What is Capture The Flag?

Capture the Flag is a family of competitive games involving opposing teams trying to steal something of value from each other. In computer security, the flag is typically a piece of secret data, and the territory from which it is captured is a computer system controlled by the opponent. There are two popular formats for computer security Capture the Flag (CTF) games: Jeopardy-style and attack/defense.

Jeopardy-style CTF games have the organizers running a set of challenges that each team has to solve for points. This format is popular because of the relatively simple logistics, especially for online games. Challenges are generally independent from each other and ideally idempotent between connecting players, which leads to reliability and stability for large contests. Scoring is nice and simple too: add up the points for solved challenges, and use timing of solutions to break ties. The DEF CON Qualifier has traditionally been a Jeopardy-style game: the engineering and operations work that goes into a game for over a thousand teams isn’t easy by any means, but it’s not difficult either.

Attack-defense CTF games are more similar to CTF in other contexts: the opposing teams themselves control their flags’ defenses, and the organizers merely create and referee a fair playing field. Attack-defense CTFs generally have each team defending one or more vulnerable services, with the ability to attack other teams’ identical services over a network. This game typically requires more work to engineer and operate because the way teams interact with the underlying game systems and each other is much more complex and open to finding weaknesses with the rules of the game itself.

For instance, by destroying a system’s availability to process benign requests (i.e. taking it offline) you can completely rule out processing malicious requests that would compromise confidentiality or integrity. Organizers have to build, run, and score availability checks to require defenders to run potentially-attackable services, otherwise attackers won’t ever have the opportunity to attack a vulnerable service.

Modern computing environments have much more powerful defenses available: defenders can and have used virtualization to protect flags in memory, system call blacklisting to protect flags on disk, and other so-called “superman defenses.” Ruling these out to force defenders into a narrowly-defined set of “acceptable defenses” takes considerable organizer effort.

DEF CON Finals is traditionally an attack-defense game. The antagonistic nature of the game becomes a complex test of time management, creativity, and the skills involved with computer hacking that isn’t available in any other legal venue.

There are other kinds of CTF that can be run: some of us have played a game that could best be described as "king of the hill," and the DARPA Cyber Grand Challenge uses a format called "consensus evaluation." The latter will be discussed more here soon, as there are implications for the future of DEF CON CTF there too.

Registration for 2016 Qualifiers Open Now

It's your favorite time of year again: the day registration for DEF CON Capture the Flag Qualifiers opens! Grab your friends, the hilarious joke team name you thought of fifteen minutes before last year's game ended, and your favorite password manager, and bring them down to the quals site.

Visit https://2016.legitbs.net/ to register for DEF CON CTF Qualifiers.

Announcing DEF CON CTF 2016 Qualifying Contests

We are pleased to announce the qualifying events for DEF CON CTF 2016! We've spent a great deal of time reviewing a record number of proposals, and had to make some very difficult choices. We'd like to thank everyone in the CTF community who took the time to send us proposals: even if we weren't able to accept your proposal, your contest is important to us and the larger CTF community.

Without further ado, the qualifying contests, in order of start date:

Event Start Date End Date Link Notes
DEF CON CTF 2015 May 16, 2015 August 9, 2015 https://legitbs.net/ Qualified DEFKOR
HITCON CTF October 17, 2015 December 6, 2015 http://ctf.hitcon.org/ Qualified Cykorkinesis
RuCTFE November 21, 2015 November 21, 2015 https://ructf.org/e/2015/ Qualified StratumAuhuur
SECCON CTF December 5, 2015 January 31, 2016 http://ctf.seccon.jp/ Online Jeopardy quals, finals on-site in 2016
32C3 CTF December 27, 2015 December 29, 2015 https://32c3ctf.ccc.ac/ Online Jeopardy style
Boston Key Party March 4, 2016 March 6, 2016 http://bostonkeyparty.net/ Online Jeopardy style
0ctf March 12, 2016 April 24, 2016 https://ctf.0ops.sjtu.cn/ Online Jeopardy quals, finals on-site in 2016
PlaidCTF April 15, 2016 April 17, 2016 https://twitter.com/plaidctf Online Jeopardy style
DEF CON CTF 2016 Qualifiers TBA TBA https://legitbs.net/ Online Jeopardy style, qualifying multiple teams
DARPA Cyber Grand Challenge August 4, 2016 August 4, 2016 http://cybergrandchallenge.com/ All-machine competition!!! On-site in Las Vegas

Want to qualify for DEF CON CTF?

The only way to qualify is through competition! Most qualifying teams compete in every contest they can, including CTF events that aren't prequalifiers, to learn the flow of the game and the experience of solving challenges.

Qualified Teams:

We will be in contact with you soon!

Updated Feb. 3, 2016

Adjusted the date for 0ctf to March 12, 2016.

How to be a DEF CON CTF 2016 Qualifying Competition

There are several ways to qualify for DEF CON Capture the Flag 2016: win DEF CON CTF 2015 (congratulations DEFKOR!), qualify through DEF CON CTF 2016 Qualifiers (more news on this in 2016), or win a "qualifying competition." If you run a Capture the Flag or other computer security competition and want to have your winners move on to DEF CON finals, you can become a DEF CON CTF 2016 Qualifying Competition!

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119.

Running a Competitive Competition

DEF CON CTF competitors are the best in the world. When less-qualified teams compete, they don’t enjoy the game, and don’t provide a lot of enjoyment for other teams either. Therefore, we must ensure  only the most qualified teams are invited. Our standards are as follows:

  1. Your competition MUST be open to all. You MUST NOT restrict entry or winning to students or professionals. You MAY structure your game with separate qualifying and finals events.
  2. You MUST NOT charge a fee to competitors, except for normal admission to a conference.
  3. Your competition MUST allow teams of at least four people.
  4. You MUST publish a final scoreboard within seven days of competition ending.
  5. You MUST be able to privately share the winning team’s contact information with us within seven days of competition ending.
  6. You MUST NOT publish personal information about competitors without consent.
  7. You MUST NOT require consent to publish personal information from competitors or winners.
  8. You MUST NOT announce DEF CON CTF qualifying status prior to a Legitimate Business Syndicate announcement of same.
  9. You MUST either have run a competition previously, or be willing to share details and challenge samples with Legitimate Business Syndicate prior to approval.
  10. Your competition MAY have both offensive and defensive components.
  11. Your competition MAY be either online or local/in-person, or both!

If you don’t or can’t meet these requirements, please don’t ask for an exception. It’s possible we might not be a good fit for your competition as designed, and we don’t want to force you to compromise how you run your event.

Sending a Proposal

Send us an email to [email protected] before Midnight, Dec. 1, 2015 (1449014400) with answers to the following questions:

  1. Who is your group?
  2. What is your game named?
  3. Where and when are you hosting it?
  4. How do you design and build challenges?
  5. What’s your favorite vulnerability or exploit (CVE-number or well-recognized name)? Why?
  6. Do you have a favorite CTF challenge or service? How did you solve it?
  7. How do you plan to handle cheating?
  8. Have you or members of your team ever organized a CTF before? Provide details.
  9. Have you or members of your team participated in a CTF event? Provide details.
  10. How many people are involved in the following: challenge writing, game design, infrastructure, and support?

The earlier we get your submission, the earlier we'll read it and form a concrete opinion. Slots are limited. Expect a response by Dec. 9, 2015.

Rules, Disclaimers, and Caveats

  1. Legitimate Business Syndicate may terminate your qualifying event status at any time for any reason, including reasons not covered in this document.
  2. Competitions that publicly publish personal information about competitors will be forbidden from being qualifying events.
  3. Competitions that announce their qualifying event status before a Legitimate Business Syndicate announcement of their status will be forbidden from being qualifying events.
  4. Legitimate Business Syndicate reserves the right to use your competition’s name, logo, and description in promotional materials.
  5. Legitimate Business Syndicate will not use your or your competitors’ contact information for anything besides internal decision-making and official game communication.

All qualifying competition decisions made by Legitimate Business Syndicate members are final.

DEF CON CTF 2015 Score Data Releases

We're releasing several pieces of scoring data today, ready to download and analyze as you see fit.

Finals Visualizer

We've replayed all the redemption events from DEF CON CTF 2015 Finals into this YouTube video for your viewing pleasure.

Qualifiers Data Dump

Much like our 2014 data dump, this release includes JSON dumps of categories, challenges, notices, teams, and limited user information, and more importantly, offline-browsable HTML pages about teams, challenges, and more!

Download the DEF CON CTF 2015 Qualifiers data dump from https://files.legitbs.net/statdump_2015.tar.bz2, and verify its cryptographic signature using Vito's previously-published public key.

Finals SQL Dump

Want to get exhaustive detail about scoring in DEF CON CTF finals? This Postgres 9.4.1-compatible SQL dump file is what you want.


  1. Have PostgreSQL 9.4.1 or newer installed. 9.3 or older may work but has not been tested.
  2. OPTIONAL: verify that you downloaded an official dump. More instructions below.
  3. Create a database named scorebot-2015. From the command line: createdb scorebot-2015
  4. Load the pgdump file into the database: pg_restore -d scorebot-2015 scorebot-2015.pgdump
  5. Query it:
    > psql scorebot-2015
    psql (9.4.3)
    Type "help" for help.
    scorebot-2014=# select id, name, dupe_ctr from teams order by name asc;
     id |             name              | dupe_ctr
      9 | !SpamAndHex                   |        0
     12 | 0daysober                     |     2289
     11 | 0ops                          |        0
      6 | 9447                          |     1549
      2 | Bushwhackers                  |        0
     10 | CORNDUMP                      |        0
      5 | DEFKOR                        |       11
     13 | Dragon Sector                 |        4
      7 | Gallopsled                    |        0
      4 | HITCON                        |        0
     15 | LC↯BC                         |        1
     16 | Legitimate Business Syndicate |        0
      1 | Plaid Parliament of Pwning    |    18441
      3 | Samurai                       |        0
     14 | Shellphish                    |        0
      8 | blue-lotus                    |        0
    (16 rows)

Validating and Verifying These Dumps

Once you've downloaded the dump files, you can check its signature against Vito's public GPG key.

  1. Obtain Vito's public key from this blog, Keybase.io, or the MIT Public Key Server .
  2. Install the key in your GPG keychain.
  3. Run gpg --verify scorebot-2015.pgdump.sig. You should see output similar to:
    > gpg --verify scorebot-2015.pgdump.sig
    gpg: assuming signed data in 'scorebot-2015.pgdump'
    gpg: Signature made Fri Aug 28 20:04:57 2015 EDT using RSA key ID C81CA674
    gpg: Good signature from "Vito Genovese " [unknown]
    gpg:                 aka "keybase.io/vito " [unknown]
    gpg: WARNING: This key is not certified with a trusted signature!
    gpg:          There is no indication that the signature belongs to the owner.
    Primary key fingerprint: 3D67 0192 A797 5173 646C  79D3 B07D 6161 43CA A77B
         Subkey fingerprint: D586 0919 7A9F 6055 BF1D  F3E9 18A0 1190 C81C A674

2015 DEF CON CTF Final Scores

We are pleased to announce the 2015 DEF CON Capture the Flag final scores.

Team NameFinal Score
Plaid Parliament of Pwning19896
Dragon Sector11288

How Scoring Worked

Before game start, we had a set of regular game services (that might or might not ever be enabled), and two LiveCTF services. Each team has an instance of a service (15+1 teams, 11 services, 176 instances), and every non-legitbs instance was given 1337 flags, for a total of 220,605 flags in the game. Ignoring the never-scored services and LiveCTF, (15 teams * 6 services * 1337 flags =) 120,330 flags were in play.

Similar to 2014, failing availability would cause a team to lose 14 flags divided evenly among their opponents. Getting owned (having a token stolen and redeemed) would also cause a team to lose 14 flags divided evenly among the teams that redeemed the token, with any remainders assigned to us until enough remainder existed to dole out to all the teams scoring that service.

LiveCTF was scored differently. The first team to finish LiveCTF qualifiers (DEFKOR) received 600 flags, and the next two teams (LC↯BC and PPP) received 300 and 200 flags, respectively. The other teams that finished (0daysober, Samurai, Shellphish, HITCON, and 9447) received 100 flags each. LiveCTF finals awarded 1000 points to the first team finishing, PPP.

Breakdown by Service

team \ servicerxcirkdtachikomaombdsuhackermudbadloggerlivectf_qualslivectf_finals

But Wait, There's More!

We have more releases planned in the coming days and months:

End of August, 2015
Supplemental scoreboard material: 2015 Quals data dump, 2015 Finals visualization, 2015 Finals SQL dump
End of November, 2015
2014 and 2015 Quals and Finals services


Thanks to everyone who made DEF CON 23 CTF our best game yet: DEF CON goons, DEF CON staff, our fifteen finalist teams, the Capture the Flag community around the world, and everyone who came by our contest area to experience CTF first-hand! See you all in 2016!

DEF CON 23 Finalists

Congratulations to the following teams, who have qualified and accepted spots in the DEF CON 23 Capture The Flag.
Team NumberTeamQualifying Event
1Plaid Parliament of PwningDEF CON CTF 2014 Finals
3SamuraiGhost in the Shellcode
4HITCONBoston Key Party
69447DEF CON CTF Qualifiers
7GallopsledDEF CON CTF Qualifiers
8blue-lotusDEF CON CTF Qualifiers
9!SpamAndHexDEF CON CTF Qualifiers
110opsDEF CON CTF Qualifiers
120daysoberDEF CON CTF Qualifiers
13Dragon SectorDEF CON CTF Qualifiers
14ShellphishDEF CON CTF Qualifiers
15LC↯BCDEF CON CTF Qualifiers
We look forward to seeing everybody out in Las Vegas. Even if you didn't qualify for our game, we hope to see anybody interested in CTF in our room, in the corner of the Bally's Event Center.