Instructions & Rules of Engagement

DHA 2026 — read this before you start your first challenge.

What this event is

DHA 2026 is a web-security capture-the-flag: a set of deliberately vulnerable challenges, each hiding one real-world flaw — broken access control, injection, insecure design, logic and race conditions, authentication and supply-chain failures. Find the flaw, exploit it, recover the flag, submit it on the challenge page.

Some challenges run as your own short-lived lab instance, spun up when you click Start on that challenge. Every challenge's own page tells you exactly what it expects and links back here for anything general.

Rules of engagement

This is a controlled, fully authorized environment — the challenges are meant to be broken. That authorization has a hard boundary: it covers the challenges you are given, and nothing else that runs the event.

In scope
  • The challenge apps served to you at your own lab URL.
  • Any technique the challenge invites — injection, logic abuse, forging tokens, timing, request races, tampering with your own requests and cookies.
  • Your own tooling — scripts, Burp/ZAP, fuzzers — within the posted rate limits.
  • Reading everything your lab exposes: source, source maps, responses, headers, error messages.
Out of bounds
  • Attacking the platform itself — the scoreboard, login, submission system, or anything that launches or routes labs.
  • Attacking other participants — their labs, sessions, accounts, or flags.
  • Denial of service, of any kind — volumetric floods, resource exhaustion, or knocking a lab or the platform over.
  • Reaching past a lab — the host, cluster, or network underneath it, and any pivot the challenge did not explicitly set up.
  • Social engineering staff or other players, and physical or out-of-band attacks.
  • Sharing flags, write-ups, or exploit code while the event is live.
Crossing the out-of-bounds line — especially attacking the platform, another participant, or attempting denial of service — is grounds for disqualification at the organizers' discretion. Traffic that looks like a flood or an attempt on the infrastructure is treated as abuse, not a challenge solve.

Scoring

Every challenge has a point value shown on its card, generally higher for harder challenges. A flag scores once — resubmitting a flag you already own adds nothing. Standings on the scoreboard are ranked by total points.

Point values for this event are set per challenge by the organizers — check each challenge's card for its current value. If this event runs first-blood bonuses or point decay, the challenge page and scoreboard will say so; treat the challenge page as the source of truth over any general expectation carried over from other CTFs.

Flag format

A flag looks like FLAG{XXXXXXXXXXXXXXXXXXXX} — the braces plus 20 uppercase Base32 characters (A–Z, 2–7). Submit it exactly as you found it — matching is case-sensitive and whitespace-sensitive, so paste, don't retype.

Every flag is yours, and only yours

Your flag for a challenge is derived from your identity and that challenge, using a keyed cryptographic hash the organizers hold the key to. No two participants ever get the same flag for the same challenge, and one of your flags reveals nothing about any other — yours or anyone else's.

  • A flag copied from another participant will not score. It was derived for their identity, not yours, and validation checks exactly that.
  • Sharing is detectable. Every submission is logged, and a flag that validates for someone other than the participant it was derived for is a clear signal — it points back to whoever leaked it, not just whoever used it.
  • Brute-forcing a flag isn't realistic — the space is astronomically large — and repeated wrong guesses are rate-limited regardless.

Lab lifecycle

90 min
maximum lab lifetime
30 min
idle timeout
5 min
warning before idle shutdown

A lab auto-terminates 90 minutes after you start it, whichever comes first against 30 minutes of no activity — the platform gives you a heads-up about 5 minutes before an idle lab is reaped, so keep interacting with it if you're still working.

Stopping and restarting a lab is safe. It does not lose your score. Your flags and points live on the scoreboard, entirely separate from the lab itself — if a lab looks stuck, wedged mid-exploit, or you simply want a clean start, stop it and start it again.

You may run up to 3 lighter labs at once, and 1 of the heaviest challenges at a time — a limit that protects capacity for everyone, not just you. Each challenge's page tells you which category it falls into if it matters for your workflow.

Conduct

Attack only what you're told to, keep your flags to yourself, and don't spoil the game for anyone else. Flag sharing, attacking the platform or other players, or using someone else's identity all end the same way — a warning, then disqualification. Be respectful toward the organizers, support staff, and every other participant.

When something breaks

First, try stopping and restarting the lab — it's safe, it does not cost you any score, and it clears the large majority of "stuck" states on its own.

If a lab is still broken after a restart, or you hit a platform problem (the site itself, login, or flag submission), contact the event help desk. Include the challenge name and roughly when it happened — every submission and lab action is logged with a timestamp, so support can look up exactly what happened on your account. Support can help with the platform; they won't give hints on the puzzles.

Everything on this page describes a controlled, authorized environment built for this event. The techniques you use here are for these challenges only — not for any system you don't own or don't have written permission to test.