Competition Rules

Participation Rules

• Individual Participation Only: This CTF competition is strictly limited to solo participants. Team participation is not permitted.

• Registration: All participants must be registered before the competition starts. No changes allowed after registration closes.

• Account Security: Each participant must use only one account. Sharing credentials is prohibited.

• Pass Requirement: Every participant must possess a valid CSA XCON 2026 Standard Pass (minimum) purchased from KonfHub.

• Bring Your Own Device: Participants are required to bring their own laptops and chargers. Devices will not be provided at the venue.

Competition Rules

• Flag Format: Unless otherwise specified, flags follow the format: CSAxCON{...}

• No Flag Sharing: Sharing flags, hints, or solutions with other participants is strictly prohibited and will result in immediate disqualification.

• No Attacking Infrastructure: Do not attack the scoring system, other participants, or any systems not explicitly part of the challenges.

• Brute Force Limits: Automated brute force attacks against challenge services are limited. Rate limiting may be in place.

• Duration: The CTF runs for 48 hours. All flag submissions must be made within the competition timeframe.

Scoring System

• Dynamic Scoring: Challenge points decrease as more participants solve them. Early solvers earn more points.

• Time-based Tiebreaker: In case of a tie, the participant that reached the score first wins.

Code of Conduct

• Respectful Communication: Be respectful to organizers, other participants, and sponsors in all interactions.

• Fair Play: Use only ethical hacking techniques. Do not use exploits that could damage systems or data.

• Report Issues: If you find vulnerabilities in the infrastructure or encounter issues, report them to organizers immediately.

• Organizer Decisions: All decisions made by the organizers are final. Appeals can be made through official channels only.

Disqualification Criteria

• Flag Sharing: Sharing flags or solutions with other participants results in immediate disqualification.

• Infrastructure Attacks: Attacking CTF infrastructure, scoring systems, or other participants will result in immediate disqualification.

• Unregistered Participants: Participants who do not have valid CSA XCON passes will be disqualified.

Frequently Asked Questions