National Competition Roadmap

Note

These are example areas to prepare in, not the content of any competition. Tasks are confidential, competitions are closed book, and formats change between years. About this site.

Purpose

National competitions separate competent practitioners from beginners. This roadmap builds on regional foundations and introduces intermediate complexity, multi-step exploitation, and deeper technical understanding.

Focus: Depth and speed. Demonstrate mastery of core techniques with minimal guidance.

Time commitment: 6-12 months of practice beyond regional level (depending on starting point).

---

How the National Final Runs in the UK

The WorldSkills UK national final is a two-day event in four sessions (Technical Handbook 2026):

Session	When	Share of the final mark	Topics	Where to study
Capture the flag (two sessions)	Day 1	50%	Social engineering, vulnerability scanning, web application exploitation, client and server exploitation, network monitoring	Offensive operations, SIEM and monitoring
System and application analysis	Day 2	25%	Network traffic analysis, web application code analysis, malware analysis	Network forensics, Secure coding, Memory forensics
System hardening	Day 2	25%	Network infrastructure, web applications, databases and servers, digital forensics, Security Onion	Infrastructure hardening, Digital forensics

Half the national final is CTF, so offensive speed matters more here than at the international finals, where the WSOS spreads marks across all eight sections.

The national final also counts towards Team UK. Training managers watch age-eligible finalists and can invite the strongest into the squad (squad and team selection).

---

National Expectations

At the national level, you are expected to:

• Complete multi-step exploitation chains (recon → exploit → pivot → extract)
• Use tools with advanced flags and customisation
• Identify less obvious vulnerabilities requiring enumeration
• Produce detailed documentation with technical explanations

New compared to regional:

• Fewer explicit instructions - you must infer the attack path
• More complex environments - multiple machines, network segmentation
• Defensive + offensive skills combined - secure one system while attacking another
• Time pressure - tasks must be completed faster than at regional level

---

Infrastructure hardening and secure coding

What you need to know (beyond regional)

Topic	Anchor Link	Priority
SELinux/AppArmor configuration	Advanced Linux Hardening	HIGH
Group Policy hardening (Windows)	Active Directory Hardening	HIGH
Secure coding: XSS prevention	Secure Coding Fundamentals	MEDIUM
Database encryption at rest	Data Protection	MEDIUM

Competency checklist

• Configure SELinux policies to restrict service access
• Deploy AD Group Policy to enforce password complexity and lockout
• Fix reflected XSS in application code (output encoding)
• Implement TLS 1.3 with strong cipher suites
• Configure Linux audit daemon (auditd) for security monitoring

---

Digital forensics

What you need to know (beyond regional)

Topic	Anchor Link	Priority
Memory forensics: process injection detection	Memory Forensics	HIGH
Timeline analysis from multiple log sources	Log Analysis	HIGH
Registry forensics (UserAssist, ShimCache)	Windows Artifacts	MEDIUM
Network forensics (PCAP analysis)	Network Forensics	MEDIUM

Competency checklist

• Detect malware in memory dump using Volatility (malfind, psxview)
• Correlate Windows Event Logs + IIS logs + firewall logs into timeline
• Extract executed program history from UserAssist/ShimCache
• Analyse PCAP to identify exfiltration or C2 traffic
• Recover encrypted data using extracted keys

---

Offensive operations (red team CTF)

What you need to know (beyond regional)

Topic	Anchor Link	Priority
UNION-based SQL injection (manual, no sqlmap)	SQL Injection	HIGH
Active Directory enumeration (BloodHound)	AD Attacks	HIGH
Advanced Linux privilege escalation (SUID, capabilities)	Linux PrivEsc	HIGH
File upload vulnerabilities	Web Exploitation	MEDIUM
Reverse shells and persistence	Post-Exploitation	MEDIUM

Competency checklist

• Extract database content using UNION SELECT manually
• Map AD attack paths using BloodHound
• Exploit SUID binary to escalate to root
• Upload web shell via unrestricted file upload
• Establish reverse shell and maintain persistence

---

Defensive operations (blue team)

What you need to know (beyond regional)

Topic	Anchor Link	Priority
Advanced incident response (containment strategy)	IR Fundamentals	HIGH
SIEM rule creation and tuning	SIEM Basics	HIGH
Threat hunting with IOCs	Threat Hunting	MEDIUM
Network segmentation under attack	Live Response	MEDIUM

Competency checklist

• Isolate compromised host while maintaining business continuity
• Create SIEM rule to detect specific attack pattern
• Hunt for IOCs across multiple systems using logs
• Deploy emergency firewall rules to segment network
• Write detailed incident report with root cause analysis

---

Study Strategy

Focus Areas

1. Speed and automation - Build scripts for repetitive tasks (enumeration, log parsing)
2. Manual exploitation - Don’t rely on automated tools; understand the underlying techniques
3. Multi-system thinking - Practice pivoting between multiple machines in a network
4. Documentation discipline - Write clear, concise reports under time pressure

Practice Routine

• Weekly: Complete one full 4-day mock competition (16 hours total)
• Daily: 1-2 hour focused drill on weakest area
• Monthly: Review past test projects and analyse marking schemes

---

Common Mistakes

National-Level Pitfalls

Tool dependency Sqlmap/Metasploit may be blocked or unavailable. Know manual exploitation.

Incomplete enumeration Missing a secondary vulnerability because you stopped after finding the first one.

Poor time management Spending 2 hours on a 10-point task while ignoring a 30-point task.

Weak documentation Screenshots without explanation, or explanations without proof.

---

Progress Tracking

• Consistently place top 3 in mock competitions
• Can complete nationals-level tasks in 60% of allocated time
• Comfortable with manual exploitation (no reliance on automated tools)
• Can write incident reports meeting professional standards
• Understand all HIGH priority topics at depth

---

Next Steps

• Compete at nationals
• If selected for squad/team training: Squad Selection Roadmap
• Continue deepening knowledge in weak areas