Practice CTF competition vocabulary: binary exploitation, web challenges, finding flags, scoreboard submission, reverse engineering, and competition formats.
0 / 10 completed
1 / 10
In a CTF competition, a 'flag' is:
A CTF flag is a specific string (typically formatted as flag{...} or ctf{...}) hidden within a challenge. Submitting the correct flag string to the scoreboard earns points.
2 / 10
A 'binary exploitation' CTF challenge involves:
Binary exploitation challenges require finding memory corruption vulnerabilities (buffer overflows, format strings, use-after-free) in compiled binaries and exploiting them to get code execution.
3 / 10
'We submitted the flag to the _____.' Where are solved flags entered in a CTF competition?
The scoreboard is the central platform where teams submit flags from solved challenges. Correct submissions are verified automatically and points are awarded in real time.
4 / 10
'Reverse engineering the _____' — what is analyzed in a reverse engineering CTF challenge?
Reverse engineering challenges provide a compiled binary (no source code) that must be analyzed with tools like Ghidra or IDA Pro to understand its logic and extract the hidden flag.
5 / 10
'Web application CTF' challenges typically test for:
Web CTF challenges focus on web application vulnerabilities — SQL injection, cross-site scripting, insecure direct object reference, server-side template injection, and authentication bypasses.
6 / 10
During a code review of a new exploit module for a CTF challenge, Alice comments: 'This uses a classic format string bug. The attacker is directly controlling the buffer size via the input, which could lead to a heap overflow.' What does Alice primarily mean in this context?
Alice is referring to a format string vulnerability – a critical security flaw. This occurs when user-controlled data is used within a string formatting operation without proper sanitization, allowing an attacker to inject arbitrary commands or cause memory corruption. The incorrect options misinterpret the core concept of buffer overflow and input validation.
7 / 10
You receive a Slack message from Ben in the #ctf-team channel: 'Just found a potential win! The API endpoint /user/profile is returning sensitive user data unencrypted. Looks like we can brute-force it.' What technique does Ben describe?
Ben describes a brute-force attack, which is a common method used in CTFs and security assessments. It involves systematically trying every possible key or combination of keys until the correct one unlocks access to sensitive data. The other options represent distinct vulnerabilities with different attack vectors.
8 / 10
You're drafting a pull request description for a CTF flag submission. You want to clearly explain the steps taken to solve the challenge. Which of the following best describes how to phrase your explanation?
The best explanation is concise and technical. It details the specific exploitation technique used – a buffer overflow – which demonstrates understanding of the underlying vulnerability. Options 2 & 3 are overly complex for a PR description, while option 4 is misleading and unprofessional. Providing a clear technical explanation builds confidence in your solution.
9 / 10
During a standup meeting, Chloe says: 'We're spending too much time trying to reverse engineer the firmware image. It's incredibly complex and obfuscated.' What does Chloe likely mean in the context of a CTF challenge?
Chloe is referring to the complexity of reverse engineering – specifically, the presence of encryption and compression. These techniques are commonly used in CTF challenges to make analysis more difficult. Options 1 & 4 represent alternative interpretations, while option 3 accurately describes a common obfuscation method.
10 / 10
You've been tasked with investigating a web application CTF challenge. The description states: 'Identify the vulnerable parameter that allows for command injection.' What is the primary goal of this task?
The core objective is to analyze how user input interacts with command execution. Command injection vulnerabilities occur when user-supplied data is interpreted as commands by the server, allowing an attacker to execute arbitrary code. This requires understanding the impact of different inputs on the application's behavior.
What will I learn from the "CTF (Capture the Flag) Vocabulary" exercise?
Practice CTF competition vocabulary: binary exploitation, web challenges, finding flags, scoreboard submission, reverse engineering, and competition formats.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free to use with no account, sign-up, or paywall required.
How many questions are in this exercise?
This set contains 10 multiple-choice questions, each with a detailed explanation shown after you answer.
Do I need to create an account to track my progress?
No account is required. Your progress bar and score reset each time you reload the page, but you can retry the exercise as many times as you like.
Who is this Security Lab exercise for?
This exercise is built for IT professionals and non-native English speakers who need to read, write, and discuss security lab topics confidently at work.
What happens if I answer a question incorrectly?
You will see the correct answer highlighted along with a detailed explanation of why it is correct -- so every wrong answer becomes a learning moment, not just a lost point.
Can I retry this exercise?
Yes -- click "Try again" on the results screen at any time to reset your score and go through all the questions again.
How long does this exercise take to complete?
Most learners finish all 10 questions in under 10 minutes, since each question is answered by clicking a single option.
Where can I find more Security Lab exercises?
See the full Security Lab exercises hub for more vocabulary drills on this topic.
Is this exercise mobile-friendly?
Yes -- the exercise works on any device with a modern browser, including phones and tablets, with no app download required.