CTF practice: learn web hacking one flag at a time

A capture-the-flag (CTF) challenge hides a flag behind a vulnerability and asks you to find it. It is the most direct way to learn web hacking legally, because the target was built to be attacked and the flag tells you when you got it right.

Start with web challenges for beginners, then read how CTF Mode works: it drives a browser, keeps the payloads that worked and remembers what you found across a long session, and it coaches you toward the flag instead of handing it over.

CTF Mode runs a CTF on your own website, or helps you work through CTF tasks you bring.

Articles

• CTF for beginners: start with web challenges

  What a CTF is, the main challenge categories, a small starter toolset, and a worked web challenge on CyberGym — plus how an AI can coach you through one without handing over the flag.

• HackerGPT 0.5.7: Stateful CTF Engagements, Concurrent Steering, and Decoupled Browsing

  Explore the latest HackerGPT update featuring stateful memory for CTF engagements, concurrent task steering, and a decoupled, low-latency browsing engine.

• HackerGPT 0.5.0: Advancing Applied Security Training with CTF Mode

  Discover HackerGPT 0.5.0's new CTF Mode. Learn how headless browser automation, traffic interception, and payload management streamline security training.