Capture the Flag
Hack. Solve. Capture the Flag.
Hands-on hacking competitions: solve real security challenges, find the hidden flag, and score points on your own or with a team.
Upcoming
Open for Registration
The Next CTF Is Being Planned
New CTFs appear here and on the events page first. Want one at your college or company? Tell us.
The basics
What Is a CTF?
A Capture the Flag (CTF) is a security competition. Every challenge hides a piece of text called a flag, such as FLAG{y0u_f0und_1t}. Find it by breaking, investigating or reverse engineering what you are given, submit it on the competition platform, and you score.
CTFs are the fastest way to practise real skills legally: every challenge is built for the competition, so nothing you attack belongs to anyone else.
-
Solve Challenges for Points
Pick a challenge from a list, find the hidden answer (the flag), submit it and earn its points. Harder challenges are worth more.
Players call it: Jeopardy style
-
Attack and Defend (Team vs Team)
Each team gets the same systems. Keep yours running and safe while finding weaknesses in the other teams’ copies.
Players call it: Attack-Defence
-
Capture and Hold a Target
Everyone goes after one shared system. Take control of it and keep it to earn points for as long as you hold it.
Players call it: King of the Hill
-
Mixed Rounds
More than one of these, in separate rounds.
Players call it: Mixed format
Challenge categories
Pick Your Battlefield
Each CTF lists the categories it includes on its own page.
-
Web
Find and exploit flaws in web applications: injection, broken access control, logic bugs.
-
Cryptography
Break weak ciphers, misused keys and home-made encryption.
-
Digital Forensics
Investigate like a digital forensics examiner: recover evidence from disk images, phones, memory dumps, logs and packet captures.
-
Reverse Engineering
Take programs apart to understand what they really do.
-
Binary Exploitation
Exploit memory bugs in programs to take control of them.
-
OSINT
Follow public information to answer questions about people, places and systems.
-
Steganography
Find data hidden inside images, audio and other files.
-
Networking
Read traffic, follow protocols and spot what does not belong.
-
Mobile
Analyse Android and iOS apps for secrets and weaknesses.
-
Miscellaneous
Puzzles, scripting and everything that does not fit elsewhere.
How it works
From Registration to Scoreboard
-
1
Register
Verify your mobile number and take your seat on the event page.
-
2
Form a team
Create a team and share its code, join one with a code, or play solo where allowed.
-
3
Get access
Platform details are shared with confirmed participants before the CTF starts.
-
4
Capture flags
Solve challenges, submit flags and climb the scoreboard while the CTF is live.
Play Fair
Our standard rules. A CTF can add its own on its event page.
- 1 Attack only the challenges. The competition platform, its servers and other players are off limits.
- 2 Do not share flags, solutions or hints with other teams while the CTF is running.
- 3 One registration per person, and one team per person.
- 4 Do not brute-force the flag submission or flood the platform with automated requests.
- 5 Write-ups are welcome once the CTF has ended.
- 6 Breaking these rules can lead to disqualification.
What You Need
- A laptop with a modern browser. Some challenges are easier from a Linux machine or virtual machine.
- Free tools help: a proxy such as Burp Suite, Wireshark, CyberChef, Ghidra and a terminal.
- Curiosity. Beginner-friendly CTFs say so on the event page.
FAQ
Questions About CTFs
Do I need experience to take part?
Can I play on my own?
How does a team work?
Is this legal?
How do I get on the platform?
Is there a fee, a prize or a certificate?
Bring a CTF to Your Campus
Colleges, universities and companies can host a Capture the Flag with us, on its own or at the end of a workshop.