A classroom CTF kit is a ready-to-run teaching pack for running capture-the-flag exercises in a lab period. This free kit gives instructors a setup checklist, six 90-minute session plans (Linux, crypto, forensics, web, OSINT and reversing), an answer-free grading rubric, a student briefing sheet and a print-friendly layout.
Key takeaways
- Built for a timetable, not a fest. Each session fits one 90-minute lab slot with a brief, a demo, solving time and a debrief.
- Every session runs on files and static flags, so a section of up to 50 students can use the CTF7 Free plan, hosted by CTF7 with nothing to install.
- Grade the process, not the rank. The rubric scores progress, method, writeups and conduct, and contains no answers you need to hide.
- No exploit walkthroughs. Sessions teach concepts and investigation habits; students discover the details themselves.
- Print it. Use the print button: navigation is stripped and each session plan starts on a new page.
This page is the teaching layer. If you are planning a public or inter-college event, read how to host a CTF and the college CTF playbook instead. For background on each discipline, see CTF categories explained.
Run it on Free, Standard or an organization plan
Pick the plan by class size and by whether you need live targets. Run your first session free (Free covers one event a year, up to 50 participants), then move to Organization Starter for a season of sessions: ₹999 a month covers two events a month, each with Standard features (dynamic flags, hints and anti-cheat) for up to 100 participants, including a graded end-of-module CTF with fair-play controls. Standard, priced per event, suits a one-off assessment for a larger cohort.
| For your class | Free | Standard |
|---|---|---|
| Price | ₹0, one event a year | ₹9,999 per event |
| Participants | Up to 50 | Up to 500 |
| Flags | Jeopardy with static flags | Static and dynamic flags |
| Challenge delivery | Attachments and external links | Attachments, links and hints; bring-your-own Docker challenge images |
| Fair play | No dynamic flags or anti-cheat | Anti-cheat with IP and browser tracking, alerts and submission logs |
| Hosting | Hosted on CTF7, nothing to install | Hosted on CTF7, with custom branding |
Two practical notes. First, the Free limit counts participants, so a section of 60 students needs Organization Starter or Standard. Second, Free has no container labs, which is why every session below ships as downloadable files or as links to targets you already run on your lab network. On Standard you can package any target as a bring-your-own Docker challenge image. Organization plans also add learning seats, and the Pro and Enterprise organization plans add curriculum management and managed lab hosting for programs that run labs all semester. Compare everything on the pricing page, including what an organization plan adds for a department that runs labs all year.
Need the department to sign off first? Share the pitch-your-HOD guide. No lab servers at all? Read running a cybersecurity lab without servers.
Setup checklist
Tick these off in order. The two-week stage is the one people skip, and it is the one that saves the first session.
Two weeks before
- Confirm student machines: a Linux VM or WSL, Python 3, a modern browser with developer tools, Wireshark, a hex viewer, CyberChef and Ghidra. Our CTF tools guide covers installs.
- Check with IT that lab machines can reach the event URL and download attachments.
- Create the event, choose the jeopardy format and set a course flag format such as
CTF7{...}. See flag format. - Choose static scoring with fixed values (100 to 400) so grades are predictable. How CTF scoring works explains the alternatives.
- Build or adapt four challenges per session, following our guide to creating CTF challenges.
The week before
- Upload challenges and attachments, then have a teaching assistant solve every one from a student account.
- Add TAs as mentors or judges with limited permissions, so they can help without full admin access.
- Ask students to create accounts at ctf7.com/accounts/signup and join the event before the lab.
- Publish the rules and AI-use policy. Start from the CTF rules template.
- Print the student briefing sheet below, one per seat.
On the day
- Open only that session's challenges. Keep later sessions hidden.
- Post hints as announcements at the halfway mark, and use the admin panel to pause the round if something breaks.
- Watch the real-time scoreboard for teams with zero solves after 30 minutes and send a TA.
After the session
- Review solve trends in the post-event analytics to see which challenge stalled the room.
- Collect writeups within 48 hours and grade with the rubric.
- Note one change for next term in the challenge file itself.
Six classroom CTF session plans
Every session uses the same 90-minute run of show, so students learn the rhythm once and spend their energy on the material. Run them in the order below: each one leans on habits from the last.
| Time | Block | What happens |
|---|---|---|
| 0–10 | Brief | Learning goals, rules, flag format, how hints work. |
| 10–25 | Concept demo | Instructor works a separate, unscored example on the projector. |
| 25–75 | Solve | Pairs work the four-challenge ladder. Hints posted at minute 50. |
| 75–90 | Debrief | Pairs explain approaches (not flags), then start their writeups. |
Why pairs? Pairs talk through their reasoning, which is what you want to hear. Teams of four tend to leave two people watching. Pairing also halves your hint traffic.
Session 1: Linux command line
- Beginner
- Free-ready
- Prereq: none
Goal: students move around a filesystem, search it and chain small tools together without a GUI. Every later session depends on this.
| Pts | Challenge idea | Skill practiced |
|---|---|---|
| 100 | A flag inside a hidden file in a provided archive | Navigation, listing hidden files |
| 200 | One line in a deep directory tree of decoy files | Searching by name and by content |
| 300 | A question about a large log file, answered in the flag format | Pipes, sorting, counting, filtering |
| 400 | Archives nested in several formats | Identifying file types, extracting |
Debrief: Which command saved you the most time? How would you search 10,000 files? Practice afterwards: the practice section of the beginner guide lists places to practice.
Session 2: Cryptography and encoding
- Beginner
- Free-ready
- Prereq: session 1
Goal: students separate encoding from encryption and see why classical ciphers fail against patient analysis.
| Pts | Challenge idea | Skill practiced |
|---|---|---|
| 100 | A flag wrapped in two common encodings | Recognizing Base64 and hex |
| 200 | A short message under a shift cipher | Classical ciphers, key space |
| 300 | A long substitution-cipher paragraph | Frequency analysis |
| 400 | A repeating short-key XOR, where students know the flag's prefix | Known-plaintext reasoning |
Debrief: Why is Base64 not security? What made the 400-point cipher weak, and what would fix it? Read the cryptography section of the categories guide.
Session 3: Digital forensics
- Beginner–intermediate
- Free-ready
- Prereq: sessions 1–2
Goal: students treat files as evidence: identify what something really is, read what it says about itself and find what is hidden inside it.
| Pts | Challenge idea | Skill practiced |
|---|---|---|
| 100 | A file whose extension lies about its type | Magic bytes, file identification |
| 200 | A photo you took, with a clue in its metadata | Reading EXIF and document metadata |
| 300 | A packet capture of a cleartext protocol you generated | Following streams in Wireshark |
| 400 | One file embedded inside another | Carving and extraction |
Instructor note: make every artifact yourself, and remove GPS data from photos of real places. Debrief: What would an investigator write down first, and why? See the forensics and steganography sections of the categories guide.
Session 4: Web fundamentals
- Beginner–intermediate
- Partly needs a target
- Prereq: session 1
Goal: students see what the browser sends and receives, and learn the core rule of web security: never trust the client.
| Pts | Challenge idea | Skill practiced |
|---|---|---|
| 100 | A page whose developer left notes in the markup | Reading source, developer tools |
| 200 | A clue carried in a response header or cookie | The network tab, HTTP basics |
| 300 | A page that is not linked anywhere | How sites tell crawlers what to skip |
| 400 | A check done only in browser JavaScript | Client-side vs server-side validation |
Free-plan delivery: the 100 and 400 challenges work as downloadable HTML files opened locally. The 200 and 300 challenges need a server: link to a small target on your lab network, or use a bring-your-own Docker challenge image on Standard. Debrief: Which check would you move to the server? Continue with the web exploitation section of the categories guide.
Session 5: OSINT with a fictional persona
- Beginner–intermediate
- Free-ready
- Prereq: session 3
Goal: students practice structured open-source research and source verification, on a target that does not exist.
Use fiction only. Build an invented person and company with pages and images you control. Never point students at real people, classmates, staff or your institution's systems. Say this out loud in the brief.
| Pts | Challenge idea | Skill practiced |
|---|---|---|
| 100 | A staged street photo with a shop sign and a landmark that place the persona in a city | Reading visual clues, location basics |
| 200 | A handle that appears on two invented profile pages | Linking accounts across sources |
| 300 | A PDF on the fictional company's site that carries author metadata and an older revision | Metadata and old versions |
| 400 | A short timeline of the persona's week, assembled from every earlier clue | Correlating and verifying sources |
Free-plan delivery: ship the persona's pages and images as attachments, or link to pages you host. Debrief: How did you confirm a source rather than trust it? What would you remove from your own profiles? Read the OSINT section of the categories guide.
Session 6: Reverse engineering
- Intermediate
- Free-ready
- Prereq: sessions 1–2
Goal: students read a program they did not write and explain what it does, using a decompiler instead of guessing.
| Pts | Challenge idea | Skill practiced |
|---|---|---|
| 100 | Readable text left inside a compiled program | Extracting strings |
| 200 | An obfuscated script with a password check | Reading unfamiliar code |
| 300 | A small binary with a simple comparison | Control flow in Ghidra |
| 400 | A check that transforms input before comparing | Reconstructing logic |
Instructor note: compile for the lab's OS and keep binaries tiny. Debrief: What did the decompiler get wrong? See the reverse engineering section of the categories guide; save the binary exploitation track for a later module.
Answer-free grading rubric
Scoreboard rank is a poor grade on its own: it rewards speed and prior experience, and it punishes the student who spent 40 minutes on the right idea. This rubric grades observable work. It contains no flags or solutions, so you can publish it on the course page.
| Criterion | 4 · Excellent | 3 · Good | 2 · Developing | 1 · Beginning |
|---|---|---|---|---|
| Progress (30%) | Solved 3–4 ladder challenges | Solved 2 | Solved 1 | Engaged, no solves |
| Method and writeup (30%) | Steps reproducible by a classmate, dead ends explained | Clear steps, some gaps | Results without reasoning | Missing or copied |
| Tools and reasoning (15%) | Chose tools deliberately and says why | Right tools, little rationale | Trial and error | Needed step-by-step help |
| Collaboration (10%) | Shared reasoning, both partners can explain | Mostly shared | One partner led | Did not engage |
| Conduct and scope (15%) | Followed every rule, stayed in scope | Any flag sharing or out-of-scope activity is graded 0 here and handled under your academic integrity policy | ||
Score unsolved challenges through the writeup: a well-documented failed attempt earns method marks. Give students the CTF writeup guide as the template. Decide your AI policy before session 1; should your CTF allow AI lays out the options. On Free, flags are static, so a copied flag looks like a real solve; the writeup is your check. For a graded end-of-module CTF, Organization Starter and Standard add dynamic flags and anti-cheat, explained in how dynamic flags work.
Student briefing sheet
Print one per seat, or paste it into your course page.
- Scope. Only the challenges and targets listed in this event. Never the platform, the lab network, other students or any real system.
- Flags. Submit in the format
CTF7{...}. Do not share flags or answers with other pairs. - Hints. Ask a TA first. Written hints appear as announcements at minute 50.
- Notes. Record every command and idea as you go. Your writeup is worth as much as your solves.
- AI tools. Follow the policy your instructor announced, and disclose any use in your writeup.
- Conduct. The CTF7 code of conduct and your institution's rules both apply.
- Due. Writeup within 48 hours of the session.
Printing the kit
Use the button below or your browser's print command. The print layout removes site navigation and the sidebar, switches to black on white, opens the FAQ and starts the checklist, each session plan, the rubric and the briefing sheet on new pages. Choose "Save as PDF" to keep a copy on your course drive.
After the semester
Six sessions give students a working toolkit. The natural next steps are a class-wide CTF on Organization Starter or Standard as an assessment, then an open event your student club runs for other colleges. Our page for universities covers fests and club selections, student clubs covers the club side, and CTF platforms for universities compares the options. If writing challenges is the bottleneck, our challenge development service designs, builds and tests custom challenges. Want to talk it through? Tell us about your class.
