Rules
These rules apply to every team and every player, from the first minute of the prelims to the last of the finals. The organisers keep this page up to date; what is still open is listed at the bottom.
1 Who can play
- Open to all. A team has 1 to 4 members, so you can play alone or with friends. Each person plays for one team only.
- There is a beginner category for people with no experience, made to teach the basics of CTFs. The other challenges range from easy to hard to extreme.
2 Flags and fair play
- Every flag looks like L3m0n{...}: the letters L3m0n, then the secret text between curly braces. Send it exactly as you found it, braces included.
- Do not share flags, solutions or hints with anyone outside your team while the contest runs.
- Do not team up across teams, and do not use accounts or teams that are not your own.
3 Stay in scope
- Attack only the challenges you are given, and only the instances that belong to your team.
- The platform, the scoreboard, the network and other teams are not targets. Report a platform bug, do not exploit it. A bug report can earn bonus TRP, where it applies.
- No denial of service, no flooding the flag form, no scanning of hosts outside the challenge list.
4 Tools
- Normal security tools are fine inside the scope above. Do not overload challenge servers.
5 Be decent
- Be respectful to participants, volunteers and organisers. Harassment ends your run.
- The organisers may remove teams that cheat or abuse the event. Their decision is final.
6 What comes next
- More to come: the finals dates, the registration link and deadline, and the prizes will be announced on the home page and on CTFtime.
- We are listing the event on CTFtime so results count towards the global rating. Team names and final scores are shared with CTFtime; the platform privacy notice, shown before you register, has the details.