A note was left on the server. It ends in an equals sign, and that is not a coincidence. Find the flag.
ZmxhZ3t5b3VfanVzdF9kZWNvZGVkX2Jhc2U2NH0=
Your first flag in five minutes. No VM, no Kali.
Learn cybersecurity the way CTF players do: read the evidence, spot the trick, capture the flag. Everything runs in your browser, even on a phone.
Get the idea in five minutes.
Each topic starts with a short explanation and a category playbook: first moves, tools, and the traps that cost time.
Find real flags.
Inspect files, traffic, pages and code with in-browser tools. Hints when you need them, a write-up after you solve.
Build the instinct.
A daily flag, a practice board of 89 challenges and weekly leagues turn one solve into a habit.
13 topics. 89 flags. Four stages.
What a CTF is, how to read evidence, and the formats every challenge uses.
- What is a CTF? 6 flags
- CTF essentials 6 flags
- Encodings and bytes 9 flags
- Linux and the terminal 6 flags
The four categories almost every beginner CTF includes.
- Introductory cryptography 6 flags
- Web inspection 9 flags
- Artifact forensics 7 flags
- Network evidence 8 flags
Keys and hashes, public-information hunting, reading code, and automating the boring part.
- Ciphers, hashes and keys 6 flags
- OSINT (fictional targets) 6 flags
- Reversing fundamentals 8 flags
- Scripting for CTFs 6 flags
Multi-step challenges that chain categories, then a proper write-up.
- Mini CTF: put it together 6 flags
The whole method, on one page.
The five-step solving loop, a table that turns “what am I looking at?” into “try this next”, playbooks for every category, and where to practise after Exorvio.
For your first CTF. And your next one.
Heard about CTFs from a senior, a club poster or a reel, opened a big platform, hit the VPN setup and closed the tab? Start here instead. Exorvio teaches each idea, then hands you the evidence and a flag to find, with no installs and no paid barrier. When you are ready, the map points you to picoCTF, OverTheWire and real events.
Built by Devvik Agarwal, for people who learn by doing.
Capture your first flagA few useful answers.
What is a CTF?
A Capture The Flag is a security game. Each challenge hides a secret string, a flag such as flag{this_is_a_flag}, behind a puzzle: an encoding, a cipher, a file, captured traffic, a web page or a small program. Find the flag, submit it, score points.
Is Exorvio free?
Yes. Exorvio has no learner fees and no ads. An eligible free account saves your flags, XP and streak.
Do I need to install anything?
No. Every challenge includes its evidence and runs in the browser, with decoding tools built in. You will meet tools like Wireshark, exiftool and Ghidra in the playbooks for when you move on to bigger events.
Is this legal?
Yes. Every Exorvio challenge is a practice target we built, and OSINT challenges use invented people and places only. Solving them does not authorise testing any real system: only test systems you own or have written permission to test. Read the rules.
Do I need programming experience?
No. Most early topics need only careful reading and the built-in tools. The scripting topic introduces a little Python for the challenges where repeating a step by hand gets slow.
Do I have to join a leaderboard?
No. You can turn off leaderboard participation in account preferences and keep learning, earning XP and saving your progress.
Can younger learners use Exorvio?
The CTF map, course introductions and the public daily flag are available without an account. Adults can create their own accounts. Younger learners in India and United States can use a private parent-managed account after adult verification and parental consent. Read the information for families.