YanoSec
Progress0 of 152 lessons complete

Course / 11 First CTF / Lesson 02 of 07

Picking a category you are ready for

Estimated time: 12 min reading · 15 min activity

Two challenges can be equally available but require very different skills. Choose a first task whose method you can describe: reading a text file, interpreting a request or following an encoding. Readiness means having a useful first step, not knowing the answer in advance.

A prerequisite is knowledge the task depends on. If you cannot yet read the representation it supplies, selecting another task is a reasonable use of your session. You can return later after learning that skill. A timebox is a chosen limit for one attempt; the next lesson uses it to make that decision easier.

Before you begin

Estimated time
12 min reading, 15 min activity. Setup and optional practice may take longer.
Where you work
Use the original fictional Desk Lamp board and supplied files in any current desktop or mobile browser. No account, event registration, installation or network request is required. Keep draft notes in your own file.
Without a lab
All board rows, requests, rules and log lines needed for reasoning are printed here. Trace them in notes and compare with the activity rubric; label fictional or predicted evidence accurately. Reading works without JavaScript. Checking needs JavaScript and a secure context; saving also needs usable browser storage.

After this lesson you can:

  • Match three blurbs to a taught skill or to a skill this stage defers.
  • Choose a ready file or log card while an assembly card waits.
  • Decide that deferring an unlearned assembly task is a sensible entry choice.

01Example

Worked comparison. W-8 uses the http lesson. P-9 uses memory, which this stage does not require. The pick is W-8.

W-8  Web  open
Task: read a saved HTTP request.
Skill you can name: http.

P-9  Binary exploitation  later
Task: a write goes past the end of a buffer.
Skill on the card: memory.

Pick for someone finishing First CTF: W-8.
P-9 can wait until Pwn.

02A category is a label, a task is the job

Ignore the prestige of a category label and read the blurb. A log task calls for ordering and citing records; a file task calls for reading the supplied file; an assembly task calls for understanding processor instructions. Those are different starting methods.

Use a short readiness note: material supplied, first action you can explain, missing prerequisite and stopping point. First CTF does not require Testing, Reversing, Pwn or every advanced Web security topic. Those remain later study rather than conditions for trying an accessible challenge.

Match a card's task to a skill you can already practice, and leave assembly for a later stage.Model. A teaching model drawn by hand. It shows the idea, not real tool output.

Read the full explanation below.

W-8: read a saved HTTP requestP-9: write beyond a buffer
W-8: read a saved HTTP request

Saved request, unsent

Web

httpAvailable in this plan
memoryLater or not established
Pick W-8

Saved-request reading matches a taught HTTP skill.

Category is a label; the task determines readiness.

Saved-request reading matches a taught HTTP skill. Category is a label; the task determines readiness.

Follow the explanation

  1. Saved-request reading matches a taught HTTP skill. Category is a label; the task determines readiness.
  2. Buffer reasoning needs the later memory lessons. No task is opened or solved.
Read every state and value

1. Saved-request reading matches a taught HTTP skill. Category is a label; the task determines readiness.

Task
W-8: read a saved HTTP request
Choice
web
Relevant skills
http

2. Buffer reasoning needs the later memory lessons. No task is opened or solved.

Task
P-9: write beyond a buffer
Choice
later
Relevant skills
memory
A category label does not define the job; Reversing/Pwn are not First CTF gates.

03Match three blurbs

The file has three cards. Two name a skill this course already taught. One names assembly.

Three blurbs
Label: match each card to a skill you can name. Use the supplied skills to choose a starting task.

B1. Saved lines with UTC timestamps. The job is to cite the line that records a lamp turning on.
Skill already taught: logs-as-evidence.
State: ready.

B2. A local text file. The job is to read the first line and leave the file unchanged.
Skill already taught: reading a file.
State: ready.

B3. A compiled program. The job is to follow a compare and a jump in assembly.
Skill named on the card: assembly.
State: later. Reversing teaches that skill after this stage. It is not required to finish First CTF.

Activity result: defer B3. A ready card is B1 or B2.

Download the three readiness cards

  1. Write the skill named on B1, B2, and B3.
  2. Mark B1 and B2 ready. Mark B3 later.
  3. Check: the card to defer is B3. A ready card is B1 or B2.
  4. Stop. Do not fetch a compiled program. This packet has none.

04Optional challenge

Name the later lessons that would make B3 a fair card: compiled-and-interpreted, then c-and-assembly. One sentence is enough, plus the limit that those lessons are not required to finish First CTF. About ten minutes.

05Fresh cases for the checks

Use these fictional cases for the checks below. They have different inputs from the worked examples. Read them here or make notes; no installation or external service is needed.

Readiness card A: fresh blurbsOwned fixture. An original file made for this course. Follow the activity's instructions in your own lab.

A1: reorder saved UTC lines and cite the completed event.
A2: read the first line of an unchanged local text file.
A3: follow a compare and jump in a compiled program’s assembly.
This stage teaches log reading and file reading; assembly comes later.

Choice card B: independent learner constraintsOwned fixture. An original file made for this course. Follow the activity's instructions in your own lab.

The learner knows file and log reading, has no assembly knowledge and wants to practise ordering events.
J2: local note, ready, file supplied.
J6: UTC event log, ready, lines supplied.
J8: assembly comparison, later.
J9: memory overwrite, later.
Only the printed tasks are in scope.

Changed readiness COwned fixture. An original file made for this course. Follow the activity's instructions in your own lab.

After a later course session, the learner can read the compare/jump notation and has the supplied assembly card. The grant still covers only reading the supplied card.

06Explain the evidence and its limit

Optional self-check: make a readiness note with material, first action, missing skill and stop.

Review it: connect the chosen task to an actual practice goal, make deferral specific and revisitable, and preserve the action boundary when prerequisites change.

07Common mistakes

If B3 is chosen because reversing sounds advanced, the skill line was skipped. The card says assembly, and this stage has not taught it.

If a ready card is skipped because its value would be small, value was used as a gate. These cards do not print a value.

If deferring B3 feels like a locked route, the course still lists later titles. The choice is about the task in front of you.

References

  • CTFd: Challenge categories

    The page describes categories the authors see in their events and in most CTFs. Cryptography examples there are ciphertexts and algorithms. Base64 is not one of those examples. Exploitation examples there are memory flaws that reach a shell.

  • CyLab Security Academy

    Describes self-paced practice, events and broad skill domains. Individual challenge launches and account access are separate from this reading activity.