverTheWire: free wargames focused on Linux and exploitation.
• TryHackMe: guided rooms with full machines and learning paths.
• Root-Me: hundreds of free challenges by category.
• CryptoHack: the best pick if cryptography is your thing.

Frequently asked questions

Is picoCTF free?

Yes. Both the competition and the picoGym are free; you just need to sign up.

Is picoCTF only for students?

No. It is designed with students in mind, but anyone can register, practise in the picoGym and join the competition.

What do I need to know to start?

Nothing in particular. The General Skills challenges teach the basics. Some Linux and Python knowledge will speed you up a lot.

picoCTF or TryHackMe?

They complement each other: picoCTF trains you with short CTF-style puzzles and TryHackMe teaches methodology on full machines. Plenty of people use both at once.

If you want to get comfortable in the terminal before diving into CTFs, practise with the command exercises at the Hackers en Acción Academy.