Hackout CTF
Rules of Engagement

The contest

  • Format: individual. Each participant plays with their own account.
  • Where and when: on site at Aula ETTI, Politehnica București · bd. Iuliu Maniu 1-3, on 29.10.2026. The contest window (start and end) is shown on the event page, in Romania time.
  • Check-in: register online or on site, then confirm your registration at the check-in desk. An organizer approves your registration and you can open the challenges right away, without logging in again.

Challenges and points

  • Each challenge has one or more tasks. Every task has its own points, shown next to it.
  • Flag tasks: submit the answer in the field under the task. Flags look like [FLAG FORMAT, e.g. HACKOUT{...}] unless the task says otherwise. Points are awarded once per task, the first time you submit a correct answer.
  • Report tasks: upload one PDF report. It is graded by an AI model against criteria written by the organizers, and the organizers can review and correct any score. You can upload only once per task, so check your file before you send it. If something went wrong with your upload, talk to an organizer.
  • Some challenges may be hidden at the start and published during the contest.
  • After the end of the contest window, no answers or reports are accepted.

Ranking and tie-break

  • The scoreboard ranks participants by total points.
  • On equal points, whoever reached that score first ranks higher, that is, the participant whose last scoring answer came earlier. For report tasks, the time that counts is the moment you uploaded the report, not when it was graded.
  • The scoreboard shows your nickname only.

Allowed and not allowed

Allowed:

  • Any tools, scripts and references you like, unless a task says otherwise.
  • AI ASSISTANTS: allowed

Not allowed, and a reason for disqualification:

  • Attacking the platform itself (the website, its server or database), other participants, or anything outside the targets named in a task.
  • Denial of service, mass scanning of infrastructure that is not a target, or brute-forcing the answer field. The platform limits how fast you can submit.
  • Sharing flags, solutions or reports with other participants during the contest, or playing with someone else's account.
  • Submitting a report you did not write, or a report that tries to manipulate the grading (for example hidden text asking for full points). Such reports get 0 points.

Help and decisions

  • If you find a bug in the platform or a broken task, tell an organizer right away instead of exploiting it.
  • Forgot your password? Use Forgot password? on the login page, or ask at the check-in desk.
  • Organizers may correct scores, add accepted answers to a task, or extend the contest window. Their decisions are final.