RabaCTF is a team CTF event provided by the RabaCTF organizers for your enjoyment. The CTF event is run by a team of volunteers - we don't have big sponsors or a large rewards pool. As such, we request your support to make sure the event runs smoothly.
Don't attack the infra: this means the submission server, game server, VPN, router, underlying cloud providers, Discord, or thse organizer's tools or personal infrastructure.
Attack the other teams' Vulnboxes, but not the players themselves: this means it is fair game to launch cyberattacks agains the services running on the Vulnboxes, but it is not allowed to target players' computers or infra-boxes.
Teams must maintain the availability of their services throughout the competition. Intentional or reckless modifications that permanently disable critical services are grounds for penalties or disqualification.
Give us a heads up if the infra is broken: we have set up firewalling and NAT to ensure that traffic doesn't flow the wrong way. If it does, let us know!
Don't grief in chat: hateful, spammy, abusive and harassment in communications (whether private or using the RabaCTF server) is disallowed and also goes against Discord policies. Keep it civil, assume good intent, and be respectful.
If you manage to escape the container during the Attack and Defense CTF, ensure that your actions do not restrict team access, disrupt essential services, or violate competition rules.
Exploits should not cause excessive load (CPU, memory, or network traffic) that could disrupt the availability of any Vulnbox—even if done unintentionally. Techniques that intentionally lead to Denial-of‑Service (DoS) conditions are disallowed.During the CTF, you should keep your team communications private. Play with your teammates, and don't involve other teams.
It's fine to chat in Discord, as long as you aren't leaking the solutions, sharing flags or providing hints to other teams during the event.
It's OK to share writeups and discuss challenges after the RabaCTF event is over.
The RabaCTF organizers are working to ensure a high quality event for the players. We test challenges before release, test the infrastructure, and have monitoring & logging set up to catch any flaws early.
Even so, there may be issues - either downtime, scoreboard issues, health checking issues and so on. We'll keep those to a minimum, and strive to resolve issues quickly to ensure the players have fun.
The RabaCTF organizers won't guarantee that the events will be error free, uninterrupted or have flawless security.
You are free to use RabaCTF to train, play, have fun and learn together. However, CTF scores are not perfectly representative of your team's abilities. As such, we ask you not to rely on RabaCTF 2025 scores for anything important - like qualifying players to play in ECSC.
We provide a live scoreboard system so your team can track their progress, and to provide a competitive environment for the players. The scoreboard however may have issues, such as an incorrect health check result, or missing data. In these cases, we will not adjust the scoreboard in any way, and the game will continue counting points as normal.
Your entire team is responsible for the actions of any single member. If a team mate is in violation of these rules, the entire team will receive the corrective actions. This is either due to technical or procedural reasons. For example, to stop a DDoS attack, we have to disconnect the entire team instead of just one member.
As such, we ask you to be mindful of your teammates and ensure that the actions of a single member don't cause a bad experience for all of your team's players.
Successful participation in RabaCTF does not bring you rewards or acclaim, so we ask you not to cheat, and to play with good intentions. We will not hesitate to disconnect teams that are hateful, abusive, harassing other players or disrupting gameplay.