Overview
CTF challenges are grouped into categories, each testing a different area of security skill. Knowing the categories helps you find challenges that match what you want to learn and understand what a challenge is asking before you start. This lesson surveys the common CTF categories.
Learning objectives
- Name the major CTF challenge categories.
- Describe the kind of skill each category tests.
- Identify which categories are most approachable for beginners.
Core concept
A category labels the type of challenge and the skill it exercises. Most Jeopardy CTFs organize their board by category so players can specialize or explore. While events vary, a core set of categories appears again and again.
How it works
- Web — Exploiting vulnerabilities in web applications (for example, injection or access-control flaws). Very common and beginner-friendly.
- Cryptography (Crypto) — Breaking or analyzing weak or misused encryption, encodings, and hashing to recover a secret.
- Reverse Engineering (Rev) — Analyzing a compiled program to understand its logic and find the condition that reveals the flag.
- Binary Exploitation (Pwn) — Exploiting memory-safety and logic flaws in a program to make it behave unexpectedly. Usually more advanced.
- Forensics — Recovering hidden or deleted data from files, disk images, memory, or network captures.
- Steganography (Stego) — Finding data concealed inside media such as images or audio.
- OSINT — Using publicly available information to answer a question or locate a flag.
- Miscellaneous (Misc) — Puzzles and scripting challenges that do not fit neatly elsewhere.
Practical example
You open a CTF board and see the Forensics column. A challenge provides a network capture file. The category tells you immediately that the flag is hidden somewhere in the captured traffic, so you know to open it in a traffic-analysis tool and search the streams — rather than, say, looking for an injection flaw as you would in a Web challenge. The category framed your whole approach.
Cybersecurity relevance
The categories map directly onto real security disciplines: application security (Web), applied cryptography, malware and software analysis (Rev/Pwn), incident response and digital forensics, and open-source intelligence. Sampling different categories in CTFs is a low-risk way to discover which areas you enjoy and where your strengths lie, which can guide a future security career.
Common mistakes
- Only ever playing one category and missing the breadth of security skills.
- Ignoring the category label and approaching a challenge with the wrong tools or mindset.
- Assuming all categories are equally hard — Web, Forensics, and OSINT are usually gentler starts than Pwn.
Key takeaways
- CTF challenges are organized into categories such as Web, Crypto, Rev, Pwn, Forensics, Stego, OSINT, and Misc.
- Each category tests a distinct skill and maps to a real security discipline.
- Web, Forensics, and OSINT are typically the most approachable for newcomers; the category tells you how to approach a challenge.
Check your understanding
- What skill does the Reverse Engineering category test, and how does it differ from Web?
- Why is reading the category label a useful first step before solving a challenge?