YanoSecA Capture the Flag event, usually shortened to CTF, presents security puzzles as challenges. In a Jeopardy-style event, you choose separate challenges from a board. A flag is the event's expected answer or proof of completion; submitting it may earn points. This course's Desk Lamp board is fictional and has no external flag or live service.
Read a row before choosing a tool. Its identifier names the challenge, its category groups a kind of work, its value gives the organizer's points and its state tells you whether it is available in this packet. The task and rules tell you what you may actually use. A high point value does not mean a task is a suitable starting point.
Before you begin
- Recommended first
- Where practice is allowed, How to take notes, Logs as evidence, Binary, hex, Base64, and URL encoding, HTTP methods, headers, status codes, cookies
- Estimated time
- 12 min reading, 15 min activity. Setup and optional practice may take longer.
- Where you work
- Use the original fictional Desk Lamp board and supplied files in any current desktop or mobile browser. No account, event registration, installation or network request is required. Keep draft notes in your own file.
- Without a lab
- All board rows, requests, rules and log lines needed for reasoning are printed here. Trace them in notes and compare with the activity rubric; label fictional or predicted evidence accurately. Reading works without JavaScript. Checking needs JavaScript and a secure context; saving also needs usable browser storage.
After this lesson you can:
- Name the category, value, state, and task on one Desk Lamp card.
- Choose an open card with a local file or a saved request.
- Place a Base64 note with the encoding category when the other choice is binary exploitation.
01Example
Compare two fictional challenge rows. F-3 provides a taught file-reading task, while P-9 names a memory skill that comes later. No program was run.
F-3 Files 50 open
Task: read a supplied local note.
Choice: suitable entry; file-reading is already taught.
P-9 Binary exploitation 300 later
Task: reason about a write beyond a memory buffer.
Choice: defer until the memory lessons.
The higher value does not supply the missing skill.02What a row is for
F-3 is open and asks you to read a supplied note, so its materials and skill are available. P-9 says later and concerns memory bounds, a skill taught in Pwn. Here later describes the task's readiness; it does not lock a route in the course. A real event may use different availability rules.
Categories are organizer labels. On this board, encoding tasks are filed under Cryptography even though Base64 itself provides no cryptographic secrecy. Reading a saved HTTP request belongs to Web; tracing a compiled program belongs to Reverse Engineering. Read the task's actual operation as well as its label.
The scoreboard and account system operate the event; they are not automatically challenge targets. The printed grant permits only the named files. A Host header inside a request is evidence to read, not permission to connect to that name.
Read a board's category, value, state, and task, then pick an open card whose skill you can already name.Model. A teaching model drawn by hand. It shows the idea, not real tool output.
Read the full explanation below.
Supplied local note only
Files · 50 points
File reading is already taught.
No challenge was launched.
File reading is already taught. No challenge was launched.
Follow the explanation
- File reading is already taught. No challenge was launched.
- The higher points do not supply the missing memory skill. Later does not lock course reading.
Read every state and value
1. File reading is already taught. No challenge was launched.
- Task
- F-3: read a supplied local note
- Choice
- f3-ready
- Relevant skills
- File reading
2. The higher points do not supply the missing memory skill. Later does not lock course reading.
- Task
- P-9: write beyond a memory buffer
- Choice
- p9-later
- Relevant skills
- Memory bounds
03Pick the open request
Use the text board. The HTML file has the same six rows. Cover the check, choose the card, then look.
Desk Lamp board
Label: original fictional board. No live host, no flag, and no scoreboard submission.
Printed window: 2026-10-12 18:00-21:00 UTC. Missing that window does not lock a lesson on this site.
ID Category Value State Task
F-3 Files 50 open Read the local note. First line: the spare lamp is on shelf 2.
W-8 Web 50 open Read the saved HTTP request. Do not send it.
C-2 Cryptography 100 open Turn a supplied encoding back into text.
L-6 Forensics 100 open Read timestamped lines and cite one line id.
R-4 Reverse Engineering 200 later Follow a compare and a jump in assembly.
P-9 Binary exploitation 300 later A write goes past the end of a buffer.
open means the card's text is in this course.
later means the skill is taught after First CTF and is not required to finish this stage.
Value is the organizer's point number on this fictional card. It is not a measure of readiness.
The scoreboard and the login are out of scope.
Full rules: rules.txt.
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8">
<title>Desk Lamp board</title>
</head>
<body>
<h1>Desk Lamp board</h1>
<p>Original fictional board. No live host, no flag, and no scoreboard submission.</p>
<p>Printed window: 2026-10-12 18:00-21:00 UTC. Missing that window does not lock a lesson on this site.</p>
<table>
<thead>
<tr><th>ID</th><th>Category</th><th>Value</th><th>State</th><th>Task</th></tr>
</thead>
<tbody>
<tr><td>F-3</td><td>Files</td><td>50</td><td>open</td><td>Read the local note. First line: the spare lamp is on shelf 2.</td></tr>
<tr><td>W-8</td><td>Web</td><td>50</td><td>open</td><td>Read the saved HTTP request. Do not send it.</td></tr>
<tr><td>C-2</td><td>Cryptography</td><td>100</td><td>open</td><td>Turn a supplied encoding back into text.</td></tr>
<tr><td>L-6</td><td>Forensics</td><td>100</td><td>open</td><td>Read timestamped lines and cite one line id.</td></tr>
<tr><td>R-4</td><td>Reverse Engineering</td><td>200</td><td>later</td><td>Follow a compare and a jump in assembly.</td></tr>
<tr><td>P-9</td><td>Binary exploitation</td><td>300</td><td>later</td><td>A write goes past the end of a buffer.</td></tr>
</tbody>
</table>
<p>open means the card's text is in this course. later means the skill is taught after First CTF and is not required to finish this stage.</p>
<p>Value is the organizer's point number on this fictional card. It is not a measure of readiness.</p>
<p>The scoreboard and the login are out of scope. Full rules are in rules.txt.</p>
</body>
</html>
Desk Lamp rules
Label: original fiction. These rules govern the cards in this course. They are not a real event's terms.
1. Material. Use only the file named on the card you chose.
2. Hosts. A Host header is text in a saved request. Do not look it up, connect, or send the request.
3. Scoreboard. The scoreboard and the login are out of scope. Points on a card are the card's value, not a target.
4. Sharing. A method note may stay in your own file. Do not post a solution on a public page. Do not send the note from this course.
5. Flags. This board has no flag to submit. Do not bring a flag from another event into these notes.
6. State. open means the card's file is in this course. later means the skill is taught in a later stage and is not required to finish First CTF.
7. Window. The printed window is 18:00-21:00 UTC. Missing it on a real calendar does not lock a lesson on this site.
- Read rules 2 and 3. A host name on a card is text. The scoreboard is out of scope.
- Find the open card whose task is a saved HTTP request.
- Check: that card is W-8. R-4 stays later because the task asks for assembly.
- Stop. Do not send a request, and do not look up a host.
04Optional challenge
Write three lines on why P-9 is a poor first card even though its value is 300. The rubric is the state later, the skill memory, and one sentence that value is the organizer's number. About ten minutes.
05Fresh cases for the checks
Use these fictional cases for the checks below. They have different inputs from the worked examples. Read them here or make notes; no installation or external service is needed.
Board card A: independent fictional rowsOwned fixture. An original file made for this course. Follow the activity's instructions in your own lab.
ID Category Value State Task
N7 Files 75 open Read the supplied local note.
Q4 Web 90 open Read a saved request; do not send it.
E6 Cryptography 120 open Reverse a declared Base64 representation.
M9 Binary exploit 250 later Reason about a write beyond a buffer.
Categories are this board’s filing labels. Points do not establish readiness.
Selection card B: separate session constraintsOwned fixture. An original file made for this course. Follow the activity's instructions in your own lab.
The learner knows file reading and HTTP but not assembly. They have only the saved-request card downloaded.
B2: Files, open, local note not available in this session.
B5: Web, open, saved request available.
B8: Reversing, later, compiled file needs assembly.
B9: Scoreboard login, excluded by the rules.
No network action is allowed.
Method card COwned fixture. An original file made for this course. Follow the activity's instructions in your own lab.
C1 supplies UTC event lines and asks for the line recording a light turning off.
C2 supplies hex bytes and asks for their declared ASCII text.
C3 supplies an HTTP request and asks for its path.
All three cards are supplied and locally readable.
06Explain the evidence and its limit
Optional self-check: write category, value, state, task and a suitable first method for a fresh row.
Review it: distinguish the five jobs, use supplied material, and explain why points do not decide readiness or authorize a network action.
07Common mistakes
If the largest value becomes the first card, the row was read as a ranking of people. On this board the value is a number on the card.
If the scoreboard looks like part of the puzzle because it sits on the same site, rules line 3 still leaves it out.
If a later card is treated as a locked page on this site, the course routes stay open. later describes the skill, not a gate.
References
- CTFd: Challenges overview
Challenges are the main content. A participant submits a flag, also called an answer, and the platform awards points.
- CTFd: Creating challenges
The create form names Name, Category, Message, and Value, and the tutorial sets state to visible or invisible. Desk Lamp's open and later are course labels, not those two words.
- CTFd: Challenge categories
The page describes categories the authors see in their events and in most CTFs. Cryptography examples there are ciphertexts and algorithms. Base64 is not one of those examples. Exploitation examples there are memory flaws that reach a shell.
- CyLab Security Academy
Describes self-paced practice, events and broad skill domains. Individual challenge launches and account access are separate from this reading activity.