What is a CTF and how to start playing (beginner's guide)

If you have been learning cybersecurity for a while, you have probably seen the word CTF on forums, on Discord or even in job listings. A CTF (Capture The Flag) is an ethical hacking competition where you solve challenges to find a secret string, the flag, and submit it for points. In this guide we explain what a CTF is, which formats exist, which challenge categories you will meet (with an example of each), where to practise all year round and a four-week plan to play your first competition.

What a CTF is

A CTF is a security game with clear rules: the organisers prepare servers, binaries, files or web pages that are vulnerable on purpose, and your goal is to exploit or analyse them until you find a flag. When you find it, you paste it into the event platform and the scoreboard adds your points.

What makes CTFs so good for learning is that everything is legal and built to be broken. You do not need to look for a real target or ask anyone for permission: the environment exists precisely so you can practise. On top of that, each challenge forces you to understand one specific technique (a SQL injection, misused encryption, a buffer overflow) instead of just running a tool without knowing what it does.

There are CTFs for every level, from competitions aimed at high school students to events where professional teams compete. Many are online and free, and almost all of them let you play solo or as a team.

What a flag looks like

A flag is just a piece of text in a format the event announces in advance, so you can recognise it when you see it. Some common examples:

• picoCTF{th1s_1s_4_fl4g} on picoCTF.
• crypto{...} on CryptoHack.
• HTB{...} in Hack The Box challenges (on its machines, flags live in files such as user.txt and root.txt).
• flag{...} or CTF{...} in many generic events.

Knowing the format is more useful than it seems: if you know the flag starts with picoCTF{, you can grep for that string inside a huge file, or spot it when it shows up Base64-encoded (for example, picoCTF in Base64 always starts with cGljb0NURn).

CTF formats: Jeopardy, Attack-Defense and King of the Hill

Jeopardy

The most common format and the best one to start with. You get a board of challenges grouped by category (web, crypto, forensics...) and each one is worth a number of points based on difficulty. You solve them in whatever order you like. Many events use dynamic scoring: the more teams solve a challenge, the fewer points it is worth. When people simply say "playing a CTF", they usually mean this format.

Attack-Defense

Every team gets a machine or network running the same vulnerable services. You have to patch your services so nobody steals your flags while attacking the other teams' services. Flags rotate periodically, so attacks need to be automated with scripts. It is far more demanding and aimed at experienced teams; finals of long-running competitions such as DEF CON CTF have used variants of this format.

King of the Hill

All players attack the same machine. Whoever gets control first writes their name to a file (for example, king.txt) and scores points for as long as they hold it, so they also have to defend their position against everyone else. TryHackMe has a game mode like this. It is fun but chaotic for a beginner: better after a few Jeopardy events.

Typical categories and what an easy challenge looks like in each

These examples are illustrative, made up to give you a feel for the kind of thinking each category requires. Real entry-level challenges look very similar.

Web

You get the URL of an application. In an easy challenge the flag might sit in an HTML comment (press Ctrl+U to view the source), in /robots.txt, or behind a cookie like admin=false that you just need to change to true from the browser's developer tools. Later on come SQL injection, XSS and SSRF, and that is where Burp Suite becomes essential for intercepting and modifying requests.

Cryptography (crypto)

You get some apparently unreadable text. For example:

cGljb0NURntiNHMzXzY0X24wXzNzX2MxZnI0ZDB9

Decode it as Base64 and you get picoCTF{b4s3_64_n0_3s_c1fr4d0} (Spanish for "Base64 is not encryption"). Another classic is synt{ebg13_ab_rf_pvsenqb}, which is ROT13. The lesson of these first challenges is to tell encoding (reversible by anyone) apart from encryption (needs a key). Advanced challenges attack RSA with weak parameters, XOR ciphers with short keys or misused block cipher modes.

Forensics

You get a file: an image, a .pcap network capture, a memory dump or a disk image. An entry-level challenge might be a photo that actually hides a ZIP at the end. The first commands to try are always the same:

file challenge.jpg
exiftool challenge.jpg
strings challenge.jpg | grep -i pico
binwalk -e challenge.jpg

For network captures, Wireshark and its "Follow TCP Stream" option solve many basic challenges.

Reverse engineering (reversing)

You get a program that asks for a password. At the simplest level, the password is stored as-is inside the binary and strings ./program reveals it. One step further, the program transforms your input (say, adding 3 to each character) before comparing it, and you have to read the disassembled or decompiled code in Ghidra to undo the operation.

Binary exploitation (pwn)

You get a binary and an address to connect to with nc. The classic beginner example: a C program stores your name in a 32-byte buffer using an unsafe function, and right after it in memory sits a variable that prints the flag if it stops being zero. Sending more characters than expected is enough:

python3 -c "print('A'*48)" | nc server.ctf 1337

This is the category with the steepest learning curve: you need to understand C, the stack and some assembly. Python's pwntools library is the standard for writing exploits.

OSINT

Open source intelligence. You get a photo and are asked which city it was taken in, or a username and must find which social network they posted something on. You solve it with reverse image search, metadata, maps and a lot of patience. It is a good entry point because it requires no programming.

Miscellaneous (misc)

The catch-all: a broken QR code, a program written in an esoteric language, a Python "jail" you must escape using limited functions, or a programming challenge that requires automating a hundred answers in a few seconds. These are often the most creative ones.

Where to practise CTFs all year round

Live competitions last a day or two, but there are platforms with permanent challenges where you can train at your own pace:

Platform	Best for	Entry level
picoCTF	Jeopardy challenges in every category, with hints. Its picoGym keeps challenges from past editions.	Very low
OverTheWire	Level-based wargames. Bandit is the best introduction to the Linux terminal.	Very low
TryHackMe	Step-by-step guided rooms and CTF-style machines.	Low
Root-Me	Hundreds of challenges sorted by category, very good for web and cracking.	Low to high
CryptoHack	Learning cryptography by solving challenges, from XOR to elliptic curves.	Low to high
Hack The Box	Full machines and standalone challenges; ideal once you have the basics.	Medium

If you are not sure where to start: the first levels of Bandit on OverTheWire (connect over SSH with ssh bandit0@bandit.labs.overthewire.org -p 2220, password bandit0) and then picoCTF's picoGym. You will find more options in the practice platforms section.

How to find live competitions: CTFtime

CTFtime.org is the community's reference calendar. It lists upcoming events with their format, duration, whether they are online or on-site, and a "weight" that indicates how much they count towards the ranking. You can also register your team there and browse writeups from past events.

Tips for choosing your first event:

• Look for Jeopardy-style online events.
• Prefer low-weight events or those advertised for beginners or students: they will have easy challenges.
• Read the rules: flag format, whether teams are allowed, maximum team size and what is forbidden (almost always, attacking the event infrastructure or other players).

Starter toolkit

You do not need hundreds of tools. With this kit you can tackle most entry-level challenges:

• A Linux virtual machine. Kali Linux ships with almost everything preinstalled; if you have never used it, follow our Kali Linux for beginners guide. Working in a VM isolates you from any suspicious files you download.
• CyberChef. The "Swiss army knife" for encoding, decoding, XOR, decompression and chaining transformations in the browser. Its "Magic" operation tries to guess the encoding for you.
• Burp Suite Community. A proxy to inspect and modify HTTP requests in web challenges.
• Ghidra. A free disassembler and decompiler for reversing and pwn.
• Python 3. For automation: decoding in a loop, talking to a server over sockets or writing an exploit with pwntools.
• Terminal utilities: file, strings, grep, xxd, nc, curl, exiftool and binwalk.

You can extend the list with our selection of ethical hacking tools for beginners.

How to approach a challenge (and take notes)

1. Read the description twice. The title and description almost always hide a hint ("something smells like Caesar", "the admin forgot something in the code").
2. Survey the ground. If it is a file, run file and strings. If it is a website, check the source, cookies, robots.txt and the requests in Burp. If it is a binary, run it, check which protections it has and open it in Ghidra.
3. Form a concrete hypothesis and test it. "I think the id parameter is vulnerable to SQL injection" is useful; "I'll try stuff" is not.
4. Search precisely. If you see something you do not understand (a file format, an error message), search for it literally. Research is part of the game.
5. Set a time limit. If you have been stuck for an hour, switch challenges or use the hints. Coming back later with a fresh mind works surprisingly well.

About notes: create a folder per event and a file per challenge (Markdown, Obsidian, CherryTree or whatever you prefer). Write down the exact commands you ran, what worked, what did not and why. Those notes become your own knowledge base: the trick you learned today will show up again in another CTF three months from now, and they will also help you write your writeups.

Writeups: how to use them and when to publish

A writeup is an explanation of how a challenge was solved. Reading writeups from past events is one of the best ways to learn, especially for the challenges you could not solve. The key is to try first and read the solution afterwards, reproducing each step instead of just reading it.

The etiquette is simple:

• Never publish solutions or flags while the event is running. It is the most respected rule in the community, it is usually in the event rules and it can get you disqualified.
• Respect each permanent platform's rules. Some ask you not to publish solutions for active content or restrict what you can share; check before you post.
• Do not share bare flags. A good writeup explains the reasoning, not just the result.
• Credit others if you built on their work.

Writing your own writeups once the event is over consolidates what you learned and, as a bonus, builds a public portfolio that recruiters value.

Joining a team

You can play solo, but you learn faster in a team: each person covers different categories and you see how others think. Some ways to find a team:

• Start one with friends or classmates, even if nobody has experience. Every team started that way.
• Look for your university's or city's CTF team; many are listed on CTFtime.
• Ask in cybersecurity Discord or Telegram communities; many teams accept beginners who are committed to learning.

As a team, use one channel per challenge and keep a shared document noting who is on what and what has already been tried. It stops three people from spending two hours doing the same thing.

4-week plan: from zero to your first CTF

This plan assumes one or two hours a day. If you are starting from absolute zero in IT, first go through our guide on how to learn ethical hacking from scratch.

Week 1: terminal and environment

• Set up your virtual machine with Kali or the Linux distribution you prefer.
• Work through the first levels of Bandit on OverTheWire (try to get at least halfway).
• Start your note-taking system from day one.

Week 2: entry-level categories

• In picoCTF's picoGym, solve the easiest General Skills, Cryptography and Forensics challenges.
• Get comfortable with CyberChef and with file, strings, exiftool and binwalk.
• Do the first CryptoHack lessons to understand encodings and XOR.

Week 3: web and a bit of reversing

• Install Burp Suite Community and learn to intercept and repeat requests.
• Solve the easiest web challenges on picoCTF or Root-Me.
• Open a simple binary in Ghidra and find the main function. You do not need to understand everything; the goal is to lose your fear of it.
• Write a small Python script that connects to a server and reads a response.

Week 4: your first live CTF

• Find a Jeopardy-style online event on CTFtime for the coming weekend, ideally one aimed at beginners.
• Sign up solo or with friends and read the rules.
• During the event, start with the challenges that have the most solves: they are the most approachable.
• When it ends, read writeups for the challenges you missed and write your own for at least one you solved.

The goal of your first CTF is not to top the scoreboard, but to solve one or two challenges and walk away with a list of things to learn. That already counts as a win.

Next step

CTFs are the most fun way to turn theory into practical skill. If you want a structured path that combines fundamentals with hands-on challenges, take a look at our Academy, and explore the resource repository to find more platforms and tools. Pick a challenge today, even the easiest one on the board: the first flag is always the hardest.