This year, HITB-XCTF GSEC CTF will again co-organized by HITB and XCTF League from China! An Attack & Defense Style CTF Competition is planned for the 30th and 31st of August alongside the conference.
The game is hosted on-site utilizing the CP-AD Contest Platform developed by CyberPeace Technology, China. Game challenges are authored by FlappyPig CTF Team, The Champion Team of 3rd XCTF International League.
For the on-site game, we have a capacity for a maximum of 16 teams (no more than 4 players per team). The game will run for 30 hours over the 2 days of the conference (30th & 31st August starting at 10:00SGT and ending at 18:00SGT on Day 1 and restarting on Day 2 at 10:00SGT and ends at 16:00SGT). The onsite contest will be hosted in the FREE TO ACCESS CommSec area of the conference. You do not need to be a paid conference delegate in order to compete.
The AD-Style HITB-XCTF GSEC CTF will use the traditional scoring rule of DEFCON CTF, i.e. “zero-sum” scoring rule.
Each team will be given the game machines that contain the same services, they need to maintain their own services, to keep them available to score server checking, and to defend them against other teams to guarantee the integrity and confidentiality of their secret flags, which will be updated each round by the scoring bot. They also need to find pre-planted or even unanticipated vulnerabilities from the services, and try to exploit the services of other teams to capture their respective flags or completely take down their service.
Each team will be assigned initial points and divided into point buckets for each service.
Integrity/Confidentiality Score Rule:
Team A’s service S was exploited and flag F was captured, then Team A’s score will be deducted by N Points – the N Points will then be divided to P pieces (P = the number of teams who successfully captured the flag F and submitted it to the score server), Teams will get N/P Points added to their score. If the point bucket of Team A’s Service S run out, then Team A will not lose points, and teams that captured the flag will not get any additional points.
Availability Score Rule:
Team A’s service S was checked and found to be down/invalid, then Team A’s score will be deducted N Points – the N Points will be be divided to Q pieces (Q = the number of teams whose service S was checked and found to be running correctly). Teams will be given N/Q Points. If the point bucket of Team A’s Service S run out, then Team A will not lose points, and other teams will not get any additional points.
We try hard to keep the competition as free and exciting as possible; however we do require teams to adhere to a few simple rules:
If you have any questions, please send an email to firstname.lastname@example.org