Skip to main content

Flag challenges

Use a flag challenge when participants must find and submit an exact secret string.

Flags are best for classic CTF tasks, reverse engineering, web exploitation, cryptography, forensics, and any challenge where the proof of solve is a fixed answer.

How players solve​

  1. The player opens the challenge.
  2. They read the prompt and any attached resources.
  3. They find the flag.
  4. They submit it in the flag input.

The submitted value must match the configured answer. Treat flags as exact strings: casing, braces, prefix, and spacing matter unless your challenge design says otherwise.

Good flag design​

  • Use a clear format such as ctf{example_flag}.
  • Avoid ambiguous characters where possible.
  • Do not put the flag directly in visible challenge text.
  • If a file contains the flag, make sure the player still has to solve something meaningful to find it.
  • Test the flag before the event starts.

Scoring behaviour​

Flag challenges can use the world point scheme:

  • Static - the challenge keeps a fixed point value.
  • Dynamic - the challenge value can decrease as more teams solve it.

First strike bonuses, hints, penalties, prerequisites, and timebomb windows can also affect scoring or availability depending on how the challenge and world are configured.

Common mistakes​

  • Accidentally changing the flag after publishing the challenge.
  • Including invisible whitespace in the answer.
  • Using a flag format in the prompt that does not match the configured answer.
  • Forgetting to test solve the challenge with a normal player account.

See also: Making/editing a challenge, Challenge optional fields and tips, and Submitting flags and using hints.