Technical information

1. In brief

CyberQuest 2026 is an in-person team competition with two parallel formats: 4 Jeopardy challenges and 4 Attack-Defense (A/D) services. This page describes the A/D infrastructure. We will not reveal challenge contents in advance.

2. What to bring

• A laptop and charger for each teammate. We provide the network: according to our current plans, this will be Wi-Fi.
• A WireGuard client, installed in advance (wg-quick on Linux, the official app on macOS and Windows).
• An SSH client.
• Recommended: Wireshark or tshark for PCAPs, Python for your exploits and submission script, and familiarity with Docker.

3. Network

• Connect to the competition network using WireGuard. Each teammate receives their own configuration. There is no shared team file, and you do not need to generate keys.
• After signing in, download the configuration from the portal (Team → Connection). You can download it again at any time.
• Run only one game VPN on a machine at a time. A second active VPN can take over the default route and silently cut off access to the competition network.
• Only vulnboxes may be attacked. Attacking other teams’ computers is prohibited.

The real addresses are shown in the portal after you sign in.

All requests to your services arrive from the same address, so you cannot distinguish other teams from the checker by source address.

4. Vulnbox

• Each team gets its own centrally hosted Linux VM. This is the vulnbox. You do not need to download an image or run it on your own machine.
• The box runs the 4 A/D services in containers (Docker Compose).
• Connect over SSH using the shared team key. Any approved teammate can download the key from the portal. The exact address and SSH command are there too. Your WireGuard connection must be active.
• Resources: 4 vCPU, 8 GB RAM and 100 GB disk, shared by the four services. This may still change before the competition. Do not run heavy analysis on the box. Inspect PCAPs on your own machine.
• The box is yours to patch. If a service does not respond correctly, you lose SLA points.
• We will describe how to patch and restart services later. We will publish the details here before the competition.

5. Reconnaissance phase (09:00–10:00)

• The checkers are already running. You can see the status of your own services and access your own PCAPs.
• There is no scoring (SLA, attack or defence), and flag submission is closed: the submission service returns GAME_NOT_OPEN. Flags placed during reconnaissance do not earn points after the competition opens either.
• The inter-team network will be closed during this phase: you cannot attack one another yet.
• Jeopardy challenges are not available yet.
• The plan is for the network to open automatically at 10:00, when scoring starts. The portal shows a countdown.

Use this time to check your access, explore the services, observe normal traffic and make your first patches.

6. Ticks and flags

• A tick lasts 3 minutes (180 seconds).
• At the start of each tick, the checker places a new flag in every service of every team. It also checks that the service works correctly.
• A flag can be submitted during the tick in which it was placed and the following 5 ticks (r…r+5).
• The checker retrieves flags from the current tick and the previous 5 ticks. Losing data during a patch or restart costs SLA points.
• Flag format: FLAG{...}. We will publish the details here before the competition.

Flag IDs and the target list

The portal’s teams.json endpoint provides the list of attackable teams and per-service flag IDs. A flag ID might be a username or record identifier telling you where to look for a valid flag.

The endpoint is planned to be public, without authentication, while the competition is active or finished; at other times it may return 404. The format is FAUST-compatible.

7. Flag submission

• Use a line-based TCP connection on port 31337 inside the competition network. The exact address is in the portal (Team → Connection).
• Send one flag per line, terminated by LF. There is no greeting line: send first, then read. You receive one response line per flag, in order.
• Your source IP identifies your team; there is no separate authentication. Your VPN must therefore be active.

8. Service statuses

9. Scoring (A/D)

Each service’s score has three components. The final score is their sum. The formula is planned to follow FAUST CTF scoring.

attack  += 1 + 1 / (number of teams that captured the same flag)
defence -= (number of times your flag was captured) ^ 0.75
SLA     += (UP ticks + 0.5 × RECOVERING ticks) × sqrt(number of teams)
total    = attack + defence + SLA

• Rarer flags are worth more, but every accepted flag is worth at least 1 point.
• Flags captured from the NOP team are worth no points.
• Jeopardy challenges have fixed scores. There is no dynamic scoring, first blood or partial credit.
• The final result is the sum of Jeopardy and A/D points. We will publish the details here before the competition.

10. Traffic captures (PCAP)

• Every approved teammate can download their own team’s box traffic from the portal (Team → PCAP).
• The plan is to produce one file per tick containing all traffic to and from the box, with a delay of 1 tick (3 minutes). The portal shows which services’ traffic is included. We also plan to offer the last 10 ticks as a single PCAP download.
• Only your own team’s traffic is available.

11. NOP team

There is also an unpatched organiser vulnbox running. You can test your exploits on it. It receives flags and is checked by the checker, but flags captured from it are worth no points. Its address is shown in the portal after you sign in.

12. Jeopardy

• 4 Jeopardy challenges.
• The challenges are available from 10:00.
• We will explain the details at the venue.

13. AI tools

The use of AI tools is restricted during the competition. This includes LLM-based assistants and agents.

We will publish the exact rules here before the competition.

Be prepared for us to ask you for a screen recording of your machine during the competition, for example with OBS at a low frame rate.

The organisers may also flag traffic indicative of AI tools on the server side.

14. What is not allowed

• Only other teams’ vulnboxes may be attacked. The competition infrastructure, portal, other players’ computers and venue network are not targets.
• Denial of service is prohibited: do not take another team’s service down by flooding it with requests or exhausting its resources. Exploiting a vulnerability is allowed.
• Cooperation between teams (sharing flags or exploits) is prohibited.
• See the competition rules (Hungarian) for details.

15. Help on site

• Technical briefing at 08:45.
• During the competition, ask for help at the on-site helpdesk.
• Questions before the competition: [email protected].