Preparation guide
How to prepare for picoCTF
A free capture-the-flag cybersecurity competition designed specifically for students with no security background.
Some preparation needed · Anyone may compete. To be eligible for prizes you must be a middle or high school student enrolled in an accredited US school, or home-schooled at that level in compliance with your state's requirements.
Where the points actually are
picoCTF is designed so that a student with no security background can solve the first tier of challenges on day one. The whole archive of past challenges stays open in the picoGym, so preparation is simply playing last year's competition before this year's starts.
Topic breakdown
- 01General skills
- Linux commands, file types, encodings such as base64 and hex, and using the terminal without fear. Half the entry-level challenges are only this.
- 02Cryptography
- Classical ciphers, XOR, RSA basics, and recognising when something is encoded rather than encrypted.
- 03Web exploitation
- Browser developer tools, cookies, SQL injection, and reading page source properly.
- 04Forensics
- File carving, metadata, steganography, packet capture analysis with Wireshark.
- 05Binary exploitation and reverse engineering
- The hardest categories. Assembly basics, buffer overflows, and tools such as Ghidra. Leave these until the others are comfortable.
A study plan that works backwards from the date
- Any time before the competition Work the picoGym from the easiest challenges upward. It is free, always open, and it is literally the same style of problem.
- Two months out Get comfortable in a Linux terminal and write short Python scripts. These two skills unlock more challenges than any security knowledge.
- One month out Pick two categories to go deep on rather than spreading thin. Teams score better when members specialise.
- During the competition Solve every easy challenge across all categories first. Points scale with difficulty, but easy solves are guaranteed points and hard ones are not.
Tips that come from the format itself
- The picoGym is the entire preparation resource. There is no need to buy anything.
- Write down every technique you use in a personal notes file. Capture-the-flag skill is almost entirely accumulated pattern recall.
- Split categories across your team. Five people each covering one area outscores five generalists.
- Read the hints. They cost points in some formats but they teach you the technique you will need next year.
Practice resources
-
picoCTF and the picoGym
Registration plus a permanently open archive of every past challenge with hints and walkthrough support.
-
picoCTF learning guides
Official primers on each challenge category, written for students with no background.
-
OverTheWire Bandit
Free wargame that teaches the Linux command line through 30 levels. The best single preparation for picoCTF general skills.
Past papers and official materials
- picoGym: every past challenge
The complete archive of past competition challenges, free and permanently available.
Videos worth your time
- John Hammond
Capture-the-flag walkthroughs including picoCTF challenges, explained step by step.
Skills this builds
- Linux command line
- Python scripting
- Cryptography basics
- Web security
- Reverse engineering
- Persistence and lateral thinking