What a jeopardy CTF looks like

02Read before trying

Start with the task and allowed material. A challenge may supply a file or name a practice service. A target is the specific thing you may examine. A lab is a practice environment prepared for an exercise. Permission for that lab does not extend to other systems operated by the same organization.

In the example, the reading card is a suitable first choice for a learner who has only completed Start. The web card needs knowledge from later lessons. Its larger point value does not remove that prerequisite, and points alone do not establish difficulty.

Read the event-wide rules as well as the chosen card. If they conflict or leave a boundary unclear, pause and ask through the organizer's stated contact. Do not settle uncertainty by choosing the widest possible permission.

03Flags and checking

Submit a discovered flag to the event's own answer box under its rules. The place where you submit a flag and the system you may examine can be different. A scoreboard showing your result is not therefore a testing target.

Events choose their own answer formats and checking behavior. A flag may need exact capitalization and punctuation. This course's treatment of capitals is not a rule for other platforms. CTFd, software used to run events, documents challenge submissions and awarded points, but an organizer can configure an event differently.

04Inspect a fresh card

Use this new card to practice separating the target, exclusions and submission destination. notice-lab is an invented system name. A later question uses another name, challenge-vm. VM stands for virtual machine, a computer environment created in software; Computers explains it. You need no practice computer for this reading exercise.

FICTIONAL CARD: First toy service
Category: Web
Task: investigate the supplied service after learning web basics
Allowed target: notice-lab
Allowed action: the toy-service exercise listed by the card
Excluded: results-page, event login, other teams' machines
Submit: the event's challenge-answer box
Stop: unclear permission, activity leaving the named lab, or private data

The names are labels. No address or flag is supplied here.

1. In your notes, copy the allowed target and action. On another line, list the excluded systems so they cannot be mistaken for additional targets.
2. Record where a flag would be submitted. Explain why a submission destination can accept an answer without becoming a system you may test.
3. Return to the two-card worked example. Choose a first card for someone who has completed only Start, and name the prerequisite that makes the other card wait.
4. Review your note: it should distinguish the permitted challenge, the systems excluded from testing and the answer-submission destination. Finish with the reading decision; no connection or puzzle solve is required.

05When to use help

If you become stuck in a later event, record the task, action and result as you practiced earlier. Follow that event's hint and solution-sharing rules. Ask about your method without posting a flag publicly.

The Practice directory lists resources you can use later. Before beginning a challenge there, check its current rules, prerequisites and allowed target. A link in a directory does not enlarge the provider's permission. The next lesson gives you a method for reading that permission carefully.

06Optional challenge

Allow about 5 extra minutes. Write three preparation lines for the example Web card: the knowledge still needed, the allowed target and one excluded system. Explain why its point value does not change any of those facts.

07Fresh cases for the checks

Use these fictional cases for the checks below. They have different inputs from the worked examples. Read them here or make notes; no installation or external service is needed.

CARD amber: category files; 80 points; open; read a supplied text file.
CARD birch: category pwn; 60 points; open; requires memory skills not yet learned.
CARD coral: category web; 50 points; closed.
Learner knows how to read supplied text, but has no memory-training prerequisite.
Submission destination: event flag box.
Permission: supplied challenge files only. Excluded: scoreboard service and other learners.
Required flag format: YS{...}; preserve case and braces. No flags are supplied here.

08Read the event card

Optional written self-check: Write category, state, task, prerequisite and submission destination for your selected card. Explain your scope decision using the permission and exclusion lines, rather than point value. Keep the candidate flag private and follow actual event rules.