Generating a Lab Challenge from a Learning Card

Each learning card in a CTFFactory Learning Path can include an embedded challenge lab — a purpose-built CTF challenge generated by AI specifically to assess the competency covered by that card. This page explains how lab generation works, the rules that govern it, and how the output differs from challenges generated outside a learning context.

What the Lab Button Does

When viewing a learning card, a Generate Lab button appears in the Challenge Lab section (visible when the card has a challenge lab configured). Clicking this button instructs CTFFactory's AI engine to create a new challenge that:

• Directly tests the competency cluster defined on the card
• Falls within the card's configured difficulty range (min/max values set by the curriculum designer)
• Aligns to the category appropriate for the card's domain (e.g., Web Exploitation, Reverse Engineering, Forensics)

Generation typically completes within 30–90 seconds depending on challenge complexity. A progress indicator is shown during generation.

Learn-Context Rules

Challenges generated from a learning card operate under a distinct set of rules compared to challenges created from the main CTF organizer workflow. These rules are intentional and cannot be overridden by the learner.

Why insane difficulty? Lab challenges are assessment instruments, not learning aids. The theory and lesson outline on the card provide the conceptual scaffolding. The lab measures whether the learner can independently apply that knowledge under realistic, unassisted conditions — the same environment they would face in a real engagement or a competitive CTF.

Player-Only ZIP vs. Auto-Deploy

The output of lab generation depends on whether the challenge specification is deployable or non-deployable.

Non-Deployable Challenges (Player-Only ZIP)

Some challenge types — for example, static file analysis, steganography, and cryptography puzzles — do not require a live server to be running. For these, CTFFactory produces a player-only ZIP containing:

• The challenge files the player interacts with (binary, image, PCAP, ciphertext, etc.)
• A challenge.json metadata file describing the flag format and category
• No solve scripts, no source code, and no Dockerfile

The learner downloads the ZIP and works through the challenge locally or in their own environment.

Deployable Challenges (Auto-Deploy)

Challenges that require a live service — web applications, network services, binary exploitation targets with remote connections — are flagged as deployable. For these, CTFFactory automatically:

1. Builds and pushes a container image to the platform's internal registry
2. Provisions an isolated deployment on the CTFFactory infrastructure
3. Provides the learner with a live hostname and port (and, where applicable, SSH credentials or a browser-based terminal)
4. Tears down the deployment automatically when the flag is captured or the session times out

The learner does not receive source code, Dockerfiles, or solve scripts. The deployment is ephemeral and isolated per-learner session.

How This Differs from Normal Challenge Generation

The table below summarizes the key differences between generating a challenge through the Learning Path lab flow versus through the standard CTF organizer interface.

The learning lab is a one-shot, closed-box experience. Once a correct flag is submitted, the evidence requirement on the card is automatically fulfilled and the card advances toward completion.