If you have never done a CTF before, PicoCTF is the best place to start. It is free, always available, and the challenges are designed to teach you security concepts from scratch. This is a picoctf walkthrough aimed at people who are completely new to capture-the-flag competitions.

I am going to walk through what PicoCTF is, how to get set up, and then solve a handful of beginner challenges across different categories so you can see what each one involves.

What Is PicoCTF

PicoCTF is a free cybersecurity competition created by Carnegie Mellon University’s CyLab. Unlike most CTFs that run for 48 hours and then disappear, PicoCTF keeps its challenges available year-round through picoGym. You can practice at your own pace.

The challenges are organized into categories:

  • General Skills - command line basics, encoding, scripting
  • Web Exploitation - finding vulnerabilities in web applications
  • Forensics - analyzing files, images, network captures
  • Cryptography - breaking ciphers and encryption
  • Reverse Engineering - understanding compiled binaries
  • Binary Exploitation - memory corruption, buffer overflows

Each challenge gives you a flag in the format picoCTF{some_text_here}. Find the flag, submit it, get points.

Getting Started

  1. Go to play.picoctf.org{:target="_blank"} and create an account
  2. Navigate to picoGym Practice to access challenges from previous competitions
  3. Sort by point value (lowest first) to start with the easiest ones
  4. You will need a terminal - Linux is ideal, but WSL on Windows works fine

For tooling, you do not need much at first. A web browser with developer tools, a terminal, and Python installed will cover most beginner challenges.

General Skills: Obedient Cat (5 pts)

This is usually the very first challenge people solve. You are given a file and told the answer is inside it.

Download the file and read it:

wget https://challenge-url/flag
cat flag

The flag is sitting in the file in plaintext. The point of this challenge is just to make sure you know how to download a file and read it. Every CTF has a sanity check challenge like this.

Takeaway: The simplest challenges teach tool mechanics. Knowing how to use wget, curl, cat, and strings will carry you through many early challenges.

General Skills: Nice netcat… (15 pts)

You are given a netcat command to run. When you connect, you get a stream of numbers:

nc mercury.picoctf.net 21135

Output is something like:

112
105
99
111
67
84
70

These are ASCII decimal values. Convert each number to its character:

numbers = [112, 105, 99, 111, 67, 84, 70]
print(''.join(chr(n) for n in numbers))

This prints the flag. The challenge teaches you about ASCII encoding, which shows up constantly in CTFs. If you see numbers in the range 32-126, try converting them to ASCII characters.

Takeaway: Encoding is not encryption. ASCII, hex, base64 - these are ways of representing data, not protecting it. Learning to recognize them quickly is a fundamental CTF skill.

Web Exploitation: Insp3ct0r (50 pts)

You get a link to a web page. The page looks normal, but the flag is hidden across the source files.

Open the page and view the HTML source (Ctrl+U in most browsers or right-click and View Source). Part of the flag is in an HTML comment:

<!-- Part 1: picoCTF{tru3_d3 -->

Check the CSS file linked in the head:

/* Part 2: t3ct1ve_0r_ */

Check the JavaScript file:

// Part 3: just_lucky?_f7f947b2}

Combine all three parts. The lesson here is that anything sent to the browser is visible to the user. HTML comments, CSS files, JavaScript files - none of these are secret.

Takeaway: Client-side code is public. Never put secrets, passwords, or API keys in frontend code. This is security 101, but developers still make this mistake in production applications.

Forensics: information (10 pts)

You are given an image file. The flag is not visible in the image itself.

Check the file metadata using exiftool:

exiftool cat.jpg

In the output, look at the fields - one of them contains a base64-encoded string. Decode it:

echo "cGljb0NURntNRTRkYXRhXzFzX01vZGlmaWVkfQ==" | base64 -d

This gives you the flag. Image metadata (EXIF data) can contain all sorts of information - GPS coordinates, camera model, software used, and custom fields. Forensics challenges frequently hide data in metadata, file headers, or appended bytes.

Takeaway: Files are more than their visible content. Tools like exiftool, binwalk, strings, and file should be your first step when analyzing any unknown file in a CTF.

Web Exploitation: where are the robots (100 pts)

The challenge gives you a website URL. The name is the hint.

Check robots.txt:

https://challenge-url/robots.txt

The robots.txt file tells search engine crawlers which paths to avoid. In CTFs (and in real security assessments), this file often reveals hidden directories or files:

User-agent: *
Disallow: /secret-flag-page.html

Navigate to the disallowed path to find the flag.

This is a real technique used in reconnaissance during security assessments. robots.txt, sitemap.xml, .git/ directories, backup files - these are all things you should check on any target.

Takeaway: Information disclosure comes in many forms. Configuration files, directory listings, and metadata all reveal things the developer might not have intended to expose.

Tips for PicoCTF Beginners

Read the challenge name and description carefully. They almost always contain hints. A challenge called “Bases” probably involves base64 or another base encoding. A challenge mentioning “Mr. Robots” is pointing you at robots.txt.

Learn to use CyberChef. It is a free web tool from GCHQ that handles encoding conversions, cipher operations, and data analysis. You will use it constantly. Keep it open in a tab.

Start a notes file. Write down what you tried, what worked, and what did not. CTF challenges repeat patterns. The technique you learn on a 50-point challenge will show up again on a 300-point challenge with added complexity.

Do not brute force. If you are guessing randomly, you are missing something. Go back and re-read the challenge description, check the source more carefully, or try a different tool.

Use the community. PicoCTF has a Discord server and active forums. If you are stuck for more than an hour on a beginner challenge, look at hints or ask for a nudge (not the full answer). The point is learning, not points.

What to Tackle Next

After you clear the easiest challenges in each category, you will start to see patterns. Web challenges get harder by adding input filtering and more complex vulnerabilities. Forensics moves from metadata to steganography and memory dumps. Crypto shifts from classical ciphers to flawed implementations of modern algorithms.

The jump from beginner to intermediate is where most people get stuck. Pick one category that interests you and go deep. Being good at web exploitation or forensics is more valuable than being mediocre at everything.

PicoCTF releases a new competition every year, and past challenges stay in picoGym. There is enough content there to keep you busy for months.

Solve. Learn. Repeat. That is how you get good at this.