Average Familiarity in CTFs

You may have seen the xkcd comic Average Familiarity.

In it, Randy jokes about how experts often vastly overestimate how familiar other people are with their own field of study. It’s a good comic, and as usual it reflects a good amount of truth.

I recently had my own average familiarity moment when making some beginner challenges for a CTF aimed at noobs. I needed to make a number of challenges that a complete beginner could solve. Someone who has never played a CTF before, or really gone deep into technical cyber security work.

I started cutting out the more in-depth, tougher categories that require pre-existing knowledge like rev, pwn and web. These categories usually need you to know what vulnerability or issues your looking for, and the challenge is mainly finding it.

I started looking at stenography challenges, as normally these tools just require you to identify the tool, run it and boom, you’ve got the flag. I made some basic ones like, white-space, slight colour variations and simply using steghide to create an image with an embedded txt file containing the flag.

As stenography challenges go they’re all very rudimentary, one command and you can solve it. However, when testing it with friends who never play these challenges, they were completely stumped. When sending it to them, and telling them it was a challenge they simply just thought it was an image.

They started zooming in, reverse image searching it, searching the name of the file on social media to try find the flag. It never occurred to them that I could be using stego to hide the flag.

As well, the people I got to test it aren’t complete normies. They all work in IT to some degree, or have very good knowledge in computing. But since CTFs and these challenges are so abstracted from their field of work it just wasn’t something they ever came across so it never came to mind.

Even when trying to account for a persons lack of knowledge in the field, I overestimated their familiarity and assumed they would know about stego techniques and tools. I mean, who hasn’t heard about steghide!?

solution?

For those curious about a solution for this issue, I did end up finding a few challenge types that anyone, regardless of CTF/Technical experience could solve.

As some of you might expect, one of the easiest and beginner friendly categories was OSINT¹ . One of the easiest ones being GeoSINT challenges, a cryptic picture of some location with the goal of identifying where they are. People with no experience in CTFs had no issue with leaping into this challenge type, as well they all reported back very positively about it.

Another OSINT-like challenge I found that people really liked is the “DOX this person”-eque challenges. Challenges where you need to stalk a persons various social media pages, posts they’ve made, what they interact with etc. I created a challenge like this for ZeroDays2026 this year that involved following a hacker through Twitter, Reddit with “deleted” posts and eventually a Github with some accidental commits. I really tried to combine every aspect of these forms of challenges and got amazing feedback from competitors, both newbies and experienced players. I particularly really like these challenges when you create a whole story around it to follow, giving them a persona and a reason, filling up their social media with a lot of posts and character.

The last challenge type I found to be very beginner friendly is Symbols Cipher challenges. You could through these under stego or misc. The bare bones of them is just doing a substitution cipher challenge with cool glyphs or some symbol. The goal of the challenge then is to identify the cipher being used an decode it. A real cheap and easy way to create these is to just go to dCode.fr, pick one you like and write the flag in the cipher.

They’re extremely basic, but can still be challenging if you pick a really obscure cipher list, or one that is hard to differentiate. A lot of these ciphers also have numbers, so in theory you could write hex A-F0-9 in that particular cipher. The goal of the competitors then is to translate it from the cipher-text into hex code. The hex could be a file, another image or something else to continue the challenge on.

Anyways I’ve been yapping like mad.

Miasto