“Capture The Flag” (CTF) competitions (in the cyber security sense) are not related to running outdoors or playing first-person shooters. Instead, they consist of a set of computer security puzzles (or challenges) involving reverse-engineering, memory corruption, cryptography, web technologies, and more. When players solve them they get a “flag,” a secret string which can be exchanged for points. The more points a team earns, the higher up it moves in rank.

In computer security Capture the Flag (CTF), “flags” are secrets hidden in purposefully-vulnerable programs or websites. Competitors steal flags either from other competitors (attack/defense-style CTFs) or from the organizers (jeopardy-style challenges). Several variations exist, including hiding flags in hardware devices.

Security CTFs are usually designed to serve as an educational exercise to give participants experience in securing a machine, as well as conducting and reacting to the sort of attacks found in the real world (i.e., bug bounty programs in professional settings). Classic activities include reverse-engineering, network sniffing, protocol analysis, system administration, programming, cryptoanalysis, writing exploits, etc.