In the context of an IT event, my team would organize a CTF (Capture The Flag). About the challenges (we’re working on them). I want to have some references on the types and levels of difficulty that we find on CTF generally. (The target audience varies from students (beginner) to security experts and regulars participant in CTF). Then for the deployment, do we should use a local server? Or a VPN? In fact, we lack experience, and I need some advices/suggestions on all organizational aspects. Thank you in advance. D3_4dl1n3

  • 4
    If you have not participated in several CTF, I'm unsure if it's feasable to organize one. – Lucas Kauffman Feb 1 '15 at 15:37

You can find a lot of CTF event in this website as a reference about how they organize it, their CTF's type, and what kind of challenges offered. For a more detailed and technical stuff about CTF challenges, I recommend you to read some CTF writeup by active CTF teams. As an example, Dragon Sector is an active team and usually make some writeup after finishing a CTF event, their blog is a good start to explore.


There are a lot of detailed accounts available of Capture the Flag at DEF CON which might provide the insight you're looking for, and you can try asking specific questions about organization in the DEF CON Community Forums. They do it up.


I have participated in Live and online CTF competitions. It depends what sort of CTF you would like to organize, and what sort of challenges there will be, I mainly categorize them into two categories.

  1. Web Application

  2. System/Network

Now if you want to organize a CTF involving web applications only that has vulnerabilities and users are required to exploit them and get the flag, you dont need to have a VPN setup. All you need to to use WAMP server and get it live.

If the CTF requires to have network access, then yes, you would need to setup a VPN , in order to let the participants, get access to your local network and do their deeds.

From resources point of view, you dont need to have large resources, if you are not expecting large number of participants, you can use multiple virtual machines on the same box and have multiple vulnerable apps running.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.