Jeopardy CTF is the format from which everyone starts
Jeopardy (or Task-Based) is the most common format of the flag of the competition. The name was pulled from the American TV quiz: participants are given a board with tasks broken down by categories and levels of difficulty. The task is to find a hidden line (flag) proving the solution, and send it to the verification platform. Flags usually look like flag{s0m3_t3xt_h3r3} – a specific format is announced by the organizers before the start.
DEF CON CTF has been held since 1996 and is historically considered to be the founder of the attack-defense format. The exact origin of jeopardy is less documented, but by the early 2000 "s it was already used at conferences. Since then, the format has become the standard for online competitions: on CTFtime.org annually pass hundreds of tournaments of this type.
How the CTF passes in jeopardy format: the command or single participant is registered on the platform (usually CTFd), accesses the task board, selects the category and level, solves the task, finds the flag and sends it to the form. For each decision, points are awarded. The winner is the one who gained a maximum of points by the time of the end of tournament.
The format is suitable for starting for three reasons: you can participate solo, tasks are solved in an arbitrary order, and you do not need to protect the infrastructure. First, for the eyes.
Task categories in jeopardy
Task types on CTFs in jeopardy format cover the main areas of cybersecurity. Each category trains a separate layer of skills:
Web – search and exploit vulnerabilities in web applications: SQL injections, XSS, SSRF, IDOR, bypass authentication. The tasks are directly related to OWASP Top 10 – A01:2021 (Broken Access Control) and A03:2021 (Injection) are most common. There are enough Burp Suite Community Edition and browser DevTools from the tools. The most affordable category for beginners – the basic understanding of HTTP and HTML is enough for the first tasks.
PWN (Binary Exploitation) – exploitation of vulnerabilities in compiled binary. Buffer overflow, format string, use-after-free, ROP chains. You are given an ELF file and the address of a remote server where the binary is running – you need to get control over the execution and read the file with the flag. Tools: gdb, pwntools. In terms of MITRE ATT&CK, typical remote-exploitable PWN tasks model Exploit Public-Facing Application (T1190, Initial Access) technique, and tasks with local escalation of privileges (e.g., suid binary) – Exploitation for Privilege Escalation (T1068, Privilege Escalation). The learning curve is steep, but after it you understand how programs work at the level of stack and registers. It's worth the pain.
Crypto — from Caesar’s cipher to small-exhibited RSA attacks, padding oracle, bit-flipping in block ciphers. PyCryptodome for software solutions, CyberChef for quick transformation.
Reverse Engineering – analysis of programs without source code through disassembling and decompilation. Ghidra, IDA Free, radare2. In fact, an autopsy of someone else’s binary and an attempt to understand what the author meant.
Forensics - digital forensics: analysis of memory dumps, network traffic (pcap), disk images, recovery of deleted files. Often includes steganography – search for data hidden in images or audio. Wireshark, Volatility.
OSINT – open source intelligence: file metadata, social networks, WHOIS, Shodan. Trains skills close to Active Scanning (T1595, Reconnaissance) and Network Service Discovery (T1046, Discovery) from MITRE ATT&CK.
Misc (Joy) - tasks outside the standard categories: logical puzzles, non-standard data formats, creative tasks. Sometimes the most interesting.
Counting points: static and dynamic scoring
Russian-speaking guides are usually limited to the phrase “the more difficult the task, the more points.” In practice, two systems are used, and the difference between them changes strategy.
Static scoring – the organizer manually sets the cost of each task. Light – 100 points, average – 300, complex – 500. The cost does not change during the tournament. Simple and predictable.
Dynamic scoring – the cost of the task decreases as other commands solve it. The initial price may be 500, but after 20 solutions will fall to 100. Logic: If almost everything has solved the problem, it is not worth a lot. This mechanism is described in the documentation of the Traboda Arena platform as a reproduction model, and it is used in most major online CTFs.
Practical conclusion: with dynamic scoring, it is profitable to solve problems faster than competitors, while the cost is high. The formula decay on paper is clear, but it is really felt only when you drive away the submishens and see how the cost of the task that you have solved for three hours.
Attack-Defense CTF – Real-time cybersecurity team competitions
Attack-defense (or Classic) is a format in which teams simultaneously attack the infrastructure of rivals and defend their own. If jeopardy is a quest room with categories, then attack-defense is a real-time war with live opponents.
Each command receives an identical server (vulnbox) with a set of vulnerable services. The organizers periodically place private information on these servers - flags. The task is double: to find vulnerabilities in their services and close them (protection) and simultaneously exploit the same vulnerabilities on the servers of rivals to pick up their flags (attack).
DEF CON CTF, the most prestigious tournament in the industry, uses this format for the finals. According to the participants’ publications, the 2025 DEF finale was held in tics for several minutes, and the format, according to unconfirmed community data, also included components of King of the Hill and LiveCTF. A multi-layered competition that cannot be optimized by a single skill set.
Attack-defense is less likely to be jeopardy because the organization requires serious infrastructure. Organizers of the International Cybersecurity Challenge described attack-defense as rare even among global CTF events — precisely because the format requires simultaneous attack and defense skills.
Attack-defense infrastructure and checkers
The infrastructure of attack-defense is fundamentally more complex jeopardy. Here's what you need to understand before registration.
Vulnbox is a command server with a set of services (usually 3-6 pieces) written in different languages. Each service contains one or more vulnerabilities inherent in the organizers.
Checkers – automatic scripts that regularly check that your services work correctly. Checker simulates a legitimate user: sends requests, checks answers, records flags into the service and then reads them. Patched a vulnerability and at the same time broke the functionality - the chequer will detect it, and you will lose SLA-points. Classic trap: closed the hole, but the service stopped responding to the checker. Minus the glasses.
An isolated network – all servers are in the same VPC. Each command connects via a VPN configuration. Access to rival servers – only within the gaming network.
Traffic analysis – in attack-defense monitoring network traffic – is your eyes. Teams use tools like Tulip to track incoming queries. Chip: You can detect and reproduce the exploits of other commands, finding vulnerabilities in CTF tasks that you have not yet found. In fact, you are looking at other people’s decisions right in the traffic.
What are the points: attack, protection and SLA
Counting points in attack-defense CTF consists of three components – understanding each is critical to strategy.
Attack Points – are awarded for the successful operation of the rival’s service and the delivery of its flag. The same service can be attacked from different teams, but each specific opponent is only once a round. In the next round, if the opponent did not close the vulnerability, you can attack again.
Defense Points – awarded for each round in which your service has not been compromised. No opponent pulled the flag out of a particular service – you get protective glasses.
SLA Points – are awarded for the uptime of services. Checker checks the efficiency of each round: the service fell - lost SLA, broke the functionality with an unsuccessful patch - also lost SLA. This is a fundamental difference from jeopardy: it is not enough to find and close the vulnerability - you need to do it so that the service continues to work for the checker.
King of the Hill CTF – capture and retention format
King of the Hill (KotH) is a format that Russian-speaking guides hardly mention, although it is actively gaining weight at major tournaments. KotH stands between jeopardy and attack-defense: teams compete to control common systems.
- Mechanics: You exploit a vulnerability to gain access to the server, set your flag (team marker), and then hold the position while other commands try to oust you. Points are charged during the retention of control. If attack-defense is a war with two fronts (its own server and other people’s servers), then king of the hill is the “take of the flag” from the shooters: one point, many applicants, the one who will hold for longer wins.
How is KotH in practice
DEF CON CTF 2025, according to participants' publications, supposedly included KotH as a separate component alongside attack-defense. According to the descriptions, the tasks of KotH took place in rounds for several hours, and the goal is to develop the most effective solution for each round. After each round, the conditions changed, forcing the teams to adapt on the fly.
A specific example: the KotH task may require writing a minimum length shellcode for flag reading. In the next round, the organizers prohibit certain bytes, and the team is forced to rewrite the solution, taking into account the new restrictions. This does not test a one-time ability to find vulnerability, but the ability to adapt quickly under pressure.
What makes KotH is fundamentally more difficult than jeopardy: it is not enough to find an exploit - you need to keep access while the opponents are actively trying to displace you. Hence the strategic dilemmas. Patching the vulnerability that you entered through to close the path to others? Or leave as a backup entrance? Defending the current position or attacking a more valuable target? In real security, it is close to persistence – retaining access in compromised infrastructure, which models Valid Accounts (T1078, Persistence / Initial Access) from MITRE ATT&CK.
According to the description of CybExer, KotH is optimal for training skills of sustainable control over the disputed system - a skill that will be useful in both Red Team operations and incident investigation, when you need to understand how the attacker held the presence.
Preparation for the first CTF tournament: rules and checklist for beginners
What to take for the first CTF tournament
Requirements for the environment:
Laptop with a minimum of 8 GB RAM (16 GB recommended for virtual machines)
A virtual machine with Kali Linux or Parrot Security OS (or WSL2 with a set of tools installed)
Stable Internet for Online Tournaments
OpenVPN-client — required for attack-defense formats
Minimum set of tools:
Burp Suite Community Edition for web tasks
Python 3 + pwntools + PyCryptodome for pwn and crypto
Ghidra or IDA Free – for reverse
Wireshark – for forensics and traffic analysis
CyberChef (online version) – for rapid transformations: base64, hex, XOR
nmap – for exploration in attack-defense and KotH
Documents and Templates:
Write-up template — start the file before the tournament, write each step in parallel with the solution
List of single-liners for each category - for example, strings filename | grep -i flag to quickly search for a flag in binary files (does not replace Wireshark for pcap or Volatility for memory dump) or sqlmap -u "URL" --batch for web
Notes with the flag format of a particular tournament — double-check before first sending
The whole team is on one task. If you go by a team of four people, agree in advance who takes the web, who is crypto cryptos. Four people on a web task are a stupid loss of time.
Ignoring easy tasks. On jeopardy-tournaments tasks for 50-100 points are often solved in 5-10 minutes. Score 500 points on ten lightweight tasks is more productive than sitting three hours over one difficult for the same 500.
Lack of records. After two hours, you will not remember which payloads have already tried. Write-up is written in parallel with the decision, not after the tournament.
Installing tools during the tournament. Put the environment the day before the start. Team apt install on slow Wi-Fi in the middle of the competition is a proven way to lose an hour. Make sure VM is downloaded, pwntools are imported, Burp Suite is launched before the timer begins.
Where to look for tournaments. CTFtime.org is the main aggregator: tournament schedule, team rating, archive of tasks from past competitions. To begin with, platforms with constantly available tasks are suitable: picoCTF from Carnegie Mellon (tasks with step-by-step introduction), Hack The Box (ranking by levels), TryHackMe (interactive scenarios).
Timing and roles in CTF: How to Spread Time in a Team
For a jeopardy tournament lasting 24 hours, typical distribution:
The first 30 minutes is a scout phase. Each participant runs tasks in his category, evaluates the complexity, marks “fast victories” – tasks solved in 10-15 minutes.
Hours 1-6 are easy and medium tasks. The goal is the maximum of points with minimal effort. If the task does not lend itself in 40 minutes, switch to another. Seriously, switch. Then you'll come back with your fresh head.
Hours 6-18 – work on complex tasks. “Quick victories” is over, you need to dig deeper.
Hours 18-24 – final spurt. Review the unsolved tasks with hints (hints) that organizers can open towards the end.
A critical error in attack-defense – the whole team deals only with the attack. Without patching you lose defense glasses and SLA every round. Balance attack/defense is a key strategic choice, and needs to be discussed before the tournament begins, not in the middle of the second round, when the SLA has already subsided.
King of the hill requires even more flexibility: after each round, the conditions change, and tightly fixed roles work worse. Here you need people who are able to switch between tasks - universals are more valuable than narrow specialists.
In my five years of participation and organization of CTF, I have come to one conclusion: the format determines the experience, not the absolute complexity of the tasks. Jeopardy can be technically super-complex — when a crypto task requires the implementation of a Coppersmith attack. Attack-defense can be relatively easy on tasks – but falls apart when the team is unable to coordinate in real time.
Jeopardy (or Task-Based) is the most common format of the flag of the competition. The name was pulled from the American TV quiz: participants are given a board with tasks broken down by categories and levels of difficulty. The task is to find a hidden line (flag) proving the solution, and send it to the verification platform. Flags usually look like flag{s0m3_t3xt_h3r3} – a specific format is announced by the organizers before the start.
DEF CON CTF has been held since 1996 and is historically considered to be the founder of the attack-defense format. The exact origin of jeopardy is less documented, but by the early 2000 "s it was already used at conferences. Since then, the format has become the standard for online competitions: on CTFtime.org annually pass hundreds of tournaments of this type.
How the CTF passes in jeopardy format: the command or single participant is registered on the platform (usually CTFd), accesses the task board, selects the category and level, solves the task, finds the flag and sends it to the form. For each decision, points are awarded. The winner is the one who gained a maximum of points by the time of the end of tournament.
The format is suitable for starting for three reasons: you can participate solo, tasks are solved in an arbitrary order, and you do not need to protect the infrastructure. First, for the eyes.
Task categories in jeopardy
Task types on CTFs in jeopardy format cover the main areas of cybersecurity. Each category trains a separate layer of skills:
Web – search and exploit vulnerabilities in web applications: SQL injections, XSS, SSRF, IDOR, bypass authentication. The tasks are directly related to OWASP Top 10 – A01:2021 (Broken Access Control) and A03:2021 (Injection) are most common. There are enough Burp Suite Community Edition and browser DevTools from the tools. The most affordable category for beginners – the basic understanding of HTTP and HTML is enough for the first tasks.
PWN (Binary Exploitation) – exploitation of vulnerabilities in compiled binary. Buffer overflow, format string, use-after-free, ROP chains. You are given an ELF file and the address of a remote server where the binary is running – you need to get control over the execution and read the file with the flag. Tools: gdb, pwntools. In terms of MITRE ATT&CK, typical remote-exploitable PWN tasks model Exploit Public-Facing Application (T1190, Initial Access) technique, and tasks with local escalation of privileges (e.g., suid binary) – Exploitation for Privilege Escalation (T1068, Privilege Escalation). The learning curve is steep, but after it you understand how programs work at the level of stack and registers. It's worth the pain.
Crypto — from Caesar’s cipher to small-exhibited RSA attacks, padding oracle, bit-flipping in block ciphers. PyCryptodome for software solutions, CyberChef for quick transformation.
Reverse Engineering – analysis of programs without source code through disassembling and decompilation. Ghidra, IDA Free, radare2. In fact, an autopsy of someone else’s binary and an attempt to understand what the author meant.
Forensics - digital forensics: analysis of memory dumps, network traffic (pcap), disk images, recovery of deleted files. Often includes steganography – search for data hidden in images or audio. Wireshark, Volatility.
OSINT – open source intelligence: file metadata, social networks, WHOIS, Shodan. Trains skills close to Active Scanning (T1595, Reconnaissance) and Network Service Discovery (T1046, Discovery) from MITRE ATT&CK.
Misc (Joy) - tasks outside the standard categories: logical puzzles, non-standard data formats, creative tasks. Sometimes the most interesting.
Counting points: static and dynamic scoring
Russian-speaking guides are usually limited to the phrase “the more difficult the task, the more points.” In practice, two systems are used, and the difference between them changes strategy.
Static scoring – the organizer manually sets the cost of each task. Light – 100 points, average – 300, complex – 500. The cost does not change during the tournament. Simple and predictable.
Dynamic scoring – the cost of the task decreases as other commands solve it. The initial price may be 500, but after 20 solutions will fall to 100. Logic: If almost everything has solved the problem, it is not worth a lot. This mechanism is described in the documentation of the Traboda Arena platform as a reproduction model, and it is used in most major online CTFs.
Practical conclusion: with dynamic scoring, it is profitable to solve problems faster than competitors, while the cost is high. The formula decay on paper is clear, but it is really felt only when you drive away the submishens and see how the cost of the task that you have solved for three hours.
Attack-Defense CTF – Real-time cybersecurity team competitions
Attack-defense (or Classic) is a format in which teams simultaneously attack the infrastructure of rivals and defend their own. If jeopardy is a quest room with categories, then attack-defense is a real-time war with live opponents.
Each command receives an identical server (vulnbox) with a set of vulnerable services. The organizers periodically place private information on these servers - flags. The task is double: to find vulnerabilities in their services and close them (protection) and simultaneously exploit the same vulnerabilities on the servers of rivals to pick up their flags (attack).
DEF CON CTF, the most prestigious tournament in the industry, uses this format for the finals. According to the participants’ publications, the 2025 DEF finale was held in tics for several minutes, and the format, according to unconfirmed community data, also included components of King of the Hill and LiveCTF. A multi-layered competition that cannot be optimized by a single skill set.
Attack-defense is less likely to be jeopardy because the organization requires serious infrastructure. Organizers of the International Cybersecurity Challenge described attack-defense as rare even among global CTF events — precisely because the format requires simultaneous attack and defense skills.
Attack-defense infrastructure and checkers
The infrastructure of attack-defense is fundamentally more complex jeopardy. Here's what you need to understand before registration.
Vulnbox is a command server with a set of services (usually 3-6 pieces) written in different languages. Each service contains one or more vulnerabilities inherent in the organizers.
Checkers – automatic scripts that regularly check that your services work correctly. Checker simulates a legitimate user: sends requests, checks answers, records flags into the service and then reads them. Patched a vulnerability and at the same time broke the functionality - the chequer will detect it, and you will lose SLA-points. Classic trap: closed the hole, but the service stopped responding to the checker. Minus the glasses.
An isolated network – all servers are in the same VPC. Each command connects via a VPN configuration. Access to rival servers – only within the gaming network.
Traffic analysis – in attack-defense monitoring network traffic – is your eyes. Teams use tools like Tulip to track incoming queries. Chip: You can detect and reproduce the exploits of other commands, finding vulnerabilities in CTF tasks that you have not yet found. In fact, you are looking at other people’s decisions right in the traffic.
What are the points: attack, protection and SLA
Counting points in attack-defense CTF consists of three components – understanding each is critical to strategy.
Attack Points – are awarded for the successful operation of the rival’s service and the delivery of its flag. The same service can be attacked from different teams, but each specific opponent is only once a round. In the next round, if the opponent did not close the vulnerability, you can attack again.
Defense Points – awarded for each round in which your service has not been compromised. No opponent pulled the flag out of a particular service – you get protective glasses.
SLA Points – are awarded for the uptime of services. Checker checks the efficiency of each round: the service fell - lost SLA, broke the functionality with an unsuccessful patch - also lost SLA. This is a fundamental difference from jeopardy: it is not enough to find and close the vulnerability - you need to do it so that the service continues to work for the checker.
King of the Hill CTF – capture and retention format
King of the Hill (KotH) is a format that Russian-speaking guides hardly mention, although it is actively gaining weight at major tournaments. KotH stands between jeopardy and attack-defense: teams compete to control common systems.
- Mechanics: You exploit a vulnerability to gain access to the server, set your flag (team marker), and then hold the position while other commands try to oust you. Points are charged during the retention of control. If attack-defense is a war with two fronts (its own server and other people’s servers), then king of the hill is the “take of the flag” from the shooters: one point, many applicants, the one who will hold for longer wins.
How is KotH in practice
DEF CON CTF 2025, according to participants' publications, supposedly included KotH as a separate component alongside attack-defense. According to the descriptions, the tasks of KotH took place in rounds for several hours, and the goal is to develop the most effective solution for each round. After each round, the conditions changed, forcing the teams to adapt on the fly.
A specific example: the KotH task may require writing a minimum length shellcode for flag reading. In the next round, the organizers prohibit certain bytes, and the team is forced to rewrite the solution, taking into account the new restrictions. This does not test a one-time ability to find vulnerability, but the ability to adapt quickly under pressure.
What makes KotH is fundamentally more difficult than jeopardy: it is not enough to find an exploit - you need to keep access while the opponents are actively trying to displace you. Hence the strategic dilemmas. Patching the vulnerability that you entered through to close the path to others? Or leave as a backup entrance? Defending the current position or attacking a more valuable target? In real security, it is close to persistence – retaining access in compromised infrastructure, which models Valid Accounts (T1078, Persistence / Initial Access) from MITRE ATT&CK.
According to the description of CybExer, KotH is optimal for training skills of sustainable control over the disputed system - a skill that will be useful in both Red Team operations and incident investigation, when you need to understand how the attacker held the presence.
Preparation for the first CTF tournament: rules and checklist for beginners
What to take for the first CTF tournament
Requirements for the environment:
Laptop with a minimum of 8 GB RAM (16 GB recommended for virtual machines)
A virtual machine with Kali Linux or Parrot Security OS (or WSL2 with a set of tools installed)
Stable Internet for Online Tournaments
OpenVPN-client — required for attack-defense formats
Minimum set of tools:
Burp Suite Community Edition for web tasks
Python 3 + pwntools + PyCryptodome for pwn and crypto
Ghidra or IDA Free – for reverse
Wireshark – for forensics and traffic analysis
CyberChef (online version) – for rapid transformations: base64, hex, XOR
nmap – for exploration in attack-defense and KotH
Documents and Templates:
Write-up template — start the file before the tournament, write each step in parallel with the solution
List of single-liners for each category - for example, strings filename | grep -i flag to quickly search for a flag in binary files (does not replace Wireshark for pcap or Volatility for memory dump) or sqlmap -u "URL" --batch for web
Notes with the flag format of a particular tournament — double-check before first sending
The whole team is on one task. If you go by a team of four people, agree in advance who takes the web, who is crypto cryptos. Four people on a web task are a stupid loss of time.
Ignoring easy tasks. On jeopardy-tournaments tasks for 50-100 points are often solved in 5-10 minutes. Score 500 points on ten lightweight tasks is more productive than sitting three hours over one difficult for the same 500.
Lack of records. After two hours, you will not remember which payloads have already tried. Write-up is written in parallel with the decision, not after the tournament.
Installing tools during the tournament. Put the environment the day before the start. Team apt install on slow Wi-Fi in the middle of the competition is a proven way to lose an hour. Make sure VM is downloaded, pwntools are imported, Burp Suite is launched before the timer begins.
Where to look for tournaments. CTFtime.org is the main aggregator: tournament schedule, team rating, archive of tasks from past competitions. To begin with, platforms with constantly available tasks are suitable: picoCTF from Carnegie Mellon (tasks with step-by-step introduction), Hack The Box (ranking by levels), TryHackMe (interactive scenarios).
Timing and roles in CTF: How to Spread Time in a Team
For a jeopardy tournament lasting 24 hours, typical distribution:
The first 30 minutes is a scout phase. Each participant runs tasks in his category, evaluates the complexity, marks “fast victories” – tasks solved in 10-15 minutes.
Hours 1-6 are easy and medium tasks. The goal is the maximum of points with minimal effort. If the task does not lend itself in 40 minutes, switch to another. Seriously, switch. Then you'll come back with your fresh head.
Hours 6-18 – work on complex tasks. “Quick victories” is over, you need to dig deeper.
Hours 18-24 – final spurt. Review the unsolved tasks with hints (hints) that organizers can open towards the end.
A critical error in attack-defense – the whole team deals only with the attack. Without patching you lose defense glasses and SLA every round. Balance attack/defense is a key strategic choice, and needs to be discussed before the tournament begins, not in the middle of the second round, when the SLA has already subsided.
King of the hill requires even more flexibility: after each round, the conditions change, and tightly fixed roles work worse. Here you need people who are able to switch between tasks - universals are more valuable than narrow specialists.
In my five years of participation and organization of CTF, I have come to one conclusion: the format determines the experience, not the absolute complexity of the tasks. Jeopardy can be technically super-complex — when a crypto task requires the implementation of a Coppersmith attack. Attack-defense can be relatively easy on tasks – but falls apart when the team is unable to coordinate in real time.
