FAQ

A capture the flag, or CTF, is a security exercise built as a puzzle. You are given a machine or a website with something wrong with it, and your job is to find the weakness and use it to reach something you are not supposed to be able to reach.

Hidden in each challenge is a flag — a short string you can only get hold of if you actually solved the problem. You paste it back into this site to prove you got there, and you score points.

Your flags are yours. They are generated from your username, so the flag your classmate found will not work for you. Copying someone else's answer scores you nothing; it only tells us you copied.

1. Pick a level from CTF Levels. Each one shows a difficulty from 1 to 5, which sets what it is worth.
2. Start it. The site builds you a private machine and runs the challenge on it. Nobody else can see or touch it.
3. Solve it, and submit the flag or flags on the level page.

Points run from 100 for a difficulty-1 level to 300 for a difficulty-5 one. If a level has several flags, you get credit for the ones you found. Hints cost points — see the table below.

You do not need to be in a class to play. Many of the levels are public: log in and they are on your CTF Levels page straight away. They have no due dates, they score normally, and they are there to practice on whenever you like.

A class adds levels on top of those, and those are the ones that count as coursework. To join one:

1. Ask your instructor for the class code.
2. Open your profile.
3. Paste the code into the add class box and submit.

The class's levels appear immediately, along with any due dates your instructor has set. You can be in more than one class at a time, and the levels page lets you filter by class.

Due dates apply to class levels only. Class work handed in late loses 10% of the level's value per day and is worth nothing after a week. Public levels have no deadline.

You have to be signed in. Use Login in the navigation bar — it signs you in with your Google account. There is no anonymous mode: your flags are generated from your username, so a level cannot be started without one.

You do not need to be in a class — plenty of levels are public. Signing in is the only requirement.

Once you are in, open CTF Levels from the navigation bar. Levels are grouped by class and then by category; open a group to see what is inside it. Each row shows the difficulty, what the level is worth, and whether you have already solved it.

Open the level you want and press Start Level. The page then builds your machine and shows you how to connect once it is ready — an ssh command and a password for a shell level, or a link for a web level.

You can only run one level at a time. Starting a second one switches the machine over to it, which is quick and does not lose your progress on the first.

When you start your first level, the site creates a virtual machine for you from scratch. That is a real computer being built somewhere in a datacenter, and it is noticeably slower than any other click on this site — long enough that you will wonder whether something broke.

It has not. The page shows a spinner, a running clock, and a message saying what it is doing. Leave the tab open and let it finish.

Levels after the first are much faster. Your machine stays up between levels, so switching only swaps out the challenge running on it rather than building a new machine. You will see the difference immediately.

Two different things can take your machine away, and it is worth knowing both, because one of them can happen while you are working.

You walked away. Machines that sit unused get shut down automatically, so we are not paying for idle computers. Predictable, and entirely in your control.

It was reclaimed. Levels run on spare capacity, which is a great deal cheaper and is how this site stays affordable — but the trade is that it can be taken back at any moment, with almost no warning. This is not a failure and it is not something you did. It can happen five minutes into a level.

scp -P 15010 yourname@203.0.113.45:notes.txt .

What is never lost: your flags, your score, and which levels you have solved. Those live on this site, not on the machine. Your flags do not change either — start the level again and the flags you were hunting are the same ones. The level page will tell you when it is building you a fresh machine.

Most levels give you a login on a Linux machine and expect you to work from the command line. Once the level is ready, the page shows you a command and a password, each with a Copy button. The command looks like this:

ssh yourname@203.0.113.45 -p 15010

Run it in a terminal. It will ask for the password, which is on the level page directly underneath the command.

• The address changes every time. It belongs to the machine that was just built for you, so do not save it and reuse it tomorrow — copy it from the level page each time.
• The port matters. Leave off -p 15010 and SSH tries port 22, gets nothing, and eventually times out.
• Typing the password shows nothing. No dots, no stars, no movement at all. That is normal for SSH — type or paste it and press Enter.
• A warning about an unknown host is expected the first time. It is a machine you have genuinely never connected to before. Answer yes. If the warning says the host identification has changed, that is a different thing — see below.

If you do not have an SSH client

Windows 10 and 11 include one, but it is sometimes switched off. Open Settings → Apps → Optional Features, look for OpenSSH Client, and install it if it is not already listed. Then use it from PowerShell or Windows Terminal.

Linux almost always has one. If ssh is not found:

sudo apt install openssh-client

That is the client, which is what you need to connect out to a level. openssh-server is the other direction — it lets other people connect to your machine, and you do not want it for this.

macOS has one built in. Open Terminal and use it.

Switch from one SSH level to another and your terminal will fill up with this:

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
            @    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @
            @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
            IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!

Your SSH client is right, and you should understand why before you get rid of it. The first time you connect to a machine, SSH records its identity key. If that key later changes at the same address, something has been swapped out underneath you — which is exactly what a machine-in-the-middle attack looks like, so SSH refuses to continue.

Here, the thing that changed is not sinister. Your levels share one virtual machine, so every level answers at the same address, and each level is a different container carrying its own identity key. Switching levels genuinely does put a different machine on the other end of that address.

Overriding the check is safe on these levels specifically: you started the container a minute ago and there is nothing on it worth protecting. It is not safe as a habit, so keep the exception narrow. Add this to ~/.ssh/config and it applies only to port 15010, leaving your real SSH connections strictly checked:

Match exec "test %p = 15010"
                UserKnownHostsFile /dev/null
                StrictHostKeyChecking no
                LogLevel ERROR

You will also find advice to run ssh-keygen -R '[address]:15010'. That works, but it clears one entry — you will be typing it again after the next switch.

Some levels are websites instead of shells. For those, the level page gives you a link to click rather than a command to run.

Some levels offer hints when you are stuck. Not all of them do, and the ones that do differ in how many they offer.

• Solve a level without taking any hints and you get the full score for it.
• Each hint costs a fixed number of points, deducted from your score for that level.
• Hints are cheaper on harder levels, because the level is worth more to begin with.
• A hint you have already taken stays visible for the rest of the level. Looking at it again costs nothing extra.
• Your score for a level never goes below zero, however many hints you take.

Take them when you are stuck. A hint costs a few points; an evening spent going nowhere costs the whole level.

Being stuck is the exercise. Before you ask, re-read the level description — it usually names the thing you are meant to attack — and take a hint if the level offers one.

If the level itself looks broken rather than hard, stop it and start it again from CTF Levels. Your flags do not change when you do that. If it is still broken, tell your instructor which level it was and what you saw.