Capture the Flag: Find What Somebody Hid
Somebody hid a secret in a pile of ordinary files. Go get it.
Somebody hid a secret in a pile of ordinary files. Go get it.
A Capture the Flag challenge gives you a frozen copy of a computer that something happened on. Somewhere in it is a short piece of text called a flag. Find it, type it in, get the points. It always looks like this:
FLAG{restored_from_an_old_backup} Always lowercase, always underscores, always inside the braces. Sometimes it is sitting in a file. More often you work it out and build it yourself, and the briefing tells you the shape.
Nothing is booby-trapped and nothing can break. You are reading files on a machine that only exists while you are inside the challenge. The only skill is noticing.
This is a real challenge in a real shell, running right here on the page. Nothing is pretend except the machine. Type commands, look around, and find the flag. If you have never used a terminal, these four are all you need:
ls | List what is in a folder. Add -la to see dates and hidden files. |
cat <file> | Print a whole file so you can read it. |
grep <word> <file> | Show only the lines containing that word. |
cd <folder> | Move into a folder. cd .. goes back up. |
Type hint in the terminal, or press the hint button. On the real board a hint costs you points, so it is worth trying ls and cat on a few things first. Nothing you type can break anything.
Inside a challenge you have these commands and nothing else. If you have not used a
terminal before, the four that matter are ls to look,
cat to read, grep to filter and find to search by name.
The real power is joining them with a pipe, which feeds the output of one straight into the next. This counts how many times each address appears in a log:
$ grep "Failed" /var/log/auth.log | cut -d' ' -f9 | sort | uniq -c 14 203.0.113.90 1 10.0.4.22
Not in there, and worth knowing before you go looking for them:
Every challenge has hints, and each one takes points off what you earn for solving it. They are there for when you are genuinely stuck, not for when you cannot be bothered. Notice how they narrow instead of just answering.
Using every hint never takes you to zero. A solve always pays at least a quarter of what the challenge is worth, so being stuck and finishing still beats giving up.
There is a board of real challenges waiting in the Terminal, from ones easier than the thing you just did to a couple that take a while. The button at the bottom of this page opens the terminal on your dashboard. Type these into it:
$ ctf list see the board $ ctf start <id> begin one $ hint if you get stuck $ submit FLAG{...} when you have it $ ctf leave come back to it later
People do clear the board, and the next thing to do is write one yourself for everybody else to solve. That turns out to be harder than solving, and there is a whole manual for it.
That is the whole loop: look around, narrow it down, read the one thing that does not fit, and build the answer out of what you found. Every challenge on the board is a harder version of exactly that.
The first move is always to see what is there. A directory listing with timestamps tells you more in three seconds than opening files one by one ever will.
Nobody reads a thousand-line log. You filter it down until only the interesting lines are left, then read those. That is what grep and pipes are for.
Most of what you find is noise that is real but not yours to chase. Knowing what to ignore is as much of the skill as knowing what to follow.
Often the flag is not written anywhere. You work out a name, an address or a time, and build it in the format the briefing gave you.
Put your new knowledge into practice!