Kit for Running an Internal CTF

A CTF (Capture The Flag) is a game where you find "flags" (hidden FLAG{...} strings) by solving challenges: a clear objective, immediate reward, visible progress, and a competitive spirit.

CTF types (Jeopardy, Attack-Defense, Boot2Root)

• Jeopardy: the most common. Independent challenges sorted by category (web, crypto, forensics, reverse engineering…) and by points. You solve whichever ones you want, in whatever order you want.
• Attack-Defense: each team defends its own services while attacking those of the other teams. More complex, better suited to an advanced audience.
• Boot2Root: a machine to fully compromise, from initial access all the way to root (the format of the final mission).

For a class, the Jeopardy or Boot2Root format is the best fit.

When to Use It

• Optional CTF at the midpoint (after S7) to build motivation.
• Capstone CTF at the end of the course.
• Weekly "flag" mini-challenges (already built into the SXX files).

flowchart TB
    START[Depart] --> E1[Recon<br/>flag 1]
    E1 --> E2[Web<br/>flag 2]
    E2 --> E3[Exploit<br/>flag 3]
    E3 --> E4[Priv Esc<br/>flag 4 = root]
    E4 --> WIN[Classement]
    style WIN fill:#2f855a,color:#fff