What Is a Capture the Flag (CTF)?
On this page
A Capture the Flag (CTF) is a legal hacking competition where you solve security challenges to find hidden strings called flags. Each flag proves you completed a task — exploited a web app, cracked a cipher, reverse-engineered a binary. CTFs are deliberately vulnerable environments built for exactly this, which makes them one of the best and safest ways to build real offensive skills.
What are the formats?#
| Format | How it works |
|---|---|
| Jeopardy | Solve independent challenges by category for points |
| Attack-Defense | Defend your own services while attacking others’ live |
| King of the Hill | Compete to control and hold a target system |
Jeopardy-style is the most common and beginner-friendly: challenges are grouped into categories like web exploitation, cryptography, reverse engineering, forensics, and binary exploitation, each worth points by difficulty.
Why CTFs are great practice#
Because they combine legality, structure, and fun. You get to actually exploit things — the reason many people got into security — without any legal risk, since everything is built to be attacked. They build practical skills, teach persistence (challenges are meant to be hard), and give you something concrete for your portfolio.
CTFs are legal, hands-on skill building. See how to approach them in approaching a CTF challenge and the Careers & Practice hub.
Frequently asked questions#
What is a CTF in cybersecurity?
A Capture the Flag (CTF) is a security competition where participants solve challenges to find hidden strings called flags, which prove they completed the task. Challenges span web exploitation, cryptography, reverse engineering, forensics, and more. CTFs are legal, deliberately vulnerable environments built for practice — a safe, fun way to build real skills.
What are the main CTF formats?
The two main formats are Jeopardy-style, where teams solve independent challenges across categories for points, and Attack-Defense, where teams both defend their own services and attack others’ in real time. Jeopardy is the most common and beginner-friendly; Attack-Defense is more advanced and closer to live operations.