FAUST CTF is an IT security competition for teams of one or more members ("the teams", "the participants" or "you"). It is organized by FAU Security Team ("the Organizing Team" or "we") on behalf of Fachschaft der Technischen Fakultät Erlangen e.V.
As events happening during a CTF competition are hard to foresee, these rules may be enhanced or changed at any time before or during the competition. Changes will be announced via email and/or Discord (#announcements channel on the FAUST CTF server). In cases not covered by the rules, we will decide according to our own judgement.
Schedule
The password for service decryption will be released at 2025-09-27 12:00 UTC via email and Discord. Network connections between teams are enabled one hour later, at which point Gameserver traffic and scoring starts as well. The competition is then planned to run for eight hours, but might be expanded.
One tick lasts three minutes. The Gameserver checks the functioning of each service once per tick and places a new flag. Therefore, one flag exists per tick, service and team. Flags can be submitted within five ticks from their generation.
Scoring
The total score is the sum of the individual scores for each service. The score per service is made up of three components:
- Offense: Points for flags captured from other teams (except the "NOP team") and submitted to the Gameserver within their validity period
- Defense: Points for not letting other teams capture your flags
- SLA: Points for the availability and correct behavior of your services
Scores per Service
For each service, the component scores for a team are calculated as in this Python-like pseudocode:
Offense:
offense = count(flags_captured_by[team])
for flag in flags_captured_by[team]:
offense += (1 / count(all_captures_of[flag]))
Defense:
defense = 0
for flag in flags_owned_by[team]:
defense -= count(all_captures_of[flag]) ** 0.75
SLA:
sla = (count(ticks_with_status['up'] + 0.5 * ticks_with_status['recovering'])) * sqrt(count(teams))
Total Score
total = 0
for service in services:
total += offense[service] + defense[service] + sla[service]
Bug Bounty
Responsible disclosure of vulnerabilities and serious bugs in our infrastructure or rules will be rewarded with bonus points according to our judgement as well as eternal fame.
Technical Behavior
The Vulnboxes of other teams are the sole target for exploitation, attacks against competition infrastructure or any other portion of a team's network (inside or outside of the VPN) are forbidden.
Causing unnecessarily high loads for CPU, traffic, memory, I/O, etc. ("denial of service") on our infrastructure, other teams (including Vulnboxes) or any other party is also strictly prohibited. To prevent a team from consuming too many resources, network rate limiting (on traffic and/or requests) can be applied by the infrastructure. Breaking a service of another team through sheer amount of requests is forbidden, breaking it through a vulnerability is OK as long as it does not lead to resource spikes. But remember that preventing yourself from stealing their flags won't do you any good.
Despite these policies, all participants are responsible for the security of their own hard- and software. We will do our best to enforce the rules, but cannot give any guarantees for other participant's behavior. FAU Security Team and Fachschaft der Technischen Fakultät Erlangen e.V. are not liable for any potential damage to your equipment.
Social Conduct
The goal of FAUST CTF is to allow people to practice their skills and have fun. We ask you to avoid spoiling other's fun unnecessarily.
We want the competition to be a pleasant experience for all participants, regardless of their gender, sexual orientation, race, religion, skill level, personal background or any other criteria. Therefore, we do not tolerate harassment in any form.
This especially applies to our official communication channels such as the FAUST CTF Discord server. Misbehavior may lead to a ban from these communication channels and ultimately, the same consequences as for any other rule violation (see below). We ask everyone to speak English on the Discord server, so that all participants know what's going on.
Teams are prohibited to collaborate with other teams (e.g. share flags, information on vulnerabilities and exploits, or similar). Every individual participant must only be member of one team. There may be some services where collaboration is allowed, this will be stated explicitly.
Enforcement
Violation of the rules or any other hostile behavior may lead to deduction of points, temporary or permanent exclusion from the competition or any other measure deemed appropriate by the Organizing Team.
We suggest every team to have at least one representative on our Discord server with a nick starting with the team name. In case of problems this will be our first point of contact, because email delivery can be slow. If we want to stop you from doing something and are not able to reach you as fast as the issue requires, we might temporarily kill your VPN connection in order to get your attention.
LLM Policy
FAUST CTF does not ban or limit any form of AI usage. However, we believe that the educational aspects and the fun of solving CTF challenges are impacted if challenges are solved with only minimal human interaction. Please keep your own fun in mind when deciding how you use llms during the competition.
Additionally, we provide an optional "Low-LLM" checkbox during registration. By checking this box, your team and all of its members voluntarily commit to the following principles:
- No use of Agentic AI (Claude Code, Codex, GitHub Copilot, or similar)
- Do not provide significant parts of challenges to AI systems, short snippets are fine
- Adopt no significant outputs (exploits and similar) from AI systems, short snippets are fine
As a low-llm team it is fine to use chat bots and similar systems as a "glorified Google", i.e. for research and explanations of concepts.
Apart from an annotation on the scoreboard, there will be no distinction between low-llm and unrestricted llm teams. You will have no advantage by declaring yourself as a low-llm team. In the spirit of fair play, please only check this box if you abide by the rules above, so that results between teams can be compared reasonably.