Rules & code of conduct

>_ Rules

Read this page before you start. By registering, you accept these rules.
ccmc@ctf: ~/rules 
ccmc@ctf:~$ cat tldr.txt
1 work alone: no sharing of flags, hints or solutions
2 attack only what the challenges tell you to attack
3 never touch the scoreboard, the server or other players
4 one account per person
5 flag format: flag{...}   (case-sensitive, no spaces)
6 play fair and respect everyone

01Eligibility and registration

  • The competition is open to students of the university and to any other participants explicitly invited by the organizers.
  • Register with your institutional email address. The organizers may ask you to confirm your identity.
  • You must provide accurate information. Accounts that do not respect the registration conditions may be removed.
  • Organizers and challenge authors may not compete for prizes.

02Individual participation

  • This event is individual. Each participant plays alone, with one account only.
  • Do not share flags, hints, solutions, code or partial results with anyone during the event, in private or in public.
  • Do not let another person use your account, and do not use anyone else's.
  • Do not publish write-ups or discuss solutions before the organizers announce that the event is over.

03Scope: what you may attack

You may only work on the files and the addresses given in the challenge descriptions. Everything else is out of scope.

Out of scope, and forbidden to attack or scan:

  • The CTF platform itself (website, login, scoreboard, API) and its server.
  • The university network, other servers, and the personal devices or accounts of other people.
  • Any service that is not explicitly listed as a challenge target.

04Forbidden actions

The actions below lead to penalties up to disqualification.
  • Denial-of-service, flooding, or any automated traffic that disturbs the platform or a challenge service.
  • Brute-forcing flags, login forms of the platform, or other participants' accounts.
  • Attacking, harassing or deceiving other participants or organizers (including social engineering).
  • Creating several accounts, or using automation to register accounts.
  • Exploiting a bug in the platform for points. If you find a platform vulnerability, report it privately to the organizers and do not exploit it.
  • Damaging a shared challenge service for others (for example by deleting data or by keeping it overloaded).
  • Publishing flags, challenge files or solutions while the event is running.

05Flags and submissions

  • Flags have the format flag{...} and are case-sensitive. Do not add spaces before or after the flag.
  • Copy the flag exactly. If a challenge states a different format, the challenge description applies.
  • The platform limits the number of wrong submissions per minute, and some challenges have a maximum number of attempts. Guessing flags in bulk is not allowed.
  • A flag you find in a challenge you were not supposed to attack, or outside the challenge files and addresses, does not count and must be reported.

06Scoring and ranking

  • The competition lasts 96 hours. The start and end times shown by the platform are final.
  • Scoring is dynamic: the value of a challenge decreases as more participants solve it, down to a minimum value. Points already earned are adjusted automatically.
  • Some hints cost points. The cost is shown before you unlock the hint.
  • Ties are broken by the time of the last correct submission: the participant who reached the score first ranks higher.
  • The organizers may freeze the scoreboard during the last hours of the event. The final ranking is published after verification.

07Support and communication

  • Use the official support channel announced by the organizers for questions and problems.
  • If a challenge needs a clarification, the answer is announced to everyone, so nobody gets an advantage.
  • Organizers will never give flags or solutions. Please do not ask.
  • Report broken challenges and technical problems privately, with the challenge name and what you observed.

08Tools and AI assistants

  • Public security tools, documentation, search engines and your own scripts are allowed.
  • AI assistants may be used to learn concepts and to help you analyze challenge material, but you remain responsible for your solutions. You may be asked to explain how you solved a challenge.
  • Never give a challenge service, the platform or any out-of-scope system to an automated tool for attacking.
  • Using tools to share flags or solutions with other participants is cheating.

09Fair play and penalties

Decisions are taken by the organizers, based on evidence from the platform logs, and applied consistently.

LevelExamplesPenalty
MinorSharing a hint, careless handling of a shared challenge serviceWarning
ModerateSharing flags, using someone else's solution, repeated warningsRemoval of points
SeriousAttacking the platform or other participants, multiple accounts, denial-of-serviceDisqualification and a report to the university when required

10Technical problems and outages

  • The organizers work to keep the platform available during the whole event, but cannot guarantee it.
  • If the platform is unavailable for a significant time, the organizers may extend the event or adjust scores.
  • The organizers may fix, replace, hide or re-score a broken challenge, and will announce the change to everyone.
  • Connectivity problems on your side are your responsibility. Download the challenge files early and keep your work saved locally.

11Appeals

  • If you disagree with a decision, send a written appeal to the organizers through the official support channel within 24 hours of the decision or of the results announcement.
  • An organizer who was not involved in the original decision reviews the appeal. The decision after review is final.

12Privacy

  • To run the event, the platform stores your username, email address, IP address, password hash and submission history.
  • This data is used only to organize the competition, ensure fair play and contact participants.
  • The scoreboard shows usernames, not real names. Choose a username that does not reveal more than you want.
  • Data is kept for the duration of the event and for a limited period afterwards, then deleted or anonymized.

13Prizes and verification

  • Top-ranked participants may be asked for a short written or oral explanation of their solutions before prizes are awarded.
  • Refusing to explain, or an explanation that does not match the solutions, may lead to removal from the ranking.
  • Organizers may update these rules to clarify a situation. Updates are announced to all participants.
I accept the rules, register

Questions about the rules? Ask the organizers through the official support channel.