How to find a flag

New players often think experts just know the answer. They don't. What they have is a loop they repeat until the flag falls out:

1. 1

   Read everything

   The title, description, tags, category, difficulty and points are all clues. A challenge called "Base Jumping" with a blob of text probably involves Base64.

2. 2

   Look before you touch

   What have you been given? A file? What type is it really? A website? What pages does it have? Collect facts before forming opinions. Players call this recon.

3. 3

   Make one specific guess

   Turn what you see into something testable: "this looks like Base64", or "this page might trust the id in the URL".

4. 4

   Test it, one thing at a time

   Try the idea. If you change several things at once and something happens, you won't know which change did it.

5. 5

   Write down what happened, and repeat

   A failed test is still information, because it rules something out. Each result feeds your next guess.

Let's run the method on a real puzzle. You are given a Crypto challenge called Postcard, worth 100 points. The description reads: "A friend sent this. It looks like nonsense, but it has layers." There is one attachment:

N2E2NDYxN2I2YzM0NzkzMzcyNzM1ZjMwNmU1ZjZjMzQ3OTMzNzI3Mzdk

1. 1

   Read: what are the clues?

   It is in the Crypto category, and the word "layers" suggests the text was scrambled more than once. Expect to decode it several times.

2. 2

   Look: what am I seeing?

   One long run of upper and lower case letters and digits, with no spaces or punctuation. That character set is the signature of Base64, the most common encoding in CTFs.

3. 3

   Test: decode the Base64

   It decodes cleanly, which is a good sign. The output looks different now:

   7a64617b6c34793372735f306e5f6c34793372737d

4. 4

   Look again: what is this new thing?

   Only the digits 0 to 9 and the letters a to f. That is hexadecimal. There is a second clue too: in hex, 7a is z, 64 is d and 61 is a. It begins with zda!

5. 5

   Test: decode the hex

   And there it is. The leet speak and the right format tell you this is the real flag:

   zda{l4y3rs_0n_l4y3rs}

Notice that nothing here needed deep knowledge. The real skill was recognizing what each piece of text looked like, and knowing what to try next.

This table is worth keeping nearby. It covers most of the strange text and files you will meet early on.

Your friend sent one more. It has been scrambled the same way, so repeat the steps from the worked example.

N2E2NDYxN2I2YzMwMzA2YjVmNjIzMzY2MzA3MjMzNWY3OTMwNzU1ZjZjMzMzNDcwN2Q=

Your result appears here.

You will get stuck. Everyone does, and it is where most of the learning happens. Try these in order:

1. Reread the challenge. Authors choose titles and wording carefully. Details you skipped at the start often make sense after you have explored.
2. Search for what you see. Paste an odd error message, file header or function name into a search engine. Add "CTF" to find similar challenges.
3. Explain it out loud. Describing the problem to a friend, or a rubber duck, often exposes the assumption you never checked.
4. Move on for a while. If you have had no new ideas for 20 minutes, try another challenge and come back fresh.
5. Consider a hint. In the real competition, hints cost points, so use them when the time saved is worth the points.
6. Read write-ups afterwards. A write-up is an explanation of a solution, published after an event ends. Reading how someone solved what you couldn't is one of the fastest ways to improve.

Keep simple notes

Notes stop you repeating failed ideas, and they turn into your own write-ups later. They don't need to be neat:

Challenge: Postcard (Crypto, 100 pts)
Given:     postcard.txt, one long line of text
Tried:
  - Base64 decode: worked, output looks like hex
  - Hex decode: got the flag!
Flag:      zda{l4y3rs_0n_l4y3rs}
Learned:   hex starting 7a 64 61 means "zda"