Capture The Flag | BSides Kerala 2027

Rules of Engagement

Read these rules before the competition starts.

Eligibility & Registration

Open to all registered BSides Kerala 2027 attendees with a valid conference ticket.
CTF registration is required separately at the event check-in desk.
Slots are limited and assigned on a first-come, first-served basis.
Bring a valid photo ID for verification at check-in and prize collection.

Team Formation

The maximum team size will be announced before the event. Solo entries are allowed.
Team composition locks at the start of the competition. No substitutions afterward.
Each team nominates a captain, who is accountable for compliance with these rules.
One team per participant. Multi-team play is forbidden and grounds for disqualification.

Equipment & Access

Bring your own laptop with your offensive toolkit pre-installed. Internet access on-site is not guaranteed for downloads.
VPN credentials and lab access are issued at check-in, not before.
Power outlets are available at the venue. Bring a charger and a backup if you have one.
Conference Wi-Fi is provided but is not the CTF network. Connect to the lab VPN to access the range.

Allowed Techniques

Any offensive technique is allowed against in-scope range targets.
Public exploits, custom tooling and exploitation frameworks (Metasploit, Impacket, Sliver, etc.) are all allowed.
Automated scanning and brute-forcing against challenge boxes is permitted, within reason.
Teams may share write-ups and tooling after the competition ends, not during.

Out of Scope

No attacks against other participants, their devices, or their accounts.
No attacks against the venue network, conference infrastructure, or any system not explicitly listed in scope.
No DoS or resource exhaustion against shared infrastructure or the scoring platform.
No attacks against the scoreboard, the CTF platform, or organizer systems.
Persistent backdoors on shared boxes that block other teams are forbidden.

Scoring & Tiebreakers

Each flag carries a fixed point value based on category and difficulty.
First-blood bonus awarded to the first team to capture each flag.
Tiebreakers resolved by total time-to-capture across all flags.
Live scoreboard available throughout the competition. Updates may have a small lag.
Organizer decisions on scoring disputes are final.

Disqualification

Flag sharing or collusion between teams is an immediate DQ.
Any out-of-scope attack results in immediate DQ, no warnings.
Disrupting other teams' access or progress results in DQ.
Repeated platform abuse or attacks against organizer infrastructure result in DQ and ejection from the venue.
Disqualified teams forfeit any prize eligibility.

Conduct & Disputes

The BSides Kerala Code of Conduct applies for the entire duration of the CTF.
Direct any complaints or disputes to the CTF organizers at the help desk rather than raising them publicly.
Found a bug in the platform or the range itself? Report it privately. Do not exploit it for points.
Be respectful to other competitors, the organizers, and the venue staff.
Organizer decisions on conduct issues are final and binding.

By participating, you agree to abide by these rules and the BSides Kerala Code of Conduct. Rules may be updated before the event; the version on this page is the one that applies. Questions? Contact the organizers.

BSides KeralaCTF

When and Where