The Complete picoCTF Beginner's Guide: Learning Path, Tools & Every Category

picoCTF is a free, beginner-friendly hacking competition from Carnegie Mellon University, and you do not need to install anything, learn six categories, or read this whole guide to win at it. In fact, you can capture a flag without leaving this page. Try it.

The Reflex That Solves a Third of Beginner Challenges

I still remember staring at my first picoCTF challenge, convinced I was missing some prerequisite that everyone else already had. I wasn't. The flag was sitting in plain text inside the file, and a single command would have shown it to me. I just didn't know to run it yet.

Here is the thing nobody tells beginners clearly enough: before you can break a cipher or exploit a binary, the highest-leverage move is almost embarrassingly simple. When a challenge hands you a file, run these three commands, in order, every single time:

file thefile                 # what is this, really?
strings thefile | grep -i pico   # is the flag just sitting in there?
xxd thefile | head           # look at the raw bytes

That is it. file tells you what the file actually is regardless of its extension. strings dumps every readable piece of text inside it, and flags, passwords, and hints show up there far more often than they have any right to. xxd shows you the raw bytes when the first two come up empty. The first time this reflex handed me a flag in under thirty seconds, I was genuinely annoyed at how long I had spent overthinking it.

$ file mystery
mystery: data
$ strings mystery | grep -i pico
picoCTF{n0_r3v3rs1ng_n33d3d}

Your first flag is ten minutes away, not ten categories away.

This is also why the word "Complete" in this guide's title is a little misleading, and I want to defuse it right now. A complete map of picoCTF looks like a mountain: six categories, dozens of tools, years of technique. None of that is a prerequisite. It is a description of where the road eventually goes. You start with one account, one browser tab, and three commands. The map below is for when you want to keep climbing, not a checklist you have to clear before you are allowed to begin.

What Is picoCTF?

picoCTF is a free cybersecurity competition created by Carnegie Mellon University's CyLab. CTF stands for Capture the Flag: every challenge hides a secret string called a flag, formatted as picoCTF{…}, and your job is to solve the challenge and submit that flag for points. Solving might mean decoding a cipher, analyzing a file, exploiting a web app, or reverse engineering a binary. The challenges are graded by difficulty and split across six categories that map directly to real cybersecurity work.

It is one of the largest beginner-focused CTFs in the world. The 2024 competition drew more than 18,000 participants, and the platform has over 600,000 registered users worldwide who practice year-round. That last part matters more than the competition itself: you do not have to wait for the annual event. The picoGym is a permanent practice platform where every past challenge stays available, with no time pressure and no scoreboard breathing down your neck. It is where most people actually learn, and it is where this guide assumes you will spend your time.

Setting Up Your Environment

picoCTF challenges are solved from a Linux command line. You have two ways to get one, and the easier one requires zero installation.

Option 1: The picoCTF Webshell (recommended for beginners)

After creating your account at picoctf.org, you get a browser-based Linux terminal called the Webshell, reachable from the "Webshell" panel on the site. It is a full Ubuntu environment with most of the tools you need pre-installed. You can open files, run commands, and solve challenges entirely in your browser. The one limitation: you generally cannot install new software in it. Start here if you are new to Linux or just want to get to solving as fast as possible.

Option 2: Local Linux environment

A local setup gives you full control and lets you install any tool you want. On Windows, install WSL2 (Windows Subsystem for Linux) and run Ubuntu. On macOS, use the built-in terminal or a VM. Dedicated CTF distributions like Kali Linux and Parrot OS ship with many tools already installed, but a plain Ubuntu install works fine once you add what you need.

Essential tools to install

These cover the vast majority of picoCTF challenges across every category. On Debian or Ubuntu, one command gets most of them:

sudo apt update && sudo apt install -y \
  python3 python3-pip binutils binwalk steghide \
  exiftool wireshark-cli foremost file netcat-openbsd
# pwntools for binary exploitation
pip3 install pwntools
# Ghidra for reverse engineering (download from ghidra-sre.org)

One tool you never install at all is CyberChef. It runs entirely in the browser and handles encoding, decoding, hashing, and dozens of transformations with no setup, which makes it one of the most-used tools in all of CTF. The tools section of this site offers the same kind of browser-based utilities: base64 decoding, ROT ciphers, frequency analysis, hex viewing, RSA math, and more.

The 6 Challenge Categories

Every picoCTF challenge falls into one of six categories. Each maps to a real cybersecurity domain and asks for a different skillset and toolset. Here is the lay of the land:

The dots show roughly how steep each category is for a beginner. General Skills and Cryptography are the most forgiving entry points. Binary Exploitation is the hardest, and it leans on knowledge you build in the other five first. Every card links a real challenge you can open right now.

Recommended Learning Path

The order you tackle categories matters. Each one builds on the last, and jumping ahead creates gaps that make harder challenges frustrating instead of fun. This is the order that works for most beginners:

1. General Skills. The Linux command line, file inspection, encoding basics, and SSH. Every other category uses these. Do not skip it.
2. Cryptography. Identifying cipher types, decoding encoded data, and exploiting weaknesses in classical and modern crypto. The encoding concepts overlap heavily with what you just learned in General Skills.
3. Forensics. Analyzing files at the byte level, extracting hidden content, reading metadata and network captures. The file-inspection skills from General Skills apply directly.
4. Web Exploitation. Thinking like an attacker against web apps. No assembly required, just a browser, DevTools, and Burp Suite.
5. Reverse Engineering. Analyzing compiled binaries with strings, ltrace, and Ghidra. This is where your Linux comfort and analytical habits from the earlier categories pay off.
6. Binary Exploitation. Memory corruption attacks. This needs comfort with reverse engineering and basic C. Save it for after you have a solid foundation in the other five.

You do not have to exhaust one category before starting the next. A good rhythm is to clear the easiest General Skills and Cryptography challenges, then dip into Forensics and Web, and gradually push harder in each. The learning paths on this site sequence challenges within each category from easiest to hardest.

General Skills: Start Here

If you are new to picoCTF, this is where you begin. General Skills teaches the toolkit every other category leans on: command-line navigation, file inspection, encoding and decoding, SSH, and light scripting. Before you can reverse a binary or crack a cipher, you need to be comfortable in a terminal.

The name undersells it. "General Skills" really means "the things every CTF player does on autopilot." And here is the small irony worth sitting with: it is the most-skipped category and also the one whose payoff shows up in every other category for years. A few hours here is the best time you will spend.

You already met the core habit up in the reflex section: file, then strings, then xxd. General Skills is where you extend it. After those three, reach for grep to search for patterns and base64 -d to decode encoded blobs.

Common challenge types

picoCTF General Skills challenges fall into a handful of patterns. You will read a file buried in an unusual directory path, decode a base64 or hex string, connect to a remote server with nc (netcat) or SSH and run a command there, pipe one program's output into another, or make a downloaded script executable with chmod +x before running it.

SSH challenges are a recurring format. The challenge gives you a hostname, port, username, and sometimes a key file, then asks you to connect and find the flag on the remote machine. They are deliberately teaching a skill you will use constantly in real security work.

The essential command set

file unknown_file
strings unknown_file | grep picoCTF
cat file.txt
xxd file.bin | head -20
base64 -d encoded.txt
echo 'SGVsbG8=' | base64 -d
grep -r 'picoCTF' .
chmod +x script.sh && ./script.sh
ssh -p 12345 user@challenge.picoctf.org
nc challenge.picoctf.org 12345

Three excellent starting points: Commitment Issues, Blame Game, and Collaborative Development. All three teach git forensics (reading commit history, inspecting diffs, checking out branches), skills that resurface across General Skills and Forensics year after year.

Want a deeper foundation before diving in? The Linux CLI guide covers the terminal commands that show up most across picoCTF. For encoding specifically (base64, hex, and their relatives), the encodings guide explains how to recognize and decode each format, and the Base64 Decoder tool handles quick decodes without dropping into a terminal.

Cryptography: Break the Cipher

Cryptography challenges ask you to recover a hidden message from a scrambled or transformed version of it. picoCTF Crypto runs the full spectrum: classical pen-and-paper ciphers that are centuries old, encoding schemes like base64 and hex, and modern algorithms like RSA and AES that secure the real internet.

The most important distinction in Crypto

Before you try to solve anything, figure out which of these three things you are looking at. Getting it wrong wastes a lot of time, because trying to "decrypt" a base64 string with a Caesar cipher tool just produces nonsense.

• Encoding is a reversible transformation with no key. Base64, hex, and URL encoding are not encryption; anyone can decode them with the right tool. If something looks encrypted but no key is provided, try decoding it first.
• Encryption requires a key to reverse. Caesar cipher, XOR, RSA, and AES all live here. The challenge is either finding the key or exploiting a weakness in how the scheme was used.
• Hashing is one-way, with no reverse. MD5 and SHA-256 are hash functions. You cannot decrypt a hash; you crack it by guessing the input and checking whether it produces the same output.

Classical cipher approach

When the ciphertext looks like English words with scrambled letters, you are almost certainly dealing with a classical cipher. Start with ROT-13: it is the single most common classical cipher in picoCTF and takes two seconds to try. If that fails, look for repeating patterns, which point to a short key (Vigenere or XOR). For single-character substitution ciphers, frequency analysis works reliably: the most common letter in English is E, followed by T and A. Map the most frequent ciphertext symbol to E and adjust from there.

Modern crypto approach

picoCTF modern crypto is not asking you to break AES or brute-force RSA; that would be computationally impossible. Instead, each challenge plants a deliberate weakness: a small RSA public exponent, a reused XOR key, two RSA ciphertexts sharing a modulus, an all-zeros IV. Your job is to spot the weakness and apply the known attack for it. The source code is almost always provided, so read it carefully and look for anything that deviates from how these algorithms are supposed to be used. For deeper dives, the AES for CTF post covers the mode bugs (ECB, CBC bit-flip, CTR nonce reuse) and the RSA Attacks for CTF post covers the asymmetric ones.

Commands for the terminal

echo 'SGVsbG8gV29ybGQ=' | base64 -d
python3 -c "print(bytes.fromhex('48656c6c6f'))"
openssl rsa -in key.pem -text -noout
python3 -c "print(''.join(chr(ord(c) ^ 42) for c in 'ciphertext'))"

Good beginner challenges: interencdec (layered encoding), C3 (a custom cipher with a provided encoder, so you write the decoder), and hashcrack (hash identification and dictionary cracking).

For specific attack types, the RSA attacks guide covers the common RSA weaknesses in picoCTF, and the hash cracking guide walks through identifying hash types and cracking them with wordlists. The encodings guide is the reference for the encoding layer in nearly every beginner Crypto challenge. Handy tools: the Recipe Chain for stacking decoders (base64, hex, ROT, XOR, Morse, URL, Atbash, Vigenere) into a pipeline with a Magic auto-detect mode that clears most multi-layer beginner crypto in one paste, the ROT cipher tool for quick classical attempts, the frequency analysis tool for substitution ciphers, and the RSA calculator for working through RSA math. The Cryptography path sequences challenges from encoding basics up through modern crypto weaknesses.

Forensics: Hunt for Hidden Data

Forensics is about recovering hidden or buried data from a file someone hands you. That file might be an image, a network capture, a memory dump, a corrupted archive, or something that looks completely ordinary while hiding a secret. Unlike the categories that make you write exploits, Forensics is mostly about knowing which tool to reach for, and in what order.

The category breaks into three areas. File analysis covers identifying what a file really is, finding content embedded inside it, and reading its metadata. Steganography covers data hidden inside images or audio, invisible to the eye but extractable with the right tool. Network forensics covers PCAP files: packet captures of real network traffic that you analyze to reconstruct what happened.

The universal forensics checklist

Every time you get an unknown file, run through this before trying anything clever. Most beginner challenges fall at step one or two.

file unknown_file
strings -n 8 unknown_file
exiftool image.jpg
binwalk -e firmware.bin
steghide extract -sf image.jpg

Step 1, file: Reads the magic bytes (the first few bytes that identify a file's true type) and tells you what you are actually holding. Never trust the extension. A PNG renamed to .txt is still a PNG, and file will say so.

Step 2, strings: Dumps every readable sequence of 8 or more characters. Flags, URLs, usernames, and hints often survive embedded in binary files. The -n 8 flag filters out short random noise.

Step 3, exiftool: Reads all embedded metadata: camera model, GPS coordinates, author, creation date, comments. Challenge authors love hiding flags in EXIF fields because most people never think to look. CanYouSee is a perfect example of a flag buried in image metadata.

Step 4, binwalk: Scans for embedded file signatures and extracts them. The -e flag tells it to actually carve out what it finds. This catches ZIPs hidden inside images, firmware with embedded filesystems, and files-within-files of every kind. Secret of the Polyglot is a great intro to files that are two formats at once.

Step 5, steganography tools: If the file is an image and nothing above turned up, the data may be hidden with steganography. steghide extracts data from JPEG and BMP images (it prompts for a password; try an empty one first). zsteg works on PNG and BMP and checks many LSB schemes automatically. The steganography tools guide breaks down which tool to use when. For a one-click answer before installing anything, drop the file into Stegall: it runs LSB sweeps, bit planes, spectrograms, polyglot carving, metadata, and a base/ROT/XOR/zlib decode cascade in parallel and surfaces flag matches automatically.

Network forensics with Wireshark

When you get a .pcap file, open it in Wireshark. The first view is overwhelming, thousands of packets, so start by filtering: type http in the filter bar to see only HTTP, or tcp.stream eq 0 to isolate the first TCP conversation. Right-click any packet and choose "Follow > TCP Stream" to reconstruct a full back-and-forth as readable text. Flags very often appear in HTTP request paths, response bodies, or custom headers. The Wireshark guide walks through the common patterns. For hex-level inspection, the Hex Viewer tool examines raw bytes in the browser, and the hex dumps guide goes deeper on reading raw binary data.

Follow the structured Forensics path to work through challenges in order of difficulty. And if file says PNG but the image looks like a grid of black squares, scan it, because QR codes count as forensics too (Scan Surprise is a good early one).

Web Exploitation: Attack the Browser

Web Exploitation gives you a URL and asks you to break the web application behind it. That might mean stealing data, bypassing authentication, reading files on the server, or escalating your privileges. The vulnerabilities are real, the same bug classes that show up in actual security research, just presented in a controlled environment built for learning.

The mindset shift is the thing to internalize early. Stop thinking like a user and start thinking like an attacker. Every input field is a chance to inject something unexpected. Every URL parameter is a value the server trusts, maybe too much. Every cookie is a claim the server believes, unless you tamper with it. Your default question becomes: what happens if I send something the developer never planned for here?

Essential browser skills

Before installing anything, learn the two built-in tools. View Page Source (Ctrl+U) shows the raw HTML the server sent, including comments, hidden fields, and linked JavaScript. Developers leave debug comments, staging URLs, and sometimes flags sitting right in there. Browser DevTools (F12) goes further: the Network tab shows every request and response, and the Application tab shows cookies, local storage, and session storage. Bookmarklet and Unminify are both solvable with nothing but these browser-native tools.

The four most common vulnerability types

1. Hidden content. Look in the HTML for comments, check linked JavaScript for hardcoded values, and inspect hidden form fields (type="hidden"). Flags sometimes appear verbatim in the source.

2. Cookie and session manipulation. Open DevTools, go to Application > Cookies, and see what the site stores. If a cookie reads admin=false, try admin=true. If it is a long encoded string, it might be a JWT. The cookie and JWT guide covers the common attacks, and the JWT Decoder tool inspects and modifies JWTs right in the browser.

3. SQL injection. When a site has a login form, try putting SQL syntax into the username field. If the backend builds its query by concatenating your input directly, you can break out of the intended logic:

' OR '1'='1
' OR 1=1--
admin'--

These make the SQL WHERE clause always evaluate to true, logging you in without a valid password. The full SQL injection guide covers more, including data extraction.

4. Server-side issues. Path traversal means manipulating a file-path parameter to read files outside the intended directory, for example changing ?file=report.txt to ?file=../../../../etc/passwd. Template injection means slipping template syntax into an input the server renders, causing it to execute code.

Burp Suite: the core web CTF tool

Burp Suite sits between your browser and the server, intercepting every HTTP request before it goes out. That lets you read and modify requests the browser would normally send automatically: changing cookie values, tweaking hidden fields, replaying requests with different parameters. The Community Edition is free and handles everything you need for picoCTF. IntroToBurp exists specifically to teach you the basics.

Methodology

On a new web challenge, run this in order: view source and grep for flags or suspicious comments; check every cookie and local-storage entry in DevTools; try SQL injection on any login form; watch all outgoing requests in the Network tab; then fire up Burp and start modifying requests if nothing obvious surfaced.

Work through challenges in order with the structured Web Exploitation path.

Reverse Engineering: Read the Machine

Reverse engineering asks you to analyze a compiled program, with no source code, and figure out what it does. Usually that means finding a secret string, reconstructing a transformation, or understanding a custom algorithm. The goal is almost always to recover a flag the program is hiding.

The name sounds intimidating, and a lot of newcomers skip the category entirely. That is a mistake. picoCTF reverse engineering is designed to be approachable, and many beginner challenges fall without reading a single line of assembly. You do not need to understand every instruction. You need to understand enough to find the flag.

Think of it as three levels of depth. At the surface, strings and ltrace pull readable text and watch library calls without touching any disassembly. In the middle, a decompiler like Ghidra turns binary code back into readable C-like pseudocode. At the deep end you read raw assembly, but you rarely need to go there in picoCTF.

The RE methodology

1. Run file to identify what you have: an ELF executable, a Windows PE, Python bytecode, or something else.
2. Run strings and grep for "pico". A surprising number of beginner challenges hide the flag in plain text inside the binary.
3. Run ltrace to trace library calls. If the program calls strcmp to compare your input against a hardcoded string, ltrace prints both sides of the comparison right in your terminal.
4. Run strace to trace system calls. Useful when a program reads files or makes connections you did not expect.
5. If none of that gives up the flag, load the binary into Ghidra for full decompilation.

file program
strings program | grep -i pico
ltrace ./program
strace ./program
chmod +x program && ./program

Ghidra is a free, open-source reverse engineering tool from the NSA. It turns a compiled binary back into C-like pseudocode that reads far better than raw assembly. The skills to build: loading a binary and letting auto-analysis run, finding main() in the symbol tree, and reading the decompiled output. Do not try to understand every detail. Focus on string comparisons, return values, and conditional branches.

The most common picoCTF RE patterns: a program that compares your input to a hardcoded string (ltrace catches it instantly), a program that applies a simple XOR or ROT to the flag before comparing (reverse the math), and a program that checks mathematical conditions on your input (solve the equations).

Good starting points: Flag Hunters and Classic Crackme 0x100. Both teach the core pattern without overwhelming you.

When you are ready to go deeper, read the Ghidra guide for a full walkthrough and the GDB guide for dynamic analysis. The Hex Viewer and ASCII Table tools help when you are staring at raw bytes. Follow the Reverse Engineering path for a structured progression.

Binary Exploitation: Take Control

Binary exploitation, called "pwn" in CTF circles, is about finding memory corruption bugs in compiled programs and using them to hijack what the program does. Instead of reading the flag out of the binary, you force the program to hand it over by breaking how it manages memory.

This is the hardest category in picoCTF, and the reputation is earned. To do pwn well you need to be comfortable with reverse engineering, understand C and how it manages memory, know the Linux memory model, and write exploit code in Python. If you are brand new, do not start here. Build your foundation in General Skills and Reverse Engineering first, and get comfortable with basic C before you attempt it. Coming to it cold is the fastest way to convince yourself CTF is not for you, which would be the wrong lesson.

The Linux memory model

Every running program has several memory regions. The stack holds local variables and return addresses and grows downward. The heap holds memory allocated with malloc and grows upward. The text segment holds the actual program code. The GOT and PLT are tables that handle linking to shared libraries at runtime. Most buffer overflow exploits target the stack; most heap challenges target the heap metadata or allocator behavior.

Three entry-level vulnerability types

1. Stack buffer overflow. A program copies user input into a fixed-size buffer without checking the length. Write past the end and you overwrite the return address that tells the program where to go when the function finishes. Control that address and you control execution.
2. Format string vulnerability. A program calls printf(user_input) instead of printf("%s", user_input). Format specifiers like %x and %n in your input then let you read from and write to arbitrary memory. These often let you leak the flag straight out of memory.
3. Heap overflow. Writing past the end of a heap-allocated buffer can corrupt the metadata the allocator uses to track free chunks. Beginner heap challenges in picoCTF usually have a win() function you just need to redirect execution to.

Essential tools

Your pwn toolkit has three pieces. checksec reads a binary and reports which protections are on (stack canaries, ASLR, PIE, NX) so you know what you are up against. pwntools is a Python library built for writing exploits: it sends payloads, receives output, packs addresses, and connects to remote services. GDB with the PWNDBG or PEDA plugin gives you a debugger that shows registers, stack layout, and memory in a format that is actually usable for exploit development.

The standard pwn workflow

checksec --file=./binary
python3 -c "print('A'*100)" | ./binary
cyclic 100  # pwntools pattern for finding the offset
gdb ./binary

Run checksec to understand the protections, identify the vulnerability type, find the exact offset from the start of your input to the return address with a cyclic pattern, then write a pwntools script that sends the right payload to trigger the bug.

Good starting challenges: format string 0, heap 0, and PIE TIME. Each teaches a core concept without stacking on too many protections at once, which makes them ideal first pwn challenges.

For deeper reading, the buffer overflow guide covers stack exploitation from the ground up, the format string guide walks through reading and writing memory with format specifiers, and when you start hitting ASLR and PIE, the ASLR/PIE bypass guide explains the techniques. Work through the Binary Exploitation path for a structured progression.

Tips & Common Mistakes

These patterns show up constantly among players new to picoCTF. Knowing them before your first session saves a lot of frustration.

Next Steps

You now have the whole map: what picoCTF is, the order to approach it, and the tools and methodology for each category. Here is how to turn that into actual progress.

Start with the picoGym. Every past picoCTF challenge from 2019 through 2026 is available year-round at picoctf.org. Work through General Skills first, then Cryptography. Build the foundation before expanding.

Use the learning paths. Each category has a curated path on this site that sequences challenges from easiest to hardest, with links to writeups:

Explore past competitions. Each year's challenges are grouped on the events page. Working through a full competition year, starting easy and climbing, is one of the most effective ways to improve across all six categories at once.

Read the guides. When you hit a new technique, there is almost certainly a detailed tutorial on this site for it. The posts section covers everything from SQL injection to Ghidra to format string exploitation, with examples drawn from real picoCTF challenges.

But none of that is step one. Step one is the account, the Webshell, and file then strings on the first thing picoCTF hands you. Go capture that first flag. The rest of this guide will still be here when you want the next one.