Capture The Flags, or CTFs, are a kind of computer security competition used by hackers to test skills, by companies to recruit, and by everyone to learn.
Teams of competitors (or just individuals) are pitted against each other in a test of computer security skill. There are two kinds of CTF competitions: Jeopardy and Attack & Defense.
Jeopardy CTFs are the most common kind of CTF. They revolve around a set of challenges which are provided by competition organizers to competitors.
Each challenge is designed so that when solved, a small piece of text or "flag" is revealed. The flag is submitted to a scoring engine in exchange for points, usually relative to the challenge's difficulty.
Competitors usually receive about 72 hours — typically the course of a weekend — to solve as many challenges as possible.
Examples
Attack & Defense CTFs are less common and rarely done for the general public because of their complexity.
Teams are each given the same set of vulnerable server software to set up and audit before the competition. Once connected to an isolated network, teams launch attacks against each other's servers while patching their own to defend against exploits.
Teams earn points for extracting flags, defending their own flags, and keeping their services running normally.
Examples
Hundreds of CTFs happen every year and that number is only growing. CTFs have been used since at least 1996 by hackers looking to test each others' skill — it's almost like hacker practice, but for the good guys.
CTFs promote problem solving and team building, and can expose participants to completely foreign topics and technologies they might never encounter day-to-day. Some companies even use CTFs to recruit new employees.
Capture The Flags are one of, if not THE best way to get started in security. They can be a little hard. You definitely won't be spoonfed. You'll probably get stuck at some point.
But if you stick with it, you'll learn more about computers than you ever thought possible. There's no better way to learn something than to experience it for yourself — and in the computer security world, Capture The Flag is the best way to learn by doing.
Made with ❤️ in New York City