HackBlue

Tools · Workbench

CTF categories for beginners

How capture-the-flag challenges are structured in web, crypto, forensics, reversing, OSINT, and misc, and how to approach each without spoilers.

  • 18 lessons
  • 3 h of reading
  • 6 topics
Start with lesson 1All workbenches

Capture-the-flag competitions are puzzles with a flag string as the answer. Each category rewards a different habit. These tutorials explain what a typical challenge in each category hands you, the first questions to ask, and the tools that answer them, using practice files rather than live competition solutions.

Play on platforms and events that invite it, follow each event’s rules, and do not share flags for a competition that is still running.

Getting started

3 lessons

  1. 01What is a CTF? Jeopardy, attack-defense, and how beginners get startedUnderstand capture the flag competitions, the common categories, what a flag looks like, and how to pick a first event or practice platform that matches your level.8 min
  2. 02Setting up a CTF practice lab: a Linux VM, core tools, and safe networkingBuild a virtual machine with the tools most beginner challenges need, keep it isolated from your personal data, and organize challenge files and notes.10 min
  3. 03Learning Linux through wargames: how to approach OverTheWire BanditUse the Bandit wargame to build command-line skills: connect over SSH, read manuals, search the filesystem, and keep notes, without relying on published answers.9 min

Forensics challenges

4 lessons

  1. 01First steps with an unknown file: file, strings, xxd, exiftool, and binwalkApply a repeatable triage routine to any challenge file: identify its real type, read printable strings, inspect bytes, check metadata, and look for embedded content.10 min
  2. 02Steganography basics for CTFs: LSB data, steghide, zsteg, and spectrogramsUnderstand how data hides in images and audio, check the obvious places first, use steghide, zsteg, and stegseek on practice files, and view audio spectrograms.10 min
  3. 03CTF network forensics: finding flags in packet captures with Wireshark and tsharkApproach a challenge pcap systematically: protocol hierarchy, conversations, follow streams, export transferred files, and search for credentials or encoded data.10 min
  4. 04Repairing corrupted files in CTFs: magic bytes, PNG chunks, and ZIP headersFix files whose headers were deliberately damaged, using a hex editor and format knowledge: restore magic bytes, check PNG chunk CRCs, and recover ZIP entries.10 min

Crypto challenges

2 lessons

  1. 01Solving encoding puzzles with CyberChef: base64, hex, ROT13, and stacked layersRecognize common encodings by their character sets, peel stacked layers with CyberChef recipes and the Magic operation, and reproduce the steps in Python.9 min
  2. 02Classical ciphers in CTFs: Caesar, Vigenère, substitution, and frequency analysisBreak shift ciphers by brute force, recognize substitution ciphers, use letter frequency to recover keys, and estimate Vigenère key length with repeated patterns.11 min

Web challenges

2 lessons

  1. 01A methodology for beginner CTF web challenges: source, robots.txt, cookies, and requestsWork through a practice web challenge with a checklist: read the page source and scripts, check common files, inspect cookies and storage, and modify requests with developer tools or a proxy.10 min
  2. 02Scripting CTF interactions in Python: talking to netcat services and solving math promptsAutomate challenges that require answering many prompts quickly by connecting with Python sockets, reading lines, parsing questions, and sending answers, tested against your own local service.10 min

Reversing challenges

3 lessons

  1. 01Your first crackme: strings, ltrace, and Ghidra on a program you compile yourselfCompile a tiny password-check program, then reverse it three ways: read strings, trace library calls with ltrace, and read the decompiled logic in Ghidra.12 min
  2. 02Binary protections explained with checksec: NX, PIE, stack canaries, and RELRORead checksec output, understand what each mitigation does and why it exists, and compile the same program with and without protections to see the difference.10 min
  3. 03GDB basics for CTF reversing: breakpoints, registers, memory, and steppingRun a practice binary under gdb, set breakpoints on functions and addresses, inspect registers and memory, and step through a comparison to watch values change.11 min

Learning and community

4 lessons

  1. 01How to write a good CTF write-up after the event endsTurn your notes into a clear write-up that explains the reasoning, dead ends, and tools, publish it only after the event allows, and use it as portfolio evidence.8 min
  2. 02Running a CTF team: roles, shared notes, and communication during an eventOrganize a team for a jeopardy event with category owners, a shared tracker, a notes workspace, and a rhythm of check-ins so nobody duplicates work or gets stuck alone.8 min
  3. 03Where to practise legally: picoCTF, OverTheWire, TryHackMe, Hack The Box, and local labsCompare popular practice platforms and self-hosted vulnerable labs by level, cost, and style, and build a progression that keeps all practice on systems you are allowed to test.8 min
  4. 04Building your own CTF challenges for a club or classDesign a challenge with a clear learning goal, a single intended path, and a fair hint, package it with Docker or CTFd, and test it with someone who did not write it.10 min