FAQ

Yes — hit Play solo on your profile for a one-click team of one. Scoring requires a team, so solo play is simply a team of one; you can also create or join a team of up to four.

There's no flag to type in. Fork the target's repo under the owasp-ctf-test org, fix the vulnerability on a branch in your fork, and open a pull request against the repo's ctf branch. That's the only branch the scorer watches, and there is no per-challenge branch. A GitHub Action builds your app, runs the rubric, and posts your score on the PR, usually in two to five minutes. See How to Play for a worked example.

No. The scoring pipeline builds and runs your patched app in CI, so a PR is enough. Running it locally is just faster to iterate against while you work out the fix.

Yes, please do. Using AI to analyze and remediate these vulnerabilities is the skillset this event is built around, not something to hide or work around. Bring whatever you already use, and point it at your fork. OWASP's own Secure Agent Playbook will get you further faster. It gives an agent structured, OWASP-grounded procedures for code review, dependency and secrets scanning, and API assessment, mapped to the same Top 10 categories these challenges are graded against.

Some challenges offer one on your profile. Revealing a hint costs 10 points off your total, applied as soon as you reveal it, so save them for a challenge you're genuinely stuck on.

Check the scoring comment on the PR. If it says the score wasn't recorded, that's on our side. Push another commit and the run will record it. If it shows zero challenges patched, the rubric still reproduced the vulnerability, so the fix didn't fully close it. Points also only count for the PR author's account.

Yes, as many times as you like. Push another commit and it re-scores. Your best-ever result per challenge counts, so a later fix replaces an earlier miss and you can never lose points you've already banked, even if a later patch breaks a challenge you'd already solved.

Sign in, open the Quiz page, pick your answer and submit it. Some questions have a single right answer; others are select-all-that-apply and only score if your whole selection matches. Grading is immediate, against a stored answer key, so there is nothing to wait for and nothing for an organizer to review.

Sometimes. Organizers can cap how many times a question may be attempted and hold you on a cooldown between tries. The question says when it is on cooldown and when you have run out of attempts. Once you have answered one correctly, it is done.

Check that you were signed in when you submitted: nothing is graded for a signed-out visitor. On a select-all-that-apply question, a partly right selection scores nothing, so check whether you missed one of the correct options.

Sign in, open the Flags page, and paste the flag into the box under the one you solved. Grading is instant and happens the moment you submit: there's nothing to wait for and nothing for an organizer to review.

Leading and trailing whitespace never matters — it's trimmed before the comparison. Case usually doesn't either, but a flag can be marked case-sensitive, and its card tells you when it is; those are compared exactly as written.

Yes, as many times as you like — there's no cap on attempts. Organizers can put a short cooldown between submissions on the same flag; the board tells you when it's still counting down.

Check that you were signed in first: nothing is graded for a signed-out visitor. If you'd already solved that one before, resubmitting the same flag doesn't add more points — you already have them.

By points, for individuals and teams alike. At equal points, whoever completed more items ranks higher, and after that whoever earned their last points first, in any module.

Yes. Prizes go to the top individuals and top teams overall. You must be present at the closing ceremony to claim.

Find an organizer at the OWASP CTF in a Box area.