CTF Categories: Types of Challenges, Tools & Examples (2026)

What Are CTF Categories?

CTF categories are the skill-based groupings used to organize challenges in Jeopardy-style CTF competitions. Most competitions use the same core categories: web exploitation, cryptography, forensics, reverse engineering, binary exploitation, and OSINT/miscellaneous. Each category maps directly to real cybersecurity job skills.

In a typical Jeopardy-style CTF, you see a board of challenges sorted by category and difficulty. You pick any challenge, solve it to extract a hidden "flag" (a text string like flag{y0u_f0und_1t}), and submit it for points. Harder challenges are worth more, and you can tackle them in any order.

If you are new to CTFs entirely, start with our complete beginner guide to understand how competitions work. This article focuses specifically on what each category involves and how to build skills in each one.

All CTF Categories Compared

Use this quick-reference table to compare every CTF category at a glance before diving into the detailed breakdowns below.

Web Exploitation: The Most Beginner-Friendly CTF Category

Web exploitation is the most popular CTF category and the best starting point for beginners. Challenges involve finding and exploiting vulnerabilities in web applications: things like SQL injection, cross-site scripting (XSS), authentication bypasses, and insecure direct object references (IDOR).

Why is it beginner-friendly? Because you already use web applications every day. You understand browsers, forms, and URLs. Web challenges build on that familiarity and teach you to see these technologies from an attacker's perspective.

What You Will Encounter

• SQL injection: Manipulating database queries through user input fields to extract data or bypass authentication
• Cross-site scripting (XSS): Injecting JavaScript into web pages to steal cookies or redirect users
• Authentication bypasses: Finding flaws in login systems, session management, or access controls
• Server-side request forgery (SSRF): Tricking servers into making requests to internal resources
• Directory traversal: Accessing files outside the intended directory through path manipulation

Example: Solving a Basic Web Challenge

Imagine a challenge presents a login page. Your thought process might look like this: inspect the HTML source for comments or hidden fields, check for default credentials, try basic SQL injection in the username field (' OR 1=1 --), and examine cookies for session manipulation. Web challenges reward systematic testing over guesswork.

Prerequisites and Tools

You need a basic understanding of HTML, HTTP request/response cycles, and how browsers communicate with servers. For tools, start with browser DevTools (built into Chrome and Firefox) to inspect requests and modify page elements, and Burp Suite Community Edition to intercept and modify HTTP traffic. The OWASP Top Ten is your essential reference for understanding the most common web vulnerabilities.

HackerDNA's Web Attacks course covers these techniques step by step with hands-on labs, making it one of the fastest ways to get comfortable with web exploitation challenges.

Cryptography: Breaking Codes and Ciphers

Cryptography challenges test your ability to break or analyze encryption, encoding, and hashing schemes. They range from simple encoding puzzles that take minutes to complex mathematical attacks that require deep understanding of modern cryptographic algorithms.

Beginner crypto challenges typically involve recognizing and decoding common encodings like Base64, hexadecimal, or ROT13. As difficulty increases, you will encounter classical ciphers (Caesar, Vigenere, substitution), then modern attacks on RSA, AES, or hash functions.

What You Will Encounter

• Encoding recognition: Identifying Base64, hex, binary, URL encoding, or multi-layered encoding chains
• Classical ciphers: Caesar cipher, Vigenere cipher, substitution ciphers, and transposition ciphers
• Modern crypto attacks: RSA with weak parameters, AES in ECB mode, hash collisions, and padding oracle attacks
• Hash cracking: Identifying hash types and cracking them with wordlists or brute force

Example: Solving an Encoding Chain

A challenge gives you a string: NTI2Zjc1NzQ3YjY2NmM2MTY3N2I=. You recognize the trailing = as Base64 padding, decode it to get 526f75746b666c61677b, recognize this as hexadecimal, decode it again, and find the flag. This layered approach is common in beginner crypto challenges. The key skill is recognizing encoding patterns at each step.

Prerequisites and Tools

Start with basic math concepts and the ability to recognize common encoding formats. CyberChef is your best friend here: it lets you chain decoding operations visually and experiment quickly. Python is essential for writing custom decryption scripts, especially the pycryptodome library for modern crypto attacks.

Forensics and Steganography: Finding Hidden Evidence

Forensics challenges put you in the role of a digital investigator. You analyze files, disk images, memory dumps, or network captures to uncover hidden information. Steganography, the practice of hiding data within other files like images or audio, is often grouped into this category.

These challenges teach skills that translate directly to incident response and digital forensics careers. You learn to examine evidence methodically and extract data that someone tried to conceal.

What You Will Encounter

• File analysis: Identifying file types, examining metadata with exiftool, and searching for hidden strings with the strings command
• Steganography: Extracting data hidden in image pixels, audio frequencies, or file slack space using tools like steghide, zsteg, and binwalk
• Network forensics: Analyzing packet captures (.pcap files) in Wireshark to reconstruct conversations, find transferred files, or identify suspicious traffic
• Memory forensics: Examining RAM dumps with Volatility to find running processes, network connections, and artifacts from malware
• Disk forensics: Recovering deleted files, analyzing file system structures, and examining disk images

Example: Analyzing a Suspicious Image

A challenge provides a JPEG file. Your first steps: run file image.jpg to verify the file type matches its extension. Use exiftool image.jpg to check metadata for hidden comments. Try strings image.jpg to find readable text embedded in the binary data. Run binwalk image.jpg to check for files hidden inside. Each tool reveals a different layer, and the flag could be anywhere.

Prerequisites and Tools

Comfort with the Linux command line is essential since most forensics tools are command-line based. Key tools include Wireshark for network analysis, Volatility for memory forensics, binwalk for extracting embedded files, and exiftool for metadata analysis. You do not need to install everything upfront: start with the basic file analysis commands and add specialized tools as you encounter challenges that need them.

Reverse Engineering: Understanding How Programs Work

Reverse engineering (RE) challenges give you a compiled program and ask you to figure out what it does without having the source code. You might need to find a password the program checks, understand an algorithm it implements, or bypass a license verification. This category teaches you to think at the machine level and understand how software actually works under the hood.

What You Will Encounter

• Static analysis: Reading disassembled or decompiled code without running the program. Tools like Ghidra convert machine code back into readable C-like pseudocode.
• Dynamic analysis: Running the program in a debugger (GDB, x64dbg) to watch its behavior, set breakpoints, and inspect memory values at runtime
• Algorithm reconstruction: Understanding custom encryption, obfuscation, or validation routines by tracing through assembly instructions
• Anti-debugging techniques: Bypassing checks that programs use to detect and resist analysis

Prerequisites and Tools

A basic understanding of C programming and how code compiles from source to binary helps enormously. You do not need to master assembly language before starting, but familiarity with concepts like registers, the stack, and function calls makes challenges much more approachable. Ghidra (free, by the NSA) is the go-to tool for decompiling binaries, and GDB with the pwndbg extension handles dynamic analysis. Check our essential CTF tools guide for setup instructions.

Binary Exploitation (Pwn): Advanced CTF Challenges

Binary exploitation, often called "pwn" in CTF communities, is widely considered the hardest category. These challenges require you to find and exploit memory corruption vulnerabilities in compiled programs to gain control of execution. The reward for mastering this category is significant: binary exploitation skills are among the most valued in professional security research and penetration testing.

What You Will Encounter

• Buffer overflows: Writing past the bounds of a buffer to overwrite return addresses and redirect execution
• Format string vulnerabilities: Exploiting improper use of printf()-style functions to read or write arbitrary memory
• Return-oriented programming (ROP): Chaining small code fragments already in memory to build complex exploits without injecting new code
• Heap exploitation: Manipulating dynamic memory allocation to achieve code execution

Prerequisites and Tools

You need solid C programming knowledge, an understanding of memory layout (stack, heap, code segments), and familiarity with how functions call and return at the assembly level. The pwntools Python library is essential for writing exploits, and GDB with pwndbg is your primary debugging environment.

OSINT and Miscellaneous Challenges

OSINT (Open Source Intelligence) and miscellaneous challenges form a catch-all category that tests creative thinking, research skills, and problem-solving outside traditional security domains. OSINT challenges ask you to find information using publicly available sources, while miscellaneous challenges include everything from scripting puzzles to logic problems and trivia.

What You Will Encounter

• OSINT investigations: Tracking down information about a person, location, or organization using search engines, social media, and public records
• Google dorking: Using advanced search operators (site:, filetype:, inurl:) to find specific information indexed by search engines
• Metadata analysis: Extracting GPS coordinates, author names, or timestamps from images and documents
• Scripting challenges: Writing code to solve math problems, interact with APIs, or automate repetitive tasks within time limits
• Logic puzzles: Challenges that test lateral thinking rather than technical security knowledge

Example: OSINT Investigation

A challenge gives you a photo and asks you to identify the location. You examine the image metadata for GPS coordinates. If that is stripped, you look for visual clues: street signs, building architecture, language on storefronts, vegetation patterns. You use reverse image search and tools like Google Maps Street View to narrow down the location. OSINT challenges reward attention to detail and creative research methods.

Prerequisites and Tools

OSINT requires no special technical setup, just curiosity and systematic thinking. Browser extensions for reverse image search, exiftool for metadata, and basic Python scripting for automation are all you need. This category is a great confidence builder because the skills feel intuitive and the challenges are often satisfying to solve.

Which CTF Category Should You Start With?

The best starting category depends on your existing background. Here is a decision framework to help you pick:

Recommended Progression Path

Regardless of your background, this progression works well for building a complete CTF skill set:

1. Web Exploitation + OSINT Start here. Web challenges build fundamental security thinking, and OSINT builds confidence with quick wins. Aim for 20+ solved challenges before moving on.
2. Cryptography + Forensics Add these once you are comfortable with web. Crypto sharpens analytical thinking, and forensics teaches investigation methodology. These categories complement each other well.
3. Reverse Engineering Tackle RE after building a foundation in the above areas. Start with simple crackme challenges and work up to analyzing more complex binaries.
4. Binary Exploitation Only after you are comfortable with RE. Pwn builds directly on reverse engineering skills and requires deep understanding of memory and assembly.

PicoCTF is an excellent platform for this progression because it offers challenges in every category sorted by difficulty. Start with the easiest challenges in your chosen category and work your way up.

Frequently Asked Questions About CTF Categories

What are the main CTF categories?

The six main CTF categories are web exploitation, cryptography, forensics, reverse engineering, binary exploitation (pwn), and OSINT/miscellaneous. Most Jeopardy-style CTF competitions use these same core categories, though some events add specialized ones like hardware hacking, blockchain security, or machine learning.

Which CTF category is best for beginners?

Web exploitation is the best CTF category for beginners because you already use web browsers and understand forms, URLs, and basic HTML. OSINT is another strong starting point since it relies on research skills and creative thinking rather than deep technical knowledge. Both categories let you score points quickly while building foundational security intuition.

What is the hardest CTF category?

Binary exploitation (pwn) is widely considered the hardest CTF category. It requires solid knowledge of C programming, memory management, assembly language, and modern exploit mitigations like ASLR and stack canaries. Most experienced CTF players recommend mastering reverse engineering fundamentals before attempting pwn challenges.

What is the difference between pwn and reverse engineering in CTF?

Reverse engineering focuses on understanding what a program does by analyzing its compiled code without source access. Binary exploitation (pwn) takes that further: after understanding the program, you find memory corruption vulnerabilities and write exploits to hijack execution. Pwn builds directly on RE skills, which is why the recommended learning order is reverse engineering first, then binary exploitation.

What tools do I need to start CTF challenges?

The tools you need depend on the category. For web exploitation, start with browser DevTools and Burp Suite Community Edition. For cryptography, use CyberChef and Python. Forensics challenges need Wireshark, exiftool, and binwalk. Reverse engineering requires Ghidra and GDB. You do not need every tool at once: install them as you encounter challenges in each category.