CTF Categories and Rules

1. Competition format

This is a jeopardy-style CTF. 

Challenges are organised by category, with points varied based on difficulty. 

Teams may attempt challenges in any order, unless otherwise specified. Every challenge stands on its own — nothing is locked, and there is no required order of progression. 

1.1. Dynamic scoring

Each challenge has: 

• a base score when unsolved 

• a minimum score floor

• The score awarded decreases as more teams solve that challenge. 

• Scores never drop below the minimum. 

There is no first-solve bonus. Every team that solves a challenge ends up with the same score for it — the challenge's final value once all solves are in. Solving first does not earn extra points. 

This differs from static scoring, where each challenge is worth a fixed amount decided in advance. Here the teams playing determine what a challenge is worth: if only a handful of teams crack it, it stays worth a lot, and if almost everyone gets it, its value settles toward the floor. The intent is to reward skill and persistence, not speed. Take the time you need on the hard ones. 

2. Use of AI tools is permitted

• AI tools are permitted as learning aids. AI use does not exempt teams from the requirement to demonstrate meaningful human understanding and engagement with the solve. 

• You must understand your own solution and be able to explain it if asked — the solve path, the observations that mattered, and why the approach worked. 

• The organising team may issue additional guidance on AI use during the event. Any such guidance will be posted in the Discord and applies from the time it is announced. 

3. Prizes

First place — CREST Practitioner Security Analyst (CPSA)

 examination vouchers

The top team on the final scoreboard receives four CREST CPSA examination vouchers, one per team member, generously provided by CREST International. 

Spirit of CTF Prize

Awarded to the team that best demonstrates learning, good sportsmanship and determination, judged by the organisers and independent of scoreboard position. A team finishing well down the standings is exactly as eligible as a team at the top. We are looking for teams who arrived knowing little and visibly worked their way up, who refused to give up on a hard challenge, or who went out of their way to help other players. 

Spot Prizes

Handed out during the event for standout moments — a clever piece of thinking, a well-earned solve, a good question, or genuine perseverance. These are weighted heavily towards new and newer CTF participants. If this is your first, second or third CTF, these are aimed squarely at you. 

4. Flag submission

• Flags must be submitted via the official platform. The standard flag format is `bsadl26{...}`; where a challenge uses a different prefix, its description will say so. 

• Flags must be obtained by solving challenges in alignment with the spirit of the competition. Brute-forcing flags or exploiting the platform itself to reveal them is prohibited. 

• Do not publicly disclose solutions, flags, write-ups, walkthroughs, or challenge-specific hints until after the event is over. 

• Unintended solve paths may be patched without notice during the event. 

4.1. No flag hoarding

Submit flags as you solve them.

Flag hoarding — deliberately holding solved flags and dumping them onto the scoreboard near the end of the event to manipulate the standings — is against the rules. The live scoreboard is what other teams use to gauge how they are going, and what organisers use to judge which challenges need a hint. Deliberately distorting it is unsportsmanlike. 

The scoring gives you nothing for doing it, since every team that solves a challenge receives the same score for it regardless of when they submit. 

Any instance considered obvious and malicious will result in disqualification from prizes. This targets deliberate manipulation, not a team who saved up a couple of solves over a coffee break. 

5. Scope of activity

Only interact with systems explicitly provided. 

Do not attack: 

• the scoring platform 

• infrastructure outside scope 

• other teams 

Specific external help from non-participants or non-team-members is against the rules. 

General learning and reference use is allowed. 

Scope clarifications included in challenge descriptions are authoritative. 

For example, you may: 

• ask someone to remind you how a specific feature of a technology works or consult public documentation. 

You may not: 

• send the problem statement, challenge files, service endpoint, or solve context to a friend, colleague, or external expert and ask them to solve it for you.