A CTF (aka Capture the Flag) is a competition where teams or individuals have to solve several Challenges. The one that solves/collects most flags the fastest wins the competition.

Once each Challenge has been solved successfully, the user will find a flag within the Challenge that is proof of completion. Submitting this flag will award the team with a set amount of points. Often, if a team is the first to complete a Challenge and submit a flag, they will earn what is called a Blood (short for first blood), and this will award additional points.

At the end of the CTF, teams will be ranked by how many points they have acquired, and the team with the most points will place 1st in the CTF.

Content on the CTF Platform is broken up into two primary types. The first type of content is Machines, which can be found under the Fullpwn category. These work the same way Machines do on HTB Labs; they are full-fledged virtual machines that require a VPN connection to access.

Docker Instances, the second kind of content, accounts for all other categories. This type of content functions the same way Challenges do on HTB Labs; a Docker instance is spawned, and you are given an IP and port to access it on.

These Docker instances use a public IP, and thus no VPN connection is required.

To spawn a Machine, click on the its name in the Machine List under the Fullpwn category and press Spawn Machine.

Whenever someone on a Team spawns a Machine, a notification will be sent to all Team Members. This will include both the name of the Machine and the teammate who spawned it. All members of a Team share the same instance spawned Machines.

Once the Machine has spawned, you will be given the IP of the Machine's instance. This instance is exclusive to your Team.

There is a limit to how many Machines can be spawned by a Team at any given time, which can vary depending on the CTF. If you attempt to spawn an additional Machine after you have already reached this limit, you'll receive an error.

After a Machine has been spawned, you'll have the ability to Reset or Terminate it if you choose.

Spawning a Docker Instance is similar to spawning a Machine. Navigate to the Challenge you'd like to spawn, and press the Spawn Docker button.

Once it's been spawned, you'll be given an IP and Port. This IP address is public, meaning it can be accessed without the need for a VPN connection. Docker instances are only accessible at the port specified and will not respond to a ping, so keep that in mind.
​
Just as with Machines, spawning a Docker will notify all team members, who will all share the same instance. However, unlike with Machines, there is no limit on how many Dockers can be spawned at once.

For some CTF content, you start with more than just the IP address of the target system. Specifically, sometimes Challenge Info and/or Downloadable Content is available.

Some Challenges are accompanied by additional information, called the Challenge Info. This information is usually a brief description of the Challenge and may even hint at the technology or methods the Challenge involves.
​

To view any available Challenge Info, press on the description underneath the Challenge Name to expand it.

Some Challenges include both a spawnable instance as well as downloadable files. In these cases, both the downloadable files and the spawnable instance are typically required to solve the Challenge.

Often, the downloadable files are a copy of the source code running on the server instance. In cases where there is no spawnable instance, the downloadable files are the Challenge.

If the downloadable zip requires a password, the password will be hackthebox

If you want to access content from the Fullpwn category or any other category that uses Machines, you'll need to connect to our internal lab network using the VPN file we provide.

We offer our VPN in the form of OpenVPN packages, which come in the .ovpn file format. To download this VPN file, press the Connect to HTB button at the top right of the page.

You'll have the option to select either Pwnbox or OpenVPN. Selecting OpenVPN will give you the option to download a file you can use to connect to our network.

Connecting to the VPN can be done easily using OpenVPN, installed on most Linux distributions (including Parrot OS).

To connect, run sudo openvpn /path/to/vpnfile.ovpn in your terminal. If you see Initialization Sequence Complete, that means OpenVPN has successfully established the connection.

For more information on troubleshooting VPN connection issues, see the dedicated article on the subject.

Click the button below for help with diagnosing connection issues!

Pwnbox is our in-browser, Parrot Security virtual machine. It comes equipped with the vast majority of tools you could ever want and makes it easy to get hacking no matter where you are or what type of hardware you have at your disposal.

Pwnbox is automatically connected to the VPN, so there is no need to worry about manually connecting.

You can connect to Pwnbox from the same VPN Selection Menu you found OpenVPN.

Once you've spawned Pwnbox, you'll be able to work from within it the same way you would any other VM.

If the CTF event doesn't contain any Machines you only need to choose the location for Pwnbox and not the VPN server.

If you'd like to see your Team's place in the CTF or which teams are claiming the top spot, you can view the Scoreboard. Press the Scoreboard at the top of the page.

The dynamic scoring system on HTB’s CTF platform adjusts challenge points based on the number of participants who solve them, ensuring a fair reflection of their actual difficulty.

Each challenge starts with base points and bonus points, which decrease as more participants solve the challenge. This automatic adjustment ensures that challenges perceived as easy but solved by few participants retain higher points, while those solved by many participants see a reduction in points.

For example, if a challenge starts with 300 base points and 700 bonus points, and it is solved by many participants quickly, its points will decrease, indicating it was easier than initially assessed. On the contrary, if only a few participants solve a challenge, the points remain higher, reflecting its greater difficulty.

This approach accounts for varying difficulty levels experienced by different participants and maintains fairness across the board. Furthermore, it prevents flag hoarding - where participants delay submitting their flags to gain a strategic advantage - and promotes timely and efficient problem-solving, ensuring a fair and competitive environment for all participants.

However, it’s important to note that the current point system does not support bloods for the first, second, and third solvers, meaning there are no additional rewards for teams that solve challenges first.

In case of a tie, the winner is determined like a sprint: all participants start from the same position at the same time, and the winner is the one who crosses the finish line first. This means the participant or team who solves their final challenge the fastest, regardless of their previous ranking, will be the winner.

You can access your team’s chat on the right side of the event page to communicate with your teammates throughout the CTF period. You’ll also be able to edit or delete messages, share links, and use emojis for a more interactive experience.

CTF Try Out is a demo CTF event that you can join right away to try the platform.

It includes 10 challenges in the following categories: