Eligibility
Contest Format
Prizes
Team Name
Rules
General Terms and Conditions
Useful Tools
Online Resources
How to play ?
How to view the score ?
Eligibility
The Contest is divided into 4 categories
Secondary School – Secondary School Students in Hong Kong
- All members of the participating team must come from the same school and must be registered by a teacher from their school.
| Example | |
| Scenario | Eligible to join |
| Members are studying in the same secondary school of Hong Kong |
|
- Schools which sent more than 50 students (Only count for students from participated team(Note 1)) will receive the “Supportive School Award” (The School can send an unlimited number of teams to join.)
- The school which achieved the most outstanding result will receive the “Best School Award” (Note 2)
(Note 1) Participated Team means Teams with score greater than or equal to 20.
(Note 2) The organiser will sum the score of the top 30 teams on the scoreboard by schools.
Tertiary Institution – Full-time students studying Diploma, Higher Diploma, Associate Degree or Bachelor’s Degree in Hong Kong universities or colleges
- Participants who are under the age of 18 as of the registration deadline must obtain consent from their parents or guardians to register and agree to all the terms and conditions of the competition.
- Students who are studying other degrees not specified above ( e.g. master’s degree, doctoral degree, etc. ) are not eligible to join this category. They can consider joining the Open category.
| Example | |
| Scenario | Eligible to join |
| All members are studying Diploma, Higher Diploma, Associate Degree or Bachelor’s Degree in Hong Kong universities or colleges |
|
| One or above of the members is studying for a master’s or doctoral degree at Hong Kong universities or colleges |
|
Open Category – Hong Kong residents or holders of valid Hong Kong working or study visa is on the team
- Participants who are under the age of 18 as of the registration deadline must obtain consent from their parents or guardians to register and agree to all the terms and conditions of the competition.
| Example | |
| Scenario | Eligible to join |
| All members are Hong Kong residents or holding valid Hong Kong working or study visas |
|
| One or above of the members are not Hong Kong residents and not holding valid Hong Kong working or study visas |
|
International Category
- Participants must be at least 18 years old by the registration deadline.
| Example | |
| Scenario | Eligible to join |
| One or above of the members are not Hong Kong residents and not holding valid Hong Kong working or study visas |
|
The Contest is conducted in a team format, with each team consisting of one to four members. Each participant can only enrol to one team and submit one application and agree to and comply with all the terms and conditions as well as the rules of the competition.
Any dispute regarding eligibility, the organiser reserves the right to make the final decision.
Contest Format
The competition is divided into qualifying round and final round with different gameplay, assessing the capabilities of participants’ offense and defense in cybersecurity.
Qualifying Round: This is a 48-hour Jeopardy-style online CTF Contest. Participants need to use cybersecurity techniques to exploit vulnerabilities and find hidden “flags” to earn points
- Type of Challenges and Samples
- * All the challenges in this contest are bilingual (i.e. Trad. Chinese and English)
Past Challenges https://github.com/hkcert-ctf/CTF-Challenges - Arrangement
- The participating teams will receive an email from the organiser one day before the qualifying round, containing the login account for the platform and the platform link.
- * Each participating teams will share one account to participate.
- Qualification to Final Round
- The top 5 teams with the highest scores in each category of the qualifying round, after reviewed by the organiser (including identity verification, submission of a proof of answer (write-up) for three of the solved challenges selected by the organisers and etc.), will be automatically qualify for the finals.
- * If a team waives their qualification for the finals, fails to pass the review or is disqualified for any other reason, the qualification for the finals will be passed on to the next highest-scoring team in the qualifying round of that group.
- * In the event of a tie in scores, the qualification for advancement will be determined by the time the teams earned their last score in the qualifying round, with the team that scored earlier being given priority. For example, if team A and team B both scored 3000 points in the qualifying round, and the last scoring times for team A and team B were 15:30 and 16:30 respectively. Team A would qualify for the finals.
Final Round: This is a 1.5-day daytime physical competition with King of Hill style. Combining offense, defense and real-world scenario challenges in a turn-based format, participants are scored based on who provides the better solution.
- Type of Challenges and Samples
- Participants are required to utilise any information technology and cybersecurity
knowledge. - * All the challenges in this contest are bilingual (i.e. Trad. Chinese and English).
- Arrangement
- Physical competition, the venue is Hong Kong Productivity Council building
- * All participants must bring their own laptops, install the necessary software and bring power cords to the competition. The organiser will not provide any additional equipment or software.
- * The organiser will provide power (British Style, 220V) and internet services.
- * All participants must arrange their own transportation and their own meals.
-
- 1. Secondary School
- * Each participating team must designate a teacher from their school to accompany them to the finals.
- 2. Tertiary Institution / Open Category
- * Participants who are under the age of 18 on the day of the finals must be accompanied by a parent or guardian to attend the finals.
- 3. International Category
- * The organiser will provide each participant accommodation at a designated hotel and round-trip airfare from Hong Kong to their point of departure. (The maximum subsidy for airfare is HKD 5,000 per participant)
- * During the advancement review, if participants submit Hong Kong identification proof or a local work or study visa, they will not be eligible for hotel accommodation and round-trip airfare.
- * Apart from the hotel accommodation and airfare expenses pre-paid by the organiser, all other expenses must be borne by the participants themselves.
- * The organiser reserves the final right of interpretation and decision regarding hotel accommodation and airfare arrangements
Award Ceremony: Following the finals, the winners of each category will be announced.
Prizes
Secondary School will receive
- Gold: HKD 10,000 Shopping Voucher ( Per Team )
- Silver: HKD 8,000 Shopping Voucher ( Per Team )
- Bronze: HKD 6,000 Shopping Voucher ( Per Team )
- * In circumstances beyond the control of the organiser where shopping vouchers cannot be provided, the organiser reserves the right to substitute the shopping vouchers with gifts of no less than equivalent value without further explanation or notice.
- * Each winning school will receive a trophy (i.e. the school of Gold, Silver and Bronze winners, and the winning school of the “Supportive School Award” and “Best School Award”)
Each Category of Tertiary Institution/ Open Category/ International Category will receive
- Gold: HKD 15,000 ( Per Team )
- Silver: HKD 12,500 ( Per Team )
- Bronze: HKD 10,000 ( Per Team )
* In circumstances beyond the control of the organiser where cash prizes cannot be provided, the organizer reserves the right to substitute the cash prizes with gifts of no less than equivalent value without further explanation or notice.
* In addition to the above prizes, all the winners will receive an award certificates. Other participants from the participating team will receive electronic certificates.
* In addition to the above prizes, all the winners will receive an award certificates. Other participants from the participating team will receive electronic certificates.
Team Name
All the team names will consist of 2 parts (1) Team code; (2) Team name, which would be the name of school/institutions or any self-defined names. The naming convention of each category are shown below
-
Secondary School
- Assigned by Organiser
- Naming convention is {Team Code} – {School name of the members}
- E.g. S0001 – Tsuen Wan East Secondary School
-
Tertiary Institution
- Self-defined name in English with maximum 50 characters, or assigned by Organiser
- Naming convention is
- {Team Code} – {self-defined name}, or
- {Team Code} – {Institution name of each member}
- E.g. T0001 – HK CTFMan, or T0001 – CUHK, PolyU, AbcdU
-
Open Category
- Self-defined name in English with maximum 50 characters
- Naming convention is {Team Code} – {self-defined name}
- E.g. O0001 – HK CTFMan
-
International Category
- Self-defined name in English with maximum 50 characters
- Naming convention is {Team Code} – {self-defined name}
- E.g. I0001 – CTFLover
Rules
- Each team should include maximum of 4 team members (i.e. 1 – 4 members). All team members must fulfil the entry requirements stated in the Eligibility.
- Representatives of the Contest Organising Committee, members of the project team and supplier(s) of the Contest are not eligible for joining the Contest.
- The top 5 teams with the highest scores in each category of the qualifying round, after reviewed by the organiser ( including identity verification of the registered participants, submission of a proof of answer (write-up) for three of the solved challenges selected by the organisers and etc. ), will be automatically qualify for the finals. In case of a tie in score, the final placing will be decided by time.
- If any issues occur during the Contest, participants shall report them to the Organisers immediately.
- Don’t attack the CTF platform, such as:
- Modify the scoreboard;
- Generate excessive load;
- Launch denial of service attack;
- Don’t attack any machine or service other than the designated ones.
- No social engineering attack.
- Don’t cheat or interrupt the Contest, such as:
- Share flags;
- Ask for flags;
- Delete flags;
- Intentionally prevent other teams from submitting flags.
- In the chat room:
- Don’t send any message which contains violent, obscene or indecent content.
- Don’t upload any file which infringes any copyrights and intellectual property rights.
- Do not share any content or details of the CTF challenges with anyone before the end of the contest.
- Any abuse or violation of the Rules will result in penalty as stated in the Terms and Conditions.
- The rules, gameplay, terms and conditions for the finals will be separately notified to the advancing teams after the preliminary round.The top 5 teams with the highest scores in each category of the qualifying round, after reviewed by the organiser ( including identity verification of the registered participants, submission of a proof of answer (write-up) for three of the solved challenges selected by the organisers and etc. ), will be automatically qualify for the finals. In case of a tie in score, the final placing will be decided by time.
General Terms and Conditions
General Terms and Conditions for the Capture The Flag event organised by HKCERT
- The participating teams should abide to these Terms and Conditions and the Rules of the Contest. The Organisers reserve the right to penalise team members for noncompliance with suspension of access or disqualification. The related teams and their members shall not raise objection.
- Each participating team will be named as per the rule specified under the “Team Name” section. The Organisers reserve the right to substitute any name with another name at any time without prior notice. The participants shall not raise objection.
- The whole team is disqualified if any member of the team is not eligible.
- All works of the team in qualifying round and final round must be contributed by eligible and registered members of the team.
- The team should notify the Organisers of any change in team members immediately. The Organisers will verify the identity of the winning team members when confirming their award.
- The Organisers may allow teams from other countries / regions to compete in the platform. The invited teams would compete in another category. Their score and ranking would not affect the other groups. The participants shall not raise objection.
- The decisions of the Organisers on the Contest results will be final and the results of the Contest will be published on https://ctftime.org. The participants shall not raise objection to the Contest results or rankings.
- The Organisers reserve the right to substitute any prize with another prize at any time without prior notice.
- The Organisers reserve the right to amend the Rules from time to time and inform the participants.
Useful Tools
1. Desktop
| Type | Tool |
| Compression utilities | Any Zip tools |
| File editor | Any text editor |
| File editor | Any Hex editor |
| File viewer | Any image viewer |
| File viewer | Any PDF viewer |
| Network utilities | Ncat |
| Network utilities | Nmap |
| Network utilities | Wireshark |
| Network utilities | Burp suite |
| Password crack utilities | Any password crack tool |
| Terminal emulator | Putty |
2. Online
- Compiler, e.g.
Online Resources
Learning
- picoCTF: https://picoctf.org/resources
- CTF 101:https://ctf101.org
- HackerOne: https://www.hacker101.com/videos
- Web XSS: https://prompt.ml/0
- Cryptography: https://cryptohack.org
- Binary exploitation: https://pwnable.tw
- Wikis: https://ctf-wiki.org/en/
- Course: https://pwn.college/
- VTuber: https://www.youtube.com/c/kurenaif
Practice
- picoCTF: https://play.picoctf.org/practice (require registration)
- HSCTF3: https://jacobedelman.gitbooks.io/hsctf-3-practice-problems/content/
- CTFlearn: https://ctflearn.com (require registration)
How to play ?
1. Login to the online platform (Link and user credential will be provided before the contest)
2. After login, you can find the “Challenges”. The challenges are grouped by categories and assigned a score based on difficulties.
3. Click the challenge to check the details. All challenges are NOT simple question-and-answer type. They are all hands-on and technical tasks. In most cases, repeated trials and errors are required to make a successful solve. In some challenges you may need to download additional files, or access to a specific host (No worry, we won’t deliver malware). Try your best to “hack” or “exploit” the challenge in order to get the flag (i.e. correct answer). Once you are confident that you have the correct flag, input it in the input box and click Submit.
4. If the flag is correct, the correct message will be shown and you will get the score.
5. Otherwise, the Incorrect message will be shown. Please try again.
2. After login, you can find the “Challenges”. The challenges are grouped by categories and assigned a score based on difficulties.
3. Click the challenge to check the details. All challenges are NOT simple question-and-answer type. They are all hands-on and technical tasks. In most cases, repeated trials and errors are required to make a successful solve. In some challenges you may need to download additional files, or access to a specific host (No worry, we won’t deliver malware). Try your best to “hack” or “exploit” the challenge in order to get the flag (i.e. correct answer). Once you are confident that you have the correct flag, input it in the input box and click Submit.
4. If the flag is correct, the correct message will be shown and you will get the score.
5. Otherwise, the Incorrect message will be shown. Please try again.
How to view the score ?
1. View the overall Leaderboard
a. The Top Teams score and rank will be shown in a Leaderboard
2. View the division leaderboard
a. You can also check the division score and ranking of the team
b. After click the individual team name, the team’s score, Rank, Division Rank and solved challenge information will be shown in the page
a. The Top Teams score and rank will be shown in a Leaderboard
2. View the division leaderboard
a. You can also check the division score and ranking of the team
b. After click the individual team name, the team’s score, Rank, Division Rank and solved challenge information will be shown in the page