Playing on ZeroDay Alliance

You don't need an account to read these lessons or look through the challenge board, but you do need one to open a challenge and play for points:

1. 1

   Create your account

   Go to Create account and continue with your Google account. Your account is created automatically the first time you sign in.

2. 2

   Complete your profile

   You will be asked to fill in a short registration form. Flag submissions stay disabled until it is complete.

3. 3

   Read the rules

   The rules take a few minutes to read, and taking part means you agree to them.

4. 4

   Open the challenges

   Go to Challenges, filter down to something that interests you, and pick an Easy one to begin with.

Opening a challenge shows you these parts. Every one of them can be a clue, so read them all before you start:

• Points are fixed. A challenge's value doesn't drop as more people solve it.
• Several flags split the points. You are credited as you capture each one, and the challenge counts as solved once you have them all.
• First blood is bragging rights. The first player to fully solve a challenge is shown on it and on the scoreboard, but gets no extra points.
• Ties are broken by time. With equal scores, whoever reached that score first ranks higher, so scoring early always helps.

Hints cost real points

Here hints are free, but in the competition they aren't. The cost comes off your score as soon as you unlock a hint. It is never refunded, even if you never solve the challenge. You also need at least that many points to unlock one, so most paid hints are out of reach until you have scored something. Once you have solved a challenge, all its hints are free to read.

Clans are separate competitions with their own challenges and their own scoreboard, so they are ideal for playing with a college, a club or a group of friends. Your clan score doesn't mix with the main competition.

You can join an open clan directly, or enter a key for a private one, and some private clans also need the organizer's approval. A clan's competition begins when its organizer starts it.

A CTF only means something if the results are honest. The full rules cover this properly, but the main points are:

• Keep flags, solutions and hints to yourself, and don't ask others for theirs.
• Don't brute-force flags. The box is for flags you have actually found.
• Only attack what a challenge gives you. This scoring platform and other players are off limits.
• Don't take servers down. Challenge servers are shared, and denial-of-service attacks affect everyone.
• Found a real bug in the platform? Report it to the organizers rather than exploiting it.

You know enough to start. Here is a plan for your first real session:

1. Open the challenge board and look for the Easy ones with the most solves.
2. Pick a category you enjoyed here. Spend about 20 minutes on it, using the method from How to find a flag.
3. Stuck? Switch to another challenge. Coming back later works surprisingly often.
4. Keep notes on what you try. When you capture a flag, write a few lines on how you did it.
5. Want more practice? See the list of free training sites.

Your first flag will feel great. Good luck!