What a CTF is
Capture-The-Flag = solving security puzzles for points ("flags" like PISA{w3lc0me_h4ck3r}). Formats: Jeopardy (task board) and Attack-Defense (patch your box, break theirs). Pakistan's ecosystem: PKCERT's CTF Square, university competitions, and PISA's national CTF during Awareness Month (this portal → /ctf).
Categories you'll meet: Web (SQLi, XSS, auth bypass) · Crypto (classical ciphers, RSA basics, hash tricks) · Forensics (pcap analysis, file carving, steganography) · Reverse Engineering (binaries, Ghidra) · Pwn/Exploitation (buffer overflows) · OSINT (finding people/things from open data) · Misc.
Your first 90 days:
- Linux comfort: OverTheWire Bandit (levels 0–20) — free, the classic start
- TryHackMe: "Pre-Security" then "Complete Beginner" path
- PicoCTF: previous years' problems, category by category
- Tools to install: Burp Suite Community, Wireshark, Ghidra, cyberchef, john/hashcat, exiftool, binwalk
- Join PISA's CTF → top performers are invited to the advanced squad (national-team pathway)
Ethics line (once, loudly): CTF skills are legal ONLY inside competitions, labs, and authorized engagements. Same skill + no authorization = PECA crime + career over.