HafezCTF
CTF & Security Assessment Platform
A capture-the-flag platform for competitions that end in a decision: a different flag for every participant, isolated environments, multi-stage chains, anti-cheat, and a report showing who can actually do the work. Hands-on training and learning paths now live in Hafez Academy, on the same engine.
About HafezCTF
Typical capture-the-flag platforms sort participants by points and stop there. An organization letting a researcher into a private bug bounty programme, or hiring a candidate, needs more than a rank: it needs a defensible signal it can stand behind in the room where the decision is made.
HafezCTF is built for that. Every participant gets their own flag, stateful challenges run in a private environment per person, multi-stage chains score partial progress, and the platform records time, hints, write-ups and integrity signals. What comes out is a qualification report: a skill breakdown by domain and a recommendation tier for each person.
One engine has two faces: time-boxed events and an always-on Academy of learning paths. A challenge written once works in both. You can use our instance, run it on your own servers under your own branding, or stand it up inside a network with no internet access.
1:1
Flag and Environment per Person
Two Modes
Events and Academy
Report
Qualification, Not Just Rank
Self-Hosted
Or on Our Instance
Why a Scoreboard Is Not Enough
Two people on the same score are not necessarily equal, and the platform has to show it
1
Two People, One Score
Two participants finish on 2,400 points. One solved the hard chain unaided in forty minutes; the other took six hours and used every hint. A scoreboard says they are equal. For a hiring or qualification decision, they are not.
2
The Platform Records the Difference
Points by domain, how far into each multi-stage chain a person reached, which hints were taken, how write-ups were scored by your reviewers, and the integrity signals raised along the way.
3
You Get a Report, Not a Ranking
The qualification report shows each participant with a skill breakdown across domains as a heatmap and a recommendation tier — recruitment review, bug bounty participation, further validation, or not recommended — and exports to a spreadsheet your hiring team can work from.
A Look at the Operator Console
The scoreboard, the qualification report and the integrity events — what an operator watches during a round
HafezCTF — operator console
PreviewAn illustration of the interface with sample data. Switch screens with the tabs above.
Key Features
The mechanics that turn a competition into an assessment
A Different Flag for Every Participant
The same challenge issues a unique flag to each person, so a flag submitted by someone it was not issued to is invalid and raises an integrity event by itself. Sharing is not discouraged by a rule; it is detectable by construction.
Multi-Stage Attack Chains
A challenge can run as a chain where each stage awards its own flag and unlocks the next. Partial progress scores, so you learn how far someone got rather than only whether they finished.
A Private Environment per Person
Stateful challenges give each participant their own hardened instance with outbound traffic blocked, a visible lease countdown, resets they can trigger themselves, and caps on CPU, memory and how many run at once.
Shared Environments Where Isolation Is Waste
A static reversing task does not need a container per person. The platform runs shared and isolated challenges side by side, so an event costs what it should rather than one instance per participant per challenge.
A Qualification Report, Not Just a Scoreboard
Per participant: points, solves, a skill heatmap by domain and a recommendation tier, exported as a spreadsheet. Disqualified participants are excluded, and the export itself is recorded in the audit log.
Layered Anti-Cheat
Cross-participant flag reuse raises an integrity event, submissions are rate-limited per person with backoff on repeated failures, and the full submission ledger stays available for an operator to review.
Scoring You Set
Base points by difficulty, first-blood bonuses, decay as more people solve a challenge, hint penalties shown before the hint is taken, and write-up bonuses. The rules are event settings, not code.
Write-Ups With Review
Participants explain how they solved it; your reviewers read and score the explanation. It is the part of the picture a flag submission cannot give you, and it feeds the qualification report.
Every Challenge Proven Solvable
Nothing is published until an automated solver has taken it from start to flag. Packages are signed, and an instance only imports bundles signed by a key it trusts, so a competition never opens on a broken task.
One Console for the Operator
Event settings, challenge visibility, running environments, participants, write-up review and the integrity view, with every operator action written to the audit log.
Security-First by Default
Passwordless sign-in, server-side sessions, a strict content security policy, protection against cross-site request forgery on every action, and rate limits. The platform a security company would accept running for itself.
Your Brand, Your Instance
Organizations run their own competitions on their own instance, with their branding and their operators. We host it, you host it, or it runs inside a network with no route to the internet.
Two Modes, One Engine
A challenge written once runs as a scored task and as a lab
Events
Time-boxed competitions with a live scoreboard, first-blood and decay scoring, hint penalties shown before the hint is taken, a freeze window near the end, and open, invite-only or closed registration. Participants submit write-ups after solving, and your operators review and score them.
Academy
Always-on learning paths that combine lessons with hands-on labs and track each learner’s progress. Labs reuse the same challenges as Events, so a challenge written once serves training, practice and assessment from one library.
Use Cases
Wherever security skill has to be measured or built in practice
Hiring and Candidate Screening
Put a shortlist through the same challenges and compare them on evidence instead of on how well they interview.
Bug Bounty Researcher Qualification
Gate a private programme on a qualifying round, so the researchers who reach your production systems have already shown what they can do.
Team Training and Readiness
Academy paths for the year, an internal competition each quarter, and a record of who actually improved.
Public and Community Events
University competitions, conference side events and community rounds, on an instance carrying your branding.
Customer-Facing Competitions
A bank or a platform runs a public round against a safe replica of its own stack, and turns security into something visible.
Security Champions Programmes
Developers work through paths built from your own stack, and the progress record shows which teams are ready for more responsibility.
How It Works
From choosing challenges to acting on the result
1
Build the Challenge Set
Take challenges from the library, commission them from us, or write your own with the authoring tools. Each one passes the automated solvability check before it can be used.
2
Configure the Event or Path
Set the window, who may register, the scoring rules and the freeze, or arrange lessons and labs into a learning path that stays open all year.
3
Participants Solve
They sign in without a password, launch their own environment with a visible timer, submit flags, take hints knowing the cost, and write up what they did.
4
Read the Result
Beyond the scoreboard: the qualification report, the integrity view, the write-up scores, and an export your hiring or programme team can work from.
Ways to Run It
On our instance, on your servers, or on a disconnected network
Hosted by Us
We run the instance, you run the event. Suits a one-off competition or a first programme, with our team on hand while it is live.
On Your Servers
Install it in your own environment with your branding, your operators and your participant data, on a single host or a cluster as the numbers grow.
Disconnected Networks
Everything the platform needs ships with it, so a competition can run inside a classified network with no route to the internet.
Why HafezCTF
How it differs from a typical CTF platform
Built for a Decision, Not a Leaderboard
Every feature is tested against one question: does it help tell apart two people with the same score? That is what makes a result usable for hiring or for gating a bug bounty programme.
Runs Where You Need It
The same platform runs as our hosted instance, inside your network, or on a disconnected one. Nothing depends on a foreign service being reachable on the day.
No Broken Challenge on the Day
Anyone who has run a competition has watched one task melt down at hour two. Here a challenge cannot ship until a solver has proved the path from start to flag.
From People Who Compete
HafezSecure has designed and played capture-the-flag competitions for years. The platform reflects what goes wrong in real events, not what looks good in a feature list.
Frequently Asked Questions
What organizations ask before running an event
How do you stop participants sharing flags?
Can participants interfere with each other?
What if someone destroys their environment mid-event?
Do we have to write our own challenges?
Can we run it on our own servers?
What do we actually get at the end of an event?
Can we use the result in a hiring decision?
What do participants need?
Which language is the platform in?
How long does it take to set up an event?
Can we brand it as our own competition?
How is Academy different from an event?
A Competition That Ends in a Decision
See the platform at ctf.hafezsecure.ir, or talk to our team about running a competition, screening candidates, or installing it on your own infrastructure
Related Services
Complementary services that might be useful for you
Purple Team Exercises
Collaborative red and blue team exercises
Learn more
Security Champions Program
Embed and scale secure engineering practices inside development teams through a structured security champions program
Learn more
Penetration Testing (VA+PT)
Comprehensive penetration testing combining vulnerability assessment and exploitation
Learn more
Related insights
What we have written about this service
Penetration testing
What a penetration test report must contain
The sections a useful penetration test report has, what each one is for, and the questions to ask before you accept a deliverable that is missing them.
Penetration testing
Vulnerability assessment vs penetration test
The two are bought for different reasons and priced differently. How they differ in method, depth and output, and a simple rule for which one to order this quarter.
Other Platforms
The rest of the HafezSecure platform range
VAaaS
Vulnerability Assessment as a Service
A scalable assessment platform combining expert-led testing, automation, and AI-assisted analysis
Learn more
ASM
BetaAttack Surface Management
Continuous discovery and monitoring platform for visibility into exposed assets
Learn more
Asset Management
BetaCyber Asset Inventory
An evidence-grounded inventory of every asset — AI systems and machine identities included — where each asset and field carries its source, confidence and freshness, built for on-prem and air-gapped networks
Learn more