Notes from my first CTF

This is a starter draft. Rewrite it in your own words, or delete the file — the site picks up whatever is in content/posts/.

We placed 5th at the GDG college capture-the-flag. I went in assuming it would mostly be clever exploitation. It was mostly reading carefully.

What actually helped

• Reading the whole prompt. Two challenges told us the answer format up front, and I still burned time guessing.
• strings before anything clever. More than one flag was sitting in plain text.
• Splitting by category early instead of five people staring at the same problem.

What I wasted time on

I spent close to an hour on a web challenge convinced it was SQL injection. It was a comment in the page source.

# The one command that should have been first
curl -s https://target/challenge | grep -i flag

The takeaway

CTFs reward breadth over depth at this level. Knowing that binwalk exists beat knowing any single technique deeply — you mostly need to recognise the shape of a challenge fast, then reach for the right tool.

Doing another one soon.