CTF: First Blood

Games that teach you to hack

A CTF — Capture The Flag — is a hacking game. You are given challenges, and hidden inside each is a secret string called a flag. Find the flag, submit it, earn points. That is the whole loop, and it is how most people fall in love with security.

CTFs are the safest, most fun way to learn, because:

• Everything is legal and built to be hacked — no permission worries.
• You get instant feedback — the flag is either right or wrong.
• They cover every skill at once — web, crypto, forensics, and more.

This room is your first proper challenge box. The earlier rooms taught you ideas; here you *use* them to recover real flags.

Flag: ASEC{capture_the_flag}

Know what you are looking for

Before hunting, know your prey. On this platform every flag follows the same shape: a prefix, then curly braces around some text.

ASEC{something_here}

The prefix here is ASEC, and the answer sits inside the { }. Different competitions use different prefixes (flag{}, HTB{}, picoCTF{}), but the idea is identical. Knowing the format is powerful: you can literally search a page, a file, or decoded text for ASEC{ to find flags fast.

The mindset

• Do not overcomplicate. The simplest thing that could work usually does.
• Look everywhere. Page source, comments, response headers, file contents.
• Notice odd data. Strange strings are begging to be decoded.

Flag: ASEC{read_the_format}

Learn to spot scrambled data at a glance

Half of beginner CTF challenges are just data in disguise. The skill is recognising which disguise it is, so you know how to reverse it.

A quick field guide:

• Base64 — letters, digits, + and /, usually ending in one or two = signs. So a string ending in = is probably Base64.
• Hexadecimal — only the characters 0-9 and a-f, often in pairs, like 41534543.
• Binary — just 0s and 1s in groups of eight.
• ROT13 / Caesar — looks like normal words but nonsense, e.g. NFRP.

Remember the crucial point from the crypto room: encoding is not encryption. It needs no key, so anyone can reverse it. Recognising it is most of the battle.

Flag: ASEC{spot_the_encoding}

Your first flag: decode the Base64

You intercept this string in a request:

QVNFQ3tiYXNlNjRfaXNfbm90X2Ffc2VjcmV0fQ==

It is not encrypted — it is Base64 encoded, which anyone can reverse. Notice the tell-tale == at the end. Decode it to recover the flag:

$ echo QVNFQ3tiYXNlNjRfaXNfbm90X2Ffc2VjcmV0fQ== | base64 -d
ASEC{base64_is_not_a_secret}

Any online Base64 decoder (or CyberChef) works just as well. This is one of the most common moves in all of CTF — see a suspicious string, decode it first.

A 2000-year-old cipher you can break in your head

The next flag is hidden with ROT13, a simple Caesar cipher that shifts every letter 13 places along the alphabet.

NFRP{ebg13_vf_gevivny}

Because the alphabet has 26 letters, shifting by 13 twice brings you back to the start — so ROT13 is its own inverse. Apply ROT13 again to reverse it:

N → A, F → S, R → E, P → C ...
NFRP{ebg13_vf_gevivny}  →  ASEC{rot13_is_trivial}

You can use an online ROT13 tool, CyberChef, or the "ROT13" option in most decoder sites. The name of the flag says it all — this cipher is trivial, which is exactly why it shows up in beginner CTFs.

The kinds of challenges you will meet

CTF challenges are sorted into categories, and knowing them tells you which skills to reach for.

• Web — hack websites (the injection, XSS, and access-control skills from your web rooms).
• Crypto — break or decode ciphers and weak cryptography.
• Forensics — dig hidden data out of files, images, network captures, and memory dumps.
• Reversing — take apart a compiled program to understand or defeat it.
• Pwn (binary exploitation) — exploit memory bugs to take control of a program.
• OSINT — find information from public sources.

You do not need to master all of them. Most people find one or two they love and go deep. The category that hunts hidden data inside files and images is forensics.

Flag: ASEC{know_your_categories}

Tools and a plan for when you are stuck

You do not need many tools to start, but a few are magic.

• CyberChef — a free web app nicknamed "the cyber swiss army knife". Paste in mystery data and it can detect and decode Base64, hex, ROT13, and hundreds more, often automatically. It is a CTF beginner's best friend.
• The browser Dev Tools for web challenges.
• A Linux terminal for base64 -d, strings, grep, and friends.

When you get stuck

1. Re-read the challenge title and text — they are usually hints.
2. Look at the data again: what encoding could it be?
3. Try the obvious tool — decode it, run strings on it, view the source.
4. Take a break — fresh eyes solve challenges.

Flag: ASEC{cyberchef_is_magic}

Go get first blood

"First blood" is the CTF term for being the first person to solve a challenge — a small, addictive thrill. You now have what you need to earn it.

Your first-blood checklist:

• Know the flag format (ASEC{...}) and search everything for it.
• Recognise encodings — = means Base64, nonsense words mean ROT13, 0-9a-f means hex.
• Reverse them with base64 -d, ROT13, or CyberChef.
• Match the challenge to a category and reach for the right skill.
• When stuck, re-read the hint, try the obvious tool, and rest.

That loop — recognise, decode, submit — will carry you through hundreds of beginner challenges. The rooms ahead go deeper into each category, but the CTF mindset you built here never changes.

Your graduation flag for this room: ASEC{you_got_first_blood}

A repeatable method beats luck

The players who get first blood are not lucky — they are systematic. Enumerate thoroughly before you exploit anything: every open port, every web directory, every service version, every hint in the source.

Ninety percent of stuck moments are solved by going back and enumerating harder, not by trying a flashier exploit. Keep notes, and let each finding suggest the next question.

The flag: ASEC{enumerate_everything}

Job-Ready Notes

Tools to know: a broad kit — pwntools, Ghidra, Wireshark, CyberChef, Burp Suite.
Cheat sheet

file ./unknown; strings ./unknown | grep -i flag

Interview practice

• Describe your methodology when you land on a new target.
• How do you approach an unknown file?
• When do you decide a lead is a rabbit hole and move on?