Rules
Short on purpose. Entering means you accept all of it.
Format
- Solo. One account per person. No teams, no shared logins. Duplicate accounts are removed and all of them disqualified.
- Entry is Rs 100, paid once by JazzCash to 0309 9578150. Upload the screenshot after you register and an organiser confirms it by hand. That number is the only one we collect on — anyone giving you a different one is not us.
- If we cannot run the event, the fee comes back. If your payment cannot be confirmed you are told why and can send it again. Once you have played, the fee is not refundable.
- Six hours, Fri 30 Oct 2026, 2:00 PM PKT to 8:00 PM PKT. Every time on this site is Pakistan time.
- Twelve flags, each looking like
TBZ{...}. Flags are case-sensitive. Surrounding spaces and line breaks are stripped for you, so a messy paste is not a wrong answer.
Scoring
- Points decay with solves. The first person to solve a challenge earns its full value; each later solver earns slightly less, down to a floor.
- What you earn is yours. Your points are fixed at the moment you solve. Nothing you already banked can shrink because other people caught up.
- Harder challenges decide the result. Clearing the warm-ups puts you on the board; it will not put you in the top three.
- Ties break on time. Equal scores are ranked by who reached that score first.
- No negative marking. A wrong flag costs you nothing but time. Submissions are rate-limited to 10 per challenge per minute, so brute force is not a strategy.
- The board freezes for the last 30 minutes. Flags still count — you just cannot watch the standings move.
Allowed
- Any tool you like, on your own machine. Burp, Wireshark, Ghidra, CyberChef, Python, a hex editor — all fine.
- Search engines, documentation, write-ups of other CTFs, and AI assistants. Looking things up is the job.
- Asking the organisers whether a challenge is broken. We will tell you that, and nothing else.
Not allowed
- Sharing flags or solutions during the event — in any direction, in any group. Both accounts are disqualified, and we can see it in the submission log.
- Attacking this scoreboard, the TechBiz website, the academy, or any infrastructure that is not explicitly named as a target in a challenge. The targets are listed in the challenge text; everything else is out of scope and will be reported.
- Attacking other players, or anything that degrades the event for others: scanners pointed at the site, request floods, automated submission scripts.
- Brute-forcing flags, or hammering a target to find one. Every challenge has an intended route that does not need volume.
- More than one account. Including a friend's, a sibling's or a second email.
Scope, plainly: the only systems you may test are the ones a
challenge names. This scoreboard is not one of them. Testing anything else
belonging to TechBiz Security is unauthorised access, and we will treat it
that way rather than as a clever entry.
Prizes and verification
- Rs 2,000, Rs 1,000 and Rs 1,000 for the top three.
- Before anything is paid, the organisers review the top three's submission history. A result that cannot be explained is not awarded.
- Winners may be asked for a short write-up of how they solved the hard challenges. Not being able to produce one is itself an answer.
- Prizes are paid to the name on the registration, so register under your own.
- Anyone who solves at least one flag can request a participation certificate afterwards.
Decisions
- If a challenge turns out to be broken or unsolvable, we may fix it, re-score it, or drop it. That decision applies to everybody equally.
- The organisers' decision on disqualification is final. We will tell you which rule it was.
- Anything not covered here, ask: WhatsApp +92 304 9196868.