Justas Kaminskas on what CTF is and how to win it

Question 1

1. Tell us about how you first got into CTF - when was your first competition, how did you end up there, and what got you hooked?

Answer

I started in 2019; my first CTF was pico CTF, which was aimed at high school and college students. It was a great way to test my skills. But the process of solving and analyzing problems had been familiar to me for a long time—I have a bronze medal from the International Physics Olympiad. I see many similarities between math and physics Olympiads and CTFs. After graduating from high school, I chose cybersecurity as my career path, so I became more interested in these competitions. In 2024, I participated in my first in-person CTF event in Estonia. Later, my participation in various cybersecurity competitions continued to grow, and I began to win. In 2025, the National Cybersecurity Center (NKSC) selected a national youth team for a competition in Warsaw, and I became the captain of that team. This was the first time Lithuania had ever participated in an international youth competition of this scale.

Question 2

2. CTFs are certainly popular competitions, but not just anyone can participate in them. What skills and knowledge do you think are necessary to participate in a CTF competition?

Answer

I’d say you need a combination of technical cybersecurity knowledge, the ability to look at a problem or question from different angles, and an interest in what cybersecurity incidents are happening around the world. For example, take Hack the Box – there, the goal wasn’t to collect flags, but to answer questions, such as investigating a ransomware attack and finding information extremely quickly.

Question 3

3. Which cybersecurity competition did you like the most or found most memorable, and why?

Answer

My favorite was the 2024 Hack the Box challenge, Operation Tinsel Trace II: Join the Resistance Against Krampus!, where we had to answer questions about the artifacts provided, which were “released” every few days, and the first person to solve that day’s challenge won. The very last, 6th challenge was the most difficult; it took me 5 hours to solve, and I was definitely feeling exhausted by then. Somehow I pulled myself together and won. Try hack me was also memorable because of the prize we won—together with the NRD Cyber Security team, we received twelve PlayStation 5 consoles.

Question 4

4. All right, so what does it take to create a good CTF? You yourself created these challenges for the BSides Vilnius conference in 2025 and 2026.

Answer

Personally, I like real-world scenarios; for example, when creating a challenge for BSides Vilnius I used an investigation that actually took place in 2012. People enjoy it when they can not only complete a task but also learn something and analyze what happened and how. Most often, there isn’t a single story behind it; CTFs rarely have them – which is a shame, because that makes it much more engaging.

Question 5

5. How long does it take to create assignments?

Answer

Depending on the complexity, it usually takes 1–2 hours to prepare a single task.

Question 6

6. Does participating in a CTF enrich you in any other way?

Answer

My passion for CTF also led me to the LockedShields cybersecurity exercise, where I participated in digital forensics teams. There, too, I had to solve challenges, and I feel that I’ve really improved a lot thanks to that experience. Now it’s part of my daily work.

Question 7

7. Let's talk about SANS CTF EU. What made you decide to participate, and what tactics did you use to win (if you're willing to share, of course)?

Answer

The NKSC, which is a partner of the SANS CTF EU, shared information about the event. I saw it and decided to participate. The irony is that I might not have even been able to enter this competition at all. I kept putting off registration, and by the time I was ready… I couldn’t register anymore. I didn’t give up, and my third attempt to contact the organisers was successful – they let me participate.

I got very little sleep during the competition itself. I knew that it wasn’t just speed that mattered, but also the number of incorrect answers. I wasn’t among the leaders at any point during the competition, but I armed myself with patience and tried to make as few mistakes as possible and use as few attempts as possible. In the end, I made only one mistake, jumped up 30 spots, and became the winner. There were 300 participants left in the final; about 1,000 people participated in total.

Question 8

8. A question on a very “hot” topic - artificial intelligence (AI): What challenges does AI pose for both participation in cybersecurity competitions and the creation of challenges? Are there any advantages as well?

Answer

It certainly presents many challenges, especially since AI is used to solve problems. Easy problems become even easier to solve, while harder ones become harder – but that’s just the way it is. And if AI can’t solve them, then no one can. So a dilemma naturally arises: is this a competition of cybersecurity knowledge and skills, or a contest to see who can make better and more effective use of AI’s capabilities? Organisers of in-person CTFs try to limit the use of AI, but doing so online is very difficult. That’s why, for example, reflecting on the BSides Vilnius conference, the organising team and I discussed holding next year’s CTF (which took place online this time) in person.

Undoubtedly, AI is becoming a part of our daily lives, both at work and everywhere else, so CTFs shouldn’t be an exception either, and we need to look for ways in which these competitions should and could evolve. When AI is used properly, it makes it easier to track information, follow sequences, and stay on track. This becomes especially valuable during sleepless nights, as it allows you to organise and process information more quickly. Also, AI plays an important supporting role – when you’re stuck, the right query can put you on the path to solving the problem.

Question 9

9. What advice would you give to those who think CTF sounds like an interesting experience? Where should they start? Where can they find information?

Answer

Well, first of all, you need to take a broad interest in the field of cybersecurity, the incidents occurring around the world, and try to understand how they happened, how they are investigated, and how they are resolved. You’ll also definitely need technical skills and knowledge. You can use various online platforms for this, such as pwncollege, where you can learn how to “hack” programs.

Second, you need to give it a try. It’s worth starting with simpler competitions; for example, picoCTF would be a good choice. If you’re still in school, the NKSC organizes the Cyber Marathon (with monthly challenges), where you can test your skills. Also, for young people (up to age 25), the NKSC organizes an annual selection process for the national CTF team called Cyber Sprint, followed by training camps and other events.

There are certainly plenty of opportunities and ways to get involved, so I encourage you to give it a try and join these competitions. I hope the national team will thrive and grow stronger, and that we’ll make a name for ourselves on the international stage!