The event lasts 48 hours and runs from 5:00 pm on August 8, 2025 until 5:00 pm on August 10, 2025 (Eastern Daylight Time). Registration remains open throughout the event.

The following competition guidelines are subject to change ahead of the event.

Teams

This is a team competition. Each team can be composed of up to 5 members. Players are allowed to play by themselves (as a solo team), but are encouraged to form teams with other players.

Each individual may only be on one team, and players may not switch teams after the competition begins (unless they were on a solo team).

Each team member must register with their own account and join their team on this platform. Account sharing is prohibited.

Challenges

There will be a variety of challenges released during the event, covering all six of the following categories: web exploitation, reverse engineering, binary exploitation, forensics, cryptography, and miscellaneous. Each category will have challenges of varying difficulty.

Challenges can be solved in any order and at any time. You do not need to solve previous challenges before attempting later-released challenges.

There will be 4 total waves throughout the event. The first wave will be released at the start of the event, and the final wave will be released 12 hours before the end of the event.

Exact wave release times will be announced closer to the event date.

Flags

You need to obtain a flag that is always in the format csd{example_flag}. Knowing the flag format may be useful when attempting challenges. You do not need to solve previous challenges before attempting later-released challenges.

Flags may be submitted at any time during the event, but cooldowns may be present after repeated guesses.

There may be a limit imposed on certain challenges for the number of attempts you can make to submit flags. If you reach this limit, you will not be able to submit flags for that challenge without the assistance of an event administrator.

Scoring

Each challenge starts at 500 points, and the points will decrease over time as the challenge is solved by other players.

Please note that the updated points will retroactively apply to all teams who have solved the challenge, meaning you will not be at a disadvantage if you solve a challenge later in the event.

However, in case of a tiebreaker between points, the team with the earliest submission time for their most recently solved challenge will win.

Flag hoarding (i.e., waiting to submit many flags near the end) is discouraged, but not prohibited. Waiting to submit flags may result in a longer verification process at the end of the event.

Prizes and divisions

The prize pool for this event will be announced closer to the event date. The minimum prize pool, as of July 2, is $200 (including non-monetary items) for all divisions.

• Only full-time high school students (or the equivalent in the player’s country) and full-time undergraduate college/university students at an accredited institution are eligible to win prizes for the High School & College division.
• Students who have a bachelor’s degree or higher are not eligible to compete in the High School & College division.
• All members of a team must meet the eligibility requirements for the High School & College division to compete in that division.
• Teams may not compete in both the High School & College and Open divisions.
• Teams eligible to win prizes for the High School & College division may elect to compete in the Open division instead by selecting the Open division during registration.
• Teams may not change between the High School & College and Open divisions once they complete registration.
• Any registered players are allowed to participate in the write-up division. We will open submissions near the end of the event; they will be judged by the event administrators and challenge developers. More details regarding write-up submissions will be announced later.

Additional guidelines

• Individuals must be 13 years old or above by the time they begin registration. Participants living in certain countries or regions may have a higher age requirement. Please see the full list here.
• Individuals under 18 years old or the age of majority in their country must have consent from their parent or guardian.
• Individuals who have not yet begun 9th grade (or the equivalent in their country) cannot participate in the High School & College division without first obtaining permission from an event administrator. Students are not considered to be in high school during the summer before they begin 9th grade.
• Inaccurate or false information provided during registration may result in disqualification from the event.
• Participants should show sportsmanship and be respectful towards other players and event administrators.
• Sharing or accepting hints, methodologies, solutions, flags, resources, or any other type of collusion to individuals outside of their team during the event is prohibited.
• Negligently making hints, methodologies, solutions, flags, or resources accessible to other players (e.g., on social media, forums, public Discord channels, by sharing an account on ChatGPT with other players) may result in disqualification.
• Certain challenges and their associated write-ups may be restricted from being discussed or published for some period after the event ends (“embargoed”). Until we announce which challenges are embargoed and for how long, participants may not discuss or publish write-ups for any challenges.
• Using automated tools (e.g., DirBuster, sqlmap) blindly to scrape or fuzz challenges extensively (e.g., with a large, generic wordlist) to the degree where it may cause performance issues is prohibited, unless specified otherwise.
• Players should observe notes or code comments regarding out-of-scope functionality or behavior within a challenge which were obviously and seriously written by challenge developers (e.g., “online mode is just for fun and is not part of the challenge, seriously!”).
• Using commercial-level computing resources (e.g., AWS, school or university clusters, renting GPUs with services like Vast.ai) specifically for the competition without prior permission from an event administrator is prohibited.
• Participants may not use any performance-enhancing or similar substances, including but not limited to, amphetamine sulfate (Evekeo), dextroamphetamine (Adderall and Adderall XR), dexedrine (ProCentra, Zenzedi), dexmethylphenidate (Focalin and Focalin XR), lisdexamfetamine (Vyvanse), and methylphenidate (Concerta, Daytrana, Metadate CD and Metadate ER, Methylin and Methylin ER, Ritalin, Ritalin SR, Ritalin LA, Quillivant XR) during the event unless they have a justifiable medical condition and have obtained express permission from an event administrator.
• Do not repeatedly spam or attempt to render the server or infrastructure inaccessible.
• Do not use files, links, or instances that were created for another team.
• Do not perform attacks on the competition website, scoring system, Discord bot, or Discord server.
• Do not attempt to perform attacks on or attempt to sabotage other players.
• Do not attempt to circumvent sandboxes for challenges.
• All team members must register with their own account and join their team as soon as possible.
• Each person can only register with one account.
• Information about participants’ devices, including IP addresses, user agents, and other patterns may be collected to ensure competitive integrity. Any attempts to circumvent this collection or its accuracy may result in disqualification.
• Challenge developers and CSD CTF event administrators are not allowed to participate in the event.
• Participants must not be currently banned from the Discord server or have been disqualified from previous CyberStudents events.
• The competition guidelines will still apply to all participants after the event ends until the event administrators announce the winner(s) for all divisions.
• The entire team may be disqualified if any team member or associated parties are found to be in violation of the competition guidelines. Exceptions may be made at the discretion of the event administrators based on the severity of the violation and involvement of other parties.
• The event administrators reserve the right to disqualify and revoke recognition from any team or individual at any time, including after the competition.

• Any dispute, controversy, or claim arising out of or relating to this Agreement, including its breach, termination, enforcement, interpretation, or validity, shall be resolved by binding arbitration conducted in the United States. The arbitration shall be administered by an arbitration provider or individual arbitrator selected solely by CyberStudents. The arbitration shall be conducted in English, in accordance with procedures agreed upon by the parties or, if no agreement is reached, as determined by the appointed arbitrator. Judgment on the arbitral award may be entered in any court having jurisdiction.

  To the fullest extent permitted by applicable law, all disputes shall be resolved on an individual basis. Neither party shall bring or participate in any class, collective, or representative action or proceeding against the other, whether in arbitration or otherwise. The arbitrator shall not have authority to consolidate claims or award relief on a class, collective, or representative basis.

  Notwithstanding the foregoing, either party may opt out of this arbitration agreement and the class action waiver by providing written notice of such election to the other party within thirty (30) days of entering into this Agreement. The opt-out notice must include the party’s full legal name, username used during registration, and a clear statement of the intent to opt out. If no such notice is provided within that time period, this arbitration clause and class action waiver will be binding.