How Does Hacker101's Capture the Flag Work?

Hacker101's Capture the Flag (CTF) is a set of practice levels you play directly on the Hacker101 site, built to apply what you learn in its web security lessons. It suits you if you're a programmer curious about bug bounties, a student learning web security, or an experienced professional who wants realistic practice. The site describes the CTF as "levels inspired by the real world," so expect challenges modeled on real web vulnerabilities rather than abstract puzzles. It's a practice environment, not a competition platform with published rankings or prizes.

What the CTF is for

The CTF sits alongside Hacker101's video lessons as the hands-on half of the class. The lessons explain concepts; the CTF levels give you a target to test them against. The site frames it as "put your skills into practice," which tells you the intended workflow: learn a technique, then find and exploit it in a level.

This makes it a reasonable fit if you want structured practice with real-world flavor. It's a weaker fit if you're looking for timed competitions, team brackets, or a scored leaderboard — the site's own description points to self-paced levels, not organized events.

How a typical session works

The exact interface and level list live on the site, so treat the steps below as the general shape rather than a fixed menu path:

1. Start from the Hacker101 site. The homepage presents two main entry points: Capture the Flag and Video Lessons. Choose the CTF.
2. Pick a level. Levels are the unit of practice. Each one presents a target — typically a small web application or page — with a vulnerability to find.
3. Reconnaissance. Explore the target as a normal user would: look at pages, parameters, inputs, and responses. This mirrors how you'd approach a real web app.
4. Identify the vulnerability. Match what you observe against the classes of bugs covered in the lessons (for example, injection, access control, or authentication flaws).
5. Exploit it to capture the flag. Success means retrieving the flag — a string that proves you solved the level. Submitting it marks the level complete.
6. Move to the next level. Levels build on each other, so the skills compound as you go.

The expected result of each level is the same: you demonstrate that you can find and use a specific vulnerability, not just recognize it in a quiz.

What you need before starting

• A web browser. The CTF runs in the browser; no special tooling is required to begin.
• Basic web literacy. Understanding HTTP requests, URLs, cookies, and HTML helps you read what the target is doing.
• Willingness to use developer tools. Browser dev tools and an intercepting proxy are the standard way to inspect and modify traffic, which is how most levels are solved.
• The lessons, ideally first. Since the CTF is designed to apply the class material, working through the relevant video lessons makes the levels far less opaque.

How to tell if it fits your goals

Common sticking points

• Getting stuck with no hint. CTF levels are meant to be figured out. If you're blocked, revisit the matching video lesson rather than hunting for a walkthrough — the lesson usually contains the technique you're missing.
• Skipping the lessons. Jumping straight into levels without the class material makes the vulnerabilities harder to spot, since you won't yet know what to look for.
• Assuming fixed rules. The number of levels, their difficulty, and any scoring or submission rules are set by the site and can change. Check the CTF page itself for the current setup rather than relying on secondhand descriptions.

The bottom line

Use Hacker101's CTF if you want hands-on, real-world-flavored web security practice that pairs with free lessons. Start with the lessons, then work the levels in order, using browser dev tools to inspect and manipulate the targets. If you want ranked competitions instead of self-paced practice, this isn't that — but as a practice loop for web security skills, it's a direct fit.