New to CTFs? You are in the right place. This guide takes you from "what is a flag?" to solving real challenges, with labs you can try right on the page.
CTF stands for Capture The Flag. It is a cybersecurity competition made of puzzles called challenges. Think of each one as an escape room for computers: a website, file or program built with a deliberate weakness. Work out how to get in, and you win points.
Read the full lessonA flag is a secret piece of text hidden inside a challenge. You can only get it by solving the puzzle, so having it proves you did. Submit it on the challenge and the platform checks it instantly and awards your points.
Read the full lessonzda{h3ll0_h4ck3r}
Choose one from the board. Each has a category, a difficulty and a points value.
Read the clues, open the website or file you are given, and try ideas until something gives.
Solving the puzzle reveals a secret line of text that looks like zda{...}.
Paste the flag into the challenge. If it is right, you earn the points straight away.
Each lesson mixes clear explanations and worked examples with tasks you complete yourself. Do them in order, or jump straight to whatever interests you.
The basics. No experience needed: what a CTF is, what a flag is, and how to go about finding one.
What Capture The Flag means, how a competition works, and what solving one challenge looks like from start to finish.
8 min
What a flag looks like, why it exists, the places flags hide, and how to submit one without losing marks to a typo.
7 min
The repeatable method experienced players use on any challenge, a full worked example, and what to do when you get stuck.
12 min
The browser tools and terminal commands that solve most beginner challenges, with a practice terminal to try them in.
15 min
Hands-on introductions to the main types of challenge, each with labs you can break safely.
How websites really work, why you should never trust the browser, and how a single quote mark can log you in as admin.
15 min
The difference between encoding, encryption and hashing, how to break classic ciphers, and how to peel apart layered puzzles.
14 min
Act like a digital detective: work out what files really are, pull secrets out of them, and spot messages hidden in plain sight.
13 min
Take a program apart to work out the secret it is checking for, starting from readable code and moving toward compiled binaries.
11 min
Why memory bugs let you take control of a program, and a visual lab where you overflow a buffer to reach the flag.
12 min
A quick tour of OSINT, networks, mobile, hardware, blockchain, cloud and programming challenges, so you know what to expect.
7 min
Take what you have learned into the real competition.
Complete all 11 lessons and every one of the 43 tasks while signed in, and a certificate is generated in your name. It carries a unique ID and the date you finished, and you can download it as a PDF.
Certificate of completion
CTF Learning Path
This certifies that
Your Name
has completed all 11 lessons and 43 hands-on tasks of the ZeroDay Alliance CTF Learning Path, covering web exploitation, cryptography, forensics, reverse engineering and binary exploitation.
The words you will keep running into, in plain language.
Not to start. The first lessons need no coding at all. A little Python helps later on, and you will pick it up more easily once you have a reason to use it.
No. Every lab here runs right on the page, including the practice terminal. When you are ready, the toolkit lesson explains how to set up your own machine.
Not to learn: every lesson and lab works without one. Sign in to save your progress to your account and to get a certificate. You also need an account to play the real competition.
Sign in, then complete every task in all the lessons. Your certificate is generated automatically in the name from your registration details, and you can download it as a PDF.
No. These lessons are separate from the competition. Practice flags earn no points, and hints here are free.
When you are signed in, in your account, so it follows you to any device. When you are not, only in this browser: clearing your browser data or switching device starts over. Anything you complete before signing in is added to your account when you sign in.
Mostly, yes. A computer is better for the tasks that use browser developer tools, and each of those has a walkthrough if you are on a phone.
Yes, as long as you stay on systems you have permission to test. CTF challenges exist to be attacked, but using these skills on anyone else’s system without permission can be a crime.
Nobody gets good from one guide. When you finish here, these free or free-to-start sites are the best places to keep going. They aren't run by ZeroDay Alliance.
Free, beginner-friendly practice challenges from Carnegie Mellon University.
Guided rooms that teach security topics step by step.
OverTheWire: Bandit(opens in a new tab)
A wargame that teaches the Linux command line level by level.
PortSwigger Academy(opens in a new tab)
Free, in-depth labs on every major kind of web vulnerability.
CryptoHack(opens in a new tab)
Learn modern cryptography by solving puzzles.
pwn.college(opens in a new tab)
A free university-style course on binary exploitation and more.
Hack The Box(opens in a new tab)
Realistic machines to break into once you have the basics.
A calendar of CTFs around the world, with team rankings and write-ups.
Ready to play for real?
The challenge board is waiting, and every expert started with a first flag.