Home Skill inventory Get access
← Back to store

The CTF Mastery Path: From Zero to Solver

CTF is a set of repeatable skills, not a talent. Here's the 90-day path — and how to let your agent grind the reps.

CTF9 min read·Aug 7, 2026

Most people lose CTFs the same way: no structured progression. They jump between random categories, read writeups without understanding, and quit after a weekend with zero solves. Winners do the opposite — they drill one category to fluency, then expand. Here's the exact progression.

Days 1–30: Web & crypto foundations

1

Web exploitation (the fastest wins)

Web is where beginners score first because the skills overlap with real jobs. Master the core five:

  • SQLi: from ' OR 1=1-- to blind extraction via timing
  • XSS: stored vs reflected, and why CSP changes everything
  • SSRF: internal services, metadata endpoints, DNS rebinding
  • Command injection: filters, blacklists, and their bypasses
  • Template injection: the modern multi-tool — one payload, full RCE
2

Crypto: patterns, not mathematics

CTF crypto rarely needs a math degree. It needs pattern recognition:

  • RSA misuse: small e, shared n, n factoring, padding oracle
  • AES ECB/CBC flaws: byte-at-a-time, bit flipping, IV reuse
  • Hash length extension, key reuse in stream ciphers
  • Encoding soup: base64 → hex → XOR → back again

Days 31–60: Forensics & OSINT

3

Forensics: the file is never innocent

Every flag is hidden somewhere — the skill is knowing where to look:

  • binwalk/foremost for embedded files in images and PCAPs
  • Steganography: LSB, EXIF, appended data after file markers
  • PCAP analysis: follow TCP streams, hunt DNS/HTTP exfil
  • Memory dumps: volatility process/network/hashdump basics
4

OSINT: a search engine is a weapon

  • Reverse image search and EXIF GPS trails
  • Metadata in documents (authors, software versions, hidden comments)
  • Username and email correlation across platforms
  • Timeline analysis: what happened, in what order, and who was there

Days 61–90: Pwn & reverse

5

Pwn: the structured mindset

Binary exploitation is the steepest curve. The 90-day goal is fluency with the standard toolkit, not exotic 0-days:

  • Buffer overflows with pwntools: control EIP, leak addresses, ret2libc
  • Format string leaks and arbitrary reads
  • Heap basics: UAF, double-free, tcache poisoning
  • Mitigations: NX, ASLR, PIE, canaries — and the standard bypasses
6

Reverse: read the machine

  • strings, file, checksec — the 10-second triage
  • Static analysis in Ghidra: map the flag-checking logic
  • Dynamic with a debugger: patch the strcmp, skip the branch
  • Obfuscation basics: packing, XOR strings, anti-debug stubs

The one habit that matters: write writeups

Solvers don't just solve — they document. Every challenge you solve becomes a template for the next one. After 90 days, a solver's writeup library is their real superpower: pattern → procedure → toolchain, all in their own words.

# your personal solve library (keep it machine-searchable)
~/.ctf-library/
  web/sqli-blind-timing.md
  crypto/rsa-small-e.md
  pwn/ret2libc.md
  forensics/pcap-streams.md

The Elite edition ships the complete CTF Mastery pack: 122 sub-skills across every category with step-by-step attack playbooks, plus the CTF Solver SOUL persona and writeup templates. It's this exact path, pre-built as skill files your agent can execute against live challenges.

Skip the 90 days of finding out

The full CTF Mastery pack — 122 sub-skills with attack playbooks — is included in Elite.

Get Elite — $349

Crypto payment · automatic activation · lifetime files