CTF Participation During Military Service
Introduction
I have been fulfilling my mandatory military service since 2025. During my service, I had the opportunity to participate in a CTF competition held within the military. In this post, I’d like to share how I prepared for the competition and some of the thoughts and lessons I took away from the experience.
Studying Before the Qualifiers
I was able to get some information about the competition from someone who had participated the previous year.
According to them, last year’s competition was held in an environment where internet access was unavailable, although participants could use an AI tool provided within the military to search for information. I was also told that the challenges were not particularly difficult.
Based on this information, I figured that instead of memorizing every query or exploit technique, it would be enough to develop the ability to quickly identify vulnerabilities in each challenge. So that became the focus of my preparation.
I studied a variety of attack techniques and practiced analyzing challenges on my own to identify potential vulnerabilities. Afterward, I would use AI to check whether the weaknesses I had found were actually exploitable vulnerabilities.
At that point, I felt like I could solve just about anything.
At least, I did until the official competition announcement came out.
The Qualifiers
No way.
Three days before the competition, an announcement was posted saying that even AI tools would not be allowed.
I hurriedly went back through the exploit scripts and solutions from all the challenges I had previously solved. But perhaps three days simply wasn’t enough.
Despite all the time I had spent preparing for web and pwn challenges, I ended up failing to solve a single one.
I could tell which parts were vulnerable, but I couldn’t figure out how to turn those vulnerabilities into actual solutions.
It was incredibly frustrating.
Then, with about an hour left in the competition, perhaps my desperation somehow reached the competition server. I realized that the Scenario 1-2-3 challenges were much easier than I had initially thought.
From there, I started solving the scenario challenges one after another. With just 30 seconds remaining, I submitted the final solution.
And somehow, I managed to qualify for the finals.
Studying Before the Finals
The qualifiers made me realize that the way I had been studying was fundamentally flawed, and my motivation took a serious hit.
I started wondering whether studying even more material from that point onward would really make much of a difference in the finals.
There was one month left.
I thought carefully about what I needed to do to solve more challenges in an environment where I would have absolutely no access to search tools.
Looking back, my biggest problem was clear:
I could identify the vulnerability, but I couldn’t turn it into a working solution.
So instead of learning new material, I decided to focus entirely on reviewing what I already knew.
I revisited the solutions to the challenges I had solved before and went through the tools I had used in detail, learning their individual features and options one by one.
That was how I prepared for the finals.
The Finals
I ended up finishing 3rd in the enlisted personnel division.
I was satisfied with the result itself, but I was still disappointed that I once again failed to properly solve the web and pwn challenges I had spent so much time preparing for.
Still, the scenario challenges—which had a major impact on the overall score—focused heavily on web vulnerabilities. Because of that, I don’t feel that the three months I spent studying went to waste.
I also think one reason I was able to place as high as I did was that the web challenges in the finals required significantly more guessing than those in the qualifiers.
As a result, fewer participants were able to solve them overall, which probably worked in my favor.
If I Were to Prepare for the Competition Again
If I had known from the beginning that AI tools would not be available, I would have practiced solving more difficult challenges entirely on my own, without relying on the internet.
Rather than stopping once I had identified a vulnerability, I would have made sure I fully understood the tools and techniques I frequently used, as well as the detailed process required to turn a vulnerability into a complete exploit.
Had I practiced that way, I think I could have achieved better results not only in the qualifiers, but also in the finals.
Thoughts on the Competition
With the recent rise of AI, I had started to feel that CTFs were becoming somewhat pay-to-win, and as a result, I had gradually lost some of my motivation for them.
But this competition was different.
It was a competition driven entirely by human skill.
It threw me into an extreme environment where I had to rely almost entirely on my own memory for whatever I needed.
Trying to figure out the best strategy for such an environment and studying vulnerabilities in preparation for it helped me rediscover the passion that had been buried somewhere inside me.
Thanks to this experience, I feel like I was finally able to break out of the slump I had been going through with cybersecurity studies—especially CTFs.
One Last Thing I’d Like to Say
I agree with the idea that you shouldn’t let your military service—whether it feels short or long—go to waste.
From that perspective, I think competitions held within the military are definitely worth participating in if you have the opportunity.
Preparing for a competition can give you a meaningful goal to work toward while serving, and depending on the circumstances, good results may even lead to rewards such as additional leave or early promotion.
It doesn’t necessarily have to be the same competition I participated in.
If you are currently serving in the military, I hope you look for different competitions and challenges that you can take on during your service. I hope that, through preparing for them, you can find goals of your own and make your time in the military both productive and fulfilling.