Learn to think like an attacker,
one real flag at a time.
A hands-on Capture-The-Flag built by RTS — Rudra Tech Services — to teach the recon skills every security career starts with. Ten planted, safe artifacts are hiding in this very site. Find them, decode them, and submit the flags.
How RTS CTF works
No prior experience required — just curiosity and a willingness to view page source.
Register
Create a free account with your email and a display name for the leaderboard.
Verify
Confirm it's really you with a 6-digit code sent straight to your inbox.
Solve
Work through recon-based challenges hidden across this very site.
Climb
Bank points per solve and rise up the public Hall of Fame leaderboard.
Who's leading right now
Live from the scoreboard — these are the top 3 recruits today.
From recon rookie to red-team ready
Five stages, built out over time. Stages 1 and 2 are live today — Stages 3 through 5 unlock as they ship.
Reconnaissance
Passive & active recon: robots.txt, response headers, metadata files, exposed backups, IDOR, and weak credentials.
Play Stage 1 →Exploitation
Web application exploitation, one deliberate bug at a time: SQL injection, stored XSS, command injection, broken access control, insecure file upload.
Play Stage 2 →🔒 Privilege Escalation
Local and remote privesc across Linux and Windows targets.
🔒 Lateral Movement
Pivoting, persistence, and moving through a small simulated network.
🔒 Red Team Ops
Expert-tier, full-chain scenarios that pull every earlier stage together.
What you'll actually learn
Real recon habits
robots.txt, sitemaps, HTTP headers, exposed .git folders — the exact things a bug bounty hunter checks first.
Zero collateral damage
Every challenge lives entirely on this domain. Nothing here ever asks you to touch a third-party site.
Live Hall of Fame
Solve, score, and climb a public leaderboard — ties are broken by who got there first.