learn
Beginner prep guide
Never played a CTF? Start here. Set up a few free tools, try the practice challenge, and you'll be ready for Part 1 of every category. None of this is required, but each step makes the day easier.
a one-evening plan
If you only have an hour or two
step_1
Try the practice box
Decode the puzzle at the bottom of this page. It teaches the most common CTF move: undo layers of encoding.
step_2
Do 3 picoGym problems
Filter by the General Skills category and sort by easiest. Read a write-up if you get stuck; that's how everyone learns.
step_3
Play OverTheWire Bandit 0 to 5
Five short levels that teach you to move around a Linux shell and read files.
apt install
Tools worth installing
All free. Install them before the event so you aren't downloading a 400 MB file on venue Wi-Fi.
Kali Linux or WSL
A Linux command line
Many challenges are easier from a Linux shell. On Windows, install WSL (Windows Subsystem for Linux) with Ubuntu. On a Mac, the built-in Terminal covers most of it. Kali Linux in a virtual machine comes with lots of security tools pre-installed, but it's optional.
try: Run wsl --install in an admin PowerShell, reboot, then try ls, cat, file, and strings on a few files.
Wireshark
Network captures (Forensics)
Opens .pcap files so you can read network traffic packet by packet. Forensics challenges often hide a flag in a capture: a web request, a file transfer, or a chat message.
try: Open any sample capture, then right-click a packet and choose Follow > TCP Stream.
Ghidra
Reverse engineering
A free disassembler and decompiler from the NSA. Load a program and Ghidra turns machine code back into readable C-like code so you can see what it checks.
try: Load a small program, run auto-analysis, and find the main function in the Symbol Tree.
CyberChef
Decoding anything (Crypto, Misc)
A browser tool for chaining transforms: base64, hex, rot13, XOR, and hundreds more. Its Magic operation will even guess the encoding for you. Nothing to install.
try: Paste the puzzle from the practice box below into CyberChef and solve it there too.
Python
Scripting (every category)
When you need to try 1,000 keys or parse a weird file, a 10-line Python script beats doing it by hand. Learn variables, loops, strings, and bytes. That covers most CTF scripting.
try: Run python3 -c "print(bytes.fromhex('4b45414e').decode())" and see what it prints.
Your browser's DevTools
Web challenges
Press F12. The Elements, Network, Application (cookies), and Console tabs solve a surprising number of beginner web challenges.
try: Open DevTools on any site and look at its cookies under Application > Storage.
wargames
Free places to practice
- picoGym (opens in a new tab)Hundreds of beginner CTF problems from Carnegie Mellon's picoCTF, sorted by category.
- OverTheWire: Bandit (opens in a new tab)Learn the Linux command line one level at a time, over SSH.
- CyberChef (opens in a new tab)Decode, decrypt, and convert data in your browser. You'll use it a lot.
- CTF 101 (opens in a new tab)Short explainers for each CTF category from the OSIRIS Lab at NYU.
your first flag
Practice box
The input below is a flag wrapped in three layers of encoding. Peel them off one at a time.
- Pick a transform and look at the output.
- If it looks closer to readable text, click "Use output as input" and keep going.
- Base64 often ends in
=. Hex is only0-9anda-f. Rot13 shifts every letter by 13. - When you see something shaped like
KEAN{...}, submit it.
Stuck? Show the answer
The order is base64 decode, hex decode, then rot13. The flag is KEAN{practice_makes_perfect}. It's a practice flag only and won't score anything on the real platform.
practice.sh (runs in your browser, nothing is sent)
output