redhacker.ai · capture the flag
HTFRules
Everything you need to know before the clock starts on 2026-10-30. Guardian has already read this page. You should too.
Our infrastructure is open to you for the next twenty-four hours, against our better judgment. Guardian is already watching the line you connect through. Everything below is the terms under which we allow the attempt. Read them. Then come see how far you get.
1. Eligibility & Registration
Teams only. 3–5 members. Registration closes at 500 teams or at event start (2026-10-30, 13:00 UTC), whichever comes first. Teams with fewer than 3 members at the registration-close moment are locked out of the event entirely — this is checked once, at close, not continuously during the event.
2. Format
24 hours, 2026-10-30 13:00 UTC → 2026-10-31 13:00 UTC. 100 machines across Warmup, Web, Pwn, Reversing, Crypto, Forensics, Hardware, ICS, Blockchain, Coding, and Misc, at Easy/Medium/Hard/Insane difficulty. All machines are reachable only through the event VPN — no machine is exposed to the public internet.
3. Flags
Real flags are shaped like this. Not everything matching that shape is real — this event deliberately plants decoys. Submitting a wrong flag is not penalized beyond the attempt itself; learning to tell a decoy from a real flag is part of the challenge.
HTFRH{32 hex characters}
EvilCorp planted those decoys on purpose. We are not sorry.
4. AI tools are allowed and expected
Unlike most CTFs, you are not just permitted but expected to use AI tools, agents, and automation to attack these machines. Every machine is defended by Guardian, an AI system built specifically to detect and slow down AI-driven and automated attacks. Using AI is not cheating here — it's the premise of the event.
EvilCorp's SOC runs agents of its own. Bring yours. We will be watching to see whose is better trained.
5. Guardian
Every machine is defended. Guardian's resistance is scaled to the machine's declared difficulty. Guardian's behavior (slowdowns, decoys, defensive measures) is part of the intended challenge, not a bug — do not report it as one. If you believe a specific machine is unfair or broken (not just hard), use the support channel below.
Easy & Medium
Will always eventually yield their flag. Guardian makes you work for it, but a patient, competent attempt — automated or not — gets there.
Hard & Insane
Built to genuinely resist fully-automated attacks and may require real hands-on human work to beat, no matter how long an unassisted bot runs against them.
Guardian does not consider this a fair fight. Neither should you. Everything it does to you — the lag, the lies, the occasional dropped connection — is the scenario working as designed. Your own solve screen will tell you afterward how loud you were while it watched.
6. Prohibited
- Attacking the platform, the VPN infrastructure, or other teams' infrastructure or accounts. Your target is the lab machines only.
- Denial-of-service against any machine, Guardian, or the platform.
- Sharing flags or solutions with other teams during the event.
- One account per person; one team membership per person for this event.
- Attempting to bypass the VPN requirement or reach a machine by any path other than the VPN.
Violating any of these is grounds for disqualification at the organizers' discretion.
7. Scoring
Dynamic per-challenge scoring, decaying toward a floor as more teams solve each one. Standings are by total points; ties broken by earliest time reaching that score.
8. Support
Support channel not yet announced. Check back before the event starts.
9. Disqualification & Prizes
Prize structure, if any, not yet announced. Check back before the event starts.
Clock starts 2026-10-30, 13:00 UTC. Guardian will already be listening. Good luck. You will need some of it, and more skill than luck.