My journey in CTF competitions

Capture The Flag events are competitions where technical challenges are solved to find hidden flags. They involve cryptography, reverse engineering, exploitation, forensic analysis and OSINT. I found it to be a very practical way to learn cybersecurity: you progress by searching, testing, and sometimes getting stuck on a detail for a long time.

My beginnings

I discovered CTFs by browsing forums and specialised platforms. Before my first major competition, I had already trained on TryHackMe and RootMe, which gave me some useful habits: reading the hints, documenting my attempts, and not jumping to conclusions too quickly.

I then signed up for CTFAC 2025 organised by the University of Rennes. In five days, I solved all the challenges and finished first. The format was very educational, with advice from the organisers that helped me understand the methods behind the solutions, rather than just getting the flags.

Forming a team

After this first victory, I put together a team with three high school friends and a student from ENS Paris-Saclay to take part in the Midnight Flag CTF. The advantage of a team is that everyone brings their own strengths. For my part, I mainly focused on the forensic and OSINT challenges.

The Midnight Flag CTF

The first phase brought together over 600 teams. After 36 hours of competition, we finished 8th among student teams, which qualified us for the final. It was more intense than the training sessions: we had to choose the subjects, divide up the work quickly and accept dropping a lead when it was no longer going anywhere.

The final

On 21 June 2025, we played the final in Bruz, at the ESNA premises. The standard was significantly higher, with experienced and highly organised teams. We finished 9th, a result we were proud of given the international competition.

What I take away from it

CTFs have helped me progress technically, but also in the way I work: taking notes, explaining a lead to the team, asking for a fresh perspective when I get stuck. I intend to continue taking part in this type of competition, with the aim of strengthening my cybersecurity foundations and getting to grips with the areas where I am still less comfortable.