2024 Virginia Cybersecurity Education Conference

As a CTF developer, there are two worst case scenarios: some student solves all of the challenges and some student does not solve any of the challenges.  The first of these, somebody solves all of the challenges, might be embarrassing to the developer, but it might also mean that one or more students are not being challenged.  The second, some student does not solve any of the challenges, is big problem because it means that one, or more, students are not engaged and potentially not learning.  We have been developing CTF challenges for more than ten years and in that time, we have developed strategies and rules of thumb that help encourage students and provide scaffolding where capturing one flag provides most of what a student will need to capture the next one.  In this workshop, we will take the participants through the process of creating challenges in three categories:  reconnaissance, hashing, and cryptography.  Participants will learn the tricks that we use to lay out a set of challenges for each of these categories so that the challenges progress from fairly easy (avoiding the second scenario) to quite challenging (avoiding the first scenario), raising the level of student accomplishment and engagement with each successive challenge.  Not only will participants be guided through the process of creating just-in-time learning opportunities for their students, the tools and techniques that we will share may help them prepare their students for future competitions.