Google CTF: How It Works and How to Practice (2026 Guide)

What Is the Google CTF?

The Google CTF is an annual Capture the Flag competition organized by Google's security team. Teams solve security puzzles in web security, cryptography, reverse engineering, binary exploitation (pwn), and miscellaneous categories, and each solved puzzle reveals a flag that looks like CTF{...} and earns points on a public scoreboard.

Google announced the 2018 edition as the "3rd annual Google CTF," which dates the first one to 2016. The event grew fast. In that same 2018 announcement on the Google Security Blog, the team said the 2017 edition had over 5,000 players and that nearly 2,000 teams captured flags.

Why Google bothers is spelled out in the same post: the company believes the security community helps it protect its users, and the CTF is a way to "nurture the community and give back in a fun way." It also works as a showcase for its bug bounty programs, which the post promotes right after the CTF details.

Three things set it apart from most CTFs:

• The difficulty. On CTFtime, the site that rates CTFs, the 2025 Google CTF carries a rating weight of 97.17 out of a possible 100. Events rated that high are the ones the world's top teams build their year around.
• The prizes. CTFtime lists 12,345 USD for first place in 2025, 5,432.10 USD for second, and 3,210 USD for third, with more at the final.
• The archive. Google open-sources its challenges on GitHub after each event. That archive is the real reason this guide exists.

How the Google CTF Works

The structure has been stable for years: an online qualifier open to anyone, then a final for the best teams. Here is the format based on CTFtime's event pages and Google's own announcements.

The qualifier

The qualifier is where nearly everyone plays. You register a team, the board opens, and for 48 hours you pick challenges in whatever order you like. The 2025 event page on CTFtime shows 276 teams on the final scoreboard, won by Friendly Maltese Citizens ahead of kalmarunionen. The public archive holds 30 challenges from that qualifier: 8 web, 6 pwn, 6 reversing, 5 crypto, and 5 misc.

Hackceler8, the final

The final is not a normal CTF. Hackceler8 mixes hacking and speedrunning: each team plays a video game written by Google, finds the bugs hidden in it, and exploits them live to reach objectives faster than its rivals. Kalmarunionen, the Danish team that won the 2025 edition in Mexico City, describes it as an "atypical #CTF format combining live hacking and gaming." Google also open-sources the Hackceler8 games, so you can study them after the event.

What happened in 2026

CTFtime listed Google Capture The Flag 2026 for June 19 to 21, 2026. The listing was then updated to say the CTF had been postponed, "stay tuned for further updates." As of November 2026 no new date has been published, so check g.co/ctf and the CTFtime page before you plan anything around it. The practice advice in this guide does not depend on the date.

Is the Google CTF Good for Beginners?

The main Google CTF qualifier is not a beginner event, and it would be unkind to pretend otherwise. Challenges are written for top international teams, and a newcomer can easily spend 48 hours without a single flag. The parts of the Google CTF that do suit beginners are the Beginner's Quest editions and the public archive of past challenges.

Google has known this for a long time. In the 2018 announcement, it said it would add challenges for "people that may be new to CTFs or security," presented in a "Quest" style with a scenario "similar to a real world penetration testing environment." That became the Beginner's Quest, which ran alongside the main event in 2018 and 2019. In its June 2024 announcement, Google said a new Beginner's Quest would launch later that summer, with "simpler gamified challenges."

So the honest answer depends on what you mean by "play":

• Competing in the qualifier: worth doing once, to see what elite challenges look like. Expect to solve little or nothing.
• Playing a Beginner's Quest: a good fit if one is running. It tells a story and gets harder gradually.
• Training on the archive: the best option for most beginners, available any day of the year.

If you want a live event where a first-timer can actually score, start with picoCTF and come back to Google's challenges once you have a few dozen flags behind you. Our picoCTF guide explains how to get through its practice gym.

What the Google CTF Beginner's Quest Looked Like

The 2019 Beginner's Quest is fully preserved in Google's repository, and it shows the style well. Every challenge belonged to one silly story about aliens and a secret society called the "Cookie World Order," whose members turn out to be cauliflowers. Behind the jokes were real techniques. Four of them are worth a close look.

Work Computer (sandbox, 200 points)

You land in a restricted shell on a container and must read a file called README.flag. The catch: the usual commands for reading files are not available. The official walkthrough shows two answers, both using the BusyBox tools that remain: pack the file into an archive and print it back out with tar, or have makemime encode the file and print it. A second, harder flag had no read permission at all.

This is a beginner classic because it teaches the most useful CTF reflex: when the obvious tool is gone, list what you do have and ask what each tool can do as a side effect.

Caulingo (crypto)

An RSA challenge with a weakness in how the two primes were chosen: the challenge states that |a*p - b*q| < 10000 for small values of a and b. In other words, the primes are related, and the public modulus can be factored. The official hint is two words long: "Bruteforce" and "Fermat's Factorization Method."

Fermat's method finds the two factors of a number quickly when they are close to each other. Here is a toy version we ran in Python 3.11 with two close primes (1,000,000,007 and 1,000,000,009):

import math

def fermat(n):
    a = math.isqrt(n)
    if a * a < n:
        a += 1
    while True:
        b2 = a * a - n
        b = math.isqrt(b2)
        if b * b == b2:
            return a - b, a + b
        a += 1

print(fermat(1000000016000000063))

$ python3 fermat.py
(1000000007, 1000000009)

The second hint in the repo is the part that catches real players: "Check the precision of the result of your sqrt." Python's math.sqrt converts to a float and loses precision on big numbers. On our toy modulus it already returns 1000000008.0 when the true root sits just below that. Use math.isqrt (exact integer square root) or a library like gmpy2, as Google's own solution recommends. With the real challenge's 2048-bit numbers, the float version simply fails.

STOP GAN (pwn)

A buffer overflow with two flags. The challenge console explains it plainly: crashing the program gives the first flag, and controlling the crash gives a bonus flag. This split is a lovely teaching device. Crashing a program by sending too much input is easy. Making the crash do what you want is the actual skill. The buffer overflow chapter of our binary exploitation course walks through both steps on x86, which is easier to start with than the MIPS binary in this challenge.

Cookie World Order (web)

A web challenge built around cross-site scripting: the livestream page drops a URL parameter straight into the chat, so you can run JavaScript in the browser of an admin and steal its auth cookie. The admin area then hides a second flag behind a server-side request forgery (SSRF). The fact that the 2019 quest included XSS says a lot. XSS is one of the first web bugs you should learn, and it shows up across the Google CTF archive in much harder forms.

How to Practice With Past Google CTF Challenges

The google/google-ctf repository on GitHub "lists most of the challenges used in the Google CTF since 2017," under the Apache 2.0 license. Each year has its own folder, split into quals, finals or hackceler8, plus a beginners folder in 2018 and 2019.

Download only the challenge you want

The full repository is large. Git's sparse checkout lets you fetch a single challenge folder:

git clone --depth 1 --filter=blob:none --sparse https://github.com/google/google-ctf.git
cd google-ctf
git sparse-checkout set 2019/beginners/crypto-caulingo
ls 2019/beginners/crypto-caulingo
# README.md  attachments  hint.md  solution.md  solution.py

The layout varies from challenge to challenge. In 2019, README.md holds the challenge text, attachments holds the files players received, and some folders include hints, a solution, or a Dockerfile so you can run the vulnerable service locally. Since 2021, most qualifier challenges ship as kCTF challenges, Google's Kubernetes-based CTF infrastructure, with a challenge.yaml and a challenge folder containing the Dockerfile.

A method that works

1. Read only the README and attachments. Do not open the source of the server or the solution yet. You want to face the challenge the way players did.
2. Timebox it. Give yourself 60 to 90 minutes. Write down every idea you tried, even the ones that failed.
3. Use the hint if there is one. In the 2019 beginner folders, hint.md often gives exactly the nudge a newcomer needs.
4. Then read the solution or a community write-up. CTFtime collects write-ups for each event. Compare it with your notes and find the exact step where you got stuck.
5. Solve it again from memory a week later. If you cannot, you learned the answer but not the technique.

In practice, the Beginner's Quest folders are the right place to start, then the easiest-looking qualifier challenges from the most recent years. Challenge names usually start with the category (web-, crypto-, rev-, pwn-, misc-), so you can focus on one category at a time. Reversing beginners should look at 2024/quals/rev-ilovecrackmes once they have done a few crackmes elsewhere.

How to Prepare for the Next Google CTF

Whenever the next qualifier lands, preparation looks the same: get comfortable in two or three categories, join or build a team, and practice under time pressure. A realistic plan for someone who already knows the basics:

1. Months 1 and 2: core skills. Learn Python well enough to script a solution, the Linux command line, and the foundations of one category. Web is the most forgiving starting point.
2. Month 3: past Beginner's Quest. Work through the 2018 and 2019 beginner folders with the method above.
3. Month 4: smaller live CTFs. Play two or three weekend events listed on CTFtime with a rating weight under 50, which are much friendlier than the Google CTF.
4. Month 5: recent qualifier challenges. Pick the challenges from the last two Google CTFs that had the most solves and try them under a timer.
5. Event weekend: pace yourself. Read every challenge in the first hour, choose one, and sleep. 48 hours is long, and tired players miss simple things.

One honest tip: play with a team. The challenges are hard enough that people in different categories passing notes is how most mid-ranked teams score at all. If you have no team, CTFtime's team pages and the Discord servers of other beginner CTFs are where people find one.

Google CTF vs Other Competitions

The Google CTF is a great event to watch and a great archive to train on, but it is rarely the right first competition. Here is how it compares with the events beginners usually start with. Our guide on how to enter your first CTF competition covers the full calendar.

Our take: use the Google CTF archive the way musicians use recordings of the greats. You will not play at that level next month, but studying how a hard challenge is built teaches you more than solving ten easy ones you already understand.

Legal and Ethical Considerations

• Stay inside the challenge scope. Attacking the scoreboard, the CTF infrastructure itself, or other teams is against the spirit of every CTF and can get your team disqualified.
• Keep vulnerable code off the internet. The archive is intentionally insecure. A challenge container left listening on a public IP is a real vulnerability on your network.
• Wait to publish write-ups. Share solutions only after the event ends, so you do not spoil it for teams still playing.

Frequently Asked Questions