What is a CTF (and how to start)

CTF stands for Capture The Flag. In information security, it's a competition where you solve challenges to find a flag: a secret string, almost always in a format like flag{...}, hidden in a website, a file, a program or an encrypted message. Find the flag, submit it, score the points.

The two most common formats

• Jeopardy: a board of challenges split by category and difficulty. It's the most common format and the best one to start with.
• Attack-defense: each team runs a server, protects its own and tries to attack the others. It's more intense and better suited to people with some experience.

The categories

• Web: flaws in websites and web apps.
• Cryptography: encrypted or encoded messages.
• Forensics: clues hidden in files, images or network captures.
• Reverse engineering: understanding a program without its source code.
• Exploitation (or pwn): making a program behave in a way it shouldn't.
• Networking: analyzing traffic and protocols.

Why it's worth it

CTFs are learning by doing. Every challenge forces you to really understand how something works: a protocol, a file format, a common programming mistake. And it all happens in an environment built for it, where attacking is allowed.

One rule always applies: only test the security of systems you have permission to test. Outside a CTF or an authorized job, breaking into a system is a crime.

Where to start

1. picoCTF: made by Carnegie Mellon University for beginners, with practice challenges all year round.
2. OverTheWire: Bandit: teaches the Linux terminal, level by level.
3. CyberChef: a "kitchen" for encoding and decoding text, such as base64 and hex. It helps with lots of challenges.
4. CTFtime: the calendar of competitions happening around the world.

A tip: write down what you learned from each challenge. Many tricks come back.

There's a CTF on this site

I hid a small challenge here in the portfolio, made for people who have never played. The flag is split into three pieces, each encoded in a different way. To start, go to the terminal on the home page and type ctf. Happy hunting! 🚩