Offline practice simulation
Cybersecurity Category
A complete capture-the-flag platform for the IT Skills Olympics 2026. Register your team of three, start the 90 minute clock and work through 19 graded challenges across the four official areas of the category - plus a trivia round and one hidden tiebreaker. Everything runs in your browser: no backend, no internet, no build step.
What is a CTF?
A Capture The Flag (CTF) is a cybersecurity exercise in which small teams are given a set of practical tasks - decrypting a message, analysing a packet capture, hunting for persistence on a disk image or ranking the risk of a scan report.
Every task hides a secret string called a flag, for example
CTF{some_text_here}. You solve the task, find the flag and submit it
to earn points.
Teams compete against the clock and against each other; the team with the most points when time runs out wins.
This site is a faithful practice simulator of the Cybersecurity Category of the IT Skills Olympics 2026 - it runs completely offline, stores your progress in your own browser and never sends anything over the network.
Flag format
Every flag of a graded challenge looks like this:
CTF{some_text_here}
Flags are case sensitive unless the challenge says otherwise
(the trivia round ignores case and punctuation). For trivia you type the plain
answer - the CTF{} wrapper is optional there.
Flag checking
The site never stores a flag in clear text. Only a salted SHA-256 hash of it is stored, and your input is hashed in the browser and compared. The flag is therefore never sent anywhere.
Team registration
Teams of exactly three membersRegistered team
-
-
Competition rules
- Teams of exactly three members. Register all three names before the clock starts.
- Total time: 1 hour 30 minutes. The countdown starts when you press "Start Competition" and survives a refresh. When it reaches zero every submission is blocked and the board becomes read only.
- No internet - bring your own tools. In the real contest there is no network access. Install everything you need on Kali Linux beforehand (nmap, Wireshark/tshark, john, hashcat, hashid, binwalk, exiftool, strings, an offline CyberChef copy and the rockyou wordlist).
- Scoring by difficulty. Easy = 50, Average = 100, Difficult = 150, Trivia = 30. Maximum 1500 points.
- Three hints per challenge, unlocked in order. Every hint costs points: Easy -20, Average -60, Difficult -100. Trivia has no hints. A challenge awards max(0, points - total hint cost).
- Three attempts per challenge. After the third wrong submission the challenge is locked for good - the lock is stored in your browser, so a refresh does not reset it. The attempt limit replaces any cooldown and stops brute forcing of the submit form.
- Ranking. Highest total score wins. If two teams are level, the team whose last correct submission came earlier ranks higher. One hidden tiebreaker challenge exists for exactly that case - it is not counted in the total score.
- Fair play. Do not attack or stress the site that hosts the competition, do not share flags with other teams and do not brute force the submission form.
How scoring works
| Difficulty | Points | Cost per hint |
|---|---|---|
| Easy | 50 | -20 |
| Average | 100 | -60 |
| Difficult | 150 | -100 |
| Trivia | 30 | no hints |
Example: a Difficult challenge is worth 150. Unlocking one hint leaves 50 points, two hints leave 0 points. A challenge you never solve gives nothing - and an unused hint on an unsolved challenge costs nothing either.
How hints work
Every challenge exposes up to three hints. They unlock strictly in order and each one shows its price before you confirm it. A hint can only be bought while the challenge is still open.
The four official areas
1. Essential Security Principles
CIA triad, hashing, encoding, encryption, password security, authentication. Tools: base64, tr, john, hashcat, hashid, python3, CyberChef.
2. Basic Network Setup and Security
IP addressing, subnetting, ports and services, firewalls, packet analysis. Tools: nmap, ipcalc, Wireshark, tshark, iptables.
3. Endpoint Security Concepts
Logs, malware indicators, permissions, persistence, hardening. Tools: grep, logwatch, crontab, systemd, exiftool, binwalk, strings.
4. Vulnerability Assessment and Risk Management
Scan reports, CVSS, risk matrices, remediation. Tools: nmap, OpenVAS/GVM reporting, csvkit, xmllint, CVSS calculators.
How to play
- Register the teamTeam name, school and the three member names.
- Prepare your toolkitOn Kali Linux install nmap, wireshark/tshark, john, hashcat, hashid, binwalk, exiftool, strings and an offline copy of CyberChef, plus a wordlist such as rockyou.txt.
- Press "Start Competition"The 90 minute countdown starts and the challenge board unlocks.
- Download, analyse, submitEvery challenge gives you files in /files. Use your Kali tools, find the flag and submit it in the challenge modal.
- Use hints sparinglyEvery hint costs points - a Difficult challenge is worth 150, one hint leaves 50.
- Watch the clockWhen the countdown hits zero the board is read only and the final ranking is shown on the scoreboard.
file://, from
python3 -m http.server and from a LAN address such as
http://192.168.1.20:8000. Over plain HTTP the browser does not expose
crypto.subtle, so a bundled pure JavaScript SHA-256 takes over - flag
checking keeps working.