Rules

The KalmarCTF 2025 is a jeopardy-style CTF and does not require any VPN setup.

All participants are encouraged to use individual accounts and be part of a team. If you intend to participate alone, create a solo team.

During the contest, sharing flags, solutions, or even hints is strictly prohibited and will lead to disqualification. Any attempts to request any flags, solutions, or hints can lead to disqualifications.

Attacking machines other than those designated as KalmarCTF target machines is prohibited. We encourage friendly competition and kindly ask that participants refrain from any actions that may prevent others from having fun. Bruteforce and scanning is prohibited unless obviously the solution. In case of any doubt, ask an admin for verification before running the attack. DoS of any form will result in disqualifications.

The primary method of communication for the CTF will be through Discord, but we might also make some announcements on Twitter. We strongly recommend using Discord for receiving updates and reaching out to the organizers if needed.

If you think you have a valid flag that the system rejects, please contact us.

If you find a bug in the contest infrastructure, please report it to us. Any attacks against the infrastructure will result in disqualification.

The scoring scheme is dynamic, and points may change during the contest. We decided to make our own custom CTFd dynamic scoring algorithm based on two goals: hard challenges should be worth significantly more, and points should scale according to solves. We settled on the following function: when a challenge has n solves, it is worth 1000 * sqrt(2 / (1 + n)) points, down to a minimum of 100 points.

To claim prizes, we might ask for a TLDR of the hardest challenges, which must be submitted no longer than 24 hours after the CTF ends. Relevant teams will be notified when approaching competition end.

We reserve the right to disqualify any team that goes against what the event organisers deem to be good conduct. Any and all prize awards are subject to any laws and local regulations, and any contender can therefore be ineligible if subject to such restrictions. The prize winners are required to make sure that they follow local legislation and report the winnings if required. Any prize winner will be required to provide enough information to ascertain their eligibility. Furthermore, prize winners might be required to subject to KYC by our sponsors.

If you are unsure about any rule, please don't hesitate to reach out and ask us.

Good luck, happy hacking, and as always, STACK GO BOOM BOOM!