Capture the Flag (CTF) Cyber Security for Beginners: Where to Start

Key takeaways

• A flag is a text string you find by solving a challenge, such as flag{example}.
• Common formats: Jeopardy (separate challenges), attack-defence (defend your own services while attacking others) and king of the hill.
• Categories include web, cryptography, forensics, reverse engineering, binary exploitation, OSINT and misc.
• Only attack the targets a CTF provides. Never use CTF techniques against real sites.

What is a CTF?

In a CTF you are given a puzzle that mimics a security problem. Solve it and you get a flag, a string like flag{...} that you submit for points. CTFs teach practical skills in a legal, safe setting because the targets are built for it.

Formats

What are the common categories?

• Web: finding flaws such as injection or broken access control in a provided web app.
• Cryptography: breaking or analysing weak encryption and encodings.
• Forensics: analysing files, memory dumps, network captures and disk images.
• Reverse engineering: working out what a program does without source code.
• Binary exploitation ("pwn"): abusing memory bugs in a provided program.
• OSINT: finding information from public sources about a fictional target.
• Misc: puzzles that do not fit elsewhere.

A worked beginner challenge

A beginner cryptography challenge gives you this text:

ZmxhZ3tiYXNlNjRfaXNfbm90X2VuY3J5cHRpb259

Step 1: Notice the pattern. Letters and digits, ending without punctuation, look like Base64, an encoding, not encryption.

Step 2: Decode it in a Linux terminal.

echo "ZmxhZ3tiYXNlNjRfaXNfbm90X2VuY3J5cHRpb259" | base64 -d

Output:

flag{base64_is_not_encryption}

You found the flag, and the name says the lesson: Base64 only changes representation. Anyone can reverse it, so it hides nothing. Real challenges add layers, but the habit is the same: identify what you are looking at, pick a tool, test and document.

Where can you practise?

• picoCTF from Carnegie Mellon University is built for beginners and stays available for practice. See picoctf.org.
• OverTheWire wargames such as Bandit teach Linux command line through puzzles. See overthewire.org.
• PortSwigger Web Security Academy offers free web security labs; see portswigger.net.
• OWASP Juice Shop is a deliberately vulnerable web app you run locally.
• TryHackMe and Hack The Box offer guided rooms and machines, with free and paid tiers.
• CTFtime lists upcoming events. See ctftime.org.

Check each platform's current offering and rules before you start.

A first-week plan

1. Day 1 to 2: work through Linux basics with OverTheWire Bandit.
2. Day 3: learn encodings (Base64, hex, ROT13) and solve beginner crypto puzzles.
3. Day 4 to 5: try web challenges on a practice platform. Learn to use browser developer tools and a proxy such as OWASP ZAP.
4. Day 6: try a forensics challenge with a file and basic tools such as strings and file.
5. Day 7: write up what you solved and what you did not.

Write-ups are the real learning tool. Read other people's after you have tried.

Skills to build

Linux command line, networking basics, HTTP and web basics, Python scripting and careful note-taking. Tools you will meet: Wireshark, Burp Suite or ZAP, CyberChef, Ghidra and Python libraries.

Rules and ethics

Attack only the targets the CTF gives you. Do not attack the CTF infrastructure, other players or any real website. Share hints, not flags, during live events, and respect event rules. These habits carry over to professional work, where testing needs written authorisation under India's Information Technology Act, 2000.

Playing in a team

Teams share work by category. Use a shared notes document, a chat channel and agree who submits flags. Teaching each other is part of the point.

Next steps

Read why CTF is important in cybersecurity and how to gain hands-on cybersecurity experience. For a structured route, see the CEH v13 AI course or the Cyber Security course.

Related reading

• How Can I Gain Hands-On Experience in Cybersecurity for an SOC Role?