CTF competitions are how most hackers get their first taste of real exploitation. Here's what they are, what categories come up, and how to get started even with zero experience.
CTF stands for Capture the Flag. In a security context, it's a competition where participants solve hacking challenges to find hidden strings called flags — typically formatted like FLAG{some_text} — and submit them for points. The team or individual with the most points at the end wins.
CTFs are where most working security professionals got their start. They compress years of learning into weeks of focused, competitive problem-solving. They're also free, legal, and completely safe — every challenge runs in an isolated environment built for the purpose.
Each challenge is a self-contained puzzle. You're given a target — a web app URL, a binary file, a packet capture, a cryptographic ciphertext — and your job is to find and exploit the vulnerability to retrieve the flag.
A simple web challenge might look like this: you get a URL to a login page. The username field is vulnerable to SQL injection. You inject admin'--, bypass authentication, and the dashboard shows you the flag. Submit it. Points.
Harder challenges require chaining multiple techniques — an XSS vulnerability that lets you steal an admin's cookie, which you then use to access an API endpoint that leaks a file path, which contains a binary you have to reverse engineer to extract the flag. Each step builds on the last.
Jeopardy-styleis the most common format. Teams solve individual challenges across multiple categories. Each challenge has a fixed point value (often scaled to how many teams have solved it — first blood is worth more). You pick your challenges based on your team's strengths. This is the beginner-friendly format.
Attack-Defenceis more advanced. Each team gets an identical server running vulnerable services. You attack other teams' servers to steal their flags while defending your own. It runs in real time. Your score depends on both offence and defence. This format appears at high-level competitions like DEF CON CTF.
CTFtime.orgis the central calendar for upcoming competitions. It lists events by difficulty rating, upcoming dates, and past writeups. Sort by beginner-friendly if you're starting out.
For practice that's always available (not tied to a competition date):
After every CTF, participants publish writeups — step-by-step explanations of how they solved each challenge. These are invaluable learning resources. Reading how someone else approached a problem you couldn't solve teaches you techniques and thought processes you couldn't get elsewhere.
The CTFtime page for any past competition links to writeups. GitHub is full of them. Search for the competition name + "writeup". Reading one good writeup per day compounds dramatically over a year.
The skills are direct. Web CTF challenges use the exact same techniques as bug bounty hunting: the same browser developer tools, the same Burp Suite workflow, the same thought process for finding injection points. The difference is that CTF challenges are designed to be solvable in hours, while real targets require more patience and methodology.
Forensics and reverse engineering skills translate directly to incident response, malware analysis, and threat intelligence roles. Binary exploitation maps to vulnerability research. Cryptography challenges build the intuition to spot weak crypto in real applications.
Many hiring managers at security companies specifically ask about CTF participation and ask candidates to walk through their approach to a challenge. It's a better signal of practical ability than most certifications.
Register on CTFtime.org. Create a HackerOne account. Go to PicoCTF and attempt the first five web challenges. When you get stuck, spend twenty minutes thinking, then read a writeup from a previous year's version of the challenge. Understand the technique, not just the answer.
That loop — attempt, struggle, understand, repeat — is the entire method. There's no secret beyond volume of practice.
Put this into practice on hackr.gg. Real vulnerable machines, real attack tools, right in your browser. No setup, no VPN — get your first flag in under 10 minutes.
Start hacking free →