Core Concept
In CTF, players solve security challenges to find hidden "flags" (proof strings). Challenges often cover web exploitation, reverse engineering, cryptography, digital forensics, and binary exploitation.
Capture The Flag (CTF) Guide
Learn what CTF is, why it matters for cybersecurity careers, and where to train with professional challenge platforms.
What Is CTF?
CTF (Capture The Flag) is a legal, educational cybersecurity competition format.
Why CTF Helps
CTF builds practical security skills faster than passive learning. You learn attacker techniques and defender thinking, then apply both in SOC, red team, incident response, and appsec roles.
Main Formats
- Jeopardy: independent challenge categories with points.
- Attack-Defense: teams defend services while attacking others.
- King of the Hill: hold control of target systems over time.
Professional CTF Websites
Trusted platforms used by students, professionals, and security teams.
Competition & Events
Hands-On Labs
- Hack The Box - Realistic red/blue labs and CTF challenges.
- TryHackMe - Guided learning paths plus challenge rooms.
- OverTheWire - Classic terminal and Linux wargames.
Web & Mixed Security Practice
- PortSwigger Web Security Academy - Web exploit labs by vulnerability class.
- Root-Me - Broad CTF challenge archive across many domains.
CTF Learning Roadmap
A practical path from beginner to advanced player.
- Start with Linux, networking basics, and HTTP fundamentals.
- Practice easy web and crypto tasks on picoCTF and TryHackMe.
- Write systematic notes and reusable scripts for recurring techniques.
- Join team-based CTF events on CTFtime and review writeups after each match.
- Focus on one specialization (web, pwn, reverse, forensics) and deepen tooling.