CTF Beginner's Guide

Chapter 1 — What is a CTF?

CTF (Capture The Flag) is a cybersecurity competition where teams or individuals solve hacking puzzles to find hidden strings called "flags". It's the best way to learn security hands-on — every challenge teaches a real skill.

Two main formats:

• Jeopardy-style — categories of challenges, each worth points. Most common. Good for beginners.
• Attack-Defence — each team has a server to attack and defend simultaneously. Advanced.

Chapter 2 — CTF Categories

Chapter 3 — Where to Practice

# Beginner-friendly platforms:
PicoCTF          → picoctf.org  (best for absolute beginners, Google-run)
TryHackMe        → tryhackme.com (guided rooms, very beginner-friendly)
HackTheBox       → hackthebox.com (more challenging, but free tier available)
OverTheWire      → overthewire.org (wargames, good for Linux + SSH)
CryptoHack       → cryptohack.org (cryptography focus)
pwn.college      → dojo.pwn.college (binary exploitation)

# Active CTF competitions:
CTFtime.org      → calendar of all upcoming CTF competitions
# Filter by difficulty: beginner, easy, medium, hard

# Start here (suggested order):
1. OverTheWire Bandit → Linux skills (Level 0-30)
2. PicoCTF Practice Arena → mix of categories
3. TryHackMe beginner path → guided learning
4. Enter a live CTF from CTFtime.org → compete for real

Chapter 4 — Web Challenges

# Always check these first on any web challenge:
1. View page source (Ctrl+U) — flags sometimes hidden in comments
2. Browser DevTools (F12) → check Console, Network, Storage tabs
3. Check robots.txt → http://challenge.com/robots.txt
4. Check cookies → DevTools → Application → Cookies

# Common web CTF vulnerabilities:
SQLi          → ' OR 1=1-- in login fields
XSS           → <script>alert(document.cookie)</script>
IDOR          → change ?user_id=1 to ?user_id=2
LFI           → ?page=../../../../etc/passwd
JWT attacks   → decode with jwt.io, modify claims
Source code   → check HTML comments, JavaScript files

# Useful web CTF tools:
curl -v "http://challenge.com/"   # see all headers
gobuster dir -u http://challenge.com -w /usr/share/seclists/Discovery/Web-Content/common.txt

Chapter 5 — Forensics

# Always start with: what is this file?
file challenge.dat       # identify file type
strings challenge.dat    # find readable text inside any file
xxd challenge.dat | head # view hex dump
binwalk challenge.dat    # find embedded files
binwalk -e challenge.dat # extract embedded files

# Image forensics
exiftool image.jpg       # check metadata (GPS, camera, dates)
strings image.jpg | grep -i flag

# Network capture (.pcap) files
wireshark capture.pcap
# File → Open → look for HTTP requests, FTP transfers, suspicious traffic
# Follow → TCP Stream → read conversations
tshark -r capture.pcap -Y "http" -T fields -e http.request.uri

# Memory forensics
volatility -f memory.raw imageinfo   # identify OS
volatility -f memory.raw --profile=Win7SP1x64 pslist

Chapter 6 — Cryptography

# IDENTIFY THE ENCODING/CIPHER FIRST

# Common encodings (not encryption — no key needed)
Base64    → ends with = or ==: SGVsbG8= → "Hello"
Base32    → uppercase + digits: JBSWY3DP
Hex       → 0-9 a-f: 48656c6c6f → "Hello"
Binary    → 01001000 01100101...

# Decode online: CyberChef (gchq.github.io/CyberChef) — the Swiss army knife

# Common ciphers in CTFs:
Caesar cipher    → shift letters by N (use ROT13 first: N=13)
Vigenere cipher  → uses a keyword
XOR encryption   → common in reversing challenges
RSA              → check for small exponents (e=3), common N

# Python for crypto:
python3 -c "print(bytes.fromhex('48656c6c6f'))"   # hex → text
python3 -c "import base64; print(base64.b64decode('SGVsbG8='))"

Chapter 7 — Steganography

# Steganography = hiding data inside other data (images, audio, etc.)

# Check the file first
file image.jpg
strings image.jpg | grep -i "flag\|ctf"
exiftool image.jpg
binwalk image.jpg

# steghide — hide/extract data in JPG/BMP/WAV
steghide extract -sf image.jpg       # try blank password first
steghide extract -sf image.jpg -p "password"

# stegsolve — visual analysis of images
sudo apt install stegsolve -y
java -jar stegsolve.jar

# zsteg — PNG/BMP LSB steganography
sudo gem install zsteg
zsteg image.png

# Audio steganography
# Open .wav in Audacity → view Spectrogram
# Flags are often written in the spectrogram view!

# pngcheck — check PNG integrity
pngcheck -v image.png

Chapter 8 — Reverse Engineering

# Start with strings — flags are often just in the binary
strings binary_file | grep -i "flag\|ctf"

# Determine file type and architecture
file challenge
# ELF 64-bit LSB executable, x86-64... → Linux binary

# Run it first (in a safe environment)
chmod +x challenge
./challenge

# ltrace — library calls
ltrace ./challenge        # often shows strcmp() with the password!

# strace — system calls
strace ./challenge

# Ghidra — free NSA decompiler (best for beginners)
sudo apt install ghidra -y
ghidra                    # New project → Import file → Analyze → CodeBrowser

# GDB — debugger
gdb ./challenge
(gdb) break main        → breakpoint at main
(gdb) run               → start program
(gdb) info registers    → view CPU registers
(gdb) x/s $rdi         → view string at address in RDI register

Chapter 9 — OSINT Challenges

# OSINT CTF challenges give you limited info and ask you to find more
# "Find the real name of this Twitter user"
# "What city was this photo taken in?"
# "Find the email of the CEO of this company"

# Image geolocation — find where a photo was taken
# 1. Check EXIF data: exiftool photo.jpg (GPS coords!)
# 2. If no GPS: look at landmarks, signs, sun angle, vegetation
# 3. Reverse image search: Google Images, TinEye, Yandex Images
# 4. Use GeoGuessr skills

# Username investigation
# Sherlock (searches 300+ sites for a username):
python3 sherlock username

# Email investigation
hunter.io               # find emails by company domain
haveibeenpwned.com      # check if email was in a breach

# Google dorking
site:twitter.com "target person"
"target person" email OR contact

Chapter 10 — CTF Mindset

Getting good at CTFs is less about knowing everything and more about your approach to unsolved problems.

# The CTF methodology
1. READ THE CHALLENGE DESCRIPTION CAREFULLY — it almost always has hints
2. Identify the category first
3. Enumerate → check everything: metadata, source, headers, file type
4. Google your observations → "CTF base64 + xor" → someone solved it before
5. Try the obvious things first before going deep
6. If stuck 30+ minutes → look at hints, or move to another challenge
7. After CTF ends → read writeups for unsolved challenges (best learning!)

# Essential CTF tools on Kali
CyberChef    → gchq.github.io/CyberChef (encode/decode anything)
Ghidra       → reverse engineering
Wireshark    → network forensics
Burp Suite   → web challenges
steghide     → steganography
exiftool     → image metadata
pwntools     → Python library for pwn challenges
pycryptodome → Python crypto library

# Build a CTF toolkit
sudo apt install -y steghide exiftool binwalk foremost pngcheck audacity ghidra