Learn CTF: guides for players and organizers
Practical guides on what a CTF is, its categories and formats, scoring, a practice roadmap, the tools, how to host an event and how to score vulnerability reports with CVSS 4.0.
Two ways in
Players and organizers need different things. Pick the side that fits you. Each step links to the guide or tool for it. If you would rather have a reading order, the learning paths further down cover the whole route.
I want to play
From your first flag to a confident player
Understand what a CTF is
Flags, scoring, teams and rules, plus a solved beginner challenge so you can see the whole loop.
Follow the beginner roadmap
The skills to learn first, a Linux or WSL setup, a 30-day plan and a practice roadmap built around CTF7.
Choose your first categories
Web, crypto, pwn, reverse engineering, forensics and OSINT: what each one tests, with a section on each.
Build your toolkit
Browser decoders and calculators, plus Burp Suite, Ghidra, Wireshark, pwntools and CyberChef, organized by category.
Join a live event
Pick a beginner-friendly CTF, play with a team, then review what you missed. Browse CTF7 events or keep practicing on Ouroboros CTF.
I want to host
Plan, build and score an event
Pick the right format
Jeopardy, attack-defense, King of the Hill, Raw Ops or SOC simulation, matched to your goal and audience.
Estimate your budget
Hosting, challenge authoring, prizes and staff, so there are no surprises in week 10.
Plan the event
A 12-week timeline, platform choice, infrastructure, anti-cheat and an event-day runbook, then write your rules and plan your scoring.
Build and playtest challenges
Difficulty curves, flag formats, Docker packaging, hints and playtesting before launch, plus 56 challenge ideas.
Score reports fairly
Running a Raw Ops or hiring round? Learn CVSS 4.0 and share our report template with players.
All guides and resources
Guides, templates and tools written by the team that runs CTFs for conferences, universities and security communities across India. For event recaps and deep dives, read the CTF7 blog.
Learning paths
Three ordered routes through the guides above. Each step is one guide, in the order that tends to work. Take the whole path or jump straight to the step you need.
Start here
New to this, or picking a second discipline
What is a CTF?
The whole loop in one read: what a flag is, how points are awarded, who plays, and how the format started.
Pick your format
Jeopardy, attack-defense, King of the Hill, Raw Ops, SOC simulation and boot2root, with a decision guide for choosing one.
Learn the categories
What web, crypto, pwn, reversing, forensics and OSINT each test, and which ones are worth your time first.
Follow the beginner roadmap
A lab setup, the skills to learn in order, a ladder of easier events and a 30-day plan.
Practice on Ouroboros
Our practice event, launching soon: self-paced, with no clock, between real competitions.
Read the whole path, then take it somewhere live. Every guide above is free to read and bookmark.
Learn with BootcampRun your first CTF
From blank page to a clean finish
Plan the event
Goals, format, platform choice, budget and a 12-week timeline that ends in an event-day runbook.
Build and playtest challenges
Difficulty curves, flag formats, Docker packaging and the checks to run before you launch.
Write the rules
A copyable template covering eligibility, teams, scoring, tie-breaks, prizes and the writeup embargo.
Set the scoring
Static against dynamic points, decay curves, hint costs and how a tie is actually broken.
Publish the writeups
Structure, screenshot and code etiquette, embargo rules and a free Markdown template to copy.
Score reports consistently
CVSS 4.0 base and threat metrics, with a working calculator, so two judges reach the same number.
Hand players a report template
A VAPT and bug bounty layout with a worked CVSS 4.0 example, ready to hand out with the rules.
Run it in a classroom
Six 90-minute session plans, a setup checklist and an answer-free grading rubric for instructors.
Work the plan, then run the event. Every template above is free to copy and adapt.
Plan your event with usBuild a team that lasts
Recruiting, retaining and showcasing
Decide what you are running
What a competitive team owes its members that a club does not, and the reverse. Roles by category, recruiting, tryouts, size and a weekly practice routine that sticks.
Show newcomers what they joined
What a competition day looks like, how to find a team, and what to read while you wait.
Bank the wins as writeups
Turn solved challenges into a portfolio recruiters and other players can read, with a free Markdown template.
Then run your own
When the team is ready, host a competition yourselves: format, platform, timeline, roles and the runbook for event day.
Get the whole team through the path first. Every guide above is free to share with them.
Learn with BootcampPlan your next event with us
A free jeopardy event for up to 50 players goes live when you publish it. For flagship events, our team can build the challenges and run the managed formats: attack-defense, King of the Hill and SOC simulations.
