Guide: CTFd (Capture the Flag)

New to all of this? Good - this guide assumes you have never written a line of code, never “hacked” anything, and have never heard the phrase “capture the flag.” By the end you will know exactly what CTFd is, how to get into it, and how to go from “what is this?” to “I submitted my flag and got the points.” Keep this page open in one browser tab and your challenge open in another while you work.

Every single activity this semester follows the same six-step loop, no matter which week or which challenge you are on. It is worth burning this picture into your memory now, because once you have done it once, you have done all five:

Figure 1. The core CTFd loop, start to finish - the flag is printed by the notebook, then submitted on the server. Illustration - your screen may differ slightly.

1. What this is and why CIS 350 uses it

CTFd is a website that keeps score for a game called Capture the Flag (CTF). In a security CTF, each “challenge” is a small, safe puzzle. When you solve it, the puzzle hands you a secret string of text - the flag. You prove you solved it by turning in that flag. CTFd is just the scoreboard: it shows the list of challenges, it checks the flag you submit, and it awards points and updates the rankings.

Think of it like a scavenger hunt at a museum. Each stop has a locked box, and inside is a card with a code word. You do the little task at that stop, the box opens, you read the code word, and you write it on your entry sheet at the front desk to prove you were there. CTFd is the front desk. The “locked box” for us is a Google Colab notebook, and the “code word” is your flag.

Why does a business course use this? Because the best way to understand how AI systems get attacked - and how to defend them - is to safely try an attack yourself, once, in a sealed sandbox. Every challenge in this course is an intentionally weak, made-up “toy” model built only for practice. You are the authorized red-team analyst. Doing the attack yourself makes the defense stick in a way that reading about it never will.

One important thing to know up front: the flag is not your grade. The flag is just proof that you genuinely made the attack work - a completion signal. What your instructor actually grades is your activity worksheet, where you paste your code, your result, and a short reflection on why the attack worked and how you would defend against it. So getting the flag is the fun checkpoint; explaining it is the real learning.

2. Before you start / first-time setup

You will use CTFd five times this semester (Weeks 8, 10, 11, 13, and 15). You only create your account once; after that you just log in.

What you need: a web browser, the course CTFd address (posted on Canvas), and a Google account for Colab. Nothing to download or install.

1. Find the CTFd link. Your instructor posts the exact web address on Canvas - we will call it [your course CTFd URL - posted on Canvas]. Click it, or paste it into your browser’s address bar and press Enter.
2. You will land on the course CTF home page. Look in the top-right corner for two links: Register and Login.
3. First time only: click Register. You will see a short form with three boxes: a username (pick something you are comfortable seeing on a public scoreboard - your real name or a nickname; check Canvas if your instructor requires a specific format), an email, and a password. Fill them in.
4. Click the Submit (or Register) button. CTFd logs you in automatically and drops you on the main challenges screen.
5. Every time after that: click Login instead, type the username/email and password you chose, and click Submit.

The registration form is short - three boxes and a button. Here is what it looks like:

Figure 2. The first-time register form: fill in a username, email, and password, then click Register once (after that you just Login). Illustration - your screen may differ slightly.

If you have never opened a Colab notebook before, read the Colab guide first. That guide is the “how do I run a notebook” companion to this one; this guide is the “how do I turn in the flag” half.

3. A guided tour of the interface

After you log in, CTFd is a small website with a menu bar across the top. From left to right you will typically see: the course/event name (click it any time to get home), and then tabs named Challenges, Scoreboard, and your account/profile (often your username, in the top-right). Here is a rough sketch of the layout:

+-----------------------------------------------------------+
|  CIS 350 CTF     Challenges   Scoreboard        yourname v |
+-----------------------------------------------------------+
|                                                           |
|   [ Evasion ]   [ Adversarial ML ]   [ LLM Security ] ... |   <- category filters
|                                                           |
|   +-------------------+   +-------------------+           |
|   | Evade the Filter  |   | One Pixel Too Far |           |   <- each box is a
|   | 15 pts            |   | 20 pts            |           |      challenge card
|   +-------------------+   +-------------------+           |
|                                                           |
+-----------------------------------------------------------+

The Challenges page is where you will spend your time. It shows a grid of cards. Each card is one challenge and displays its name (for example, “Evade the Filter”), its category (a topic label such as Evasion, Adversarial ML, LLM Security, Privacy, or Robustness), and its point value. Cards may be grouped by category. A challenge you have already solved is usually marked (a checkmark or a color change). Some challenges may be locked/hidden until your instructor releases that week - if you do not see this week’s challenge yet, it simply has not been unlocked. Do not worry; it will appear.

Figure 3. The Challenges page: click a card to open it, read its point value, and note its category. Illustration - your screen may differ slightly.

To open a challenge, click anywhere on its card. The point value (the small number on the card) is how much that challenge is worth if your flag is correct; the category is just the topic it teaches. The Scoreboard tab lives across the top next to Challenges.

Clicking a challenge card opens a pop-up window. Inside you will see the challenge’s description (the same brief you read in the course materials - the scenario and what to submit), often a link to the Colab starter notebook, sometimes a Hint button, and - the part you care about most - a text box labeled “Flag” with a Submit button next to it. That box is where your CIS350{...} code goes.

Figure 4. Submitting a flag: paste the exact string into the Flag box - it is case-sensitive and must keep the CIS350{ } wrapper - then click Submit. Illustration - your screen may differ slightly.

When you paste, make sure the box holds the whole flag and nothing else: the CIS350{, the text inside, and the closing }, with no leading or trailing spaces. The check is case-sensitive, so a lowercase letter where the notebook printed a capital will be rejected.

After you click Submit, CTFd tells you right away whether the flag was accepted. A green message means you scored the points; a red one means try again - almost always a copy-paste slip, not a wrong answer.

Figure 5. The two responses after submitting - and the quick fixes when a flag is rejected. Illustration - your screen may differ slightly.

The Scoreboard tab shows everyone’s points and ranking. It is just for fun and motivation; you never have to look at it, and your grade does not depend on your rank.

Your account menu (top-right) lets you see your own solved challenges and log out.

4. How you will use it in this course

CTFd is used for exactly five activities. Each one follows the identical rhythm: open the Colab starter, do the attack, copy the flag it prints, submit the flag here on CTFd, then fill in your worksheet. The table shows the specifics.

Each challenge ties to that week’s lecture and lab, so you will already have seen the ideas before you attempt the CTF. For the full description of what each activity asks, see the Activities page. Remember: CTFd points are the completion checkpoint; the worksheet is what is graded.

5. Step-by-step: completing an activity end to end

Let’s walk the Week 8 challenge, Evade the Filter, from open to submit. Every other week works the same way, so once you have done this you have done them all.

1. Read the brief. On CTFd, open this week’s challenge card and read the description, or read it on the Activities page. Week 8’s job: build an email that a phishing filter scores below 0.5 (so it calls it “benign”) while the email still asks for credentials, still has an urgent word, and still has a link.
2. Open the starter notebook in Colab. Click the Colab starter link (on the challenge card or on the Activities page). If it opens in Colab, great. If it downloads a .ipynb file instead, go to Google Colab and choose File -> Upload notebook to open it. New to this? The Colab guide shows every click.
3. Run the setup cells top to bottom. Click the first code cell and press Shift+Enter to run it, then continue down; or use Runtime -> Run all. These cells build the toy filter for you. Nothing to install - Colab already has what you need.
4. Find the TODO cell and do the attack. Scroll to the cell marked TODO. For Week 8 you edit a small Python dictionary describing your email - for example turning down the number of urgent words and links just enough to slip under the 0.5 line, while keeping cred_request set to 1. Change the values, then run that cell with Shift+Enter.
5. Run the check cell. Below the TODO cell is a check(...) cell. Run it. If your attack did not fully succeed, it will tell you what is still wrong (for example, the score is still too high) - adjust and run again. This is normal; expect a few tries.

6. Copy the flag. When you genuinely succeed, the notebook prints something like:

   SUCCESS! Flag: CIS350{ev4de_the_f1lter_2024}
   

   Select and copy the entire flag, from the C in CIS350 through the closing } - including the braces, and nothing extra.

7. Submit the flag on CTFd. Go back to your CTFd tab, open the Week 8 challenge card, click the Flag text box, paste the flag, and click Submit. A green “Correct” (or similar) message means you scored the points. Done on the scoreboard side.
8. Fill in your worksheet. Open the Week 8 activity worksheet and paste in your winning email dictionary, the flag, and one or two sentences on why the filter was fooled and one defense that would stop it. Submit the worksheet in Canvas. This is the graded part.

That’s the whole loop: read, run, attack, check, copy, submit, reflect.

6. Troubleshooting

7. Rules of engagement

• Attack only the provided sandbox. The only thing you are authorized to test is the challenge notebook itself. Nothing else.
• Never apply these techniques anywhere else. Trying these attacks on any real website, account, model, or system you do not own or are not explicitly authorized to test is illegal and a violation of the course academic-integrity policy.
• The point is defense. You practice the attack in a safe box so you can recognize and stop it in the real world. Your worksheet’s defense reflection is where that lands.

If you are ever unsure whether something is in bounds, the answer is: only the sandbox we provided, and nothing more. When in doubt, ask your instructor first.

8. Getting help + quick-reference checklist

Where to get help, in order:

1. This guide’s Troubleshooting table (Section 6) and the Colab guide for notebook problems.
2. The challenge brief (the description on the CTFd card and on the Activities page) - re-read the success condition.
3. The Hint button on the CTFd challenge card, if one is offered.
4. Your instructor or TA - post in the Canvas Q&A or come to office hours. Say which week’s challenge, what you tried, and the exact error or message you see.

Quick-reference checklist - glance at this while you work:

• Logged in to CTFd at [your course CTFd URL - posted on Canvas] (Login, not Register).
• Opened this week’s challenge and read its brief / success condition.
• Opened the Colab starter and ran all cells top to bottom.
• Edited the TODO cell to perform the attack.
• Ran the check(...) cell and saw SUCCESS! Flag: CIS350{...}.
• Copied the WHOLE flag, including CIS350{ and the closing }, no extra spaces.
• Pasted it into the CTFd Flag box and clicked Submit -> saw “Correct.”
• Filled in the week’s worksheet (code + output + why-it-worked + one defense).
• Submitted the worksheet in Canvas. (This is the graded part.)

You’ve got this. Take it one cell at a time, expect a few tries before the flag appears, and remember the flag is just the fun checkpoint - your thinking on the worksheet is what counts.