Nullbyte Labs
CTF 01 Play the game · 12 JUN 2026 · 2 min read

Hack your first hack: an intro to capture the flag

Pick a platform, solve one beginner web challenge end to end, and build the note-taking habit that separates people who improve from people who plateau.

Most people bounce off their first capture the flag for the same reason: they pick a hard platform, open a challenge with no category listed, stare at a login page for twenty minutes, and conclude they are not smart enough. The problem is challenge selection, not you. This is one full solve, start to finish, with the reasoning shown.

Pick the right platform first

  • PicoCTF — built for beginners, permanently online, challenges have hints. Start here.
  • OverTheWire Bandit — pure Linux fundamentals over SSH. Do this in parallel; it teaches the shell skills every other challenge assumes you already have.
  • TryHackMe — guided rooms with explanations. Good when you want the answer explained.
  • HackTheBox — do not start here. It assumes you already have a methodology.

Set up your notes before your first challenge

Open a note per challenge with four headings: what I see, what I tried, what happened, what I learned. This is not busywork. It is the same structure as an engagement note, and it is the only thing that turns three hours of flailing into a repeatable method.

A worked web challenge

You are given a URL and told the flag is in the admin's profile. The reflex is to attack the login form. The discipline is to enumerate first:

# what is the server telling you for free?
curl -I https://challenge.example/

# what did the developer leave in the page?
curl -s https://challenge.example/ | grep -iE "comment|todo|debug|api"

# what paths exist that are not linked?
feroxbuster -u https://challenge.example/ \
  -w /usr/share/seclists/Discovery/Web-Content/common.txt

That third command is where beginner web challenges usually break open — a /backup/ directory, a .git folder, or an /api/users/1 endpoint with no authorization check on it at all.

When you find an identifier in a URL, change it:

/api/users/2  ->  /api/users/1

If user 1 comes back with the admin record, you have found an insecure direct object reference, one of the most common real-world web vulnerabilities in existence. The flag is usually sitting in a field of that response.

The habit that actually matters

After you solve it, write the four-heading note and the one-sentence version of the vulnerability class: "the application checked that I was logged in but never checked that the record belonged to me." Do that fifty times and you have a methodology instead of a pile of solved challenges.

Rules of engagement

Everything above happens on a platform that invited you to attack it. Running feroxbuster against a site you do not have written permission to test is a crime in most jurisdictions, and there is no version of this hobby where that is worth it.