Advanced General Skills
The foundations path covered the terminal, git, and number systems. This one pushes into the harder general challenges: breaking out of locked-down shells, exploiting integer-overflow logic bugs, scripting solvers with pwntools, decoding esoteric languages, and driving real tooling like kubectl and YARA. A solid command-line and scripting base is assumed.
Guides for this path
Read these alongside the challenges below. The first one orients you; the rest go deeper on the techniques each step needs.
- Linux Privilege Escalation for CTFA decision-tree playbook for Linux privilege escalation in CTF and OSCP: enumeration, sudo, SUID, capabilities, PATH, cron, LD_PRELOAD with picoCTF receipts.
- Python Sandbox Bypass for CTF: The Filter-Breaker PlaybookEvery Python pyjail filter can be broken. Learn string surgery, MRO traversal, breakpoint(), and namespace hijacking with picoCTF receipts.
- Integer Overflow and Signedness Bugs for CTFWrap-around, signedness confusion, and truncation explained with two's complement, then used to buy flags, defeat length checks, and mint unlimited tokens.
- Bash Scripting for CTF Automation: Loops, Pipes, and Brute-Force HarnessesBash scripting for CTF automation: brute-force loops, curl and nc fuzzers, grep/awk/sed filtering, xargs parallelism, and a reusable solve.sh you can copy.
- Python for CTF: Essential Scripting TechniquesA practical guide to using Python in CTF competitions: automating tasks, handling binary data, decoding encodings, socket connections, and writing exploit scripts.
- Esoteric Languages in CTF: Recognising Code That Does Not Look Like CodeIdentify and run the esolangs that show up in CTF: Brainfuck, Whitespace, Rockstar, Befunge, Piet, JSFuck and Redcode, with a fingerprint table and an interpreter.
- Step 01
Restricted Shell Escapes
A restricted shell blocks the obvious commands, so you reach the flag through the gaps: shell globbing and echo when cat is banned, built-in command execution inside nano, or a man page that scrolls past the flag. Learning what still works when your toolbox is taken away is a core skill.
- Step 02
Logic and Integer Bugs
Some flags fall to a flaw in the program's logic rather than the system. flag_shop wraps the cost calculation negative with a signed integer overflow to mint coins, and Failure Failure abuses session-affinity headers to make a load balancer hand over the flag. Read the logic, find the assumption it breaks on.
- Step 03
Scripting and Automation
When the work is too tedious for a human, you script it. These challenges make you diff two files byte-by-byte to spell out a flag, read ELF symbol addresses with pwntools and send them per round, and drive a decryption helper from the command line. This is the automation muscle every other category leans on.
- Step 04
Esoteric Languages
CTF authors love hiding logic in languages designed to be unreadable. Rockstar reads like song lyrics but runs like code, and these challenges make you interpret or edit such programs to redirect output to the flag. The skill is recognizing that strange text is actually an executable program.
- Step 05
Modern Security Tooling
The hardest general-skills challenges expect you to know professional tooling. You list and decode a Kubernetes Secret with kubectl, write a YARA rule that a remote grader accepts against a UPX-packed PE, and work through a multi-stage printer-sharing service. This is where general skills meets real-world security operations.