A good CTF challenge teaches a specific security concept. It gives participants enough evidence to select a method and produces a clear result when they apply the method correctly.
Define the learning goal
Write one sentence that states what a participant will understand or do after the challenge. For example: “The participant will identify that an object identifier needs a server-side authorization check.”
Do not start with a vulnerability name and add unrelated obstacles. Every major step must support the learning goal.
Define the participant
State the expected experience level and prerequisite knowledge. A beginner challenge must define necessary terms and avoid hidden tool requirements. An advanced challenge can require deeper knowledge, but the task must still provide a fair path.
Create a controlled environment
- Use infrastructure made for the competition.
- Isolate the challenge from production systems and private data.
- Use synthetic accounts and content.
- Limit network access to what the solution requires.
- Set resource limits and monitor service health.
- Provide a reset process for stateful challenges.
Never build a challenge around a real unauthorized target. The organizer must control the system or have explicit permission to use it.
Design the evidence path
A participant needs an initial observation that points toward the concept. Add evidence in layers. The first layer identifies the area to inspect. Later evidence confirms the hypothesis.
Avoid random guessing. If the intended solution depends on a special value, provide a way to derive that value from the challenge.
Choose the flag and validation
Use a unique flag for the challenge. Do not place the same flag in an unintended public file or build artifact. If each team gets a different instance, confirm that the validation system accepts the correct team flag only.
Write the official solution
Complete the solution before release. Record the intended steps, commands, important output, expected time, and possible alternate solutions. Explain the security lesson and a secure implementation.
Test with other people
- Ask a reviewer to check the learning goal and safety limits.
- Ask a solver at the target experience level to attempt the challenge.
- Observe where the solver lacks evidence or misunderstands the task.
- Test the challenge from a clean environment.
- Test resets, repeated submissions, and simultaneous users.
- Remove unintended shortcuts that bypass the learning goal.
Prepare participant support
Write a clear challenge description, scope, file list, and connection method. Prepare hints that reveal the next observation without giving the complete solution. Define how participants can report a broken instance.
Review after the event
Record common failure points, alternate solutions, infrastructure problems, and participant feedback. Update the official writeup. Remove or isolate the challenge infrastructure when it is no longer needed.
If you want to help create OmniCYBR challenges, read the Join page and email your interest.