MetaCTF (Now SkillBit): Free Flash CTFs, Pricing & Tips

What Is MetaCTF (Now SkillBit)?

MetaCTF is a cybersecurity skills platform that teaches through capture the flag (CTF) challenges: small, self-contained puzzles where you exploit, decode or investigate something until you find a secret string called a flag. It was founded in 2019 in Charlottesville, Virginia, and built its name running CTFs for universities, conferences and companies.

On October 7, 2025, the company announced its rebrand to SkillBit. The co-founders explained that CTF-based learning had grown into a broader skills platform for assessing, hiring and training security teams, and the old name no longer covered it. For you as a player, the practical impact is small:

• The company and website are now SkillBit (skillbit.com), and the self-paced platform is called SkillBit Labs.
• The monthly Flash CTF still appears as "MetaCTF [Month] Flash CTF" on CTFtime and in event listings.
• Logins and challenge links still point to app.metactf.com, and flags still use the MetaCTF{...} format.

What You Can Do There

How the Monthly MetaCTF Flash CTF Works

The Flash CTF is a free, individual, online CTF held once a month. Each edition has 5 or more jeopardy-style challenges ranging from beginner to hard, and recent editions last about 2 hours. It is the easiest way to try MetaCTF without committing to anything.

• When: usually a Thursday evening in US time (the January 2026 edition ran 22:00 to 01:00 UTC). The registration link at mctf.io/flash always points to the next edition.
• Who: individuals only, no teams, open to all skill levels.
• Prizes: gift cards for the top finishers and training raffles from partners such as TCM Security, Antisyphon Training and Simply Cyber Academy.
• Afterwards: official writeups appear on the MetaCTF blog, so every challenge you missed becomes a free lesson.

The bigger annual MetaCTF CyberGames ran in 2020 and 2021 and are archived on CTFtime. Today the Flash CTF is the regular public event.

Conference CTFs

MetaCTF also runs in-person CTFs at security conferences. At RVAsec 2026 in Richmond, Virginia (June 9-10), the jeopardy-style competition was open to solo players and teams of up to 4, covered web, binary exploitation, OSINT, reverse engineering, crypto and forensics, and offered over $2,000 in prizes. Our guide to CTF competitions and how to enter your first one covers CTFtime, event weights and finding a team.

SkillBit Labs Pricing: Is MetaCTF Free?

Yes, the core of MetaCTF is free for individuals. The monthly Flash CTF costs nothing, and SkillBit Labs has a free plan. The paid Pro plan unlocks the full challenge library and more VM time.

Prices are from the SkillBit pricing page. The free tier is generous enough to find out whether the format suits you before paying anything.

MetaCTF Challenge Categories

MetaCTF challenges follow the classic jeopardy CTF categories. Easier challenges are worth fewer points, and harder ones more.

• Web exploitation SQL injection, cross-site scripting, broken authentication, cookie tampering. Skills: HTTP, browser DevTools, Burp Suite.
• Cryptography From Base64 and Caesar shifts to weak RSA keys. Skills: encodings, a bit of math, pattern spotting.
• Forensics Hidden data in files, packet captures, memory dumps and disk images. Skills: file analysis, Wireshark, metadata.
• OSINT Finding people, places and accounts from public information. Skills: search operators, image clues, patience.
• Reverse engineering Working out what a compiled program does and extracting the flag. Skills: Ghidra, reading assembly.
• Binary exploitation Buffer overflows, format strings and memory corruption. Skills: C, memory layout, GDB, pwntools.

How to Get Started with MetaCTF

1. Create an account Sign up through mctf.io/practice, which opens the free practice environment on app.metactf.com.
2. Learn the flag format Flags look like MetaCTF{some_text_here}. If a challenge uses a different format, the description says so.
3. Solve three easy challenges Filter by the lowest point values in web and crypto. Early wins teach you how the platform and the challenge descriptions work.
4. Enter the next Flash CTF Register at mctf.io/flash. Two hours of time pressure teaches more than a week of casual browsing.
5. Read the writeups After the event, read the official solution for every challenge you did not finish, then solve it yourself.

Do You Need a Virtual Machine?

For SkillBit Labs, no: challenges that need tools come with browser-based VMs. For the Flash CTF you usually download files and work locally, so a Kali Linux VM (or any Linux VM) is worth having. It keeps odd binaries and tools off your main system, and a snapshot taken before the event lets you roll back in seconds if something breaks. On a work or school computer, check the rules before installing security tools.

Essential Tools for MetaCTF Challenges

You do not need a huge toolkit. These cover most beginner and intermediate challenges; our full list of CTF tools by category goes further.

• CyberChef: decode, decrypt and transform data in your browser. Its "Magic" operation guesses layered encodings for you.
• Burp Suite Community: intercept and modify web requests. Free and enough for CTF web challenges.
• Wireshark: open packet captures, filter traffic and use "Follow TCP Stream" to read conversations.
• Ghidra: the NSA's free decompiler for reverse engineering challenges.
• John the Ripper / Hashcat: crack hashes and password-protected files with a wordlist such as rockyou.txt.
• Python with pwntools: script repetitive tasks and talk to remote challenge servers (nc host port works for quick manual tests).
• Volatility 3: analyze memory dumps in forensics challenges.

In practice, a surprising number of easy crypto and forensics flags fall to three commands before any "real" tool: file to learn what something actually is, strings challenge.bin | grep -i metactf to look for the flag in plain sight, and exiftool to read metadata. Run those first.

MetaCTF vs Other CTF Platforms

Choose MetaCTF if you like leaderboards and time pressure and want a free event on your calendar every month. Complement it with a guided platform when you keep hitting the same wall: a Flash CTF shows you what you do not know, and a structured lab teaches it.

7 Tips for Solving MetaCTF Challenges

1. Read the title and description twice. Authors hide hints in puns and wording. A challenge called "Salad" is probably a Caesar cipher.
2. Search for the flag format. Grep every output for MetaCTF{. Sometimes it is sitting in a comment or a file's metadata.
3. Try CyberChef on anything strange. Base64, hex, URL encoding and ROT13 account for many easy points.
4. Timebox each challenge. In a 2-hour Flash CTF, give yourself 20 minutes, then move on and come back later.
5. Search what you do not recognise. Looking things up is part of the game, not cheating.
6. Keep notes. A short file per challenge (what you tried, what worked) becomes your personal cheat sheet.
7. Always read the writeups. The challenges you failed teach the most, as long as you redo them yourself afterwards.

Legal and Ethical Considerations

As in any CTF, keep flags and solutions to yourself while an event is running. Writeups are welcome once it ends.