Capture the Flag (CTF).

Capture the Flag (CTF) is a cybersecurity competition format where participants find hidden strings — called flags, typically formatted like flag{...} or CTF{...} — by solving challenges in categories such as web exploitation, binary exploitation (pwn), reverse engineering, cryptography, forensics, and OSINT. Two main formats dominate: Jeopardy-style, where teams pick standalone tasks worth points, and attack-defense, where each team operates an identical vulnerable service and scores by exploiting opponents while patching their own.

The oldest and most prestigious event is DEF CON CTF, run at the Las Vegas conference since DEF CON 4 (1996); teams qualify through a gruelling online round, and the finals use a live attack-defense network where a scorebot plants and harvests flags each round. Organizing duty rotates — the Order of the Overflow ran it from 2018 to 2022 and the Nautilus Institute has run it since 2023. Global standings are aggregated by CTFtime.org, where academic powerhouses like Carnegie Mellon's Plaid Parliament of Pwning (PPP) consistently rank at the top. Jeopardy scoreboards often use dynamic scoring, where a challenge's point value decays as more teams solve it, rewarding rare breakthroughs. Educational ladders — picoCTF (Carnegie Mellon), HackTheBox, TryHackMe, and Google CTF — democratize entry from middle-school to professional level. Beyond sport, CTFs sharpen real skills in exploit development, incident triage, and secure coding, and are a staple of security recruiting pipelines and certification prep.

flowchart TD
  A[CTF competition] --> B[Jeopardy-style]
  A --> C[Attack-defense]
  B --> B1[Web / Pwn / Crypto<br/>Rev / Forensics / OSINT]
  B1 --> B2[Solve challenge -> flag{...}]
  B2 --> B3[Submit flag<br/>dynamic scoring]
  C --> C1[Run identical<br/>vulnerable service]
  C1 --> C2[Exploit opponents<br/>+ patch your own]
  C2 --> C3[Scorebot plants &<br/>harvests flags per round]
  B3 --> D[Ranking on CTFtime.org]
  C3 --> D