null
 

2019 Registration Guidelines & Competition Rules

CSAW CTF Overview

CSAW CTF is an entry-level, jeopardy style CTF, designed for students who are trying to break into the field of security. Challenges are meant to exhibit fundamental concepts and help students develop their skills. If you have never played a CTF before, check out “Preparation Resources & Tools” below.

Our competition occurs over two rounds: an online Qualifying Round in September and a Final in-person Round in November.


Qualification Round Dates & Times

CSAW’18 CTF will run 13 -15 September 2019

Start Time: 20:00 UTC Time, 13 September

End Time: 20:00 UTC Time, 15 September 


Qualification Round Platform

The qualification round of CTF is played on an online CTFd platform: ctf.csaw.io. To access challenges, players must register under a team name. The CTFd platform allows for users to either register a team or  join an already registered team. 

Only registered teams will be given access to challenges at the “Start Time.” We expect approximately 30 challenges with points ranging from 1 - 500. The competition will run for 48 hours.


Qualification Round eligibility 

Everyone is welcome to play in the Qualification Round of Capture the Flag. Our game is open to players from around the world.

CSAW CTF has different eligibility requirements based on whether a team wishes to qualify for Finals. Please carefully review this entire document before registering.


Rules for the qualifying Round

Questions regarding eligibility can be directed to Stef at smd8@nyu.edu or via Direct Message to @Stef on the Discord Channel. 

  • Registration is required through the CTF platform: ctf.csaw.io. Registration will remain open through the Qualification Round.
  • Players can compete individually or on a team.
  • All players, regardless of bracket or intention to qualify for Finals, must compete under only 1 team name; playing for multiple teams, including sub teams or alias teams, is not permitted and will result in team disqualification.
  • There is no limit to the number of players on a team during the Qualifying Round. However, should a team qualify for Finals, only 4 members of a team will be allowed to play during Finals. These 4 members must register in advance on the CTF platform prior to the Qualification Round. 12 September Note of Clarification: Please enter up to 4 team members before the end of the Qualification Round. Estimate who will participate in Finals as best as you can. Finalist team members will be confirmed with each regions' travel coordinator during the enrollment verification process. 
  • 12 September Note of Clarification: Furthermore, all team members playing in the qualification round should be of the same education level or lower as the bracket of the team. The exception here is for team members in the Regular National Service bracket. 
    • High School Bracket = high school students 
    • Undergraduate Bracket = undergraduate students
    • Stacked Bracket = undergraduate and graduate students
    • Graduate Bracket = graduate students
    • Regular National Service = team members are in the Regular National Service (Israel only) 
  • Furthermore, teams should work independently; sharing answers privately or publicly, or collaborating with another team to secure multiple spots at Finals constitutes cheating.
  • Attacking the CTF infrastructure ruins the fun for everyone. Unless a challenge explicitly calls for such an attack, it is strictly forbidden to perform any kind of Denial of Service Attack (DoS/DDoS) against the servers or the competition's infrastructure.
  • Brute forcing of flags is not tolerated or recommended.
  • Automatic vulnerability scanners such as SQLmap are prohibited.
  • Flags should be submitted as they are found rather than hoarding flags and submitting them all at once. Teams that submit flags in quick succession may be asked to provide write-ups.


Recommendations for qualifying round

  • Teams will need regular access to a computer and an Internet connection.
  • Teams should have unfiltered Internet access and the ability to install software.
  • Teams should connect to the CSAW CTF Discord channel and keep this open during the competition to be alerted of any updates.
  • Teams/players may play as much or as little as they want through the Qualification Round. We recommend dedicating as much time as you have to working through the challenges while still maintaining healthy habits (ie, getting some sleep!). 

Qualifying for Finals 

Teams earns points by solving challenges. We anticipate ~30 challenges, each worth 1 - 500 points. Eligibility and the number of teams invited to Finals varies by region as defined in the next section. Teams must earn 2 or more points to be initially considered for Finals.

Qualifying round points are reported to CTFTime.


Final round eligibility

Participation in CSAW CTF Finals is contingent upon competitors' ability to enter the given country where CSAW is being hosted. 

Questions regarding eligibility can be directed to Stef at smd8@nyu.edu or via Direct Message to @Stef on the Discord Channel. 

Eligibility requirements for Finals vary by region, defined below.

Europe - hosted by Grenoble INP - Esisar (Valence, France)
  • The top 10 eligible European teams with the most points will be invited to CSAW Finals
  • Teams may have up to 4 players total during Finals. 12 September clarification: team members should be identified by 15 September 20:00 UTC, and, following an invitation to Finals, all team members must be confirmed by 29 September 2019.
  • All team members must be enrolled in an undergraduate or graduate program and attend the same university within Armenia, the European Union, Norway, or Switzerland. On the CTF platform, the brackets that correspond to an undergraduate or graduate program are Undergraduate, Graduate, or Stacked. 
  • Only one team from any given university may qualify for Finals. If multiple teams from the same university qualify, only the highest ranked team will be invited to compete at CSAW Europe Finals.
  • Additionally, finalists teams from the same country should not exceed 40% of the total teams accepted to Finals.
  • Teams that qualify for Finals will be asked to verify their enrollment status before being offered a Travel Award.*
India - hosted by Indian Institute of Technology Kanpur (Kanpur, India)
  • The top 10 eligible Indian teams with the most points will be invited to CSAW Finals
  • Teams may have up to 4 players total during Finals. 
  • All team members must be students enrolled in an undergraduate (UG) or post-graduate (PG) program and attend the same university in India. 12 September clarification: team members should be identified by 15 September 20:00 UTC, and, following an invitation to Finals, all team members must be confirmed by 29 September 2019. On the CTF platform, the brackets that correspond to an undergraduate or graduate program are Undergraduate, Graduate, or Stacked. 
  • Up to two (2) Student Teams from any given university in India may qualify for Finals. If multiple teams from the same university qualify, only the two highest ranked teams will be invited to compete at CSAW India Finals.
  • Student Teams that qualify for Finals will be asked to verify their enrollment status before being offered a Travel Award.*
Israel - hosted by University Haifa and IBM Research (Haifa, Israel)
  • The top 10 eligible Israeli teams with the most points will be invited to CSAW Finals
  • Teams may have up to a total of four (4) players during Finals. 12 September clarification: team members should be identified by 15 September 20:00 UTC, and, following an invitation to Finals, all team members must be confirmed by 29 September 2019.
  • Teams can be comprised of either students or persons enrolled in regular national/military service. For student teams, members must be enrolled in an accredited undergraduate (UG) program, post-graduate (PG) program, or high school and all team members must attend the same school located in Israel. On the CTF platform, the corresponding brackets are: Undergraduate, Graduate, Stacked, High School, or Regular National Service. 
  • Up to two (2) student teams from any given university or high school in Israel may qualify for Finals. If multiple teams from the same institution qualify, only the two highest ranked teams will be invited to compete at CSAW Israel Finals.
  • Teams that qualify for Finals will be asked to verify their enrollment or national service status before being offered an invitation to Finals.
  • Teams that are invited to Finals are responsible for travel and lodging costs.* 
MENA - hosted by NYU Abu Dhabi (Abu Dhabi, UAE)
  • Up to 10 eligible MENA teams with the most points will be invited to CSAW Finals
  • Teams may have up to 4 players total during Finals. 12 September clarification: team members should be identified by 15 September 20:00 UTC, and, following an invitation to Finals, all team members must be confirmed by 29 September 2019.
  • All team members must be enrolled in an undergraduate or graduate program and attend the same university within the following countries: Algeria, Azerbaijan, Bahrain, Chad, Djibouti, Egypt, Eritrea, Georgia, Jordan, Iraq, Iran, Kuwait, Lebanon, Libya, Mauritania, Morocco, Oman, Pakistan, Palestine, Qatar, Saudi Arabia, South Sudan, Sudan, Syria, Tunisia, Turkey, United Arab Emirates, and Yemen. On the CTF platform, the brackets that correspond to an undergraduate or graduate program are Undergraduate, Graduate, or Stacked. 
  • Only one team from any given university may qualify for Finals. If multiple teams from the same university qualify, only the highest ranked team will be invited to compete at CSAW MENA Finals.
  • Teams that qualify for Finals will need to verify their enrollment status before being offered a Travel Award.*
México - hosted by University Iberoamericana Mexico City (IBERO, Mexico City, Mexico) 
  • Up to 10 eligible Mexican teams with the most points will be invited to CSAW Finals
  • Teams may have up to 4 players total during Finals. 12 September clarification: team members should be identified by 15 September 20:00 UTC, and, following an invitation to Finals, all team members must be confirmed by 29 September 2019.
  • All team members must be enrolled in an undergraduate (UG) or post-graduate (PG) program and attend the same university campus in Mexico. On the CTF platform, the brackets that correspond to an undergraduate or graduate program are Undergraduate, Graduate, or Stacked. 
  • Up to two (2) Student Teams from any given university in Mexico may qualify for Finals. If multiple teams from the same university qualify, only the two highest ranked teams will be invited to compete at CSAW Mexico Finals.
  • Teams that qualify for Finals will be asked to verify their student enrollment before being offered an invitation to Finals.
  • Teams that are invited to Finals are responsible for travel and lodging costs.*
US-Canada - hosted by NYU Tandon School of Engineering (Brooklyn, NY, USA)
  • The top 10 eligible US-Canadian teams with the most points will be invited to CSAW Finals
  • Only undergraduate level students enrolled in an accredited degree program at a university or college in the United States (including US Territories) or Canada are eligible to qualify for Finals. The corresponding bracket on the CTF platform is Undergraduate. 
    • Stacked teams (those with both graduate and undergraduate level students), Graduate teams, Professional/Other teams, and high school teams are not eligible to qualify for Finals.
  • Teams may have up to 4 players total during Finals. 12 September clarification: team members should be identified by 15 September 20:00 UTC, and, following an invitation to Finals, all team members must be confirmed by 29 September 2019.
  • Mixed teams -- or teams with students from different universities/colleges -- are permitted. A mixed team can have a maximum of 2 students from the same university/college, with up to 4 teammates total. For example:
    • 2 students from University A can team up with 2 students from University B.
    • Or, 2 students from University A can team up with 1 student from University B and 1 student from University C.
    • Or, a mixed team could comprise 4 students all from different universities/colleges
    • Questions about mixed teams? Please email csawctf@osiris.cyber.nyu.edu
  • A maximum of 5 students from the same university and across multiple teams are eligible to qualify for Finals.
  • Teams that qualify for Finals will be asked to verify their enrollment status before being offered a Travel Award.*

Finalist Notification

Finalists will be notified of their status between 18 and 29 September 2019. Teams will receive notification directly from regional organizers via the team email that is registered on ctf.csaw.io.


travel award*

Travel Awards vary by region. When available, transportation and lodging (hotel or residence hall), and meals are provided, free of cost to the Finalists, or reimbursed following CSAW Finals. Teams will be provided details when they are invited to Finals.


CSAW final dates & Locations

6 - 9* November 2019

*Conference agendas and competition days/times vary by location. See regional webpages for details.

CSAW'19 Finals will be hosted at five global academic centers. 

  • CSAW Europe at Grenoble INP-Esisar (Valence, France)
  • CSAW India at Indian Institute of Technology Kanpur (Kanpur, India)
  • CSAW Israel co-hosted by Haifa University and the IBM Research Lab
  • CSAW MENA at NYU Abu Dhabi
  • CSAW Mexico at University Iberoamericana Mexico City (IBERO)
  • CSAW US-Canada at NYU Tandon School of Engineering (Brooklyn, New York, USA)

finals format

Finals follows a similar format to the Qualification Round. The Final Round of CTF is played on an online CTFd platform: ctf.csaw.io. The scoreboard will be public through most of the competition, but will be taken offline nearing the end of the competition. The competition lasts 36 hours. We expect approximately 30 challenges, with points ranging from 1 - 500.


Rules for Final ROUnd

  • Players must compete in-person at their designated CSAW region
  • Finalist teams should work independently. Receiving assistance from non-team members, sharing answers privately or publicly, or collaborating with off-site friends/colleagues (for example, getting help from anyone other than your Finalist team members) constitutes cheating. Cheating during finals will result in an immediate disqualification and team-wide CSAW ban.
  • Attacking the infrastructure will result in disqualification and a team-wide CSAW ban
  • Attempting to brute force flags or guess answers on the submission platform is prohibited
  • Use of automated vulnerability scanners, such as SQLMap, are not allowed


Prizes 

A 1st, 2nd, and 3rd place winning team is identified for each region based on total points scored. Prizes vary by region. Please check the regional webpages for details.


mailing list

CTF registrants will be automatically added to the CSAW mailing list. This list is used to provide occasional updates on CSAW and to promote cybersecurity related events being organized by CSAW regional partner schools. CSAW will not rent, sell, or share emails with non-partner schools or other entities or organizations.

Registrants can opt-out of the mailing list at anytime.


preparation resources & Tools

The best way to prepare for CSAW CTF is to play CTFs. A calendar of competitions can be found here: CTFTime

Here are some other introductory resources:

CTF 101

CSAW 365

Trail of Bits CTF Field Guide


contacts

Please direct your inquiries as follows:

General Inquiries:  csawctf@osiris.cyber.nyu.edu

CSAW Europe > csaw-europe-ctf@esisar.grenoble-inp.fr
CSAW India > skmtr@cse.iitk.ac.in
CSAW Israel > 
CSAW MENA > 
CSAW México >  
CSAW US-Canada > csawctf@osiris.cyber.nyu.edu