Competition format
CTF Attack-Defense: one day, one field, a live score
Every team gets an identical server with a set of services and at the same time defends its own services while exploring its rivals’. The weak spots are the same for everyone: a vulnerability found at home exists on every rival’s server too.
One event — a CTF Attack-Defense game. Points are scored every round; the result is decided by the scoreboard.
Five principles of the format
-
All in one network
Teams play against each other: what one team does changes the others’ score at once.
-
Flags
Secret data inside the services. They are renewed every round and captured from rivals.
-
Rounds
The game is played in rounds; points are scored at the end of each round.
-
Automation
Exploits run against all rivals automatically: no one keeps up with the rounds by hand.
-
Infrastructure
Each team has its own vulnerable server (vulnbox), plus a shared jury server and one game network over VPN.
Parameters of the Dubai final
- Team
- 5 athletes and 1 coach (team representative)
- Duration
- 6 hours of play
- Services
- 5 identical services per team with the very same weak spots
- Flags
- Secret strings inside the services, renewed every round; a captured flag is submitted to the jury
- Checks
- Every round the jury’s checker verifies that each service works as intended
- Language
- All materials, briefings and judging are in English
- Winner
- Decided by the final standings; results are announced on the day of the game
Jury server and team servers
Jury server flags · checker · scoreboard
Game network · VPN
- Team 1 vulnbox
- Team 2 vulnbox
- Team 3 vulnbox
- Team 4 vulnbox
- …
- Team 20 vulnbox
-
Services
Programs on the team’s server with vulnerabilities and flag storage.
-
Flags
Secret data the jury puts into the services every round.
-
Interaction
Teams explore each other’s services only inside the game network.
What happens every round
The game is a cycle of identical rounds: there are dozens of them over the six hours of the final.
-
Jury
New flags
The jury server puts fresh flags into every team’s services.
-
Checker
Service check
The checker verifies that the services work and the flags can be read.
-
Teams
Defence and exploration
Teams close vulnerabilities on their side, capture rivals’ flags and submit them to the jury.
-
Scoreboard
Score update
The round result goes into the live table.
Next round — new flags, and it all starts again. Flags from previous rounds stay valid for a few more rounds.
Three parts of the result
A team’s result for a round is made up of three parts, and the availability of its own services works as a multiplier.
-
Exploration
Plus: rivals’ flags submitted to the jury.
-
Defence
Minus: your own flags captured by rivals.
-
Availability (SLA)
Multiplier: the share of rounds in which the service had the OK status.
Service statuses
- OK
- Works, flags can be read. The only status that earns points.
- MUMBLE
- Responds, but not according to the protocol.
- CORRUPT
- Works, but old flags are lost.
- DOWN
- The service is unavailable.
You cannot switch a service off: a closed service loses points just like a broken one. The winner is the team that balances defence, exploration and uptime. The exact formula and weights are fixed in the rulebook.
Five lines of a team’s work
-
Before the start
Deploy the services, take backups and study the source code while the network is still closed.
-
Exploration
Find a vulnerability, write an exploit, run it against all rivals and submit the flags to the jury.
-
Defence
Close the vulnerability with a source or binary patch without breaking the service: a restart can cost a round.
-
Automation
A script repeats the exploits every round, collects flags and submits them in batches.
-
Traffic analysis
Analysing network captures turns rivals’ techniques into targeted patches and counter-moves.
Flags are renewed every round, so the same action has to be repeated again and again. The winner is the team that has automated both defence and exploration.
Fair play and judging
-
Panel of judges
The same rules for all teams, a record of every round and an appeals procedure.
-
Forbidden
Interfering with the game infrastructure and the jury server, overloading the network, any action outside the range, tampering with other teams’ equipment.
-
Safety
The game runs in an isolated network on the organiser’s range; only the teams’ game servers are affected. Real systems and external networks are not involved.
Competition day schedule, 12 December
Dubai time (GMT+4)
-
Opening ceremony
-
Access credentials issued, network opens
-
Game starts
-
Finish
-
After the finish
Debrief and awards
Format FAQ
How is this different from a “regular” CTF?
A “regular” CTF is a set of independent tasks. Here teams play against each other in a shared network, and the score changes every round.
Do you need to know how to program?
Yes. Exploits, patches and automatic flag submission are all code; without it a team cannot keep up with the rounds.
Why not just switch a service off?
Availability is part of the score as a multiplier: a closed service is penalised just like a broken one. You need to close the vulnerability and keep the service running.
Why automation?
Flags are renewed every round, so actions have to be repeated against every rival automatically.
What matters more — defence or exploration?
Balance. Strong exploration will not help if your own services are down: their availability multiplies the whole result.
Can you play alone?
Formally yes, but one person cannot cover five lines of work — which is why the discipline is a team one.
Is it legal?
Yes: the game runs on the organiser’s range, only the teams’ game servers are affected, and every action is described in the rulebook.