Rules

Each person competes individually, using a single account.

• Register only one account. Duplicate accounts may be suspended.
• Complete your profile before submitting flags. Submissions are disabled until it is complete.

A flag is the secret string that proves you solved a challenge. Find it, then submit it on the challenge page.

• Every flag uses the format zda{...}, for example zda{this_is_an_example}.
• Flags must match exactly and are case-sensitive: zda{Flag} and zda{flag} are different flags. Spaces before or after the flag are ignored.
• Some challenges contain more than one flag. Each flag has its own submission box and is worth part of the challenge's points.
• To prevent guessing, submissions are limited to 10 attempts per minute on a single challenge and 30 per minute across all challenges. If you reach the limit, wait for the time shown before trying again.

You earn the points shown on a challenge card when you capture its flags.

• Every challenge is worth a fixed number of points. Points don't decrease as more players solve it.
• On challenges with several flags, the points are split across the flags. You are credited for each flag as you capture it, and the challenge counts as solved once you have captured all of them.
• First blood goes to the first player who fully solves a challenge. It appears on the challenge and the scoreboard, but doesn't award extra points.
• Some challenges open at a scheduled time. A countdown shows when they will become available.

Hints can help when you are stuck, but they cost points.

• The cost of a hint is shown before you unlock it.
• The cost is deducted from your total score as soon as you unlock the hint. It can't be undone, and it still applies if you never solve the challenge.
• For example, if you unlock a 50-point hint and then solve a 300-point challenge, your score rises by a net 250 points.
• After you solve a challenge, all of its hints become free to read.

Players are ranked by total score. Ties are broken by time.

• Your score is the points from every flag you have captured, minus the cost of any hints you unlocked.
• If two players have the same score, the player who reached it first ranks higher. Scoring earlier is always an advantage.
• You receive a rank once you capture your first flag.
• Organizer accounts don't compete and never appear in the rankings.

Win with your own skills. Results must reflect your own work.

• Don't share flags, solutions, or hints with other players, and don't ask others for theirs.
• Don't brute-force flags. The submission form is for flags you have actually found, not for guessing large numbers of values.
• Don't interfere with other players, their accounts, or their progress.

You may only attack the systems a challenge explicitly gives you.

• In scope: the hosts, ports, and services listed in a challenge's connection details, plus any files attached to the challenge.
• Out of scope: this scoring platform, other players' machines, and any system not listed in a challenge.
• Denial-of-service attacks are not allowed against any target. Challenge servers are shared, so taking one down affects every player.
• If you find a bug or vulnerability in the platform itself, report it to the organizers instead of exploiting it.

Breaking these rules can cost you points or your place in the competition.

• Organizers review submissions and activity. If a rule is broken, they may adjust scores, remove points, or suspend the account, depending on how serious the violation is.
• If you're unsure whether something is allowed, ask the organizers before doing it.