The goal is to find the flag, usually somethign unambiguous like "flag{some_lind_of_message}". There are generally no other rules to a CTF other than "don't run

The goal is to find the flag, usually somethign unambiguous like "flag{some_lind_of_message}". There are generally no other rules to a CTF other than "don't run a scanner against us"/"don't brute force." Analyzing and listing out ways to interact with the site will show you your surface area, although sometimes the interaction is so opaque you might have to check the "robots.txt" or other well known files. The start button, the difficulty level, making a move, and the admin panel all offer ways to test different inputs to see if you can get unexpected output. What inputs do they accept? What headers do they have? What encodings do they use? Are there any input checks done client side rather than server side? Then it becomes a matter of thinking about what happens with these inputs/outputs. Did it ask for a file name? What if I feed it a file it doesn't expect. Might this input be used for a database query, how could I abuse that? Could my input or the output be marshaled? Could my input be passed to an exec somewhere? Can I find artifacts that tell me what programming languages/servers/libraries are being used? How can I probe for these things? The people who do these for fun several times a month will often make writeups that offer hints of techniques to solve problems when the competition is done. These are some related sites: https://ctftime.org/ https://ctftime.org/ https://ctftime.org/writeups https://ctftime.org/writeups https://owasp.org/www-project-top-ten/ https://owasp.org/www-project-top-ten/