HackBlue

Tools · CTF categories for beginners · 18 / 18

Building your own CTF challenges for a club or class

Design a challenge with a clear learning goal, a single intended path, and a fair hint, package it with Docker or CTFd, and test it with someone who did not write it.

10 min read · practice only with authorization

Start with the lesson

Decide what the player should learn, such as “files can contain other files” or “client-side checks are not security”. Build the smallest challenge that teaches that idea with one intended path. Avoid guessing games: every step should be reachable by reasoning from what the player can see.

Packaging

File-based challenges are just a download. Service challenges run in containers so each player or team gets a clean, isolated instance, with resource limits. CTFd is an open-source platform for hosting a scoreboard, challenges, hints, and flags for a club event.

Snippet
# minimal container for a practice web challenge
FROM python:3.12-slim
RUN useradd -m app
WORKDIR /app
COPY app.py flag.txt ./
RUN pip install --no-cache-dir flask && chown -R root:root /app && chmod 444 flag.txt
USER app
EXPOSE 8000
CMD ["python", "app.py"]

# run with limits
docker run --rm -p 127.0.0.1:8000:8000 --memory 128m --cpus 0.5 --read-only club-chal-1

Lab: build, test, iterate

Build one forensics challenge from an earlier lesson, such as a flag in PNG LSB data with a hint in the description. Write the intended solution yourself. Then give it to a friend with no hints and watch silently. Note where they got stuck and whether the stuck point was a learning moment or just confusion, and adjust the description or hint.

Safety for hosts

Never deploy challenges on infrastructure that holds real data. Isolate challenge networks, apply resource limits, reset instances regularly, and avoid challenges that would teach harmful techniques against real services. Write clear rules for players about scope.

Diagram

Challenge design loop

  1. Learning goal

    One idea the player should take away.

  2. Build

    Smallest challenge with one intended path.

  3. Package

    File download or isolated container with limits.

  4. Playtest

    Watch someone solve it; refine hints.

Check yourself

1. What should you decide first when designing a challenge?

2. How should service challenges be hosted?

3. Why playtest with someone who did not write the challenge?