What is a CTF?

CTF stands for Capture The Flag. It is a cybersecurity competition made up of puzzles called challenges. Every challenge hides a secret piece of text called a flag. Find the flag, submit it, and you score points. Whoever has the most points at the end wins.

The name comes from the outdoor game where teams race to grab the other side's flag. Here nobody runs. The "flag" is a line of text, and the playing field is a website, a file or a program that the organizers built to contain a security weakness on purpose.

Think of it as an escape room for computers. Each challenge is a locked room. You look around, notice clues, try ideas, and eventually get the door open. Getting in is not cheating: it is the whole point.

The easiest way to understand a CTF is to watch someone solve a challenge. Imagine you open the challenge board and pick this one:

Here is how solving it goes, including what you would be thinking:

1. 1

   Read the challenge carefully

   The description says there is "nothing sensitive on it". That sounds like a clue. It is rated Easy and worth only 100 points, so the answer is probably simple. It is in the Web category, so the flag is somewhere around this website.

2. 2

   Look around

   You open the address in your browser and find a login form. You try a few passwords. None of them work, and you don't know the password anyway.

3. 3

   Ask a better question

   Instead of "how do I log in?", you ask "what did this website actually send to my browser?". Web pages are made of text called HTML, and browsers let you read it. You right-click the page and choose View page source.

4. 4

   Spot the flag

   Most of it is ordinary, but one line stands out. Text between <!-- and --> is a comment: it is hidden on the page but still sent to every visitor.

   <form action="/login" method="post">
     <input name="username" />
     <input name="password" type="password" />
     <button>Log in</button>
   </form>
   <!-- TODO: remove before launch! zda{c0mm3nts_ar3_n0t_s3cr3t} -->

5. 5

   Submit it and score

   You copy zda{c0mm3nts_ar3_n0t_s3cr3t}, paste it into the challenge's flag box, and press Submit. It is correct. You earn 100 points and move up the scoreboard.

That is the whole game. Harder challenges don't change the rules, they just put more steps between you and the flag. A 500-point challenge might need you to find a bug, write a small program to exploit it, and then read the flag from a server.

Competitions come in a few formats. As a beginner you will almost always start with Jeopardy, and that is what ZeroDay Alliance runs.

Categories and difficulty

Jeopardy challenges are sorted into categories so you can play to your interests: Web (websites), Crypto (codes and ciphers), Forensics (digging through files), Reversing (working out what a program does), Pwn (exploiting memory bugs) and more. Each one also has a difficulty, and here that runs from Easy through Medium and Hard to Insane. Later lessons cover each category properly.

Less than you might think:

• A browser and a computer. Everything in these lessons runs right on the page. A laptop helps, because browser developer tools are hard to use on a phone.
• Curiosity and patience. Being stuck is normal. Even expert players spend most of their time stuck, then trying another idea.
• Somewhere to take notes. Write down what you tried. It stops you going in circles.

You don't need to be a programmer or know Linux to begin. You will pick up both as you go, and they become much easier to learn when you have a reason to use them.

CTF challenges are built to be attacked, so you have permission to attack them. That is what makes this legal. The same techniques used on a website you don't own, without written permission, can be a crime in most countries, even if you are only curious and don't change anything.