# What is a CTF in cybersecurity?

Canonical: https://hackergpt.org/learn/ctf/

**A CTF, capture the flag, is a security exercise or competition in which you solve hacking challenges on targets built to be attacked, and each solved challenge reveals a secret string, the flag, that you submit for points. It is how many people first practise offensive security legally.**

## Why it matters

A CTF gives you what real targets cannot: permission, a clear goal and proof that you reached it. CTFtime, the site that tracks events, describes the two main formats. In Jeopardy-style CTFs you pick challenges from categories such as web, cryptography, forensics, reverse engineering and binary exploitation. In attack-defence CTFs teams attack each other's services while defending their own.

The skills carry over. A web challenge teaches the same moves as testing a real app: read the page source, list the endpoints, change a parameter, notice what the server reveals. Beginner-oriented platforms such as picoCTF keep challenges online after the event, so you can learn at your own pace.

## Example: a first web challenge on CyberGym

CyberGym, the legal practice target, runs OWASP Juice Shop, which works like a permanent web CTF: dozens of challenges in one shop, each solved by finding a flaw rather than a flag string. A typical first step is plain reconnaissance, which here already points at something:

```
$ curl -s https://cybergym.hackergpt.app/robots.txt
User-agent: *
Disallow: /ftp
```

The file meant to keep search engines out tells you where to look. Opening /ftp/ in the browser lists files, including a .bak backup, and working out how to read what is in that directory is a classic beginner challenge. Writing down each step, what you tried and what the server answered, is the habit that turns CTF practice into testing skill.

Once that method feels natural, you can run the same kind of exercise against your own website: treat your app as the challenge and see what an attacker would find first.

## Common mistakes

- **Jumping to the write-up.** Reading the solution after five minutes teaches the answer, not the method. Set a time box, then look for one hint.
- **Starting with the hardest category.** Web and forensics challenges usually need the least setup. Start there.
- **Attacking the CTF infrastructure.** Rules almost always forbid attacking the scoreboard or other players. Stay inside the stated scope.
- **Treating every real site as a CTF.** Challenges come with permission; real websites do not. Test only targets you own or are authorised to test.

## Related terms

- [Deliberately vulnerable app](https://hackergpt.org/learn/deliberately-vulnerable-app/)
- [Penetration testing](https://hackergpt.org/learn/penetration-testing/)
- [OSINT](https://hackergpt.org/learn/osint/)
- [OWASP Top 10](https://hackergpt.org/learn/owasp-top-10/)

## Go deeper

- [HackerGPT 0.5.0: Advancing Applied Security Training with CTF Mode](https://hackergpt.org/blog/hackergpt-050-advancing-applied-security-training-with-ctf-mode/)
- [CTF Mode: run a CTF on your own website](https://hackergpt.org/features/ctf-mode/)

## Sources

- [CTFtime: What is a CTF?](https://ctftime.org/ctf-wtf/)
- [picoCTF](https://picoctf.org/)
- [Pwning OWASP Juice Shop (the app CyberGym runs)](https://pwning.owasp-juice.shop/)

Test only sites you own or have written permission to test. To practise without one, use CyberGym, a legal, deliberately vulnerable target. [Practise on CyberGym](https://cybergym.hackergpt.app).