Custom challenges written and playtested by our team
The CTF7 challenge team builds custom challenges for your event, from beginner forensics to advanced exploitation. Each one is tested for solvability, calibrated for your audience and ships with Docker images, flags, hints and a writeup.
Challenge development for each category and format
Jeopardy boards, live targets and full competition environments. Tell us the format and audience and we will scope it. See the categories guide for what each category covers, or browse challenge ideas by category and difficulty if you are still deciding what your board needs.
Web
Realistic applications and APIs built around authentication, access control and business-logic flaws.
Crypto
From classical ciphers for beginners to flawed modern implementations for experienced teams.
Pwn & reverse engineering
Binaries and crackmes with difficulty tuned to your audience, packaged as Docker challenge images.
Forensics & OSINT
Packet captures, disk and memory artifacts, and investigation trails built on fictional personas.
Cloud
Misconfiguration-driven scenarios that reflect how cloud environments go wrong in practice.
Active Directory
Multi-host Windows domain labs for advanced and professional audiences.
Raw Ops targets
Full applications with planted, chainable weaknesses and a documented finding list for Raw Ops triage.
A/D services & KotH boxes
Patchable attack-defense services with health checks, and King of the Hill machines.
How we build custom CTF challenges
Six stages, with checkpoints where you review and approve. Nothing reaches your players untested.
Talk to the event teamBrief
We agree on audience, skill level, format, categories, number of challenges, theme, event duration and any stack you want reflected, such as your own tech for a hiring round.
Design
For each challenge we write a design note covering the concept, the skill it teaches or tests, the intended solve path, the target difficulty and the hint plan. You review the set before we build. (Prefer to write your own? Our guide on how to create CTF challenges shares the same process.)
Build
Challenges are built as reproducible packages, with Docker images where a live service is needed, and flags in your format, such as CTF7{…} or your own prefix.
Playtest & QA
A team member who did not build the challenge solves it cold. We check that the intended path works, look for unintended shortcuts, verify the flag and measure solve time against the target difficulty.
Deploy
We load the challenges into your CTF7 event with scoring and hints configured, and dry-run the participant view before launch.
Writeups & handover
After the event you get official writeups for every challenge. Publish them for learning, or keep them private for reuse.
Challenges calibrated to the people playing
The most common failure in a first CTF is a board built for the organizers, not the players. We set a difficulty curve from the audience in your brief, and check it during playtesting.
| Tier | Who it's for | What the challenge asks | Typical share of a college board |
|---|---|---|---|
| Easy | First-time players | One concept, one step, with a clear hint path | About 35–40% |
| Medium | Club members, regular players | Two or three steps, some tooling or scripting | About 35% |
| Hard | Experienced teams | Multi-stage reasoning, custom tooling | About 20% |
| Insane | Top teams, finals | Deep specialist knowledge, meant to decide the winner | 0–5% |
Calibration is about more than difficulty labels. Point values should follow real solve rates, hints should rescue stuck players rather than hand over the solution, and every category needs at least one on-ramp challenge so a beginner can score early and stay engaged. We tune all three during playtesting and adjust before the board goes live.
Illustrative split. A hiring round or a professional final shifts the curve harder, and a beginner workshop shifts it easier. Our CTF hosting guide covers board design in depth.
Our quality bar
- Tested: every challenge is solved start to finish by someone other than its author before delivery.
- Solvable: the intended path works from the player's starting point, with no hidden guessing steps.
- Intended path documented: a written solution for each challenge, so your team can support players and handle disputes.
- Reproducible: packaged so the challenge runs the same on event day as it did in QA.
- Original: built for your event, not lifted from public archives where writeups already exist.
What you receive
- Challenge files and Docker images for anything that needs a live service.
- Flags in your chosen format, ready for static or dynamic flags on CTF7.
- Hints, tiered so they help without giving away the answer, with suggested point costs.
- Descriptions written for players, with points and difficulty tags.
- Writeups for every challenge, for post-event learning or internal reuse.
Who commissions custom CTF challenges
How challenge development is priced. Custom challenge development can be included in a Premium package, or added to any plan as an add-on priced by complexity. A handful of easy challenges costs far less than a multi-host environment or a full Raw Ops target. Share your brief through host my event for a scoped quote, or compare event plans on the pricing page.
Get a quote for custom challenges
Send the topic, the difficulty range and how many challenges you need. We reply with a scope and a price before any work starts.
