Project 30: CTF Challenge Setup

Module: Module 3: Defensive Tooling, Hardening & CTF Practice  |  Level: Beginner  | 
Primary tool: picoCTF  |  Estimated time: 45–75 minutes

Objective: Solve a beginner-track CTF challenge end to end and document your methodology.

Free lab environment

picoCTF (free, always-on, beginner-friendly CTF) — https://picoctf.org/

picoCTF is a free, perpetually-available Capture-the-Flag platform built by Carnegie Mellon University’s security researchers, with challenges spanning every category in this course. Free account required, no payment.

Lab workflow

1. Create your free picoCTF account and open the challenge.
2. Read the challenge description twice before touching any tool — CTF challenges often hide the key detail in the description itself.
3. Form a hypothesis about the vulnerability class involved before you start trying techniques at random.
4. Work systematically: test one hypothesis fully before moving to the next.
5. Once you reach the flag, immediately write down the reasoning chain that got you there while it’s fresh.
6. Capture the flag-confirmation screen as your evidence.

Evidence & screenshot requirements

Submit the following with your report (see this module’s practical assignment for exact upload details):

• the challenge’s flag confirmation screen
• your written walkthrough of the reasoning steps you took to reach it

Expected deliverable

A concise lab-report entry containing: scope/target, exact commands or payloads used, your key
observation, the required screenshots above, and — where applicable — the specific remediation for what
you found. Vague answers (“sanitize input”, “use a firewall”) without naming the exact mechanism will not
receive full credit.

Safety & authorization

Only test the specific free lab target named above, or infrastructure you personally own. Do not target
third-party systems, real user accounts, or production services without explicit written authorization.
Never deploy anything from this project outside an isolated lab environment.