Capture The Flag competitions, run properly.
Jeopardy boards and attack–defense arenas with live scoreboards, first-blood alerts and seasonal standings. Enter solo or bring a team, on infrastructure that spins a fresh, isolated copy of every challenge for each competitor.
Past events
2OFFCON 2026.2
OFFCON Ultimate Cybersecurity competition to buildup hands-on skills with prizepool of 30,000 PKR
- Starts
- Challenges
- 15 challenges
- Team size
- Teams up to 4
OFFCON 2026.2 MOCK DRILL
OFFCON 2026.2 mock drill to learn how to perform a ctf on offensiveconditions.org platform
- Starts
- Challenges
- 1 challenges
- Team size
- Teams up to 4
The formats we run
Jeopardy
A board of challenges across web, pwn, reverse engineering, crypto, forensics and OSINT. Solve what you can, in any order. Points fall as more teams solve a challenge, so the board rewards the people who got there first.
Attack–defense
Every team gets the same vulnerable services and has to patch their own while exploiting everyone else's. Scoring runs in ticks: you hold points for staying up and take them for every flag you steal.
Waves
Challenges unlock in timed rounds rather than all at once, so a team that stalls on one category is not locked out of the rest of the event.
Seasons
Event results roll into a seasonal ladder with a quarter of your score carried into the next season, so a strong run keeps counting after the event ends.
Head-to-Head
Two players or two teams, the same challenge, one clock. Whoever produces the flag first takes the round. Runs as a bracket, so a match is over in minutes and a tournament resolves to a single winner instead of a leaderboard.
Showdowns
Live, spectated elimination rounds built for an audience. Short timed matches, a shoutcast-style scoreboard, and first-blood decides it — the format we run on stage at the conference and at campus events.
King of the Hill
Everyone attacks one shared machine. Break in, plant your flag, and hold root — you score for every tick you stay king while the rest of the field tries to evict you and take the crown. Persistence and patching matter as much as the initial exploit.
Host your own
Universities and societies, companies and communities run their own CTF on OFFCON — public or invite-only, with team registration, per-team instances, a live scoreboard and the same cheat-resistant flags. No infrastructure to stand up: get in touch and we set the event up with you.
Sharing a flag gets you nowhere
Flag leaking and trading is a problem even the biggest CTFs never fully solve — one team roots a box, the flag ends up in a group chat, and the scoreboard stops meaning anything. On OFFCON it means nothing, because a flag is only ever valid for the instance and the team it was minted for.
A random flag per instance
Every team spawns its own private copy of a challenge, and its flag is generated the moment that instance starts — straight from the operating system's cryptographic random source. It is never reused and never guessable from the challenge.
The flag never leaves your instance
The platform stores only a SHA-256 hash of the flag, never the flag itself. The only place the real value exists is inside your running instance — there is nothing on the server to leak, and nothing to look up.
Bound to the team that earned it
Submit a flag another team was given and it is rejected — it was valid for their instance, not yours. Machine challenges go further still: their flags are HMAC-signed against your own user and instance, so a copied flag simply does not verify.
Kill the instance, kill the flag
Tear an instance down or let it expire and its flag dies with it. The next instance mints a fresh one. There is no single “real” flag to pass around — which is exactly why passing one around is pointless.
CTF questions, answered
What is a CTF competition?
Capture The Flag is a competitive format for offensive security. Organisers hide a string — the flag — inside a deliberately vulnerable system, and you recover it by actually breaking in: exploiting a web application, reversing a binary, breaking a weak cipher, or pivoting through a network. You submit the flag, you score. It is the closest thing the field has to a sport, and it is how most professionals first learned the work.
Do I need experience to enter my first CTF?
No. Jeopardy events are built with a difficulty spread on purpose — the easiest challenges in a board are usually solvable by someone in their first month, and they exist precisely so newcomers have somewhere to start. If you would rather build a base first, the guided tracks and the easy machines cover the same ground without a clock running.
Can I compete solo, or do I need a team?
Both work. Each event decides whether it allows solo entries, team entries, or both, and the maximum team size is set per event. Solo play is listed on the event page before you register, so you know which it is before committing.
Are CTF competitions on OFFCON free?
Some are free and some charge an entry fee, and the fee is shown on the event page before you register. Paid events are typically the ones carrying a prize pool. Entry is charged once per team rather than per player, so adding someone to your roster afterwards does not cost extra.
What tools do I need?
A Linux machine — Kali or Parrot if you want everything preinstalled — and a WireGuard client to reach the lab network. Nothing beyond that is required. Challenges never depend on paid tooling.
How does scoring work?
Most events use dynamic scoring: a challenge starts at a maximum value and decays towards a floor as more teams solve it, so an early solve on a hard challenge is worth considerably more than a late solve on an easy one. First blood on a challenge carries a bonus on top. Scoreboards can be frozen near the end so the final standings stay a surprise.
Can teams cheat by sharing flags?
No — flag sharing is designed out. Every team spawns its own instance of a challenge, and its flag is generated randomly for that instance from the OS cryptographic random source; only a SHA-256 hash of it is ever stored. A flag is valid for exactly one team's instance, so a flag passed to another team is rejected. Machine challenges bind the flag even tighter, HMAC-signing it against the individual user and instance. Kill the instance and the flag dies with it — there is no shared secret to trade.