Rules of engagement

These are not guidelines. Breaking any of them means disqualification.

Scope

Within a challenge, anything that is not explicitly placed out of scope is fair game. That is where the flag is hidden, and finding it is the job.

Everything else is always out of scope. If it is not part of the challenge you are working on, leave it alone.

Stop at the flag

Go as far as you need to go to find the flag, and no further. Once you have it, you are done with that target. Continuing past the flag is not extra credit; it is a rule violation.

Not allowed

No brute forcing and no automated attack tooling. No password guessing at volume, no directory or parameter fuzzing, no vulnerability scanners. Every challenge here is solvable by understanding it. If you find yourself reaching for a wordlist, you have misread the puzzle.

No social engineering. Not against the crew, not against each other, not against anyone at all. No pretexting, no phishing, no talking your way into something.

No attacking the platform. This portal, the scoreboard, the accounts and everything that runs them are out of scope, permanently. The same goes for any infrastructure that is not a challenge target.

No attacking other participants. Not their accounts, not their machines, not their progress. Other crews are competitors, not targets.

No AI. Do not use language models or AI assistants to solve challenges, and do not hand the work to an agent. The point is what your crew works out together.

Your own data

Never enter real information about yourself or your employer. No real names, no corporate email addresses, no internal hostnames, no company data — not in your team name, not in a flag submission, not in chat.

This platform is pseudonymous on purpose. Do not undo that.

Found something we did not plan?

If you find a vulnerability that is clearly not part of a challenge — in the platform, in a challenge that breaks in an unintended way, or anywhere in between — report it to the crew and do not exploit it.

That is not a trap and it costs you nothing. It is the difference between a security professional and the other kind.

Consequences

Breaking these rules disqualifies your crew. There is no warning system and no appeal.