1. Rotated letters
Crypto10 pointsA trainee left a note on a shared drive. It looks like gibberish but it keeps its punctuation and word shapes. The flag format is flag{...}.
qwlr{nlpdlc_td_yze_pyncjaetzy}Beginner CTF Challenges: Capture the Flag Practice in Your Browser
Capture the flag (CTF) is a security competition where you solve puzzles to uncover a hidden string, the flag, and submit it for points. Here are 6 starter challenges you can solve right now: a rotated cipher, Base64, hex, a one-byte XOR, a web log and a robots.txt file. Each has three hints and a short note on what it teaches. Nothing is attacked, and nothing leaves your browser.
TL;DRThe short version
5 points
- Capture the flag (CTF) is a security competition where you solve puzzles to find a hidden text string, the flag, and submit it for points.
- This page has 6 self-contained beginner challenges: a Caesar cipher, Base64, hex, a one-byte XOR, a web log and a robots.txt file. Each has three hints, and a decoder workbench is below them.
- Everything runs in your browser. There is no target to attack, nothing is scanned and nothing you type is sent anywhere.
- The common formats are Jeopardy-style (a board of tasks by category) and Attack-Defense (teams defend their own services while attacking others), according to CTFtime.
- To keep going, join CTFtime-listed events, or work through OverTheWire's Bandit wargame, which starts with Unix and Linux basics.
Score 0 / 1100 of 6 flags
2. Not encrypted, just wrapped
Encoding10 pointsA config file stores a "secret" string. It only uses letters, digits and ends cleanly without any spaces.
ZmxhZ3tiYXNlNjRfaXNfZW5jb2Rpbmdfbm90X3NlY3JlY3l9
3. Bytes in hexadecimal
Encoding15 pointsA packet capture note lists a payload as space-separated pairs of characters. Each pair is one byte.
66 6c 61 67 7b 68 65 78 5f 69 73 5f 6a 75 73 74 5f 61 6e 6f 74 68 65 72 5f 76 69 65 77 7d
4. One-byte XOR
Crypto25 pointsA script obfuscates a string by XOR-ing every byte with the same single byte, then printing hex. You know the plaintext starts with flag{.
3c363b3d21223528052d332e320535343f0538232e3f053c3b363629053c3b292e27
5. Who got in?
Logs30 pointsThe web log below came from a login server. One address hammered the login page and then succeeded. Another address has a single typo. Give the flag as flag{ADDRESS} for the address that looks like password guessing followed by a successful login.
203.0.113.9 - - [03/Nov/2026:09:01:12 +0000] "GET /login HTTP/1.1" 200 1432 203.0.113.9 - - [03/Nov/2026:09:01:20 +0000] "POST /login HTTP/1.1" 401 211 203.0.113.9 - - [03/Nov/2026:09:01:31 +0000] "POST /login HTTP/1.1" 200 388 203.0.113.9 - - [03/Nov/2026:09:02:05 +0000] "GET /dashboard HTTP/1.1" 200 5120 192.0.2.14 - - [03/Nov/2026:09:03:44 +0000] "GET /pricing HTTP/1.1" 200 2210 198.51.100.77 - - [03/Nov/2026:09:04:02 +0000] "POST /login HTTP/1.1" 401 211 198.51.100.77 - - [03/Nov/2026:09:04:03 +0000] "POST /login HTTP/1.1" 401 211 198.51.100.77 - - [03/Nov/2026:09:04:03 +0000] "POST /login HTTP/1.1" 401 211 192.0.2.88 - - [03/Nov/2026:09:04:10 +0000] "GET /missing-page HTTP/1.1" 404 190 198.51.100.77 - - [03/Nov/2026:09:04:04 +0000] "POST /login HTTP/1.1" 401 211 198.51.100.77 - - [03/Nov/2026:09:04:05 +0000] "POST /login HTTP/1.1" 401 211 198.51.100.77 - - [03/Nov/2026:09:04:05 +0000] "POST /login HTTP/1.1" 401 211 198.51.100.77 - - [03/Nov/2026:09:04:06 +0000] "POST /login HTTP/1.1" 200 388 198.51.100.77 - - [03/Nov/2026:09:04:09 +0000] "GET /admin/export.csv HTTP/1.1" 200 884201 192.0.2.14 - - [03/Nov/2026:09:05:31 +0000] "GET /blog HTTP/1.1" 200 9120 203.0.113.9 - - [03/Nov/2026:09:06:18 +0000] "GET /settings HTTP/1.1" 200 3011
6. Polite does not mean private
Web20 pointsA site's robots.txt tells search engines which paths to skip. One entry accidentally reveals the name of a forgotten folder that should never be public. Give the folder name without slashes: flag{name}.
User-agent: * Disallow: /cgi-bin/ Disallow: /search Disallow: /cart/ Disallow: /backup_2025_old/ Allow: / Sitemap: https://www.example.com/sitemap.xml
Decoder workbench
Four small tools for the challenges. They run in your browser and nothing is sent anywhere.
use a negative number to go backwards
What is a CTF, and what formats exist?
CTFtime, the community calendar for CTF events, describes three common formats:
- Jeopardy-style. Tasks sit on a board by category (it lists web, forensics, crypto and binary) and score points, usually more for harder ones.
- Attack-Defense. Each team runs a network or host with vulnerable services, patches its own and attacks the others. CTFtime calls it the historically first CTF type.
- Mixed. Competitions that combine elements of both.
The challenges above are Jeopardy-style: independent tasks, one flag each.
Where to play next
- CTFtime: calendar of upcoming and past CTF events, task write-ups and team ratings.
- OverTheWire wargames: security games played over the command line. The site lists Bandit (Unix and Linux basics) first.
- picoCTF: as of 3 November 2026 the site says picoCTF continues as Carnegie Mellon University's free CyLab Security Academy platform.
Only attack systems an event or platform has explicitly set up for you. Pair this practice with the Log Triage lab for the defender's side of challenge 5, and the Kali Linux guide for the toolkit many players use.
Sources
- CTFtime, What is CTF? (formats and categories), accessed 3 November 2026.
- OverTheWire, Wargames, accessed 3 November 2026.
- picoCTF / CMU CyLab Security Academy, picoctf.org, accessed 3 November 2026.
- IETF, RFC 4648 section 12 (base encoding and confidentiality).
- IETF, RFC 9309 (Robots Exclusion Protocol: “These rules are not a form of access authorization”).
- IETF, RFC 5737 (documentation address blocks used in the log).
Last reviewed 3 November 2026. All six flags were generated and re-decoded by script before publishing. This is general information, not legal advice.
Frequently asked questions
What is capture the flag (CTF) in cyber security?
A CTF is a security competition in which players solve tasks to find a flag, a secret string such as flag{example}, and submit it to score points. The task categories CTFtime lists include web, forensics, cryptography and binary exploitation, and events are often played in teams or alone for learning.
What are the types of CTF?
CTFtime describes three common formats. Jeopardy-style gives teams a board of tasks in categories, with more points for harder tasks. Attack-Defense gives each team a network or host with vulnerable services that it must patch while attacking the other teams. Mixed competitions combine elements of both.
How do I start CTFs as a complete beginner?
Start with encodings and simple ciphers like the ones on this page, then learn basic Linux command-line use, because many tasks assume it. OverTheWire's Bandit wargame is a good next step: its own site lists it first, for Unix and Linux basics. Read other players' write-ups after you solve or give up on a task.
Is Base64 encryption?
No. Base64 is an encoding that turns bytes into text. RFC 4648 says base encoding does not provide any computational confidentiality, so anyone can reverse it without a key. Challenge 2 shows this.
Why can a Caesar cipher be broken so easily?
It shifts every letter by the same amount, so there are only 25 usable keys. Trying all of them, or noticing which shift turns the first word into "flag", breaks it in seconds.
Is it legal to do CTF challenges?
CTF platforms and events provide systems that the organisers explicitly invite you to attack, and the rules say which ones. Attacking anyone else's systems without permission is a different matter and can be illegal. This page has no live target and teaches only decoding and log reading. This is general information for the US, not legal advice.
Do I need Kali Linux to play CTFs?
Not for beginner challenges. Many tasks need only a browser, a text editor and a terminal. Kali bundles many security tools, but its own documentation says it is not recommended if you are unfamiliar with Linux. See our Kali guide for what it is and is not.
Is picoCTF still available?
The picoctf.org site now says that picoCTF has become Carnegie Mellon University's CyLab Security Academy, a free learning platform, and that existing logins created before 8 May 2026 still work. Check the site for current details; this was how it read on the review date below.
More security tools
The tools people use most on PlayCISO.
Prompt Scan
Catch injected instructions hiding in content your AI agent should only read.
ISO/IEC 27090 Readiness
Score your readiness against the first international standard for AI security threats.
CVE Trends
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Firewall Lab
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
NIST CSF 2.0 Assessment
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
APT Naming Rosetta Stone
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.