To pick an upcoming CTF, check a public calendar such as CTFtime, match the format (jeopardy, attack-defence or mixed) to your experience, confirm team and time rules, then set one learning goal for the event. Writeups afterwards are where most of the learning happens.
What is a CTF?
Capture the Flag is a security competition. CTFtime, the community calendar, describes three common types: jeopardy, attack-defence and mixed. Flags are usually a string of text in an agreed format, submitted to prove you solved a task.
What are the formats?
Jeopardy CTFs present a board of tasks in categories such as web, forensics, crypto and binary. Teams earn points per solved task, harder tasks usually pay more, and the highest score at the end wins.
Attack-defence is different. Each team gets its own network or host running vulnerable services. You patch your services and write exploits against the other teams' services, scoring for both defence and attack. CTFtime notes this was historically the first type of CTF.
Mixed events combine elements, for example task-based rounds plus a live wargame period.
Where do you find upcoming events?
CTFtime lists upcoming events, past events, writeups and team ratings in one place. It does not host the games themselves. Its FAQ says you cannot play on the site, but you can get a lot of information about events, including format and weight, which feeds its rating formula.
Because event dates change, we do not list any here. Open the calendar the week you plan to play.
How do you choose one that fits you?
A constructed example: a developer with two years of web experience wants to learn security. She skips an attack-defence event that needs a prepared team and infrastructure, and picks a jeopardy event with a strong web category and a long window. She plays with two colleagues, goal: solve one web task and read every writeup for the tasks she could not.
Match three things: format, duration and team size. Short onsite finals reward preparation. Online qualifiers over a weekend are friendlier to newcomers. CTFtime's FAQ says you can play alone, though it says it is more fun in a team, and you can mark yourself as looking for one.
What skills does a CTF actually build?
The categories CTFtime lists, such as web, forensics, crypto and binary analysis, map onto real job tasks. A web task teaches you how input handling goes wrong. A forensics task teaches you to read artifacts without a tool telling you the answer. Binary and reverse engineering tasks teach patience with unfamiliar code.
CTFtime also says good teams tend to have experience across many of these areas, including cryptography, steganography, mobile security and reverse engineering. That is an argument for playing in a team of people with different strengths rather than four copies of yourself.
How do you use the rating system sensibly?
CTFtime publishes team ratings and gives each event a weight that feeds the rating formula. The weight is set from team votes or by site administrators. Ratings are a fun scoreboard, but they are a poor guide to what you should learn next. A beginner will learn more from a lower weight event with approachable tasks and published writeups than from a top weight event where most tasks go unsolved.
Check whether the organizer promises to release the tasks or solutions afterward. Writeups are the closest thing to a textbook the format has.
How to check or apply this
- Open the CTFtime upcoming list and filter by the format you want.
- Read the event page for rules: team size, scoring, whether an invitation or qualification is needed.
- Check the organizer's site for infrastructure, allowed tools and any code of conduct.
- Agree a single goal before it starts, such as solving one task in a new category.
- Keep notes while you play, with commands tried and dead ends.
- After the event, read and post writeups. Compare your approach with the winners.
Quick check
Can I play a CTF on CTFtime itself?
No. CTFtime is a calendar and ratings site. You play on the organizer's own platform.
Do I need a team?
Not always. CTFtime's FAQ says you can play alone or look for a team, and many events allow either.
Is attacking other systems at a CTF legal?
Only within the scope and rules the organizer sets for the event. Never use techniques learned in a CTF against systems you do not have permission to test.
Sources
Last reviewed: 18 October 2026.
