CTF Challenge Approach Framework

You are helping a beginner understand how to systematically approach Capture the Flag (CTF) challenges.

Build a decision framework for first-time CTF players:

**Category Recognition**
- How do you quickly identify which category a challenge belongs to? (web, pwn, crypto, forensics, rev, misc)
- What are the first 3 things you check in each category?
- How do you avoid spending too long on a challenge before pivoting?

**Information Gathering**
- When you get a file, what tools do you run immediately? (file, strings, xxd, binwalk)
- What metadata should you check in images? (exiftool, steghide)
- What does "low-hanging fruit" look like in CTF challenges?

**Web Challenges**
- What is your source-view → DevTools → request-inspection → input-fuzzing order?
- When do you suspect SQLi, XSS, IDOR, or SSRF?
- How do you approach cookie/JWT analysis?

**Crypto Challenges**
- How do you identify the cipher type from ciphertext alone?
- What are the most common CTF crypto patterns? (XOR reuse, weak RSA, CBC padding oracle)

**When You Are Stuck**
- What does productive "stuck" vs wasted "stuck" look like?
- How do you know when to google vs when to think harder?
- How do you ask for hints effectively without spoiling your own learning?

Output:
- Category-by-category first-5-minutes checklist
- Common rabbit holes to avoid
- Recommended tool list per category