// Learn

Tutorials

Everything you need to go from your first login to your first flag. Open a lesson to read it, and come back whenever you need a refresher.

Join the discussionsSubmit a ticket
// 01 Set up your hacking lab Everything you need to practise safely on your own machine. +

A standard laptop with 4 to 8 GB of RAM is enough. Run Linux inside a virtual machine so your main system stays safe:

  • Install VirtualBox or VMware (or use WSL on Windows).
  • Add a Linux distribution such as Kali Linux, Ubuntu or Fedora.
  • Install the core free tools: Wireshark, Burp Suite Community, Ghidra, Python 3 and GDB.

Take a snapshot of your VM once it is set up so you can roll back if something breaks, and keep a notes file for commands and ideas. Only ever practise on our challenges and your own lab machines.

// 02 Your first flag: how the platform works From registering to submitting your first answer. +
  1. Register a free account and choose your handle.
  2. Open Challenges and pick one with a low point value to start.
  3. Read the description carefully. It may include files to download or a server address to connect to.
  4. Work out the hidden flag, a piece of text that proves you solved it. The description shows the format to submit.
  5. Paste the flag into the challenge window and submit. Correct answers earn points.

Stuck? Check for hints on the challenge, take a break, and ask the community for guidance, but never share a flag itself while a round is running.

// 03 Linux and networking basics The foundation behind almost every challenge. +

Get comfortable in the terminal. Practise these until they feel natural: ls, cd, cat, grep, find, file, strings, chmod, ssh and nc.

Understand how computers talk. Learn what an IP address, port, TCP connection, DNS lookup and HTTP request are. Opening Wireshark while you browse a website is a great way to see these in action.

An hour of practice a day for two weeks makes a visible difference.

// 04 Where to start in each domain Beginner pointers for all nine challenge domains. +
CryptographyLearn encodings (Base64, hex), classical ciphers, XOR and the basics of RSA.Python, CyberChef
ExploitStart with how web pages and HTTP work, then injection flaws. Memory bugs come later.Browser dev tools, Burp Suite
ForensicsInspect files, captured network traffic and memory images for hidden clues.file, strings, exiftool, binwalk, Wireshark
MiscellaneousOSINT, puzzles and scripting. Read the challenge text very carefully.Search engines, Python
MobileUnderstand how an Android app is packaged, then read its code.jadx, apktool, Frida
Penetration TestingPractise discovery and enumeration against lab machines you are allowed to test.Nmap, Linux enumeration tools
ProgrammingAutomate repetitive work: parsing text, talking to servers, solving against the clock.Python, sockets, regex
Reverse EngineeringRead programs without source code and work out what they do.strings, Ghidra, GDB
SteganographyFind data hidden in images, audio and other files.exiftool, zsteg, steghide, Audacity
// 05 Writing a great writeup Turn what you solved into something the community can learn from. +

A writeup is a short story of how you solved a challenge. A good one includes:

  • The challenge name, category and what it asked for
  • The tools and ideas you tried, including dead ends
  • The steps that worked, with commands or screenshots
  • What you learned and what you would do differently

Keep the actual flag out of anything public until the round has ended. Share your writeups in community sessions and team debriefs.

Where to share: post it in the Discussions forum under the Writeups category. Writeups are hidden behind a spoiler, and posts that contain a flag are blocked automatically, so everyone can learn from each other safely. Other players can reply with questions and ideas.

Post a writeup

// 06 Rules of engagement and ethics Hack to defend. Always stay in scope. +
  • Only test the challenge systems provided for you. Never attack anything outside our authorized sandboxes.
  • Do not share plaintext flags with competitors during an active round.
  • Do not launch denial-of-service attacks against the platform.
  • If you find a real vulnerability in the platform itself, report it to us instead of exploiting it.

Breaking these rules results in immediate disqualification and account revocation. Our goal is to build defenders, not bad actors.

Ready to practise, or need a hand?

Questions or stuck on something? Submit a ticket, or write to [email protected].

Browse ChallengesJoin the discussionsSubmit a ticket