Rules

Capture The Flags (CTFs) are cyber security themed competitions that present challenges which, together with general logic, problem solving and teamwork, require a range of cyber skills and techniques to solve. Topics covered include cryptography, steganography, open source intelligence, web exploitation, reverse engineering, digital forensics and more.

• Teams (of 2-4 competitors) are presented with challenges across a range of categories. The goal of each challenge is to recover a specific string of text (letters, numbers, characters), called a flag.

• PECAN+ CTF flags follow the format of: pecan{some_text_here}. The whole string, including pecan{ and }, needs to be submitted. Flags are not case sensitive, and they may or may not include pecan{} when uncovered by solving the challenge. When a flag is uncovered in a different format, the challenge description will indicate how to restructure the flag for submission. For example, the description for a challenge requiring you to uncover three bits of information may state that the flag needs to be submitted as: pecan{detail1_location2_name3}

• Points clarified: Teams gain points for every solved challenge. Most challenges are worth a maximum of 500 points. Every time a Team solves a challenge, the value of that challenge decreases, down to a minimum of 100 points. This means the final value of each challenge is set by how many Teams manage to solve it.

• There is no limit on incorrect flag submissions. However, attacking the virtual machine and/or the scoring infrastructure is prohibited (i.e.; anything outside the .chals.pecanplus.org subdomain). This includes sending a lot of useless traffic through automated tools (e.g.; dirbuster).

• Don't cheat! Compete ethically! Solve challenges ethically and within your Team only (i.e.; do not seek outside advice or help, do not share solutions with other Teams). You are, however, welcome to ethically use digital tools you have at your disposal.

A note on the use of Artificial Intelligence (AI): PECAN+ CTF is a competition for humans! However, we recognize that AI (including genAI, LLMs and other agents) can be useful digital tools. You are permitted to use AI as a tool and in targeted ways. However, using generativeAI to wholesale solve challenges for you (e.g.; asking AI to “solve this challenge”, only saying "yes" to AI agent prompts etc) is not sufficient to meet the requirement of being a "human-driven” solve of challenges.

Plus, it takes the fun out of participation, and is poor form in a competition!

• Although AI tools can be helpful, attempt challenges on your own first and only ask AI for help if you get stuck, or use it only in targeted ways. We will be monitoring the use of AI and we reserve the right to disqualify solves that are not being achieved in the spirit of ethical, human-driven participation. We will disqualify Teams who are relying heavily on AI.

Extra special challenges:

• The 2026 ASD Challenge: the first Team to complete the 2026 Australian Signals Directorate (ASD) Challenge: Homophonic Cipher, will win a prize pack.

Thanks for reading the Rules. If you find a problem, please let us know via Discord (“Support" tickets are for direct questions/comments to the PECAN+ CTF organising team. The #General channel can be used for public questions and comments), so that we can fix it and improve the PECAN+ CTF experience for everyone.