Introduction to capture-the-flag
10 modules · ~16 contact hours · no prerequisites beyond a browser
A sequenced introduction to the techniques capture-the-flag competitions actually test: encoding recognition, classical and modern cryptanalysis, hash cracking, web tokens, file and network forensics, steganography, and binary exploitation. Every technique is practised in a browser tool that runs the real algorithm locally, and assessed by a produced artefact rather than a quiz.
Materials
- ctfpal - https://ctfpal.com. A static web application with 89 documented tools. No installation, no account, no cost.
- Any modern browser. A locked-down lab machine or a Chromebook is sufficient.
- Practice challenges are hosted by picoCTF and are free; the course links them rather than redistributing them.
Software and data-protection statement
All processing happens in the student’s browser using JavaScript and WebAssembly. Files students open are read through the File API and are never transmitted. There are no user accounts, no server-side storage, and no analytics or telemetry. Work is held in the browser’s own IndexedDB on the student’s machine and can be cleared like any other site data. The source is public and MIT licensed, so it can be reviewed, forked, or self-hosted on institutional infrastructure.
Three features make outbound requests, and only when a student explicitly uses them: the HTTP request replayer and the path scanner, which contact a target the student names and are covered by the responsible-use policy below, and an optional AI triage helper that is inert unless the student supplies their own API key.
Assessment
Each module carries one checkpoint: a specific artefact the student either produced or did not. Because every tool is deterministic, two students who did the work correctly submit the same value, which makes marking fast and bluffing hard. Practice challenges are formative and ungraded.
Responsible use
Several tools perform active testing against a target the user names. Used against systems the user does not own and has no written permission to test, that is a criminal offence in most jurisdictions. Cover this before the web module rather than alongside it; a student who learns the technique without the boundary has been taught badly.
Module schedule
1. Recognising encodingsFoundation · 60 min · 52 challenges
Tell Base64 from hex from Base32 from binary on sight, peel layered encodings, and learn why an encoding is not encryption.
Objectives
- Identify Base64, Base64-URL, hex, Base32, binary, and Morse from their alphabets alone
- Decode a multi-layer wrapper without guessing the order
- Explain why encoding provides no confidentiality
- Recognise when a decode produced bytes rather than text, and switch approach
Checkpoint: Given a three-layer encoded string, produce the plaintext and state each layer in order.
Tools: Cipher identifier and automatic decoder, Base64 decoder and encoder, Hex to text converter, Base32 decoder and encoder, Binary to text converter. Reading: Spot the encoding: reading base64, base32, hex and friends at a glance, The first ten minutes: a triage playbook for any CTF challenge.
2. Classical ciphers and frequency analysisFoundation · 90 min · 23 challenges
Break Caesar, Vigenere, and arbitrary substitution using letter statistics - and learn why statistics beat guessing.
Objectives
- Break a Caesar shift with chi-squared scoring rather than by reading 26 candidates
- Recover a Vigenere key length using the index of coincidence, then the key itself per column
- Distinguish a transposition from a substitution by looking at letter frequencies
- Explain why short ciphertexts defeat statistical attacks
Checkpoint: Recover a Vigenere key from ciphertext alone and report the index of coincidence at each candidate period.
Tools: Caesar cipher decoder with automatic shift detection, Vigenere cipher solver with automatic key recovery, Monoalphabetic substitution cipher solver, Rail fence cipher solver. Reading: Chi-squared, index of coincidence, and why classical ciphers fall.
3. Hashes, identification and crackingFoundation · 60 min · 13 challenges
Identify a digest by shape, understand why hashing is one-way, and learn where wordlist cracking works and where it is a trap.
Objectives
- Identify a hash from its length and prefix, and name the ambiguities that length alone cannot resolve
- Explain the difference between encoding, encryption, and hashing
- Crack a fast unsalted hash with a wordlist and rule transforms
- Recognise a deliberately slow hash and choose a different approach
Checkpoint: Identify an unknown digest, justify the identification, then crack it - or argue from the algorithm why cracking is the wrong path.
Tools: Hash identifier with hashcat mode lookup, MD5, SHA-1 and SHA-256 hash generator, In-browser hash cracker with rule transforms, SHA-3, BLAKE2, Keccak and RIPEMD calculator. Reading: Hash cracking that actually works: identify, wordlist, rules, mask.
4. XOR and the cost of reusing a keyCore · 90 min · 9 challenges
Break single-byte and repeating-key XOR, then recover both plaintexts from a reused one-time pad by crib dragging.
Objectives
- Brute-force single-byte XOR and score candidates automatically
- Detect a repeating keysize using normalised Hamming distance
- Recover two plaintexts from a reused pad without ever learning the key
- Explain why key reuse destroys a cipher that is otherwise information-theoretically secure
Checkpoint: Given two ciphertexts under one reused key, recover both plaintexts and describe each crib you used.
Tools: XOR cipher decoder and key recovery, XOR crib dragging for many-time pads, Hex to text converter. Reading: XOR, crib dragging, and the two-time pad.
5. RSA and the parameters that break itCore · 120 min · 23 challenges
Work the RSA decision tree - small modulus, close primes, tiny exponent, shared modulus - and learn to read a key for its weakness.
Objectives
- Recover a private exponent from a factored modulus
- Choose an attack from the shape of n, e, and the number of ciphertexts
- Apply Fermat factorization, Wiener’s attack, and the common-modulus attack
- Explain why textbook RSA without padding enables attacks that padded RSA does not
Checkpoint: Given three RSA challenges with different weaknesses, name the applicable attack for each before running anything, then verify.
Tools: RSA decryption and attack runner, Fermat factorization for close RSA primes, Wiener’s attack on small RSA private exponents, RSA common modulus attack, Hastad broadcast attack on RSA. Reading: The RSA attack decision tree.
6. Web attacks and session tokensCore · 120 min · 36 challenges
Read and forge JWTs and Flask sessions, find content nobody linked to, and probe for injection with detection payloads.
Objectives
- Decode a JWT and identify the attack its header enables
- Forge an alg=none token and recover a weak HMAC secret offline
- Discover unlinked content, including exposed .git directories
- Choose a detection probe for SQL injection, SSTI, and command injection, and read the response for confirmation
Checkpoint: Take a JWT-protected endpoint and reach an admin-only response, stating which of the three token weaknesses you used and why the other two did not apply.
Tools: JWT decoder and signature verifier, JWT alg=none bypass generator, JWT secret brute force, Directory and path scanner, Exposed .git directory dumper, Web attack payload catalog. Reading: Attacking JWTs: alg=none, algorithm confusion, and the header fields nobody audits.
7. File forensics and carvingCore · 90 min · 34 challenges
Identify files by their bytes, find data appended past a format’s end marker, and pull evidence out of images and documents.
Objectives
- Identify a file’s real type regardless of extension
- Find and extract data hidden after a format’s terminator
- Read EXIF, PNG chunks, and JPEG segments for metadata and appended payloads
- Repair a deliberately corrupted header
Checkpoint: Given a polyglot file, extract every embedded file it contains and state the offset and signature of each.
Tools: File type identifier by magic bytes, Strings extractor for binaries and blobs, Hex viewer and hexdump, PNG chunk analyzer, EXIF metadata viewer, Magic byte and file signature table. Reading: The first ten minutes: a triage playbook for any CTF challenge.
8. SteganographyCore · 90 min · 29 challenges
Sweep an image, audio file, or paragraph for hidden data across the whole technique space rather than guessing one method.
Objectives
- Extract LSB data across channels, bit orders, and traversal directions
- Read a spectrogram to distinguish painted text, Morse, SSTV, and DTMF
- Detect zero-width and whitespace steganography in plain text
- Explain why LSB survives in PNG and dies in JPEG
Checkpoint: Solve a nested stego challenge and draw the chain of containers from the outermost file to the flag.
Tools: Automatic steganography solver, LSB steganography extractor, Audio spectrogram and SSTV decoder, Zero-width character and text steganography decoder. Reading: A workflow for image steganography, from magic bytes to bit planes.
9. Network forensicsAdvanced · 90 min · 17 challenges
Triage a packet capture: find the one conversation that matters, extract transferred files, and spot exfiltration over DNS.
Objectives
- Use a protocol breakdown to decide where to look first
- Reassemble a TCP stream and read a plaintext protocol
- Extract files transferred over HTTP, FTP, or SMB
- Recognise DNS tunnelling and decode the exfiltrated payload
Checkpoint: From a capture, produce the exfiltrated payload and the exact query sequence that carried it.
Tools: PCAP analyzer for CTF network forensics, Base32 decoder and encoder, Timestamp converter (Unix, ISO, FILETIME, HFS+), Strings extractor for binaries and blobs. Reading: PCAP triage: finding the flag in a hundred thousand packets.
10. Binary exploitationAdvanced · 150 min · 51 challenges
Read a binary’s protections, find an overflow offset in one crash, and build a ROP chain when the stack is not executable.
Objectives
- Read NX, PIE, canary, and RELRO from a binary and say what each rules out
- Find an overflow offset with a de Bruijn pattern in a single crash
- Build a ret2libc chain, including stack alignment
- Turn a leaked pointer into a libc base and resolve arbitrary symbols
Checkpoint: Given a 64-bit binary with NX and no PIE, produce a working ret2libc exploit and explain each entry in the chain.
Tools: ELF, PE and Mach-O binary analyzer, Buffer overflow offset finder, ROP gadget finder, ROP chain and payload builder, Libc base address calculator, Pwntools exploit script generator. Reading: From crash to shell: stack overflows, offsets, ret2win, and ret2libc.
Licence
This syllabus and the tool it teaches are MIT licensed. Adapt it, reorder it, cut it to fit your term, and use it without attribution or permission.