Overview
A Capture The Flag (CTF) is a cybersecurity competition where you solve security challenges to earn points. CTFs are a safe, legal, and sandboxed way to build hands-on skills: every target is provided for you to attack, so there is no ambiguity about authorization. Before diving into challenges, it helps to understand the main formats a CTF can take, because the format shapes how you play.
Learning objectives
- Describe the three most common CTF formats.
- Explain how scoring differs between formats.
- Choose a format that matches your goals as a beginner.
Core concept
CTFs come in a few well-established formats. The format determines whether you are solving self-contained puzzles, attacking and defending live systems, or competing for control of a shared target. Understanding this up front tells you what kind of activity to expect and how points are awarded.
How it works
- Jeopardy — The most common and beginner-friendly format. A board presents challenges grouped by category (web, crypto, forensics, and so on), each worth points. You solve a challenge, find its flag, submit it, and earn the points. Challenges are independent, so you can work at your own pace and pick what interests you.
- Attack-Defense — Each team is given an identical set of vulnerable services to run. You must defend your own services (patching flaws) while attacking other teams' services to steal their flags. This format runs in real time and rewards both offensive and defensive skill.
- King of the Hill (KotH) — Teams compete to gain and hold control of a shared target system. You score points for the duration you maintain control, so you must both take the system and keep others out.
Practical example
A beginner joins an online Jeopardy event. They see a category board with a "Web" column containing challenges worth 50, 100, and 200 points. They open the 50-point challenge, read the prompt, work out the flag, paste it into the submission box, and watch their score go up. Because challenges are independent, they skip a hard one and return to it later — a workflow unique to the Jeopardy format.
Cybersecurity relevance
CTF formats mirror real security work. Jeopardy challenges isolate a single skill (like exploiting one bug), which is ideal for focused learning. Attack-Defense mirrors the reality that defenders and attackers operate on the same systems simultaneously. King of the Hill emphasizes persistence and hardening. Knowing the format helps you prepare, allocate time, and understand how your effort translates into score.
Common mistakes
- Assuming every CTF is Jeopardy and being surprised by real-time attack-defense pressure.
- Ignoring defense in attack-defense events and losing points to other teams.
- Not reading the event format before it starts, so time is wasted adjusting.
Key takeaways
- The three common CTF formats are Jeopardy, Attack-Defense, and King of the Hill.
- Jeopardy uses independent, point-valued challenges and is the best starting point for beginners.
- Attack-Defense and King of the Hill are real-time and reward defending or holding systems, not just solving puzzles.
Check your understanding
- How does scoring in a Jeopardy CTF differ from scoring in King of the Hill?
- Why is the Jeopardy format usually recommended for beginners?