[+] Getting Started with CTFs

How I Got Into CTFs

My first CTF was a disaster. I stared at challenges for hours, solved maybe one, and felt completely lost. But something about it hooked me. The puzzle-solving, the adrenaline of capturing a flag, the feeling when something finally clicks. Now I play regularly with my team Binary Misfits, and I want to share what helped me get started.

What a CTF Actually Is

A Capture The Flag competition is basically a set of security puzzles. You solve them to find hidden strings (flags) that prove you cracked the challenge. The categories I have encountered:

Web exploitation
Reverse engineering
Cryptography
Forensics
Binary exploitation
OSINT (Open Source Intelligence)

Each solve earns points, and the team with the most points wins. Some CTFs run for 24-48 hours straight. Sleep becomes optional.

Why I Keep Playing

I learn faster here than anywhere else - real problems force me to figure things out under pressure
Teamwork - my team covers different areas, and I learned so much from watching them work
No legal risk - I get to break things legally, which is the whole point
It looks good - CTF experience on a resume gets noticed

Types I Have Played

Jeopardy-style - Independent challenges, pick what you want to solve. This is what I started with.
Attack-Defense - You defend your own server while attacking others. Much more intense.
Mixed - Combination of both. My favorite format.

Commands That Saved Me

Linux Basics

I had to get comfortable with the terminal fast. These are the ones I use constantly:

# Search for a file
find / -name flag.txt 2>/dev/null

# Search for a keyword inside files
grep -R "flag" .

# Display running processes
ps aux

Networking & Recon

# Scan open ports - this is always my first move
nmap -sV 192.168.1.10

# Capture packets for analysis
tcpdump -i eth0 -w capture.pcap

# Pull URLs from a pcap
strings capture.pcap | grep "http"

File Analysis

# What kind of file is this?
file unknown.bin

# Extract readable strings
strings unknown.bin

# Check for hidden data in an image
binwalk image.png

Web Exploitation

# Send a request with custom headers
curl -H "User-Agent: admin" http://example.com

# Test for SQL injection
sqlmap -u "http://example.com/page?id=1" --batch

Resources That Helped Me

Where I Practice

PicoCTF - where I started. Beginner-friendly and well-structured.
CTFtime - I use this to find upcoming competitions.
HackTheBox - harder machines that pushed my skills.
TryHackMe - guided paths when I wanted to learn a specific topic.
OverTheWire - the Bandit wargame taught me Linux fundamentals.

Writeups I Learn From

CTF Writeups Archive - after every CTF I read how others solved what I could not.
ippsec’s YouTube - his HackTheBox walkthroughs are incredibly detailed.
LiveOverflow - great for binary exploitation concepts.

Tools I Installed

CyberChef - my go-to for encoding, decoding, and data manipulation.
Burp Suite - essential for web challenges.
Binwalk - saved me in forensics challenges multiple times.
Kali Linux - has everything pre-installed.

Where I Started Learning

PicoGym - permanent practice problems I can revisit anytime.
Cryptohack - this is how I learned crypto challenges.
Reverse Engineering for Beginners - free book that gave me my RE foundation.