The picoCTF General Skills Roadmap: The Category Everything Else Rests On

General Skills is the prerequisite for every other category

General Skills is where almost everyone starts, and it is the category most people underrate. It has no single technique to master, which makes it feel like a grab bag of unrelated puzzles. It is not. It is the set of operations you will perform in every other category: move around a filesystem, look inside a file you did not write, decode something, automate a repetition, and talk to a service on a port.

Nobody solves a heap exploitation challenge without first downloading a binary, checking its type, running it, and connecting to a remote instance. Those four steps are General Skills. This roadmap orders the whole category into seven tiers, links the full guide for each, and names the picoCTF challenges that drill it.

The other five categories teach you attacks. This one teaches you the hands you perform them with.

If you have not competed before at all, read the picoCTF beginners guide first for how the platform, scoring, and instances work, then come back here for the skills.

Why this category is different

Three things distinguish General Skills from the specialist categories, and they change how you should study it.

• There is no theory to learn, only fluency to build. Nothing here is conceptually hard. The difficulty is entirely in speed and recall: knowing that grep -r exists, that file comes before strings, that tab completion beats typing a path. Fluency comes from repetition, not from reading.
• The skills compound instead of replacing each other. In crypto, learning RSA does not help you with AES. Here, every tier is used forever. The shell you learn in tier 1 is the shell you use in a privilege escalation challenge three years from now.
• It is the largest beginner surface in picoCTF. Roughly eighty challenges sit in this category across every event, and they range from one-command warmups to restricted-shell escapes that would be at home in a pwn track.

The triage table: what the challenge is really asking

General Skills challenges disguise themselves. Read the prompt and the provided files, then match them against this table. The first match tells you which tier to work in.

Tier 1: The shell, and being fast in it

Everything begins with moving around and finding things. The commands are few, and the skill is combining them. If you can express "find every file under this directory that contains the word flag, ignoring case" without stopping to think, tier 1 is done.

Learn the portable subset first. POSIX.1-2017 specifies the shell language and around 160 standard utilities, and everything in that set behaves the same on Ubuntu, macOS, and the Alpine container a challenge drops you into. GNU extensions are convenient and not guaranteed: grep -P for Perl-compatible regex, sed -i without an argument, and find -printf are all outside POSIX and all commonly missing on a minimal challenge box. When a one-liner that works locally fails on the remote shell, that distinction is almost always why.

ls -la                       # including dotfiles, with permissions
cd - ; pushd ; popd          # move without retyping paths
find . -name '*.txt'         # by name
find . -type f -size +1M     # by property
grep -ri 'picoCTF{' .        # recursive, case-insensitive search
cat file | head -20 | tail -5
sort | uniq -c | sort -rn    # the counting idiom
wc -l ; cut -d: -f1 ; tr -d '\n'

• The Linux CLI guide teaches the core command set, pipes and redirection, globbing, and the search idioms that solve most of tier 1 on their own.

Tier 2: Interrogating a file you did not write

You get one file and no explanation. The workflow never changes: identify the type, look for readable content, then look at the bytes. Three commands, in that order, answer most of it.

file mystery                 # what is it, by magic bytes
strings -n 8 mystery | less  # readable runs of 8+ characters
xxd mystery | head -40       # the actual bytes, with a header you can identify
ls -l ; stat mystery         # size and timestamps, sometimes the answer
chmod +x mystery && ./mystery   # sometimes you are just meant to run it

• Hex dumps for CTF teaches reading xxd output, spotting structure in bytes, and the endianness that trips up every beginner exactly once.
• File carving and magic bytes teaches identifying a file by its header when the extension lies, and pulling embedded files back out.

Tier 3: Encodings and how data is represented

This tier is recognition. Base64, hex, binary, decimal ASCII, ROT-N, and URL encoding all have distinctive shapes, and knowing them on sight turns a five-minute puzzle into a five-second one. Nothing here is encrypted, so nothing here needs cracking.

• Encodings in CTF teaches fingerprinting each format and peeling a multi-layer chain in the right order.
• The recipe-chain workflow turns that triage into a repeatable pipeline you can drive on-site without writing a script.
• XOR for CTF covers the moment a blob stops being an encoding and starts being a homemade cipher, which is the boundary between this tier and the crypto category.

Tier 4: Scripting, the moment repetition appears

The tell is scale: a thousand files, a thousand rounds, a server that asks a hundred questions. The intended solution is never to do it by hand. Bash covers gluing commands together; Python covers anything with logic or state.

for f in *.txt; do grep -l 'picoCTF' "$f"; done
cat files/* | grep -o 'picoCTF{[^}]*}' | sort -u
seq 1 1000 | while read n; do curl -s "http://host/$n"; done
 
# python, when there is state or math
import re, requests
s = requests.Session()
while True:
    q = s.get(URL).text
    s.post(URL, data={'answer': eval(re.search(r'\d+ [+*-] \d+', q).group())})

• Bash scripting for CTF teaches loops, conditionals, quoting, and the one-liners that replace an hour of clicking.
• Python for CTF teaches the bytes-versus-string model, requests, regex extraction, and the script skeletons you will reuse in every category.

Tier 5: Talking to something on a port

Half of picoCTF hands you a hostname and a port. Connecting is one command, and the skill is knowing what to do once the connection is open: read the banner, answer the prompt, keep the session alive, and pipe data in and out.

nc host 12345                       # the standard connection
ssh user@host -p 12345              # when they give you credentials
echo 'answer' | nc host 12345       # non-interactive
nc host 12345 < payload.txt         # send a prepared file
curl -i http://host:12345/          # when the port speaks HTTP

• The netcat guide teaches connections, banners, listeners, and the piping patterns that make a remote service scriptable.
• Networking tools for CTF covers the wider toolkit: port scanning, DNS lookups, and identifying what protocol is actually on the other end.
• HTTP for CTF is the specific case where the service speaks HTTP, which is more often than beginners expect.

Tier 6: Git, where deleted things are not deleted

Git is a General Skills staple because it is a database of everything anyone ever committed, including the commit where they added a password and the next one where they removed it. Removing a secret from the working tree does nothing to the history.

git log --oneline --all       # every commit on every branch
git show <commit>             # the full diff of one commit
git diff HEAD~1 HEAD
git stash list ; git stash show -p
git reflog                    # commits no branch points at anymore
git cat-file --batch-all-objects --batch-check   # every object in the repo

• Git forensics for CTF teaches the full archaeology workflow: branches, stashes, reflog, dangling objects, and recovering an exposed .git directory from a website.

Tier 7: Permissions, sudo, and restricted shells

The hardest General Skills challenges hand you a shell that cannot do what you want. A file you cannot read, a binary you can run as another user, a shell with most builtins removed. This tier is the doorway into privilege escalation, and the reasoning is identical: enumerate what you are allowed to do, then find the one allowed action with an unintended consequence.

id ; groups                   # who am I, really
sudo -l                       # what may I run as someone else
ls -l /path/to/target         # who owns it, what bits are set
find / -perm -4000 -type f 2>/dev/null   # setuid binaries
cat /etc/passwd ; ls -la /home/*

• Linux privilege escalation teaches the full enumeration checklist and the standard escalation paths from setuid binaries, sudo rules, cron, and capabilities.
• Python sandbox escapes is the same reasoning inside an interpreter rather than a shell, and the two challenge types often blur together.

A practice path through the category

Work these in order. They are chosen so that each one drills a single tier, and so that the difficulty ramps without gaps.

• picoCTF 2021 Obedient Cat is tier 1 at its simplest: download and read.
• picoCTF 2021 Tab, Tab, Attack is tier 1 and exists purely to teach tab completion through a directory tree designed to punish typing.
• picoGym First Find and Big Zip drill find and grep -r over a haystack.
• picoCTF 2021 Static ain't always noise is tier 2: identify, then strings.
• picoCTF 2024 Endianness and binhexa are tier 3: representation and bitwise operations, nothing more.
• picoCTF 2021 Python Wrangling and Repetitions bridge tiers 3 and 4: run someone else's script, then write the loop yourself.
• picoCTF 2024 binary search is tier 4 thinking without any code: the algorithm is the answer.
• picoCTF 2021 Nice netcat... is tier 5 plus a decoding step, the two tiers combined in the smallest possible challenge.
• picoCTF 2021 Magikarp Ground Mission and Super SSH drill logging in and navigating a remote box.
• picoCTF 2024 Commitment Issues, Time Machine and Blame Game are the tier 6 git set, in increasing order of history depth.
• picoCTF 2023 Permissions and Chrono open tier 7 with sudo rules and cron.
• picoCTF 2023 useless, Special and Specialer are the restricted-shell ladder, and Specialer in particular is a genuinely hard problem wearing a beginner category label.
• picoCTF 2026 sudo make me a sandwich and absolute nano are the current-generation versions of the same escape reasoning.

Quick reference

Once this category is comfortable, every other roadmap on this site opens up: web, cryptography, forensics, reverse engineering, and binary exploitation. They all assume the seven tiers above, and none of them will teach you these.

Sources and further reading

Every tier above is a manual you can read. Reading the actual man page once beats collecting flags from memory.

• POSIX.1-2017 Shell and Utilities defines the portable subset that works on every challenge box, including the minimal containers where GNU extensions are missing.
• GNU Coreutils, the Bash reference manual, and GNU grep for the extensions you will actually use day to day.
• Git reference documentation for Tier 6, and the sudo manual for Tier 7.