CTF Categories

I. Overview link

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
    A["Unstructured, fragmented\nhacking skill learning"] -- "Scenario-based, domain-specific\nhands-on skill validation" --> B["Domain-organized\nCTF problem solving (CTF)"]
    style A fill:#f9f9f9,stroke:#333,stroke-width:3px
    style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: CTF (Capture The Flag) is a hacking and defense competition in which participants solve information security challenges to find a hidden string called a flag ( Flag ) and earn points — a contest that comprehensively evaluates security skill across multiple domains.

Features:
( Hands-on Skill Development ) Strengthens real exploitation skills beyond theory, through challenges that reflect the latest vulnerabilities and attack techniques.
( Problem-Solving Ability ) Builds creative thinking ( Thinking out of the box ) by requiring participants to analyze complex logic and find a bypass within a limited time.
( Teamwork and Collaboration ) Provides experience in solving large, complex problems as specialists in different domains collaborate under team-based competition.
( Security Talent Discovery ) Uses an objective scoring system as a yardstick for identifying and evaluating skilled white-hat hackers.

II. Mechanism & Components link

A. The Five Core Categories link

graph TD
    A["CTF Categories"] --> B["Web\nHacking"]
    A --> C["System Hacking\n(Pwnable)"]
    A --> D["Reverse\nEngineering"]
    A --> E["Cryptography\n(Crypto)"]
    A --> F["Digital\nForensics"]

    style B fill:#f1f8e9,stroke:#8bc34a
    style C fill:#fff3e0,stroke:#ff9800
    style D fill:#e1f5fe,stroke:#03a9f4
    style E fill:#fce4ec,stroke:#e91e63
    style F fill:#f3e5f5,stroke:#9c27b0

B. Key Attack Points and Core Skills by Category link

III. Comparison & Application link

A. Jeopardy vs. Attack-Defense Format link

Don’t pick a format based on which one is more popular online — pick it based on the training gap you’re trying to close. Jeopardy is the better onboarding tool for building broad, per-domain depth across a large or junior team, while Attack-Defense is the only format that actually rehearses the skill most security teams lack: patching and defending a live system under active, time-pressured attack. A mature internal training program runs both, not one or the other.

B. Selecting a Format for Internal Training Programs link

• Building foundational skill: Run Jeopardy-style internal CTFs first, organized by domain (web, pwnable, crypto, forensics), so newer team members can specialize before being thrown into a live-fire exercise.
• Rehearsing incident response: Once a team has domain depth, use Attack-Defense exercises to pressure-test the exact muscle memory needed during a real incident — patching under time pressure while under active attack.
• Automate the repetitive parts: Encourage teams to script recurring exploitation and scanning steps ( Pwntools, etc.) rather than repeating manual work, since automation skill built in a CTF transfers directly to real engagement efficiency.

Key Point: The choice between Jeopardy and Attack-Defense isn’t a matter of preference — it’s a matter of which skill gap the organization is trying to close, and the strongest internal training programs deliberately rotate between both rather than defaulting to whichever is easier to run.