A capture the flag, or CTF, is a security competition. The three common types are Jeopardy, attack-defense and mixed. Jeopardy teams solve separate challenges for points. Attack-defense teams guard their own services while attacking others. Mixed events blend both. Beginners usually start with Jeopardy.
What is a CTF?
CTFtime, the long-running community calendar of events, describes CTFs as a special kind of information security competition and names those three formats. The goal in most is to find a "flag," a string of text hidden in a challenge, and submit it for points.
How does Jeopardy style work?
Challenges sit on a board by category, such as web, cryptography, reverse engineering, forensics and binary exploitation. Harder tasks are worth more points. Teams pick what to attempt, and the highest total at the end wins. CTFtime points to the DEF CON qualifying round as a famous example.
What it trains: breadth and the habit of working a puzzle alone. You can stop on a hard challenge and move on. It is the easiest format to join from a laptop, and many events let you play online.
A web challenge might ask you to find why a login page leaks a user list. A forensics one might hand you a packet capture and ask what file left the network.
How does attack-defense work?
Each team gets its own network, or a single host, running vulnerable services. There is time to patch your own services and to write exploits. Then organizers connect the teams and the game starts. You earn defense points by keeping your services up and unbroken, and attack points by exploiting the others.
CTFtime notes that this was historically the first CTF type. What it trains is closer to real operations: patching under pressure, watching traffic, and noticing that someone is already inside. It is also harder to organize and to join, because it needs running infrastructure and a team with different roles.
What are mixed CTFs?
Formats vary. CTFtime gives the example of a wargame that includes a period for task-based challenges. Mixed events often add a scoreboard for a puzzle round on top of a live network.
Which one should you start with?
If you are new, Jeopardy. It teaches the core skills without the pressure of a live opponent. After a few events you will know which category pulls you in. If you work in a defensive role, an attack-defense game gives something Jeopardy cannot, which is practice at defending something that is being attacked in real time.
A constructed team plan
A team of four students enters a 48 hour online Jeopardy event. One takes web and cryptography, one takes forensics, one takes reverse engineering, and one floats. They agree to give each challenge a time box of 90 minutes before asking for help. They finish mid-table and write up the two challenges they solved, which is where most of the learning happens.
What skills does each category build?
Web challenges teach how applications fail through input handling and access control. Cryptography teaches why small mistakes in schemes break them. Reverse engineering teaches reading code you did not write. Forensics teaches reconstructing events from files and traffic captures. Binary exploitation teaches how memory bugs turn into control. Many working security engineers started in one of these and then widened out.
A defender gains from every category, because knowing how an attack works is what makes a good detection or a good fix possible.
How to check or apply this
- Pick a Jeopardy event with a published difficulty and a beginner category.
- Split roles by category and agree on a time box per challenge.
- Keep a shared notes document and record commands as you go.
- After the event, read the writeups of challenges you could not solve.
- For defenders, try an attack-defense event once you are comfortable with basics.
- Only attack systems that the rules of an event put in scope.
Quick check
Is a CTF legal practice?
Yes, inside the event, against the targets the organizers provide. Attacking anything outside the rules is not covered and may be illegal.
What is a flag?
A secret string, often in a set format, that proves you solved a challenge. You submit it to the scoreboard.
Sources
Last reviewed: 18 October 2026.
