Gymnasium
Guided practice built from past challenge styles. Use it to learn tools, terminology, and category fundamentals without the competition clock.
PFW ACM / National Cyber League
National Cyber League turns cybersecurity into hands-on problems: inspect evidence, find patterns, test ideas, recover answers, and learn which kinds of technical puzzles click for you.
Start with guided practice, compete individually, then bring your strengths to a team. If a category is new to you, there are people and resources at PFW to help you get oriented.
9challenge areas
4 stagespractice through team game
Solo + teamdifferent ways to compete
Supportprep help available at PFW
Security is a collection of puzzles with evidence.
You might trace public information, decode a cipher, inspect logs, read packet traffic, recover a file, enumerate a service, or reason through a web application. You do not need to be equally good at all of it.
Bring the kind of problem solving you already like. NCL gives you a lot of different ways to apply it.
Authorized competition environment.
NCL challenges are designed to let students practice security techniques in scope. Work inside the game environment, follow the rules, and focus on learning how the evidence fits together.
Read the NCL rulesNine categories. Very different instincts.
Some reward careful reading. Some are mathematical. Some are about files, traffic, code, or operating systems. That variety is the point.
- OSINTOpen Source Intelligence
- Follow public information trails, verify sources, and connect small facts into a defensible conclusion.
- CryptoCryptography
- Recognize ciphers and encodings, reason about the underlying transformation, and recover plaintext or hidden values.
- LogsLog Analysis
- Establish what normal activity looks like, filter large records, and isolate the events that explain what happened.
- TrafficNetwork Traffic Analysis
- Read packet and flow evidence, identify protocols and conversations, and separate expected behavior from suspicious activity.
- ScanScanning
- Inspect authorized targets to identify reachable services, exposed interfaces, and useful technical context.
- ForensicsForensics
- Recover and interpret digital evidence from files, metadata, system artifacts, and incident traces.
- HashesPassword Cracking
- Recognize password-hash formats and choose efficient, appropriate recovery strategies for the challenge environment.
- ExploitEnumeration and Exploitation
- Study code, binaries, and services to identify vulnerabilities and work through authorized competition targets.
- WebWeb Application Security
- Reason about requests, sessions, authorization, input handling, and server behavior in deliberately vulnerable web applications.
Category names follow the National Cyber League competition taxonomy. See NCL competition details
Do the problem, not just the animation.
These are small original challenges built for this page. Pick a tab, work the evidence, use a hint if you need one, and check the answer. None are copied from NCL.
Cryptography
Recover a Caesar-shifted flag.
The plaintext was shifted forward by an unknown amount. Move the decoding shift until the structure becomes readable, then check your answer.
ciphertext
IODJ{VKLIW_WKH_DOSKDEHW}your decode
Hint
Flag answers often start with FLAG{. Use the first four letters to find the shift instead of guessing the whole sentence.
D(x) = (x − k) mod 26Caesar shift / substitution cipherCryptography / number theory
Find the hidden near-divisor.
Each value is close to a multiple of the same secret p. Sweep the candidate value and watch the residuals. The right p makes all four errors collapse toward zero.
3591416851425915residual score 74
3591q=40 / r=-94168q=46 / r=285142q=57 / r=125915q=66 / r=-25Hint
Do not optimize one row. You want a candidate where all four absolute remainders are small simultaneously.
xᵢ = p·qᵢ + rᵢ, with small |rᵢ|Approximate common divisor / hidden factor recoveryLog analysis
Which source deserves investigation first?
Read the short authentication timeline. Select the source address that forms the strongest suspicious sequence, then check your reasoning.
10:41:58 auth login_success user=lee ip=198.51.100.1210:42:03 files report_opened user=lee ip=198.51.100.1210:42:14 auth login_failed user=arun ip=203.0.113.2410:42:16 auth login_failed user=mia ip=203.0.113.2410:42:18 auth login_failed user=lee ip=203.0.113.2410:42:21 auth login_success user=admin ip=203.0.113.2410:42:23 admin token_created user=admin ip=203.0.113.2410:42:31 auth login_success user=mia ip=198.51.100.1210:42:40 system health_check service=web ip=192.0.2.9Hint
A single failure is weak evidence. Look for repeated failures, account switching, privilege level, and what happens immediately after a success.
group → sequence → anomaly → contextLog correlation / incident triageForensics
Identify the file without its extension.
A recovered file has no trustworthy name. Use the header bytes to identify the most likely format.
89 50 4E 47 0D 0A 1A 0A 00 00 00 0D 49 48 44 52Hint
The first bytes are often called a file signature or magic number. The ASCII column can also give away a format name.
header bytes → magic number → file typeFile signature / format identificationLearn the tools, test yourself, then solve together.
The season gives you several passes at the material. Practice helps you get oriented before the competitive rounds raise the pressure.
Practice Game
A lower-pressure run without guides. Collaboration is allowed, so it is a useful place to compare approaches and discover gaps.
Individual Game
Solve independently across the challenge areas. The result gives you a category-by-category view of what you already handle well.
Team Game
Bring complementary strengths together. Divide work, share findings, check one another, and coordinate submissions under a common deadline.
Practice that transfers beyond the scoreboard.
NCL rewards the same habits that matter in labs, internships, security work, software engineering, IT, and technical research: make sense of unfamiliar systems, gather evidence, use the right tool, and explain what you found.
Triage unfamiliar problems
Learn to read a prompt, identify what evidence matters, and choose a productive first tool instead of guessing at everything at once.
Tool fluency
Build practical comfort with terminals, packet tools, log utilities, forensic workflows, browsers, scripts, and the small utilities security work depends on.
Scripting + automation
Turn repetitive work into short scripts, transform data, test assumptions quickly, and learn when automation is worth the time.
Systems reasoning
Connect files, processes, networks, web requests, credentials, and software behavior into a coherent model of what a system is doing.
Evidence-based thinking
Make claims from artifacts rather than vibes: keep track of what you know, what you infer, and what still needs to be tested.
Team communication
Explain partial findings, hand off useful context, avoid duplicate effort, and combine different specialties during the team competition.
Career evidence
Use category-level results to talk concretely about demonstrated skills instead of relying only on coursework or a generic interest in cybersecurity.
Confidence under pressure
Practice making technical decisions against a clock, recovering when an approach fails, and moving on without getting stuck on one problem.
NCL SCOUTING REPORT
See where you are actually strong.
NCL reports performance by category, so the result is more useful than a single score. You get a clearer picture of where you already perform well and which challenge areas are worth practicing next.
You do not have to prepare alone.
PFW ACM helps students get ready with previous-game review, walkthroughs, tool setup, informal coaching, shared practice, and teammates who may be stronger in a different category. You can come in knowing one area well, or barely knowing where to start.
Past-problem walkthroughs
See how someone approaches an unfamiliar prompt, what clues they notice first, and which tools are worth reaching for.
Tool + environment help
Get help setting up common security utilities and understanding enough of the workflow to begin practicing instead of fighting your machine.
People to ask
Work near students who have seen different categories before. Ask questions, compare approaches during practice, and learn how they reason through a dead end.
Team experience
The team game rewards complementary strengths. You do not need to be the person who solves every category to make the group better.
One PFW benchmark14th / 1,034
PFW's top Spring 2024 team finished 14th nationally. You do not have to start at that level; the useful part is having experienced people, past problems, and a competition structure that gives you something concrete to work toward.
Get involved
Pick a category. Try the game.
You do not need to arrive as a cybersecurity specialist. Bring the way you already solve problems, learn the tools around it, and use the competition to find out what you want to get better at next.