Rules & FAQ
Play fair, learn a lot
NepSec CTF exists so you can practise offensive security legally and safely.
Rules
- 1
Attack only what's on this platform.
Challenges and labs are the only legitimate targets. Do not attack the platform itself, other players, or any system you don't own or have written permission to test. Doing so may be illegal and will get your account suspended.
- 2
Don't share flags or solutions.
Lab flags are unique to each player, so a shared flag simply won't work for anyone else. Write-ups unlock for you once you solve a challenge — please don't publish them elsewhere.
- 3
No brute-forcing the flag form.
Submissions are rate-limited and every attempt is logged. Automated guessing will get you locked out.
- 4
One account per person.
Multiple accounts to farm first bloods or points will be removed from the scoreboard.
- 5
Report problems responsibly.
If you find a bug in the platform (not a challenge), tell the organisers privately instead of exploiting it.
Frequently asked questions
What does a flag look like?
Flags are strings like NEPSEC{s0me_t3xt}. Copy it exactly — flags are case-sensitive. Surrounding spaces are ignored.
How is scoring calculated?
Each challenge starts at its full value. As more players solve it, its value falls along a curve to a minimum. Everyone who solved it gets the current value, so harder (rarer) solves are worth more. Unlocked hints are subtracted from your score.
What is first blood?
The first player to solve a challenge gets the first-blood badge on the challenge and their profile.
How do labs work?
A lab starts a deliberately vulnerable web app or Linux machine entirely inside your browser tab. It can't reach the internet or anyone else's system, and it contains your own personal flag.
I'm new to security. Where do I start?
Begin with Easy challenges, use hints when stuck, and read the write-up after each solve. For structured lessons, try NepSec Academy at nepsecacademy.kuinkel.com.