exorvio.

THE CTF MAP

How to find the flag, every time.

Capture the flag (CTF) challenges hide a secret string, usually shaped like flag{...}, behind a security puzzle. This map is the whole method in one page: the route to learn, the loop every solve follows, how to recognise what you are looking at, and a playbook for each category.

Start capturing flags →Jump to the signal table

1. The route

Thirteen topics in four stages, 89 hands-on challenges. Each topic has three core flags that complete it and extra practice flags for when you want more. Every challenge runs in your browser with its evidence supplied: no VM, no installs.

  1. STAGE 1

    Foundations

    What a CTF is, how to read evidence, and the formats every challenge uses.

  2. STAGE 2

    Core categories

    The four categories almost every beginner CTF includes.

  3. STAGE 3

    Going deeper

    Keys and hashes, public-information hunting, reading code, and automating the boring part.

  4. STAGE 4

    Your first event

    Multi-step challenges that chain categories, then a proper write-up.

2. The solving loop

Every flag, from a five-point warm-up to a hard multi-step challenge, follows the same five steps. When a solve stalls, find which step you skipped.

01

Before you start

Read the rules and the scope. Know what a flag looks like and what you are allowed to touch.

  • Read the rules page end to end. Warm-up flags often hide there.
  • Write down the flag format (here: flag{...}). Case and braces matter.
  • List what is in scope. Only test the targets the challenge names.
  • Note the category and point value. Low points usually means one or two steps.
  • Open a notes file. Every attempt goes in it, including the ones that fail.
02

Triage: what am I looking at?

Identify the evidence before transforming it. Most beginner challenges are solved by naming the thing correctly.

  • Read the brief twice. Titles and flavour text are hints.
  • Search for the flag prefix first (Ctrl+F or grep 'flag{').
  • Identify the type: text, encoding, cipher, file, traffic, code or a website.
  • For a file, check its first bytes (magic bytes) rather than its extension.
  • Use the signal table below: alphabet, length and padding give encodings away.
03

Transform one layer at a time

Decode, decrypt or extract a single step, then look at the output again. Repeat until it reads flag{...}.

  • Apply one transformation, never a guessed chain.
  • After each step ask: does this look like another encoding, a cipher, or the flag?
  • If the output is garbage, undo it and note that this path failed.
  • Known prefixes help: flag{ in disguise tells you shifts, keys and XOR bytes.
  • When the same step repeats, script it.
04

When you are stuck

Being stuck is normal. Change your angle, not your effort.

  • Re-read the title and brief. Authors rarely waste words.
  • List every artifact and field you have not looked at closely yet.
  • Check your notes: are you retrying something that already failed?
  • Try the boring checks: view source, strings, metadata, robots.txt, comments.
  • Take one hint, then try again before taking the next.
  • Walk away for ten minutes. Fresh eyes solve a surprising number of flags.
05

After the flag: write it up

A short write-up turns one solve into a skill you keep. Real security work ends in a report too.

  • Summary: what the challenge was and where the flag was hidden.
  • Steps: exactly how to reproduce the solve, in order.
  • Dead ends: what you tried that failed, and why.
  • Lesson: the one idea you would check first next time.
  • Publish write-ups only after an event ends, and only where its rules allow.

3. What am I looking at?

Most beginner challenges are solved by naming the evidence correctly. Match what you see, then try the suggested move first.

If you seeIt is probablyTry this
Letters, digits, + and /, often ending in = or ==Base64Base64 decode, then look again
Only A-Z and 2-7, often padded with =Base32Base32 decode tool (or base32 -d in a terminal)
Only 0-9 and a-f, even lengthHexHex to text; 66 6c 61 67 is 'flag'
Groups of eight 0s and 1sBinary bytesBinary to text, eight bits per character
Numbers between 32 and 126Decimal ASCII codesDecimal bytes to text
Three-digit numbers with no 8 or 9Octal bytesOctal bytes to text
%2F, %7B and other %XX sequencesURL encodingURL decode
svnt{...} or other word-shaped nonsense with bracesROT13 or a Caesar shiftROT13, then brute-force all 25 shifts
Letters only, readable length, key word mentionedVigenere cipherVigenère decode; use flag as a crib to find the key
Dots, dashes and slashesMorse codeMorse to text
32 hex charactersMD5 hashHashes are one-way: compare against hashed guesses
64 hex charactersSHA-256 hashSame: hash candidates and compare
Three base64url parts joined by dots (eyJ...)JSON Web TokenDecode the middle part; it is readable JSON
Text that reads backwards: }...{galfReversed stringReverse it
n, e and c given as numbersRSASmall n? Factor it, compute d, then m = c^d mod n
Hex bytes plus the words 'key' or 'XOR'XOR cipherXOR with the key; unknown single byte? Try all 256
File starts 89 50 4E 47PNG imageCheck text chunks and data after IEND
File starts FF D8 FFJPEG imageRead EXIF metadata (exiftool)
File starts 50 4B 03 04ZIP archive (also docx, apk)Unzip; repeat for nested archives
File starts 25 50 44 46PDF documentMetadata, hidden text layers, embedded files
File starts 7F 45 4C 46Linux program (ELF)strings first, then a disassembler
HTTP requests and responsesWeb or network evidenceRead headers, cookies and bodies line by line
A packet capture (.pcap)Network forensicsFollow the TCP stream; filter by protocol
A login page or a formWeb logicView source, cookies, hidden fields, robots.txt
A username or a photo of a placeOSINTExact handle search, metadata, archives (fictional targets only)

4. Category playbooks

Open a category for its first moves, the signs that point to it, the tools people actually use, and the traps that cost beginners the most time.

EncodingsReversible formats with no key. Name the alphabet, decode one layer, repeat.

First moves

  1. Search for flag{ in case it is already plain
  2. Identify the alphabet using the signal table
  3. Decode one layer and look again
  4. Count layers in your notes so you never lose your place

Signs

  • Padding with =
  • Only hex characters
  • Long runs of 0 and 1
  • %XX sequences

Tools

  • Exorvio workbench tools
  • CyberChef (Magic operation)
  • base64 -d / xxd -r -p in a terminal

Traps

  • Decoding with the wrong tool and trusting the garbage
  • Forgetting that a layer can be reversed text
  • Stripping padding that the decoder needed
Practise encodings: 9 flags →
Classical cryptoLetters moved by a rule. Use the known prefix flag{ to find the rule.

First moves

  1. Check whether braces and underscores survived (letter-only cipher)
  2. Compare the first four letters with f-l-a-g to get the shift
  3. Brute-force all 25 Caesar shifts when unsure
  4. Try Atbash when no key is mentioned

Signs

  • Word shapes preserved
  • svnt{ (ROT13 of flag{)
  • Only letters changed

Tools

  • Caesar and ROT13 tools
  • CyberChef ROT13 / Atbash / Vigenere
  • dcode.fr cipher identifier

Traps

  • Shifting digits and symbols too
  • Assuming ROT13 when the shift is different
Practise classical crypto: 6 flags →
Modern cryptoKeys, hashes and maths. Find the weakness: tiny numbers, reused keys, or encoding pretending to be encryption.

First moves

  1. Is it actually encrypted, or just encoded?
  2. Hashes: hash guesses and compare, never 'decrypt'
  3. Vigenere: use the crib flag to recover key letters
  4. RSA: check whether n is small enough to factor

Signs

  • 32 or 64 hex characters (hashes)
  • n, e, c values
  • A repeating key mentioned

Tools

  • Python pow(e, -1, phi) and pow(c, d, n)
  • CyberChef
  • factordb.com for known factorisations

Traps

  • Trying to reverse a hash
  • Forgetting non-letters do not consume Vigenere key letters
Practise modern crypto: 6 flags →
WebEverything the server sends, the browser can see. Look before you poke.

First moves

  1. View the page source and read every comment
  2. Open developer tools: cookies, storage, network tab
  3. Check /robots.txt and obvious backup paths
  4. Read client-side JavaScript checks
  5. On a practice target: change ids in URLs and inspect the result

Signs

  • HTML comments
  • Base64 cookies
  • Hidden or disabled form fields
  • Tokens starting eyJ

Tools

  • Browser developer tools
  • View Source (Ctrl+U)
  • CyberChef for decoding cookies and tokens

Traps

  • Testing anything outside the listed target
  • Assuming 'hidden' means protected
Practise web: 9 flags →
ForensicsFiles lie about themselves. Trust the bytes, not the extension.

First moves

  1. Check magic bytes (file command)
  2. Run strings and search for flag{
  3. Read metadata (exiftool)
  4. Look past the end marker for appended data
  5. Unpack nested archives until nothing is left

Signs

  • Mismatched extension and signature
  • Unusual metadata fields
  • Data after IEND or EOF

Tools

  • file
  • strings
  • exiftool
  • binwalk
  • a hex viewer (xxd)

Traps

  • Opening the image and concluding 'nothing here'
  • Missing a flag split across hexdump lines
Practise forensics: 7 flags →
NetworksCaptured traffic is a conversation. Reassemble it and read it.

First moves

  1. Identify protocols and ports
  2. Follow the TCP stream of interesting conversations
  3. Read headers, form bodies and cookies
  4. Check DNS records, especially TXT
  5. Decode anything that looks encoded

Signs

  • Plain HTTP or FTP
  • Custom X- headers
  • Unusual ports
  • TXT records with data

Tools

  • Wireshark (Follow TCP Stream)
  • dig
  • tshark
  • CyberChef

Traps

  • Reading packets one at a time instead of the stream
  • Scanning hosts you do not have permission to test
Practise networks: 8 flags →
LinuxA handful of commands find most flags on a box.

First moves

  1. ls -la in every new directory
  2. grep -r 'flag{' from the top of what you can read
  3. find by name, size, owner or recent change
  4. Read permission strings before trying to open files
  5. Pipe tools together: sort | uniq -c | sort -rn

Signs

  • Dotfiles
  • Files you cannot read (check owner and group)
  • Huge directories

Tools

  • ls
  • cat
  • grep
  • find
  • strings
  • file
  • sort / uniq
  • OverTheWire Bandit for practice

Traps

  • Forgetting hidden files
  • Drowning in permission errors (add 2>/dev/null)
Practise linux: 6 flags →
OSINTPublic information, connected carefully. On Exorvio every person and place is invented.

First moves

  1. Search the exact handle, then close variants
  2. Read photo metadata and look for landmarks
  3. Check web archives for deleted pages
  4. Check public code history for 'removed' secrets
  5. Cross-reference: two weak clues make a strong one

Signs

  • A reused username
  • A photo with a view
  • A page that changed

Tools

  • Exact-match search
  • Web archives
  • exiftool
  • Reverse image search

Traps

  • Matching a similar but different handle
  • Doing OSINT on real people without permission (never)
Practise osint: 6 flags →
ReversingWork out what the program checks, then give it what it wants.

First moves

  1. Run strings before anything else
  2. Find the comparison: what is input checked against?
  3. Trace values built at runtime
  4. Invert transforms in reverse order
  5. XOR again with the same key to undo XOR

Signs

  • fromCharCode or long number arrays
  • A stored value next to a transform function
  • XOR loops

Tools

  • strings
  • Browser devtools for JavaScript
  • Ghidra (free) for binaries
  • Python to replay logic

Traps

  • Guessing inputs instead of reading the check
  • Undoing steps in the wrong order
Practise reversing: 8 flags →
ScriptingWhen a step repeats, a ten-line script beats an hour of clicking.

First moves

  1. Read the input from a file
  2. Write one transformation as a function
  3. Loop over keys or layers
  4. Stop when the output starts with flag{
  5. Print candidates so you can see near misses

Signs

  • Twelve layers of the same encoding
  • A keyspace of 26 or 256
  • Hundreds of numbers

Tools

  • Python 3
  • collections.Counter
  • base64, codecs and bytes in the standard library
  • pwntools later

Traps

  • Off-by-one in key loops (range(256) includes 0)
  • Mixing bytes and str
Practise scripting: 6 flags →

5. Where to practise next

Climb one rung at a time. The other sites are free, independent resources; your Exorvio progress does not sync with them.

  1. Exorvio CTF foundationsEvery category from zero, in your browser, with hints and write-ups.
  2. picoCTF practice (picoGym)Free, beginner-focused challenges from Carnegie Mellon, all year round.
  3. OverTheWire: BanditLinux and the terminal, one level at a time over SSH.
  4. PortSwigger Web Security AcademyFree, deep web security labs once the basics click.
  5. CTFtimeThe calendar of upcoming CTF events. Pick a beginner-friendly one and play with a team.

6. The rules

We only hack things built to be hacked.

  • Only test systems you own or have explicit, written permission to test.
  • Every Exorvio challenge is a practice target we built. Solving it does not authorise testing any live system.
  • OSINT challenges use invented people, companies and places only.
  • Unauthorised access to computer systems is an offence in India (IT Act, 2000) and in most countries.
  • In events, attack only the listed targets. Never the scoreboard, the infrastructure or other players.
  • Do not share flags or solutions while an event is running.

Your first flag takes about five minutes.

Free, no ads, works on a phone. Sign in to save your flags, XP and streak.

Start the course →