What is a CTF? Jeopardy, attack-defense, and how beginners get started

Capture the flag in one paragraph

A CTF is a security competition where participants solve challenges that hide a secret string, the flag, usually in a format like picoCTF{...} or flag{...}. Submitting the flag earns points. Challenges are deliberately vulnerable or puzzle-like systems built for the event, so you can practise skills legally that would be off limits against real systems.

Formats

Jeopardy-style events offer a board of independent challenges by category and points. Attack-defense events give each team identical vulnerable services to defend while scoring against other teams’ copies, all inside the event’s network. King of the hill and mixed formats exist too. Beginners almost always start with jeopardy events.

• Web: lab web apps with bugs to find
• Crypto: weak or misused cryptography
• Forensics: files, disk images, packet captures
• Reverse engineering: understand a program
• Binary exploitation (pwn): memory safety bugs
• Misc and OSINT: puzzles and public-information challenges

Lab: plan your first month

Create an account on a beginner-friendly, always-available platform such as picoCTF, OverTheWire, or TryHackMe. Pick two categories that match your current skills, for example forensics and web, and set a goal of five solved challenges per week. Keep a notes file per challenge with what you tried, what worked, and what you learned. At the end of the month, join a beginner-friendly live event listed on CTFtime with a team or solo.

Rules and ethics

Only attack the infrastructure the organizers say is in scope. Do not attack the scoreboard, other players, or the hosting provider unless the rules explicitly say so. Do not share flags or full solutions during a live event. These rules are the same professional boundaries you will follow at work.