What is a CTF (Capture the Flag) in cybersecurity?
A Capture the Flag (CTF) is a cybersecurity competition in which players solve hands-on security challenges to find hidden strings called flags, earning points that prove they exploited or analyzed each target.
A CTF turns security skills into a game. Each challenge hides a flag, usually a short unique string, that you can only retrieve by successfully hacking, decoding, or analyzing something. Submitting the flag proves you solved it and scores points.
What are the main CTF formats?
- Jeopardy style offers a board of standalone challenges grouped by category and point value.
- Attack-defense gives each team a vulnerable server to patch while attacking opponents.
- King of the Hill rewards holding control of a target over time.
Common CTF categories
| Category | Skill tested |
|---|---|
| Web | Exploiting web app flaws |
| Pwn / binary | Memory corruption and exploitation |
| Reverse engineering | Understanding compiled code |
| Crypto | Breaking weak cryptography |
| Forensics | Analyzing files, memory, and traffic |
| OSINT | Finding public information |
Many challenges require chaining techniques such as gaining a reverse shell and then privilege escalation to read a protected flag.
How to practice CTFs hands-on
CTFs are one of the best ways to build practical, job-relevant skills. On Purple Edge the penetration-testing learning hub includes Capture the Flag challenges and full events in live cloud labs, so you exploit real targets and hunt real flags rather than answering quiz questions.
Practice this in the Learn Penetration Testing and Ethical Hacking learning path.
Put this into practice
Spin up real Kali, Ubuntu and Windows labs in your browser and learn by doing. Guided, hands-on, no setup.
Last updated: 2026-06-16