Capture The Flag | BSides Kerala 2026

About BeSec CTF

Diverse challenge categories. No isolated puzzles. Every challenge mirrors a real-world target you'd hit on a real engagement.

This high-intensity capture-the-flag experience delivers a hands-on battlefield where participants take on real-world security scenarios across multiple domains.

Taking place on May 9th, 2026, at the Kochi Marriott Hotel, Edapally, Kerala, besec.ctf promises an intense, hands-on experience designed to push your expertise to its limits. Participants will face a wide range of advanced challenges, including network exploitation, cryptographic puzzles, reverse engineering, and coding tasks. This is a unique opportunity to engage with real-world cybersecurity scenarios that demand precision, quick thinking, and innovative problem-solving.

The stakes are high, and the rewards are even higher. Top-performing teams will earn recognition and incredible prizes, solidifying their place as leaders in the cybersecurity field. Whether you’re looking to showcase your talent, learn from cutting-edge challenges, or simply experience the camaraderie of a world-class event, besec.ctf has something for everyone.

Mark your calendar for May 9th, 2026, and join us at Kochi Marriott Hotel for this unforgettable experience. Don’t miss your chance to capture the flag and make your mark in the future of cybersecurity competitions.

Rules of Engagement

Read the rules before you turn up. Stay in scope, play hard, and don't be that person.

Eligibility & Registration

Open to all registered BSides Kerala 2026 attendees with a valid conference ticket.
CTF registration is required separately at the event check-in desk.
Slots are limited and assigned on a first-come, first-served basis.
Bring a valid photo ID for verification at check-in and prize collection.

Team Formation

Teams of up to TBA participants. Solo entries are allowed.
Team composition locks at the start of the competition. No substitutions afterward.
Each team nominates a captain, who is accountable for compliance with these rules.
One team per participant. Multi-team play is forbidden and grounds for disqualification.

Equipment & Access

Bring your own laptop with your offensive toolkit pre-installed. Internet access on-site is not guaranteed for downloads.
VPN credentials and lab access are issued at check-in, not before.
Power outlets are available at the venue. Bring a charger and a backup if you have one.
Conference Wi-Fi is provided but is not the CTF network - connect to the lab VPN to access the range.

Allowed Techniques

Any offensive technique is fair game against in-scope range targets.
Public exploits, custom tooling, exploitation frameworks (Metasploit, Impacket, Sliver, etc.) are all allowed.
Automated scanning and brute-forcing against challenge boxes is permitted, within reason.
Teams may share write-ups and tooling after the competition ends - not during.

Out of Scope

No attacks against other participants, their devices, or their accounts.
No attacks against the venue network, conference infrastructure, or any system not explicitly listed in scope.
No DoS or resource exhaustion against shared infrastructure or the scoring platform.
No attacks against the scoreboard, the CTF platform, or organizer systems.
Persistent backdoors on shared boxes that block other teams are forbidden.

Scoring & Tiebreakers

Each flag carries a fixed point value based on category and difficulty.
First-blood bonus awarded to the first team to capture each flag.
Tiebreakers resolved by total time-to-capture across all flags.
Live scoreboard available throughout the competition. Updates may have a small lag.
Organizer decisions on scoring disputes are final.

Disqualification

Flag sharing or collusion between teams is an immediate DQ.
Any out-of-scope attack results in immediate DQ, no warnings.
Disrupting other teams' access or progress results in DQ.
Repeated platform abuse or attacks against organizer infrastructure result in DQ and ejection from the venue.
Disqualified teams forfeit any prize eligibility.

Conduct & Disputes

The BSides Kerala Code of Conduct applies for the entire duration of the CTF.
Direct any complaints or disputes to the CTF organizers at the help desk - do not air them publicly.
Found a bug in the platform or the range itself? Report it privately. Do not exploit it for points.
Be respectful to other competitors, the organizers, and the venue staff.
Organizer decisions on conduct issues are final and binding.

By participating, you agree to abide by these rules and the BSides Kerala Code of Conduct. Rules may be updated before the event - the latest version on this page is authoritative. Questions? Contact the organizers.

BSides KeralaCTF

When and Where