This page is meant for quick decisions during a CTF event. Use it to spot common challenge patterns, launch the right tools quickly, and jump to theory or documentation when needed.
This is the default workflow to apply before overthinking a challenge.
file challenge strings challenge | less exiftool challenge binwalk challenge binwalk -e challenge xxd challenge | less
A lot of easy and medium CTF tasks fall apart once you verify the file type, inspect metadata, or extract hidden content.
file suspicious.pdf strings suspicious.pdf | grep -i flag exiftool suspicious.pdf binwalk suspicious.pdf binwalk -e suspicious.pdf foremost -i suspicious.pdf -o output/ hexdump -C suspicious.pdf | less
A PDF may actually contain a ZIP archive or an image payload.
mv challenge.pdf challenge.zip unzip challenge.zip
This is exactly the kind of hidden-format trick that often appears in beginner-friendly CTF tasks.
Many web challenges are solved by observing the request flow and changing one small thing at a time.
?id=1 to ?id=2.' OR 1=1--
"><script>alert(1)</script>
../../../../etc/passwd
{{7*7}}
; id
$(id)Use only inside the challenge environment and where the challenge scope allows it.
= or ==.echo 'ZmxhZ3t0ZXN0fQ==' | base64 -d
python3 -c "print(bytes.fromhex('666c61677b746573747d').decode())"
echo -n 'text' | md5sum
echo -n 'text' | sha256sum
openssl rsautl -decrypt -inkey priv.pem -in flag.encOften the fastest start is simply extracting strings and watching runtime behavior before opening a heavier reversing tool.
strings binary | less ltrace ./binary strace ./binary chmod +x binary ./binary
Even when you do not fully solve a pwn challenge, protections and runtime behavior often reveal the intended path.
checksec binary gdb ./binary python3 solve.py
Even partial progress matters. A protection check, a controlled crash, or a useful symbol can tell you what kind of exploit path the author expected.
OSINT challenges are often about extracting the right clue and using the right search operator or reverse search method.
site:example.com site:example.com filetype:pdf "exact phrase" intitle:index.of backup whois example.com exiftool image.jpg
Network challenges often hand you a pcap file and expect you to find credentials, exfiltrated data, or hidden protocols.
wireshark capture.pcap tshark -r capture.pcap -Y "http" -T fields -e http.request.uri tshark -r capture.pcap -Y "dns" -T fields -e dns.qry.name tcpdump -r capture.pcap -A | less nmap -sV target_ip
http.request.method == "POST" tcp.stream eq 0 dns.qry.name contains "flag" ftp.request.command == "PASS" ip.addr == 10.0.0.1
Open these directly during the event when you need a decoder, a lab, or background material.
Good triage and communication often win more points than deep focus on one unsolved task.