What is a CTF? A beginner guide to capture the flag

How to tell which rung an event is on

• Read the description for the audience. "Beginner-friendly", "student bracket", "first-timers welcome" or a school or college organizer points to rung two. Prize money and "qualifier" usually mean rung three or four.
• Check past editions. Look up last year's challenges and writeups if the organizer published them. If you can follow the easy writeups, you'll get flags.
• Look at the field. Prize money and a scoreboard full of veteran teams mean you're there to learn, not to place.
• Mix rungs on purpose. Keep a self-paced board going while you play live events. Practice builds technique, and live events build speed and teamwork.

Where to practice CTF as a beginner

The best practice is a mix of always-on challenges, guided labs and live events. Ouroboros CTF, War Zone and live events all run on CTF7, so one account covers them. The tools and open-source targets mentioned along the way are free and run on your own machine.

Ouroboros CTF: no start time, no clock

Ouroboros CTF is CTF7's practice event. Once it opens it will run as an ongoing event in the CTF7 app, listed in the Ongoing tab of CTF7 events. There is no start time and no clock, so you can put a hard challenge down and come back to it next week.

Ouroboros CTF is launching soon. Create a free CTF7 account so you are ready on launch day.

Free boards outside CTF7

Two long-running free resources are worth knowing whatever else you use. picoCTF, run by Carnegie Mellon University and renamed CyLab Security Academy in May 2026, keeps past competition challenges open in its challenge library (formerly picoGym), sorted by category and difficulty. OverTheWire's Bandit is a wargame you play over SSH, one level at a time, and is the gentlest way to get comfortable with the Linux shell.

Practice one category at a time

Work one category until its common challenge types feel routine, then rotate. The categories guide explains each one in depth.

• Web exploitation: how HTTP, cookies, sessions and input handling fail. Read requests in your browser's developer tools, replay them in Burp Suite and use the OWASP Top 10 as a checklist of bug classes.
• Cryptography: encodings and classic ciphers first, then the math behind RSA and block-cipher modes. CyberChef handles quick decoding, the encoder and decoder and cipher toolkit cover the basics in your browser, and Python or SageMath handles the number theory.
• Forensics: packet captures, disk images, memory dumps and file carving. Learn Wireshark filters first, then Autopsy, Volatility and binwalk.
• Reverse engineering: start with strings and a disassembler such as Ghidra, IDA Free or radare2, then add dynamic analysis in gdb. What is reverse engineering?
• Binary exploitation: memory layout, the stack and common protections. Build the reversing basics first, then use gdb and pwntools to understand why a crash happens. What is pwn?
• OSINT: answers from public information, found ethically. Practice methodical notes, image and metadata checks, and verifying every source. What is OSINT?
• Steganography: check the file type, strings and ExifTool metadata, then try steghide, zsteg and binwalk. What is steganography?

A weekly practice routine

Short, regular sessions are easier to keep up than occasional all-nighters. A routine that fits around classes or work:

• Two or three sessions of 45 to 90 minutes: one challenge from your focus category on a self-paced board.
• One review session: rewrite your notes for each solve, dead ends included. If you needed a hint, note what you missed.
• One learning session: read a category guide or study one tool properly, such as Wireshark filters or gdb basics.
• Once a month: enter a live event from CTF7 events and compare how you work under a clock.

War Zone and Bootcamp

Two paid products take the guides further. War Zone is a solo practice area of time-boxed operations, each bundling CTF challenges, guided missions and raw targets, with items from easy to expert and a rank ladder to climb in each operation, at ₹499/month. Bootcamp is the structured course track: written theory, hands-on labs with dynamic flags, self-check questions as you go, and a graded capstone that earns a verifiable certificate, on the War Zone + Bootcamp plan at ₹999/month. See pricing for both. They are separate products from Ouroboros CTF, and both suit learners from week two on who want structure rather than an open board.

Open-source targets for your own machine

OWASP Juice Shop and OWASP WebGoat are intentionally insecure web apps with built-in lessons, and DVWA is a PHP training target with adjustable difficulty. Run them with Docker on your own machine or an isolated network, never exposed to the internet.

How to approach a CTF challenge

Experienced players follow a repeatable method, even when it looks like intuition. Use this loop on every challenge:

1. Read everything, twice. The title, description, point value, author, attached files and even the category are clues. A challenge called "Rotten" in the crypto category is shouting ROT13. "Shaky Hands" in forensics is probably about image noise.
2. Recon and triage. Before you guess, gather facts. For files, run file, strings -n 8, exiftool, binwalk and xxd | head. For web targets, view source, check /robots.txt, open devtools, inspect cookies and look at every request. For network services, connect with nc and read the banner. For an unknown hash, paste it into the hash identifier; for a CIDR range, the subnet calculator gives the host range.
3. Form a hypothesis. "This looks like base64 because it uses A–Z, a–z, 0–9, + and / and ends with =." Test it quickly. If it fails, note why and form the next one.
4. Search precisely. Paste exact error messages, library versions and odd strings into a search engine. Many beginner challenges are built on a documented technique, so you are looking for the technique's name.
5. Time-box. Set a timer for 30–45 minutes. When it rings, write down what you tried and move on or ask for a hint. Hints may cost points, but a solve always beats none.
6. Verify and submit. Check the flag format exactly (case, braces, prefix). Then record the solve in your notes right away.

Note-taking that pays off

Your notes are your future cheat sheet and your writeup draft. Use Obsidian, CherryTree, Joplin or a plain Markdown folder in Git. Keep one file per challenge with this template:

# [Category] Challenge name (points) - Event, date
## Given
- description, files (with sha256), host:port
## Recon
- commands run + interesting output
## Attempts
- idea -> result -> why it failed
## Solution
- the working steps, script, flag
## Lessons
- new tool/technique, what to try faster next time

After a month you will have a searchable personal knowledge base, and you'll be surprised how often a new challenge is an old one in disguise.

Solving a beginner CTF challenge, step by step

Let's solve a typical 50-point beginner challenge from start to finish, the way you would in a real event.

Challenge: Double Wrapped (Crypto, 50 pts). "Our intern says he encrypted the flag twice, so it's extra secure." Attachment: message.txt

Step 1: Triage the file

player~/double-wrapped❯file message.txt
message.txt: ASCII text
player~/double-wrapped❯cat message.txt
UEdTN3tlMGcxM18xZl9hMGdfcmFwZWxjZzEwYX0=

It is plain text made of upper- and lowercase letters and digits, with a trailing =. That's the fingerprint of base64, which pads its output with = to a multiple of four characters. Base64 is an encoding, not encryption, so it reverses without a key. You can check your result in the encoder and decoder, which decodes Base64 in your browser.

Step 2: Decode the base64

player~/double-wrapped❯base64 -d message.txt
PGS7{e0g13_1f_a0g_rapelcg10a}

Progress: it has the shape of a flag. The curly braces, digits and underscores survived untouched, but the letters look scrambled. Compare the prefix with the known flag format: PGS7 versus CTF7. P is 13 letters after C, G is 13 after T, and S is 13 after F. A fixed shift of 13 that only touches letters is ROT13.

Step 3: Reverse the ROT13

player~/double-wrapped❯base64 -d message.txt | tr 'A-Za-z' 'N-ZA-Mn-za-m'
CTF7{r0t13_1s_n0t_encrypt10n}

tr maps each letter to the one 13 places later, wrapping around the alphabet. ROT13 is its own inverse, so the same command encodes and decodes. The cipher toolkit does ROT13 and every other Caesar shift if you would rather not type tr. Submit the flag and collect your 50 points.

The same solve in Python and CyberChef

import base64, codecs
data = open("message.txt").read().strip()
print(codecs.decode(base64.b64decode(data).decode(), "rot13"))

In CyberChef, drag From Base64 and then ROT13 into the recipe. The "Magic" operation often detects layered encodings automatically, which makes it great for triage. Still, learn to recognize them yourself. For a simpler tool that runs each layer by hand, use the CTF7 encoder and decoder.

What this challenge teaches

• Know the known plaintext. The flag format (CTF7{) is a crib. Comparing it with the output told us the cipher immediately.
• Encoding is not encryption. Base64, hex and ROT13 hide nothing from someone who recognizes them.
• Peel layers one at a time and check what changed after each step.

Harder variants stack five or six layers (base32, hex, gzip, XOR with a single byte) or use a Caesar shift other than 13. The method stays the same: identify, decode, compare, repeat.

A second example: a 100-point web warm-up

The same loop on the HTTP layer, which is where most beginner points live. Here is a typical 100-point warm-up:

Web · 100 pts · "Nothing to see here"
Our intern says the dev files are hidden from search engines, so they're safe. Are they? http://web101.example.lab

Step 1: read the hint. "Hidden from search engines" points at robots.txt, the file sites use to ask crawlers to skip paths.

player~/web101❯curl -s http://web101.example.lab/robots.txt
User-agent: *
Disallow: /dev-backup/

Step 2: follow the lead. robots.txt is a request to polite crawlers, not an access control. Anyone can fetch the disallowed path.

player~/web101❯curl -s http://web101.example.lab/dev-backup/note.txt
Q1RGN3tyMGIwdHNfNHIzX24wdF80Y2Mzc3NfYzBudHIwbH0=

Step 3: recognize the encoding. Letters, digits and a trailing = mean Base64, so decode it (the encoder and decoder does the same in the browser):

player~/web101❯echo 'Q1RGN3tyMGIwdHNfNHIzX24wdF80Y2Mzc3NfYzBudHIwbH0=' | base64 -d
CTF7{r0b0ts_4r3_n0t_4cc3ss_c0ntr0l}

Step 4: submit and take the lesson. The flag explains itself: robots are not access control. The same mistake appears on real websites, which is why checking robots.txt is a standard first step in an actual web assessment. Harder challenges chain several steps like these, and the approach never changes: observe, form a hypothesis, test it, repeat.

Joining a CTF team

CTFs are more fun and more educational in a team. Teammates cover categories you haven't learned yet, and you learn by watching how they think. Most jeopardy CTFs allow teams of 2 to 5 players. Check the rules of each event.

• Start local: college cyber clubs, OWASP and null chapters, and BSides communities regularly field teams. If your campus has no club, start one. Our guide for student clubs shows how.
• Find teams online: many teams recruit through Discord servers and after strong individual finishes at events on CTF7 events.
• Bring something: a newcomer who writes clean notes, handles OSINT or scripts repetitive tasks is valuable from day one. Say which category you want to own.
• Communicate: claim a challenge in the team channel before working on it, post partial progress, and share files and scripts in a shared drive or Git repo.

Starting a team from scratch? Our guide on how to build a CTF team covers roles by category, recruiting, a weekly practice routine and how to run the team during a live event. Want to play but don't have a team? Check each event's page for its team rules, and see how the community partner program connects clubs and hacker collectives across India.

Reading and writing CTF writeups

A writeup is a post-event explanation of how a challenge was solved. Reading them is how you learn the techniques you missed. Writing them is how you lock in the ones you found.

How to read writeups without cheating yourself

• Attempt the challenge first. Read the writeup only after you're genuinely stuck or the event is over.
• Read until you hit the key insight, then close the tab and finish the solve yourself.
• Re-solve the challenge a week later without notes. If you can't, you haven't learned it yet.
• Find writeups on team blogs, GitHub and organizer posts after an event ends.

How to write a good writeup

Explain the thinking, not just the commands: what you noticed, the dead ends and why the final approach worked. Include the minimum code needed to reproduce the solve, and credit the challenge author. Our step-by-step guide on how to write a CTF writeup includes a free Markdown template, a short worked example and screenshot etiquette. Never publish a writeup while the event is still running. That's flag sharing, and it gets teams disqualified. A small portfolio of clear writeups also helps a lot when applying for security roles. Many recruiters now run hiring CTFs for exactly that reason.

Common beginner CTF mistakes, and the habit that fixes each

Most first-month frustration traces back to a short list of habits. Each mistake below comes with the habit that replaces it.

1. Tutorial hell. Watching videos for weeks without solving anything. Play from day one. Theory sticks when you need it.
2. Starting too hard. A 500-point pwn challenge is not a good first attempt. Clear the easy tier in every category first, and pick events on the right rung of the difficulty ladder.
3. Not reading the description. Half of all "impossible" beginner challenges have the hint in the title.
4. Searching for the flag instead of the technique. Hunting for someone else's answer teaches you nothing, and during a live event it's cheating. Search for the technique instead: the error message, the odd file header, the name of the cipher. Save other people's solutions for after the event, when reading writeups is exactly the right move.
5. Skipping notes. You will meet the same trick again and forget how you solved it. Use the one-file-per-challenge template above from your very first solve.
6. Collecting tools instead of learning a few. Installing 200 tools feels productive but isn't. Learn a small core well: browser devtools and Burp Suite for web, CyberChef for encodings, Wireshark for packet captures, Ghidra for reversing, and Python to glue them together. Our CTF tools guide lists what to add next per category.
7. Tool-first thinking. Running sqlmap or automated scanners blindly, often against rules. Understand the bug, then automate.
8. Specializing too early. Try every category in month one. You might love forensics even if you signed up for web.
9. Going it alone. Join a community early: your college club, a local OWASP or null chapter, an event Discord or a beginner forum. Ask questions in team channels (within each event's rules). Everyone was a beginner once, and most players are happy to point you at the right technique.
10. Waiting until you feel ready. Nobody feels ready for their first live CTF. Register for a student or beginner event by week four, even if you expect to solve only one challenge.
11. Giving up after one bad event. Scoring zero at your first live CTF is common. Read the writeups and play again next weekend.

CTF ethics and legality

CTFs teach real offensive techniques, so the rules matter.

• Only attack what's in scope. In a CTF, that's the challenges themselves. The scoreboard, the platform, other teams' machines (outside attack-defense rules) and the organizers' infrastructure are off limits unless the rules say otherwise.
• No flag sharing or collusion. Sharing flags or solutions between teams during an event is cheating. Modern platforms catch it: on Standard and Premium events, CTF7 can issue dynamic flags unique to each team and monitor submissions for sharing.
• Don't disrupt others. No denial of service, brute-forcing the flag submission endpoint or resetting shared challenge instances out of spite.
• Outside the CTF, get written permission. Testing systems you don't own without authorization is illegal in most countries, including under India's Information Technology Act, 2000, the US Computer Fraud and Abuse Act and the UK Computer Misuse Act. "I was just practicing" is not a defense.
• Channel skills legally. Bug bounty programs, authorized pentests and report-based formats like CTF7 Raw Ops let you hunt real-world-style vulnerabilities with clear scope and rules.

Read each event's rules and the platform code of conduct before you start. This section is general guidance, not legal advice. Once CTFs feel comfortable, CTF vs bug bounty vs pentest covers where the same skills go next, legally.

Starting in high school

Most beginner challenges need logic, patience and careful reading more than advanced coding, so a school student can start with a browser and a few free hours. Cryptography, forensics, steganography, simple web and OSINT are the friendliest first categories. Binary exploitation and reverse engineering can wait until you know some programming.

Stay safe and legal

Permission is the legal line. Only touch the systems and files an event or your teacher gives you. That rules out your school's Wi-Fi, the grading portal, classmates' accounts and any public website "just to see". Unauthorized access is an offense under laws such as India's Information Technology Act, 2000, and the US Computer Fraud and Abuse Act. This is general information, not legal advice.

• Protect your identity. Use a username rather than your full name, never share passwords and keep personal details out of public team chats.
• Be careful with downloads. Get tools from official sources, and open unfamiliar challenge files on a school lab machine or a virtual machine rather than a family laptop.
• Research only fiction in OSINT. Look up the invented people and places the event provides, never real classmates or strangers.

What parents and teachers should set up

Most beginner competitions and practice platforms are free, and a laptop with a browser is enough to start. Online events usually run 24 to 48 hours, so agree on playing hours in advance. A well-run event publishes its rules, a code of conduct, a named organizer with a contact address and a clear scope of what may be attacked.

Teachers should ask the school's IT administrator to allowlist the platform's domains before event day, agree on an AI rule and grade a short writeup as well as points. For a supervised event, keep an adult present or reachable throughout, use team channels an adult can moderate, show nicknames instead of real names on the scoreboard and collect guardian consent for every participant under 18. The classroom CTF kit has session plans and an answer-free rubric.

A first two-hour club night

A first school event needs no live servers. CTF7's Free plan hosts one jeopardy event a year for up to 50 participants with static flags and attachments, so every challenge can be a downloadable file or a link.

• Format: two hours after school, teams of two or three, up to 50 players and a teacher in the room.
• Warm-up: a message in a Caesar cipher (crypto, 100 points).
• Forensics: a clue hidden in a photo's metadata (150 points).
• Web: a comment left in a page's source (100 points).
• Flag format: one format for every challenge, such as CTF7{...}.
• Debrief: walk through the solutions together and ask each team for one short writeup.

To set one up, tell us about your school event or read how student clubs run theirs.

Where to play your first live CTF

After a few weeks of practice, compete. A live event with a clock and a scoreboard teaches focus and teamwork that practice gyms can't. Look for events labeled beginner-friendly or with a "student" or "newcomer" bracket: rung two of the difficulty ladder.

• CTF7 events: upcoming CTFs, hackathons and workshops, including college and community events across India.
• Ouroboros CTF: not ready for a clock yet? Our practice event is launching soon; until then, keep building solves in the CyLab Security Academy library, then enter a live event.

Running a club? You can host your own beginner CTF on CTF7, with one free event a year for up to 50 players. Organizing a CTF is one of the fastest ways to learn how challenges are built.

What a CTF platform actually does

Every scoreboard you will ever use is the same piece of software under different branding. A CTF platform registers players and teams, publishes challenges and their files, checks submitted flags, calculates scores and shows a live leaderboard. It helps to separate the platform from the targets: the platform is the management layer between organizers and players, while the vulnerable web app, binary or vulnbox you attack is the practice environment, which the platform links to or launches.

The six functions every platform needs

• Registration and teams: player accounts, team creation and team-size limits.
• Challenge hosting: descriptions, point values, file attachments and links to the live targets.
• Announcements and hints: a way to reach every player mid-event with fixes and clarifications.
• Flag checking: instant validation in a known flag format, with every attempt logged.
• Scoring: static points, or dynamic scoring that decays as more teams solve, recalculated automatically.
• Live leaderboard: rankings, points, solves and time taken, updated in real time.

Those six make a working jeopardy event. Everything else follows from the format and the audience: attack-defense also needs a vulnbox per team plus a scoring bot that tests every service each round (see checker and SLA), a large open event needs fair-play controls, and a paid on-site event needs ticketing and check-in.

Three kinds of platform

• Self-hosted scoreboard: open-source software you install and run, which means you own the servers, containers, HTTPS and uptime. Best for teams with sysadmin time and a technical audience.
• Hosted event platform: a service that runs the whole event for you, registration through scoreboard, usually with event operations included. CTF7 is one; suited to colleges, communities, conferences and hiring drives.
• Practice platform or wargame: always-on challenges and guided labs. You play, but you do not run an event. Our practice event, Ouroboros CTF, is this kind of board.

To compare specific options, read our guides to the best CTF platforms, open-source platforms and platforms for universities.

Where CTF7 fits

CTF7 is a hosted event platform: every plan runs on CTF7 with nothing to install, and on top of the six core functions it adds the operations layer many scoreboards leave to separate tools: RSVP and ticketing (open, invite-only or paid, with check-in), an organizer panel for challenges and live submission tracking, formats beyond jeopardy such as Raw Ops and hackathons, and solve analytics afterwards, with participation certificates on paid plans. You can host one jeopardy CTF a year free for up to 50 participants. The Standard event plan (₹9,999 per event, up to 500) adds dynamic flags, anti-cheat, hints, certificates and custom branding; the Premium event plan adds managed container deployment, a custom domain and unlimited participants. See pricing and all features.

CTF vs bug bounty vs penetration testing

All three involve finding vulnerabilities, but the goal, the rules and the output are different. Knowing the difference tells you which skills transfer before you point them at anything that is not a competition.

Report-based formats like Raw Ops sit between these worlds. They look like a CTF, a time-boxed event with a leaderboard, but are scored like a pentest: CVSS 4.0-rated vulnerability reports, with bonuses for chaining bugs. What Raw Ops bug hunting is explains how an event runs.

Permission is the real difference

CTFs are legal practice because the organizer owns the targets and invites you to attack them. In a bug bounty program, the published policy is your only permission: testing a site with no program, or anything outside a program's scope, is unauthorized access regardless of your intentions. Read the in-scope assets, the out-of-scope assets and bug classes, the prohibited actions (usually denial of service, social engineering and heavy automated scanning), the testing rules and the disclosure terms before you open the target. A vulnerability disclosure program gives you a channel and permission but usually no money, which makes it a good, lower-pressure place to file your first real reports.

What transfers, and what is new

Web and API skills transfer best, because they are the core of most programs. Access control, business logic and mapping a large application matter far more than they do in a CTF, where targets are small and scoped. Crypto, pwn and reversing are niche but useful for mobile, desktop and hardware scopes. Two things are genuinely new: reading scope as a daily discipline, and written communication as the deliverable. A CTF writeup explains how you got there; a bug report has to be reproducible in minutes on a fresh test account, show impact rather than claim it and rate severity honestly. Inflating severity is the fastest way to lose a triager's trust. Use our vulnerability report template for the format and the CVSS 4.0 calculator for the rating. Expect uneven income: payout requires a finding that is valid, unique and impactful, so treat the first months as paid practice rather than salary.

Which one should you do first?

• Start with CTFs if you are new to security, want fast feedback, learn well in a team, or want to survey several fields before choosing one. The 30-day roadmap above is the way in.
• Start hunting if you already build web applications, are comfortable with HTTP and access control, and can stay patient through weeks without a valid finding.
• Do both if you are aiming for application security or pentest work. CTF results show breadth, accepted reports show you can work on real systems responsibly.

A practical middle step is a report-based round. Play one, submit a writeup-style report, and let a triager rate it. You get the report-writing habit and a scored severity rating without the open-ended wait a live program can hand you, which is exactly the gap Raw Ops was built to fill.