Introduction to CTFs
How capture-the-flag works and your first puzzles.
Level 101 · 16 lessons · 15 practice labs
Lessons
How CTFs work and clues in files
- What a CTF is: You will understand how capture-the-flag (CTF) contests work, what types exist, and how this game builds real defensive skills.
- CTF rules, scoring and fair play
- Hidden files: You will learn how to find hidden files and folders on a system, and why sensitive information should never be kept that way.
- Clues from permissions: You will read how wrongly set file permissions give clues away, and learn to find and fix overly broad permissions on your own systems.
- Finding and removing forgotten backup files: You will find .bak, .zip and .old files left in a web folder, see what they leak and remove them safely.
- Short task: find three forgotten files on a lab server
Logs, environment and scripts
- Searching logs: You will learn to search log files for a particular event, user or error, and why logs are such a valuable source of clues.
- Environment variable leaks: You will see how passwords and keys left in environment variables can leak, and learn safer ways to store them.
- Script analysis: You will learn to read a script line by line, understand what it does, and notice risky details buried inside it.
- Weak credentials: In a lab puzzle you will see why default or easy-to-guess credentials are dangerous, and learn stronger alternatives.
- Short task: find the information leaking from the environment and scripts and close its source
Services and the web
- Service discovery: nmap, ss: You will use nmap and ss to find which services are listening on a machine, and learn to ask whether each one is really needed.
- Web forms and POST with curl: You will watch how a web form sends data, using curl against your own lab site, and understand why forms must be validated on the server.
- Path traversal clues: requests that leave the allowed folder: You will check in your own lab whether an app shows files outside its allowed folder when a request contains ../.
- Writing a write-up: making what you learned stick
- Capstone: a small CTF: You will combine what you learned on a fictional company's lab machine, solve a few small puzzles, and document each step in short notes.
Practice labs
- Find the hidden file on this server and take the flag: Search the lab user's home directory for dot files, find the one containing the flag and note its path.
- Use permissions as a clue to find a wrongly exposed file: Find from the permissions the file everyone can read but should not, take the flag and fix the permission.
- Find, remove and list three forgotten backup files: Find leftover .bak, .old and archive files under the web root and /tmp, take their flags and remove the files safely.
- Search the logs for the hidden flag: Search the lab server's log files with grep and record the line containing the flag and its time.
- Find the secret leaking from an environment variable and close its source: Inspect running services' environment variables, find the leaking password and change the service to read it from a protected file.
- Find a password embedded in scripts, rotate it and fix the script: Read the maintenance scripts to find the embedded credential, take the flag, rotate the password and switch the script to a safe lookup.
- Find the lab account with a weak password and strengthen it: Test the lab accounts with the given short list, identify the weak one, take the flag and bring its password in line with policy.
- Find the account reusing one password across services: Confirm the lab account's password works on two services, take the flag and change both passwords separately.
- Map which doors a leaked password opens and close them all: List every lab service the password found in a config file can reach, take the final flag, then close each access and retest.
- Find every service on the lab machine and pick the one carrying a flag: List listening services with nmap and ss, find the one on an unusual port and take its flag.
- Test a web form with curl and check its server-side validation: Send a POST to the lab form with curl, show the client-side check is not repeated on the server, take the flag and add the validation.
- Find the request escaping the allowed folder and fix the app: Confirm the lab download app returns a file outside its allowed folder, take the flag, add path checking and retest.
- Mark the fair-play violations in a CTF rules scenario: Judge five behaviours from the Gelincik Okulları CTF against the rules and explain which ones are violations.
- Write a reproducible solution note for a task you solved: Solve a small lab task and turn your steps, commands and fix recommendation into a note someone else can repeat.
- Solve a three-flag mini CTF and close every hole: Collect the three flags on the lab server, apply the root-cause fix for each and show the flags can no longer be taken.
About this course
How capture-the-flag works and your first puzzles.
What you will learn
- How CTFs work and clues in files
- Logs, environment and scripts
- Services and the web
Prerequisites
No prior knowledge is needed; the course starts from zero.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at beginner level; every term is explained where it first appears.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.