You’re probably hearing more and more about Capture The Flag (CTF) competitions and challenges. Many companies, schools and associations now run these events every year. Although the trend is growing, these competitions are nothing new: they date back at least to DEF CON in 1996. Whether you’re a beginner, a professional or just curious, this article is for you.
What is a CTF (Capture The Flag)?
It’s a type of competition found mostly in cybersecurity. The goal is to exploit vulnerabilities to take control of user accounts, servers or other components of an information system.
Participants tackle a variety of technical challenges to solve IT security problems. Each solved challenge reveals a “flag“, usually a unique string of characters, sometimes stored in a text file named flag.txt.
Here’s what a flag can look like: CTF{Y0uF1ndM3}.
The name comes from the traditional capture-the-flag game found in many activities such as paintball, where teams compete to seize the other side’s flag. In cybersecurity, the idea is similar, except participants capture virtual flags, a bit like passwords, by solving technical problems.
The flag is complex enough that you can’t guess it or obtain it through brute force (usually forbidden in CTFs except locally), but it typically follows this format: EVENT_NAME{flag}.
The full flag must be submitted to a platform or a person to earn points if it’s correct. You can take part solo or as a team, depending on the registration rules set by the organisers. If you’re on a team, every flag you find adds to the team’s score.
These competitions generally come in two main formats:
- Jeopardy-style CTFs: participants choose from a list of challenges in categories such as cryptography, reverse engineering, web development, binary exploitation, OSINT and more. Each solved challenge earns points.
- Attack & Defense CTFs: teams must defend their own infrastructure while attacking the other teams’. This format is often more complex and requires extra infrastructure work.
Students and professionals love these competitions because they offer a fun, and sometimes more effective, way to learn, practise and test cybersecurity skills.
CTFs for beginners
Are CTFs for me?
Can I try a CTF even if I’ve never done any IT security?
If I score 0 points, does that mean security isn’t for me?
These are all questions you might ask yourself, and ones I asked myself too.
Of course you can try a CTF, even if you’ve never done any IT security! Everyone starts somewhere, and CTFs are made for learning. They’re not reserved for experts or seasoned hackers, quite the opposite. Challenges are varied and cover lots of fields, so you can explore what interests you at your own pace: cryptography, web hacking, reverse engineering, network analysis… There’s always a first challenge to solve, a first flag to capture, and it’s often easier than you’d think.
And scoring 0 points doesn’t mean cybersecurity isn’t for you! It’s perfectly normal not to find anything at first. Many participants finish their first CTF without a single point, and they keep going. Why? Because what matters isn’t the score, but everything you learn along the way. By trying to understand a challenge, digging through forums and reading write-ups (other players’ detailed solutions), you improve without even noticing. The real goal of a CTF isn’t to top the leaderboard, it’s to get better every time you play.
Failure is part of the game, and it’s actually a great way to learn. Every problem is a chance to learn more, try new tools and discover concepts you didn’t know. Over time, your instincts sharpen and, before you know it, you’ll capture your first flag. Believe me, it feels amazing! So go for it, have fun and don’t let an empty scoreboard discourage you: persistence is how you get better.
Why take part in a CTF?
Some themed CTFs focus on a single category:
- Cryptography: decrypting coded messages or breaking keys.
- Reverse engineering: analysing programs to understand how they work.
- Web exploitation: finding and exploiting vulnerabilities in web applications.
- OSINT (Open Source Intelligence): using public information to solve puzzles.
- Binary exploitation: exploiting flaws in binaries to execute malicious code.
- Forensics: analysing files, network captures, disks or other storage media to find clues.
- Hardware: handling physical devices or interacting with interfaces such as UART or JTAG.
- ICS/SCADA: identifying vulnerabilities in industrial systems.
- Steganography: finding information hidden in files.
- Network: analysing network traffic and extracting sensitive data.
Jeopardy-style CTFs
Jeopardy-style CTFs offer different categories and difficulty levels, ideal for participants of mixed abilities. Here’s why they’re worth your time:
To learn
CTFs give you hands-on experience, far more immersive than theory. You’ll gain skills that apply directly in a professional setting, such as finding and exploiting vulnerabilities, managing network systems or forensic analysis. This practice helps consolidate technical knowledge that can otherwise feel abstract.
That said, the context isn’t always realistic, and the constraints and methods sometimes have little to do with real-world work.
To raise awareness
The best defence is a good offence. For students and organisations alike, CTFs help them understand current threats and how to protect against them.
To work as a team
Most CTFs are team events rather than individual ones. They encourage collaboration, task sharing and communication. Each member brings their own expertise, be it cryptography, network analysis or reverse engineering, so everyone learns from each other.
To meet professionals
Cybersecurity recruiters often see CTF results as an excellent indicator of technical skills and the ability to solve problems under pressure. Taking part in well-known competitions can be an asset on your CV and open doors to career opportunities.
Above all, to have fun
CTFs are fun and stimulating, which makes them a rewarding activity. Solving puzzles, decrypting messages or breaking into simulated systems is hugely satisfying, and complex challenges also deliver a healthy dose of humility.
Events and competitions
CTFtime 🚩
If you’re into competitions, you’ll inevitably hear about CTFtime. In short, it’s the go-to site for following, ranking and organising cybersecurity competitions worldwide.
Picture a giant CTF calendar where you can see every upcoming competition, check past results and even compare the world’s best teams. Each event is rated on difficulty and quality, helping players pick the CTFs that best match their level.
But CTFtime is more than a calendar. It’s also an international ranking system: by competing, your team earns points and climbs the global leaderboard. Some CTFs are more prestigious than others and award more points, such as the DEF CON CTF or the Google CTF.
On top of that, the site is packed with write-ups, detailed solutions to challenges shared by the community. It’s a goldmine for learning how the best players captured their flags.
Accessible events
Sthack
Sthack is a day of talks followed by a CTF, held every year in Bordeaux, with the CTF hosted at Bordeaux City Hall. I recommend it for its friendly atmosphere.
HeroCTF
HeroCTF is aimed at players of all levels and is particularly well suited to beginners and intermediates. It follows the Jeopardy format, with challenges grouped into categories such as cryptography, reverse engineering, forensics and OSINT. One of HeroCTF’s hallmarks is its community spirit, with challenges designed to be progressive and educational.
Breizh CTF
In the same spirit, Breizh CTF is another in-person event that runs through the night. Held in Brittany, it draws hundreds of participants.
Hack The Box CTF
In my view, Hack The Box (HTB) is one of the best cybersecurity training platforms, and its CTFs are no exception. It regularly hosts events that challenge participants with scenarios very close to real-world corporate problems.
Every year, HTB runs a University CTF. The 2024 edition brought together more than 1,000 universities and 7,000 students worldwide.
Major events
DEF CON CTF
The DEF CON CTF is arguably one of the most prestigious competitions in cybersecurity. Held every year in Las Vegas, it attracts experts from all over the world and is known for its high difficulty, demanding advanced skills in networking, binary exploitation and system analysis.
Google CTF
The Google CTF, run by Google’s security team, offers varied, well-designed challenges. It stands out with two levels: a beginner track, perfect for newcomers, and an advanced track for experts. Topics include web security, cryptography and reverse engineering.
PicoCTF
Created by Carnegie Mellon University, PicoCTF is designed to introduce students to cybersecurity. The competition focuses on learning, with beginner-friendly challenges. Its interface is educational and interactive, with clear explanations and instant feedback on answers.
Essential tools for a CTF
By now, you know what a CTF is and which events exist, and you’ve picked the one you want to enter or practise for. Next comes tooling. It’s best to arrive with your tools installed, up to date and configured, because a CTF is often a race against the clock: you need to analyse, exploit and solve challenges efficiently. A good setup starts with an efficient working environment. Specialised Linux distributions such as Kali Linux, Parrot OS or BlackArch are widely used because they come with many preinstalled tools. If you prefer a more modular option, Exegol gives you a ready-to-use Docker environment that’s easy to configure.
You can always use a virtual machine on VirtualBox, VMware or any other hypervisor to test exploits or analyse binaries safely.
My personal CTF experience
The CTF that left the biggest mark on me is the EC2 (European Cyber Cup). I took part in 2021 and 2022 with Les Pires Hat , in a team of 10. It was a chance to compete against other students, and above all against teams of professionals.
EC2 is organised like an esports event over several days, with a host running the show all day long. It’s much more than a CTF: it’s an immersive experience you rarely get at online events. One of the challenges that stuck with me most was the AI one, a category that was less common back then.
In 2021, we finished fourth out of fifteen (4/15), and in 2022, fourth out of eighteen (4/18).
How to create your own CTF
As you might expect, creating a CTF is far from trivial, both in substance (designing challenges takes a huge amount of time) and in form.
Define your audience
A successful CTF relies on careful planning and precise execution. First, set your competition’s goals by identifying your target audience, whether students, professionals or hobbyists, and choosing the right difficulty level.
Choose the platform
Next, choose a platform to host the CTF: CTFd for its flexibility, CTF_Café or RootTheBox for complex scenarios, or an in-house solution for bespoke needs.
I’ve written a dedicated article on CTFd: CTFd: create your own Capture The Flag cybersecurity competition.
A solid, secure infrastructure is also essential to protect you from malicious behaviour or participant mistakes. Use robust servers and set up isolated environments to prevent interference between challenges.
Scoring and visualisation
The scoring system is key to keeping participants engaged, especially knowing how hard some tryhards push. Award points in proportion to each challenge’s difficulty and provide a dynamic scoreboard to fuel the competition. Before launch, have other challenge creators test everything to spot potential problems. On the day, communicate the rules clearly and be ready to answer questions by assigning enough people to support. Finally, once the CTF is over, gather feedback to improve your future events.
Recommendations
Having organised a few CTFs myself, and without wanting to sound pessimistic, your first events will hit a few snags. I therefore recommend keeping the audience small, and not necessarily opening it online.
In a company, you could open it to your department or the whole IT division by setting aside half a day.
CTF vs Bug Bounty: the differences
Capture The Flag and Bug Bounty are two very popular approaches in cybersecurity. Although both involve hunting vulnerabilities and solving technical challenges, they differ greatly in goals, environment and impact.
A CTF is first and foremost an educational, playful competition where you solve artificially designed challenges to test your cybersecurity skills. Flags are built into the challenges and must be retrieved by exploiting intentional vulnerabilities. The aim is to learn, practise and measure yourself against other players in a controlled environment. CTFs often take place in a competitive or academic setting, with rewards such as rankings, badges or even prizes for the best participants. But their main purpose remains learning and improving technical skills.
Bug Bounty, or BB, on the other hand, takes place in the real world: security researchers analyse applications, websites or infrastructure made available by companies in order to find unintended security flaws. The goal is to detect and report exploitable vulnerabilities, proactively improving the security of an existing system. In this context, you must strictly respect the scope and rules set by the company. These rules specify which assets may be tested, which types of attack are forbidden and which vulnerabilities count as valid. Ignoring them can have legal consequences: an out-of-scope attack may be treated as unlawful intrusion, exposing the researcher to prosecution. That’s why you should always read the programme’s terms before starting.
BB pays a financial reward for each reported flaw: the more critical the vulnerability, the higher the bounty. Some people turn it into a genuine profession, collecting bounties by finding exploitable flaws on paid platforms. However, unlike a CTF, where progress is guaranteed, Bug Bounty can be frustrating: you can spend days hunting for a flaw without finding one.
Leave a Reply