0x03 Capture the flag

Tuned here, for this room.

The Security BSides Dehradun 0x03 Online CTF runs in two rounds: a free 36-hour online qualifier on 5–6 March 2027, open to anyone, then the final on site on day one. Playing on your own is a normal way to play.

Built by: The BSides Dehradun team On LevelUpCTF, our CTF partner, for the online round. Every challenge is tuned here before it goes live, and the final on site is ours end to end.
Rounds: Two, online then on site A free online qualifier on 5–6 March 2027, running 36 hours and open to anyone, then the final at the UPES Bidholi campus on day one for the top 100 to 120.
Entry: Free online, ticketed on site The online round costs nothing and needs no ticket. For the final you need either a conference pass, which covers both days, or a competitor pass at ₹699 for day one alone.
Team registration: Open, no ticket needed The form on this page is live and works. It registers a team for the free online round, and the ticket field stays optional because that round does not need one.

3–4 April 2027 UPES Bidholi Campus, Dehradun Online round, then the final on day one

01 What it is

A conference CTF, pitched at the room it is played in.

Two audiences, one scoreboard: students who have never played, and people who play every weekend. The difficulty curve is set for both, which is only possible because the difficulty is ours to set.

A wide view down a long line of white bench desks in a hall with a pale wooden floor, around twenty-five people working at laptops with headphones and phones beside them, teal and yellow chairs, taped cable runs across the floor and a green fire exit sign above double doors at the far end. — The CTF floor, one long line of desks and nobody talking.

Round one · 5–6 March 2027

The online round

Free, open to anyone who registers, played from wherever you are, and it runs for 36 hours. The hour it opens goes out with the programme and reaches the email on your registration.
Shortly after

Everyone hears the result

Qualified or not, by email. The top 100 to 120 participants go through, and solves are checked by write-up and against each other before that list is fixed.
Day one · Saturday 3 April

The final, on site

Qualifiers only, at UPES Bidholi Campus, Dehradun, on your own laptop. Workshops run the same day; the talks and the villages are on day two.

The online round runs on LevelUpCTF, our CTF partner. Our own team tunes every challenge it generates and sets the difficulty across easy, medium, hard and extreme. The smaller final on site is built and run by the team itself.

Play alone or in a team

A team of one is a team. The form below takes a single name as happily as four.
First time is a normal way to start

Entry-level challenges exist so a beginner solves something on their first attempt. Real challenges pitched low, not participation trophies. Say on the form it is your first one and somebody will point you at them.
Anyone can play the online round

Not invitational, no shortlist, and it costs nothing. The final is the one thing you have to earn, and you earn it online on 5–6 March 2027.
Arriving without a team is not a problem

Tick the box on the form and we will pair you up before the online round, or at the CTF desk on the day.

Why the tuning matters

A challenge shipped exactly as it came off the platform is one somebody may already have seen, write-up and all. Reworking each is more work for the team and a fairer game in both rounds.

Not a player?

The villages are the other half of the hands-on programme: a table, a subject, and someone who will explain it forty times. Several are gentler than a CTF for a first weekend.

See the villages

A player in a cream hooded top leaning in close to a laptop with one hand at their glasses, and a line of desks receding behind them where six or seven more people work at laptops under concrete pillars. — Heads down on a challenge.

Two players sharing one long desk, the nearer one in a navy fleece with a laptop open on a terminal, the further one watching their screen, and a paper cup and a phone between them. — Two hours in, on the same problem.

One laptop from over the player's shoulder, a dark terminal filling the screen, with a second competitor at the next desk along and the hall out of focus behind. — One screen, close up.

A side table against a window wall, two people working on laptops with a third leaning over to look, daylight coming in behind them. — The side tables, by the window.

02 How to take part

Four steps, and only one of them is a gate.

Nothing here is first-come. The one thing you have to earn is a seat in the final, and you earn it on the online round's scoreboard.

Register the team on this page

One submission per team, filled in by whoever does not mind being written to. That is the whole entry to the online round. Solo players register on the same form with fewer names in it.
Play the online round

On 5–6 March 2027, from wherever you are, over 36 hours. Free, and no ticket needed. The hour it opens is emailed to the address on your registration.
If you qualify, pick how you get in

The final is at the conference, so it needs a pass: a full conference pass, or the ₹699 competitor pass. Qualifying does not oblige you to buy the bigger one. Tickets are not on sale yet, and the registration section carries the three full prices, which are set.
Bring a laptop, and find the CTF desk

The final is on day one. Assume contested wifi. Where the desk is and when it opens go out with the programme, and it is where to go if your team is a person short.

Online round: Free, on 5–6 March 2027 Open to anyone who registers, no ticket needed. The hour it opens is not set yet, so it is not printed here.
Final: Day one, on site The top 100 to 120 from the online round, at UPES Bidholi Campus, Dehradun, on your own laptop.
Cost: Free online · ₹699 on site The competitor pass covers day one and the final. A full conference pass covers both days and gets you in too.
Format: TBA Categories and scoring are published with the programme.
Duration: Online round, 36 hours How long the on-site final runs goes out with the programme.
Who reaches the final: The top 100 to 120 participants The organisers' own figure. Where the line falls and the tie-break on it are published before the round opens, not after it closes.
Fair play: Checked by write-up submission and plagiarism checks Solves are verified before the qualifying list is fixed, so a flag that came from somewhere else does not take a seat from a team that earned it.
Team size: Teams of one to four A team of one is a team, and four is the cap the registration form enforces.
Prizes: TBA Dependent on sponsorship. We will not announce a prize we are not certain we can hand over.
Bring: A laptop and a charger Assume contested wifi and plan for it.
Ask about it: support@bsidesdehradun.com

03 Register

One form, one team, and no queue.

The only way in, and it is free. It puts your team on the online round's scoreboard and tells us how many people are playing their first CTF. Nothing on it is checked against anything except the ticket list, once sales open.

How are you playing?, required

On my own A team of one is a team.

Creating a team, and I am the captain We email you a team code. Pass it to the others and they each register with it. Up to four of you in total.

Joining a team that already exists Your captain has the code. It goes in the team code box below.

Your name, required Whoever fills this in is who we write to.

Your handle, required What you want on the scoreboard. Your own name or an alias that leads nowhere near it, either is fine. We do not check it.

Email, required Anything the CTF needs to tell you in advance goes here, the team code included if you are the captain.

Team name, required Not the same thing as your handle. On your own, your handle is a fine answer. Joining, use the name your captain registered, and if the two do not match, the code decides.

Team code, only if you are joining The code your captain was emailed. Leave it empty if you are playing alone or creating the team. If you are joining without it, register anyway and say so in the last box.

Everyone else on the team, optional One name per line, yourself included or not. Leave it empty if you are playing alone or still recruiting. The online round is free, and passes only come into it if the team reaches the final.

How much CTF have you played?, required

Answer for the team, not the strongest player in it. It is not scored and it does not put you in a bracket.

How many of you, optional A team is one to four people, so 1 is a normal answer. Count yourself in it.

Do you already have a 0x03 pass?, required

It changes nothing about the online round, which is free whichever you pick. It matters for the final on day one, which needs a pass. What a pass costs.

Ticket reference, optional Only if you answered yes above: the order or ticket ID from your confirmation email. We check it against the ticket list and store nothing else from your order.

Pair me up with other players Tick this if you are arriving without a team, or with room for one more. We introduce people by email beforehand, or at the CTF desk on the day.

Anything we should know, optional Access requirements, a laptop you cannot bring, a category you have never touched and would like pointing at. Practical things. This is not a pitch.

I have read the code of conduct and it applies to us, required Read it here. It is short, and it covers the CTF the same way it covers everything else.

This reaches the organising team, and the scoreboard part of it reaches LevelUpCTF, the CTF platform. It is not a payment and does not confirm a ticket. What we do with it.

Before you fill it in

Start hour to be confirmed
The form is open now and does not close early. The online round runs on 5–6 March 2027, free, with no ticket involved until the final. The start hour reaches the email address you put on the form.

What we do with it

On the scoreboard: Your handle and your team name.
Sent to the platform: Handle, team name, and an email address to attach the account to. LevelUpCTF runs the online round and is our CTF partner.
Stays with us: What you told us about experience, about access, and anything in the last box.
Your email: Anything the CTF needs you to know in advance, and pairing you up if you asked for it. There is no separate CTF mailing list to come off.

The form sets no cookie and adds no tracker. Analytics are a separate question, site-wide and only if you accepted them. The privacy page says what they are and names every company involved.

No cookie from the form

Changed your mind, or your line-up

Write to the address below and we will edit the entry. No need to submit the form twice. Withdrawing is a sentence, and nobody chases it.

support@bsidesdehradun.com

04 Fair play

Five rules that were true before the challenges existed.

Not the full ruleset, which goes out with the programme. These are the part that does not depend on what gets written.

Attack the challenges, nothing else

The scoreboard, the platform, the conference wifi, the venue's systems and the laptop next to you are not part of the game. If a challenge seems to let you reach outside it, that is a bug. Tell us and you will not be penalised for finding it.
Flags stay inside your team

Working it out together is the whole activity. Handing a flag to another team is not, and both teams lose the points.
Qualifying solves are checked

Before the qualifying list is fixed, solves are verified by write-up submission and plagiarism checks. A write-up does not have to be elegant, it has to be yours: say how you got there.
Tell us if you break something real

Say so at the CTF desk, or by email while the online round is running. Nobody is thrown out for a mistake reported honestly.
The code of conduct applies here too

A competition does not suspend it. It covers the CTF room exactly as it covers a talk track, and the reporting route is the same one. How reporting works.

The full ruleset

Not settled yet, and published with the programme and emailed to everyone registered:

Categories
Scoring
Hints, and their cost
Tie-breaks
Where the cut line falls

Writing challenges, not solving them

Anyone who has written a challenge for this edition cannot score on it, and the team keeps that list.

05 Questions

The ones we are actually asked.

Do I need a team to enter?

No. Register on your own and you are a team of one on the scoreboard, which is a normal way to play a conference CTF. If you would rather not, tick the pairing box on the form and we will try to introduce you to other players before the online round, and if that has not worked out, the CTF desk will do it on the spot at the final.

Does everyone on the team need a ticket?

Not for the online round. That one is free and needs no ticket at all, from anybody. For the final, yes: it is played at the conference, so everyone at the table needs to be able to get in. There are two ways to do that, a full conference pass or the competitor pass at ₹699, and they are per person either way.

One ticket reference per team is all the form asks for, and that is how we recognise the registration, not a way of covering four people.

Can I come only for the CTF, without a conference ticket?

Yes, if you qualified. The Competitor pass is ₹699 and it covers exactly this much: day one, the CTF final only. It is not a cheap way into the conference. It does not cover day two, the talks or the villages floor, and who may buy it is narrow: players who qualified in the online round.

If you get here on the competitor pass and decide you want the second day after all, you are not buying a second ticket. Pay the difference between ₹699 and the current price of the Student, Individual or Corporate pass you choose. So qualifying during a later, dearer pricing stage does not cost you more than buying the full pass would have on the day you upgrade. The upgrade does not close when sales do. Ask by email, or find any of the team on site before or after the final, and they can sort it there. The address is support@bsidesdehradun.com.

How long does the online round run?

36 hours, on 5–6 March 2027. It is a window rather than a sitting: you are not expected to be awake for all of it, and the hour it opens goes out with the programme and by email to everyone registered.

I have never played a CTF. Is it worth entering?

It is the reason the entry-level challenges exist. They are real challenges pitched low, not participation trophies, and they are written so that somebody who has never seen a CTF before solves something in the online round. Say on the form that it is your first one and somebody will point you at them.

Can I play remotely?

The first round is online, so for that one, yes: register a team and play from wherever you are, on 5–6 March 2027. The final is not remote. It is on site at UPES Bidholi Campus, Dehradun, on day one, on your own laptop, and only the top 100 to 120 from the online round play it. Bring a charger and assume the wifi is busy.

Do we have to send in a write-up?

Qualifying solves are verified by write-up submission and plagiarism checks, so plan on being able to explain how you got a flag. Whether every team submits one or only the ones a reviewer looks at is being settled, and the ruleset that goes out with the programme will say which. Either way it is not a writing competition: rough notes that show the route are the point.

What if we do not qualify?

Everyone who played the online round is emailed the result either way, rather than left to work it out from a scoreboard. The round itself cost you nothing, so there is no refund to chase. If you have a conference pass it is not a CTF ticket: it still admits you to both days, and the villages floor on day two is the other half of the hands-on programme. See the villages.

Will I have to choose between the CTF and the talks?

No, and that is why the programme is arranged the way it is. The CTF final is on day one, alongside the workshops. The talks and the villages floor are on day two. The one clash the shape does create is between the final and a workshop on day one, and the hours for both go out with the programme, so you will be able to plan around something specific rather than guess.

What are the prizes?

To be confirmed
They depend on sponsorship, and we will not announce a prize we are not certain we can hand over. If your company would like to back it, the sponsor page is the place to start.

What tools am I allowed to use?

Assume the ordinary answer: your own machine, your own tooling, the internet. The one thing that is not allowed is taking a flag from outside your team. The ruleset published with the programme is the authoritative version, and if it restricts anything unusual it will say so plainly rather than in a footnote.

Can I write a challenge for it?

Possibly, the set is tuned by the team, and the team is volunteers. Email info@bsidesdehradun.com with what you have in mind. Writing one means you cannot score on it, which is worth knowing before you offer.

Play it

The form takes a minute and the scoreboard remembers you did it.

Register once, alone or as five. The online round is free and comes to you, and the final is on day one for the top 100 to 120 who get through it.