A Scaffolded, Metamorphic CTF for Reverse Engineering

Hands-on Capture-the-Flag (CTF) challenges tap into and cultivate the intrinsic motivation within people to solve puzzles, much in the same way Sudoku and crossword puzzles do. While the format has been successful in security competitions, there have been a limited number of attempts to integrate them into a classroom environment. This paper describes MetaCTF, a metamorphic set of Jeopardy-style, CTF challenges for teaching reverse code engineering. MetaCTF is 1) scaffolded in a way that allows students to make incremental progress, 2) integrated with the course material so that students can immediately apply knowledge gained in class, 3) polymorphic and metamorphic so that individual students within a class and between multiple offerings of a class are given unique challenges, and 4) extensible in order to allow students to design their own CTF challenges that can be later integrated into future offerings of the course.