Your starter toolkit

The browser tools and terminal commands that solve most beginner challenges, with a practice terminal to try them in.

About 15 minutes · 4 tasks

01Your browser is a hacking tool

Every desktop browser ships with developer tools, and they are all you need for many web challenges. Open them with F12, or Cmd + Option + I on a Mac. To read a page's raw source, press Ctrl + U, or Cmd + Option + U on a Mac.

Tab	What it shows	Why it matters in a CTF
Elements	The live HTML of the page	Find hidden fields and comments, and change them
Console	Run JavaScript on the page	Call functions and do quick decoding
Network	Every request the page makes	See the data going back and forth, including hidden API calls
Application or Storage	Cookies and saved data	Read and edit values like role=guest

02The terminal in ten minutes

A terminal is a text window where you control a computer by typing commands. It looks intimidating, but each command is just a small program that does one job. These are the ones you will use constantly:

Command	What it does	Example
`ls`	Lists files. Add `-a` to include hidden ones, whose names start with a dot	`ls -a`
`cd`	Moves into a folder. `cd ..` goes back up	`cd logs`
`cat`	Prints a file	`cat notes.txt`
`grep`	Finds the lines containing some text	`grep zda server.log`
`file`	Identifies what a file really is	`file mystery.dat`
`strings`	Pulls readable text out of any file	`strings photo.png`
`base64 -d`	Decodes Base64	`base64 -d message.b64`
`xxd`	Shows the raw bytes of a file	`xxd photo.png`

The pipe: where it gets powerful

The | character sends one command's output into the next command. This single line is one of the most useful in all of CTF: it pulls the text out of a file and keeps only the lines that mention the flag prefix.

terminal

strings firmware.bin | grep zda

Try it for real

This terminal runs inside the page. It is a simulation with a fake folder, so you can't break anything. Start with ls, then read the README with cat README.txt.

LabPractice terminal

A simulated terminal. Nothing here runs on your computer. Type help to list the commands it understands, and use the up arrow to repeat one.

Welcome! Type ls and press Enter to see what's in this folder.

Your turn

Practice only: hints are free and nothing here affects your score.

Q1A plain ls doesn't show every file. Find the hidden file and read the flag inside it.
Q2The file logs/server.log has 240 lines, and one of them contains a flag. Find it without reading them all.
Q3The file message.b64 holds a flag, but it is encoded, so grep can't see it. Decode it.

03Connecting to a challenge

Some challenges run on a server, and the challenge shows you connection details. Two tools cover most of them. Use nc (netcat) when you are given a host and a port, and curl when you are given a web address.

terminal

# Talk to a program running on a server. Type, and it replies.
nc pwn.challenges.example 9001

# Fetch a page, and show the response headers as well (-i).
curl -i http://web.challenges.example:8080/

# Send your own cookie with the request.
curl -b "role=admin" http://web.challenges.example:8080/admin

04A little Python goes a long way

You can solve your first challenges without code. Eventually, though, you will want to automate something, like trying 1,000 keys. Python is the favorite language for this because a few lines go a long way:

decode.py

import base64

encoded = "emRhe2V4YW1wbGV9"
print(base64.b64decode(encoded).decode())   # zda{example}

05Setting up your own machine

When you outgrow the labs here, set up a real terminal. You don't need anything fancy, and you don't need to install all of these on day one. Add a tool when a challenge calls for it.

Windows: install WSL(opens in a new tab), which runs Linux inside Windows, by running wsl --install.
macOS: the built-in Terminal app works. Homebrew makes installing tools easier.
Linux: you are ready. Most tools are a package install away.

Category	Tools to learn	Used for
Everything	CyberChef(opens in a new tab)	Encoding, decoding and data wrangling in your browser
Web	Browser dev tools, `curl`, Burp Suite	Viewing and changing web traffic
Forensics	Wireshark(opens in a new tab), ExifTool(opens in a new tab), `binwalk`	Network captures, metadata, files inside files
Reversing	Ghidra(opens in a new tab)	Turning programs back into readable code
Pwn	`gdb`, pwntools(opens in a new tab)	Debugging programs and scripting exploits

Your turn

Practice only: hints are free and nothing here affects your score.

Q4A challenge gives you a file with no extension and no explanation. Which command should you run first?
Choose one answerfile mysterync mystery 9001cd mystery

01Your browser is a hacking tool

Tab	What it shows	Why it matters in a CTF
Elements	The live HTML of the page	Find hidden fields and comments, and change them
Console	Run JavaScript on the page	Call functions and do quick decoding
Network	Every request the page makes	See the data going back and forth, including hidden API calls
Application or Storage	Cookies and saved data	Read and edit values like role=guest

02The terminal in ten minutes

Command	What it does	Example
`ls`	Lists files. Add `-a` to include hidden ones, whose names start with a dot	`ls -a`
`cd`	Moves into a folder. `cd ..` goes back up	`cd logs`
`cat`	Prints a file	`cat notes.txt`
`grep`	Finds the lines containing some text	`grep zda server.log`
`file`	Identifies what a file really is	`file mystery.dat`
`strings`	Pulls readable text out of any file	`strings photo.png`
`base64 -d`	Decodes Base64	`base64 -d message.b64`
`xxd`	Shows the raw bytes of a file	`xxd photo.png`

The pipe: where it gets powerful

terminal

strings firmware.bin | grep zda

Try it for real

This terminal runs inside the page. It is a simulation with a fake folder, so you can't break anything. Start with ls, then read the README with cat README.txt.

LabPractice terminal

A simulated terminal. Nothing here runs on your computer. Type help to list the commands it understands, and use the up arrow to repeat one.

Welcome! Type ls and press Enter to see what's in this folder.

Your turn

Practice only: hints are free and nothing here affects your score.

Q1A plain ls doesn't show every file. Find the hidden file and read the flag inside it.
Q2The file logs/server.log has 240 lines, and one of them contains a flag. Find it without reading them all.
Q3The file message.b64 holds a flag, but it is encoded, so grep can't see it. Decode it.

03Connecting to a challenge

terminal

# Talk to a program running on a server. Type, and it replies.
nc pwn.challenges.example 9001

# Fetch a page, and show the response headers as well (-i).
curl -i http://web.challenges.example:8080/

# Send your own cookie with the request.
curl -b "role=admin" http://web.challenges.example:8080/admin

04A little Python goes a long way

decode.py

import base64

encoded = "emRhe2V4YW1wbGV9"
print(base64.b64decode(encoded).decode())   # zda{example}

05Setting up your own machine

When you outgrow the labs here, set up a real terminal. You don't need anything fancy, and you don't need to install all of these on day one. Add a tool when a challenge calls for it.

Windows: install WSL(opens in a new tab), which runs Linux inside Windows, by running wsl --install.
macOS: the built-in Terminal app works. Homebrew makes installing tools easier.
Linux: you are ready. Most tools are a package install away.

Category	Tools to learn	Used for
Everything	CyberChef(opens in a new tab)	Encoding, decoding and data wrangling in your browser
Web	Browser dev tools, `curl`, Burp Suite	Viewing and changing web traffic
Forensics	Wireshark(opens in a new tab), ExifTool(opens in a new tab), `binwalk`	Network captures, metadata, files inside files
Reversing	Ghidra(opens in a new tab)	Turning programs back into readable code
Pwn	`gdb`, pwntools(opens in a new tab)	Debugging programs and scripting exploits

Your turn

Practice only: hints are free and nothing here affects your score.

Q4A challenge gives you a file with no extension and no explanation. Which command should you run first?
Choose one answerfile mysterync mystery 9001cd mystery