How to Play
New to capture the flag? Here's everything you need to get started.
What is a CTF?
A capture the flag (CTF) is a security competition. Each challenge hides a secret piece of text called a flag. You find it by solving a puzzle: cracking a code, digging through a file, reverse engineering a program, or finding a bug in a website. Submit the flag and you earn points.
You don't need to be an expert. Every category has beginner challenges, and every challenge you solve teaches you something new.
Flag format
Every flag on this site looks like this:
CyberPaw{s0me_t3xt_h3re}
- Submit the whole flag, including
CyberPaw{and the closing}. - Flags are case-sensitive unless the challenge says otherwise.
- No spaces before or after the flag.
- If you find text that looks like a flag but uses a different format, it's probably a decoy.
How scoring works
- Each challenge is worth points. Harder challenges are worth more.
- Some challenges show ↓ decaying points: they start high and drop as more players solve them, so solving early pays off.
- Hints may cost points. The cost is shown before you unlock one.
- The ⚠ triangles show difficulty, from 1 (easy) to 5 (hard).
- The first player to solve a challenge earns the 🐾 First Paw badge.
- Ties on the scoreboard go to whoever reached the score first.
Challenge categories
| Category | What you'll do |
|---|---|
| Crypto | Break codes and ciphers, from classic shifts to modern mistakes |
| Forensics | Dig through files, images and network captures for hidden data |
| Web | Find and exploit bugs in websites built for this competition |
| Rev | Reverse engineer programs to figure out what they do |
| Pwn | Exploit memory bugs in programs to take control of them |
| Misc | Everything else: puzzles, OSINT, scripting and more |
Tips
- Read the description carefully. The title and wording often contain hints.
- Download every file and look at it in more than one way.
- Search the web. Looking things up is part of the game.
- Keep notes of what you tried. It saves time when you come back.
- Stuck? Try a different challenge and come back later, or unlock a hint.
Useful free tools
- CyberChef for decoding and converting data
- Wireshark for network captures
- Ghidra for reverse engineering
- Your browser's developer tools (press F12) for web challenges
Before you start, read the Rules. Good luck, wildcat! 🐾
psst. if your the first to sovle a problem you'll get a First Paw 🐾 plus 1 extra point!