CTF Details

Capture the Flag Competition Official Rules

WHO MAY ENTER:

Open only to legal residents of the fifty (50) United States and the District of Columbia who are 17 years of age or older and who are registered for Competition in CyberForge 2025 (Capture the Flag), in Newport News, Virginia March 23, 2025 . Partners, principals, and employees of Deloitte Consulting LLP and its subsidiaries are not eligible to enter and win. Federal, state and local government officials and employees may enter but may not win a prize.

Note: In order to be eligible to win a prize, you must be a current student AND 17 years old or older.

COMPETITION OBJECTIVE:

The objective of the Competition is to solve practical cyber challenges in a simulated environment. The goal of each challenge is navigate through scenarios and submit responses to the Sponsor’s on http://us.hackazon.org/ (the “Website”) in order to receive points. Challenges award varying amounts of points depending on difficulty. 

HOW TO PARTICIPATE: 

Eligible participants must form a team of no more than four (4) people as provided below. An individual may not participate in the Competition on more than one team. Each individual team member must complete registration for the Competition by March 7, 2025 to participate in the Competition via online conference registration link.

For the purpose of these Official Rules, a participating individual and a participating team will each be referred to as a “participant.” 

CAPTURE THE FLAG COMPETITION 

The Competition is an in person event and will begin on March 23, 2025 at 10:00 a.m. Eastern Time (“ET”) and conclude on March 23, 2025 at 3:00 p.m. ET (“Competition Period”). Check-in will begin at 08:00 am and opening remarks will begin at 09:00 am ET.

REGISTRATION 

• Participants are responsible for providing their own computers or laptops for the competition. Laptops must be capable of connecting to an unsecured Wi-Fi network or an Unsecured Ethernet Link. Administrative Privileges are recommended. Participants must provide their own Power Strips and Extension Cords. 

COMPETITION STRUCTURE 

The Competition will be completed in one continuous event in one day during the Competition Period (with breaks as designated by the Event organizer as required). The participants with the most amount of points at the end of the Competition Period wins. The scoreboard is automatically updated on the Website to reflect the current state of the Competition. The scoreboard will reflect the final rankings when the Competition Period ends. The initial kick off will occur on March 23, 2025 at 10:00 a.m. ET and ends at 3:00 p.m. ET on March 23, 2025. Top three (3) scoring participants per the scoreboard on the Website will be announced as 1st, 2nd, and 3rd place winners in person. In the event of a tie for points, the fastest participant wins.

Ground rules: 

• No Outside Help: Participants are not allowed to use outside help during the Competition Period (i.e. no remote and/or unregistered players are allowed). Google/internet research is allowed.

• No Collateral Damage: Only attack systems for which they have explicit permission and are running in the Competition infrastructure (these will be clearly indicated) provided by the Sponsor. No attacks on any systems or equipment outside of this environment are allowed.

• Competition Area: Participants are not allowed to take any of the equipment outside of the Competition area unless explicitly permitted by the Sponsor. Also, please take any phone calls outside the area.

• Brute Forcing: Avoid generating large amounts of traffic and/or brute forcing; none of the challenges can be solved by running automated scanners, so please do not do so. This includes scanning with Nikto, Skipfish, Vega, Nessus, etc. (Nmap and Sqlmap are fine!)

• No Fratricide: Sabotaging or in any way hindering the progress of other participants is not allowed. This includes attempting to alter or disrupt a challenge or service after you have completed it.

• One Team/Multiple Challenges: Each participant may work on multiple challenges at one time, with some restrictions, based on the portal backend software.

• Challenge Progression: Challenges may be attempted in any order. If you are stuck on a challenge, move on to a different challenge.

• Bring Your Own Attack Platform: All teams need to bring their own attack platform(s). We recommend Kali Linux, but this is not a requirement.

• Team Swaps: Team swapping is not allowed for this event. Sponsor reserves the right to disqualify any participant for any reason, in its sole and absolute discretion. Sponsor reserves the right to remove any participant from the Competition who does not conform to the ground rules for any reason, in its sole and absolute discretion. Sponsor reserves the right in its sole discretion not to choose winners for the Competition. The decisions of the judges and Sponsor are final and binding on all matters.