A Beginner's Guide to CTF

🏴 What Even Is a CTF?

Capture The Flag competitions are cybersecurity challenges where you break into intentionally vulnerable systems, solve puzzles, and find hidden strings of text called flags — usually formatted like FLAG{s0m3th1ng_h3r3} or THM{...} on TryHackMe. Think of it as legal hacking with a gold star at the end instead of handcuffs.

CTFs are genuinely one of the best ways to go from "I want to learn hacking" to actually understanding how systems break. You learn by doing — not by watching a 10-hour YouTube playlist, taking notes on slide 3, and then never opening the folder again. (We've all been there. No judgment.)

🧠 The Core Mindset

📡 Step 1: Reconnaissance with Nmap

Almost every machine-based CTF starts with Nmap. It scans your target and tells you what's open, what's listening, and sometimes embarrassingly what version of software is running that hasn't been patched since 2014.

Basic scan

nmap <target-ip>

The scan you'll actually use most

nmap -sC -sV -oN scan.txt <target-ip>

• -sC runs default scripts that poke services for extra info
• -sV detects service versions (very useful, very juicy)
• -oN scan.txt saves the output — because you will forget to scroll up

Thorough scan (all ports)

nmap -p- -sC -sV <target-ip>

The -p- flag scans all 65,535 ports. The default scan only hits the top 1,000. CTF creators love hiding services on weird ports like 8080, 4444, or 31337 specifically to catch people who didn't bother scanning properly. Don't be that person.

🌐 Step 2: Web Enumeration

Found a website? Great. Your next tools are your browser and a directory scanner, and your first move costs you nothing.

Look at the page source. Right-click, View Page Source, Ctrl+F for "flag". CTF makers have a time-honoured tradition of leaving flags or hints in HTML comments like some kind of digital Easter egg hunt. Check for things like <!-- TODO: remove this before going live -->. Spoiler: they did not remove it before going live.

Check /robots.txt — this file tells search engines what not to crawl. It accidentally reveals hidden paths like /admin or /secret with suspicious regularity.

Directory busting with Gobuster

gobuster dir -u http://<target-ip> -w /usr/share/wordlists/dirb/common.txt

This brute-forces URL paths to find hidden pages. A good wordlist matters — common.txt is fine to start, but directory-list-2.3-medium.txt from SecLists will find things common.txt would miss.

🔑 Step 3: Finding and Cracking Credentials

You'll regularly stumble across password hashes sitting in files, databases, or /etc/shadow like someone left their diary out. Your job is to crack them open.

Identify the hash type first. Use hash-identifier or just paste it into hashes.com — it identifies the type and sometimes cracks it on the spot.

Crack with Hashcat

hashcat -m 0 hash.txt /usr/share/wordlists/rockyou.txt

-m 0 is MD5. Swap the mode number for other types (-m 1000 for NTLM, -m 1800 for sha512crypt). The rockyou.txt wordlist cracks a genuinely embarrassing number of CTF hashes. People really do use password123.

Crack with John

john hash.txt --wordlist=/usr/share/wordlists/rockyou.txt

John is easier to use but slower. Particularly handy for SSH key passphrases using ssh2john.

⬆️ Step 4: Privilege Escalation

You've got a foothold — a low-privilege shell, probably as some user called www-data who has the permissions of a tired intern. Now you need root. This is where most beginners stare at the screen and question their life choices.

Run LinPEAS immediately

curl -L https://github.com/peass-ng/PEASS-ng/releases/latest/download/linpeas.sh | sh

This script enumerates the machine and highlights privilege escalation paths in colour. Red and yellow highlights are your best friends.

🚩 Common Flag Patterns

Flags aren't always sitting on the desktop with a bow on top. Here's where they tend to lurk:

• /root/root.txt — the TryHackMe classic
• /home/<user>/user.txt — user flag location
• Hidden files — ls -la shows dotfiles. Check .bash_history, .ssh/, .config/
• Inside images (steganography) — use steghide extract -sf image.jpg or strings image.jpg
• Encoded strings — Base64, ROT13, Caesar cipher. Paste into CyberChef
• Source code & config files — hardcoded database credentials and API keys appear constantly
• Git repositories — git log and git show — the commit history is permanent

🕵️ OSINT Challenges

OSINT (Open Source Intelligence) CTFs don't involve touching a machine at all. You're handed an image, a username, or a single clue, and asked to dig up real-world information from public sources. It's less "hack the planet" and more "I am a digital detective."

Core OSINT techniques

• Reverse image search — Google Images, TinEye, or Yandex Images (suspiciously good at identifying locations)
• Username lookup — Sherlock searches hundreds of platforms — python3 sherlock username
• Geolocation from photos — look for landmarks, street signs, sun angle, vegetation, license plates. GeoGuessr helps
• Domain/IP research — whois, Shodan, VirusTotal
• Metadata in files — exiftool image.jpg — GPS coordinates get embedded in photos constantly
• Wayback Machine — web.archive.org — the internet never truly forgets

OSINT rooms reward patience and lateral thinking more than technical skill, making them a great entry point if the command line still feels a bit intimidating.

🎯 Beginner Rooms (TryHackMe)

First real challenges

OSINT rooms

When you're feeling confident

🔄 The Workflow

When you first connect to a TryHackMe machine, do this until it becomes muscle memory:

1. nmap -sC -sV -oN scan.txt <ip> — figure out what you're working with
2. If web is open, browse manually first, then run Gobuster
3. Research any service versions — search <service> <version> exploit
4. Get a foothold through whatever vulnerability you find
5. sudo -l and find / -perm -4000 2>/dev/null the moment you land
6. GTFOBins anything suspicious
7. Grab your flags from /home/*/user.txt and /root/root.txt

Simple. Repeatable. Works embarrassingly often.

💬 Final Thoughts

CTFs will make you feel dumb. Genuinely, properly stumped in ways that make you question if you even know how computers work. That's completely normal and honestly the whole point — because the moment something clicks after two hours of being stuck, you've learned it in a way that actually sticks.

The TryHackMe community is helpful, write-ups exist for every room if you've been stuck for too long and just need a nudge, and the learning curve flattens out faster than you'd expect once you get the fundamentals down.

Keep a notes folder. Write down every technique that works. Six months from now you'll look back at your first solve and barely recognise your own thought process — and that's a genuinely good feeling.