Rule Set CTF: Retro 2016

View PDF


High school - A secondary educational institution that comprises of grades 9 through 12.
High school ages - 13 to 19 years of age.
Judges - Executive committee for the NULLify Computer Security Group.


  • This event will take place in The Milo Bail Student Center (MBSC), Ballroom & Nebraska Rooms (207/201). Teams will be expected to arrive prior to the start of the competition phase in order to verify their registration with the judges.
  • Teams, once registration is verified, may come and go as they please during the competition phase.


  • If an individual attends a local area high school, they must attempt to form a team with that high school using the forthcoming rules. (1)
  • A team is defined as a group of high school aged individuals that compete under the same team name.
  • Each team must have a unique, identifying, team name.
  • A team must not consist of more than 6 students.
  • Each team will be required to bring three laptop for competition use.
  • A team must have at least one adult (preferably faculty) sponsor from their school or community to stay with students throughout the day.
  • Faculty sponsors must not, under any circumstances, answer challenges or assist their team in a way that may put other teams at a disadvantage during the competition phase.(2) (3)
  • All individuals on a team must sign a press-release prior to the competition.

(1) - This does not apply to home-schooled individuals that meet all other rules.
(2) - The judges wish to stress that this competition is for students not for sponsoring faculty members. We will enforce this rule in a very strict manner. In the event that this rule is broken, the judges reserve the right to disqualify any team at any time.
(3) - Proper assistance takes the form of answering technical questions, providing moral support, and assisting in preparation prior to the competition. Improper assistance takes the form of a faculty sponsor answering challenges for their students, creating scripts or programs to aid in the answering of challenges, and/or interfering with another team or teams sponsor.


  • Under no circumstances will a team be allowed to attack the competition infrastructure. This includes, but is not limited to: denial of service attacks, cross-site scripting attacks, brute-forcing of judges or opposing teams passwords to gain an unfair advantage, or cross-site request forgery.
  • Under no circumstances will a team be allowed to masquerade as surrounding, publicly accessible, infrastructure. This includes, but is not limited to, wireless access points and local area networks (LANs).


  • Scoring will be based on challenges completed during the competition phase. Each challenge will have an assigned point value by the judges based on difficulty.
  • In the event of a tie at the end of the competition phase, the team that achieved the score first, will be held at the higher placement.
  • A team may not, under any circumstances, exchange answer keys, solutions, or algorithms with another team.

Any violation of these rules may disqualify a team from the competition or make a team ineligible for prizes. NULLify reserves the right to modify these rules at any time without notice.