HafezCTF

The same challenge issues a different flag to each participant, so a shared flag is invalid for whoever submits it and raises an integrity event naming both sides. Submission rate limits and the full submission ledger sit on top of that, and an operator reviews the flagged cases.

For stateful challenges each person gets a private instance, so nothing they break affects anyone else, and outbound traffic from those environments is blocked. Shared environments are used only where a challenge is read-only by nature.

They reset it themselves and carry on. Resets are limited per participant so the reset button does not become the exploit, and an operator can restart or stop any environment from the console.

No. Use the library, commission challenges built around your own stack, or write your own with the authoring tools — or mix the three. Whatever the source, a challenge only publishes after an automated solver proves it can be solved end to end.

Yes, and it is often the better choice: participant data and challenge content stay inside your network, with your branding on the instance. It runs on a single host for a normal event and across a cluster when the numbers grow, including on networks with no internet access.

The scoreboard, and more usefully the qualification report: each participant with points, solves, a skill heatmap by domain and a recommendation tier, exportable as a spreadsheet. Alongside it sit the write-up scores your reviewers gave and the integrity events raised during the event.

That is what it is built for. You see how far someone got into each chain, which domains they are strong in, what hints cost them and how well they explained their work — evidence a hiring panel can discuss, rather than a single number. The recommendation tiers are a starting rubric, and the raw breakdown is there when you want to apply your own.

A browser and an email address. They sign in with a one-time code, launch environments from the challenge page and submit flags there. Nothing is installed on their machine, though they are free to use their own tools against the environment.

The platform and its current content are in English, which suits international audiences and most security tooling. Persian is a localisation we are adding rather than a rewrite: the interface was built to carry more than one language from the start.

Configuring an event on a running instance is an afternoon: window, registration, scoring, challenge selection. The real timeline depends on content — a set built around your own systems takes longer than one assembled from the library — and on whether the instance is ours or yours.

Yes. Organizations run their own competitions on their own instance, with their name and look, and their operators in the console. Participants see your event, not ours.

Same challenges, different clock. An event is time-boxed and competitive; Academy stays open, groups lessons and labs into paths, and tracks each learner over months. A team can run both: paths through the year, a competition each quarter.