Reverse › Module 7 › Lesson 2
CTF Workflow
CTF reversing workflow — triage, static, dynamic, flag extraction, writeup discipline on $RE_LAB challenge binaries.
Visual · t23_ctf_workflow
CTF workflow = structured RE on challenge bins. $RE_LAB. Original Cyberlium.
Opening
CTF time pressure is fake — the workflow is real: triage, analyze, prove flag, write it up without paste-bin piracy.
CTF reversing workflow: (1) triage file type, strings, protections; (2) static in Ghidra/objdump — entry, main logic, compare; (3) dynamic in GDB with breakpoints; (4) derive flag or key on $RE_LAB; (5) writeup with hash, tools, steps, flag format, ethics line. Team rules: no sharing live flags before deadline if brief says so; no attacking CTF infra; no using RE skills on non-CTF commercial targets afterward. Cyberlium teaches reproducible workflow on YOUR assigned CTF/crackme — NOT plagiarized writeups, NOT flag hoarding to sell, NOT 'CTF skills' as excuse for piracy.
1. Triage to flag
file, strings, checksec-class literacy, Ghidra auto-analysis, rename functions honestly, dynamic confirm hypothesis.
Flag submission only on authorized CTF platform — document UTC solve time.
Command guide
Try these commands — Triage to flag
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
pwn.college — https://pwn.college/ (CTF workflow literacy) crackmes.one — https://crackmes.one/ (difficulty-tagged legal targets) LiveOverflow CTF — https://www.youtube.com/c/LiveOverflow (methodology literacy)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
Built-in (binutils)
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest) Use WSL or install binutils
═══ LINUX / macOS ═══
Command — copy this
export LAB_RE=${LAB_RE:-$HOME/cyberlium-lab/t23-re}
curl -sS https://pwn.college/ | head -8
mkdir -p "$LAB_RE/notes"
cat > "$LAB_RE/notes/ctf-workflow.txt" <<'EOF'
1) file/strings on YOUR toy
2) objdump/readelf static pass
3) gdb dynamic pass
4) document flag/key — crackmes/YOUR toys only
EOFCommand — copy this
grep -E 'file|objdump|gdb|crackmes' "$LAB_RE/notes/ctf-workflow.txt"
Primary tools to practice this lesson: curl, strings. Reference sites: pwn.college (https://pwn.college/); crackmes.one (https://crackmes.one/); LiveOverflow CTF (https://www.youtube.com/c/LiveOverflow). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Writeup skeleton
Challenge name, hash, tools, static findings, dynamic proof, flag redacted in public share if brief requires.
Integrity: no commercial binary mixed in, no piracy side quest.
3. Team ethics
Collaborate per CTF rules; cite teammates; do not DoS challenge servers.
Skills transfer to defensive RE and malware class — not to cracking neighbor's app.
4. What you ship: CTF workflow checklist
Six-step workflow + writeup headers + ethics line + $RE_LAB target verify.
5. What you record before the next lesson
CTF workflow checklist path.
6. Wrong vs right: commercial piracy vs crackmes/CTF toys
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Use CTF GDB workflow on commercial app 'because same binary format.'
Right
CTF workflow checklist for $RE_LAB challenge. Next: Patch Literacy.
Mission: CTF workflow checklist
1) Write six workflow steps. 2) Draft writeup section headers. 3) Add ethics/scope line. 4) Note hash-verify before start.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Public writeup — flag redaction rule?”
Knowledge Check
APPLY: CTF workflow includes:
Multiple choice
Knowledge Check
APPLY: True or False: CTF skills justify cracking paid software.
True or False
Knowledge Check
APPLY: Writeup should document:
Multiple choice