CSAW'23 CTF Competition Eligibility & Rules

CSAW CTF is an entry-level, jeopardy style CTF, designed for university-level students who are interested in the field of security. Challenges are meant to exhibit fundamental concepts and help students develop their skills.

Challenge categories will include: binary exploitation, reverse engineering, cryptography, web security, forensics, mobile security, industrial control systems, and miscellaneous challenges.

CSAW CTF has been faithfully organized by students of the NYU OSIRIS Lab for 20 years.

CTF is one of ten competitions organized annually by the NYU Center for Cybersecurity in collaboration with our five global partners in Europe, India, Israel, MENA, and Mexico.

The competition occurs over two rounds:

Qualification Round in September (online)
Final Round in November (whether Finals will take place in-person or online varies by region)

Europe: online
India: online
MENA: in-person
Mexico: online
US-Canada: in-person

CSAW CTF Qualification Round
Dates		Time	Duration	Challenges	Location
Start	15 September 2023	16:00 UTC	48-hours	~30, 1 - 500 points	online ctf.csaw.io
End	17 September 2023	16:00 UTC

CSAW CTF Final Round
Dates		Time	Duration	Challenges	Location
Start	9 November 2023	16:00 UTC	36-hours	~30, 1 - 500 points	Varies by region: online or in-person, but still hosted on ctf.csaw.io
End	11 November 2023	4:00 UTC

Europe Eligibility for Finals
Global partner: Grenoble INP-Esisar (Valence, France)
All team members must be enrolled in an undergraduate or graduate program within Armenia, the European Union, Iceland, Norway, Switzerland, or the United Kingdom. On the CTF platform, the brackets that correspond to an undergraduate or graduate program are Undergraduate, Stacked (a team with both undergraduates and graduate students), or Graduate.
The top 15 eligible European teams with the most points in the Qualification round will be invited to participate in CSAW CTF Finals. CTF Finals for Europe will be online (remote participation).
Only one “school team” per university will be allowed to qualify for Finals. A “school team” is defined as a team with members who all attend the same university.
Mixed teams* -- teams with students from different universities -- are permitted. A mixed team can have a maximum of 2 students from the same university, with up to 4 teammates total. For example: 2 students from University A can team up with 2 students from University B. Or, 2 students from University A can team up with 1 student from University B and 1 student from University C. Or, a mixed team could comprise 4 students all from different universities A maximum of 10 students from the same university and across multiple teams are eligible to qualify for Finals.
Educational level in Fall 2023 →	High school student	Undergraduate Student	Graduate Student	Not a Student
Eligible to play in Quals	yes	yes	yes	yes
Team Size for Quals**	Unlimited	Unlimited	Unlimited	Unlimited
Eligible to qualify for Finals	no	yes	yes	no
Team size for Finals	Not applicable	1 - 4 players	1 - 4 players	Not applicable
Same School Required	Not applicable	Not required, mixed school affiliation is okay*	Not required, mixed school affiliation is okay*	Not applicable

India Eligibility for Finals
Global partner: Indian Institute of Technology Kanpur (Kanpur, India)
All team members must be students enrolled in an undergraduate (UG) or post-graduate (PG) program and attend the same university in India. On the CTF platform, the brackets that correspond to an undergraduate or graduate program are Undergraduate, Stacked (a team with both undergraduates and graduate students), or Graduate.
The top 15 eligible Indian teams with the most points will be invited to participate in CSAW Finals. CTF Finals for India will be online (remote participation).
Up to two (2) teams from any given university in India may qualify for Finals. If multiple teams from the same university qualify, only the two highest ranked teams will be invited to compete in CSAW India Finals.
Educational level in Fall 2023 →	High school Student	Undergraduate Student	Graduate student	Not a Student
Eligible to play in Quals	yes	yes	yes	yes
Team Size for Quals**	Unlimited	Unlimited	Unlimited	Unlimited
Eligible to qualify for Finals	no	yes	yes	no
Team size for Finals	Not applicable	1 - 4 players	1 - 4 players	Not applicable
Same School Required	Not applicable	yes	yes	Not applicable

MENA Eligibility for Finals
Global partner: NYU Abu Dhabi (Abu Dhabi, UAE)
All team members must be enrolled in an undergraduate or graduate program and attend the same university within the following countries: Algeria, Azerbaijan, Bahrain, Chad, Djibouti, Egypt, Eritrea, Georgia, Iran, Iraq, Israel, Jordan, Kuwait, Lebanon, Libya, Mauritania, Morocco, Oman, Pakistan, Palestine, Qatar, Saudi Arabia, South Sudan, Sudan, Syria, Tunisia, Turkey, United Arab Emirates, and Yemen. On the CTF platform, the brackets that correspond to an undergraduate or graduate program are Undergraduate, Stacked (a team with both undergraduates and graduate students), or Graduate.
Up to 10 eligible MENA teams with the most points will be invited to participate in CSAW Finals. CTF Finals for MENA will be in-person at the NYU Abu Dhabi campus.
Only one (1) team from any given university may qualify for Finals. If multiple teams from the same university qualify, only the highest ranked team will be invited to compete in CSAW MENA Finals.
Educational level in Fall 2023 →	High school student	Undergraduate student	Graduate Student	Non-Student
Eligible to play in Quals	yes	yes	yes	yes
Team Size for Quals**	Unlimited	Unlimited	Unlimited	Unlimited
Eligible to qualify for Finals	no	yes	yes	no
Team size for Finals	Not applicable	1 - 4 players	1 - 4 players	Not applicable
Same School Required	Not applicable	yes	yes	Not applicable

Mexico Eligibility for Finals
Global partner: University Iberoamericana Mexico City (IBERO, Mexico City, Mexico)
All team members must be enrolled in an undergraduate/licenciatura or posgrados (Maestria o Doctorado) program. On the CTF platform, the brackets that correspond to an undergraduate or graduate program are Undergraduate, Stacked (a team with both undergraduates and graduate students), or Graduate (posgrados).
Up to 15 eligible Mexican teams with the most points will be invited to CSAW Finals. Teams must earn at least 300 points during the final round to be considered for the award ceremony. CTF Finals for Mexico will be online (remote participation).
Mixed teams* -- teams with students from different universities -- are permitted. Up to two (2) “school teams” from any given university in Mexico may qualify for Finals. If multiple teams from the same university qualify, only the two highest ranked teams will be invited to compete at CSAW Mexico Finals. A “school team” is defined as a team with members who all attend the same university.
Educational level in Fall 2023 →	Bachillerato / High School	Licenciatura / Undergraduate	Maestría o Doctorado / Posgrados	Non-Student
Eligible to play in Quals	yes	yes	yes	yes
Team Size for Quals**	Unlimited	Unlimited	Unlimited	Unlimited
Eligible to qualify for Finals	no	yes	yes	no
Team size for Finals	Not applicable	1 - 4 players	1 - 4 players	Not applicable
Same School Required*	Not applicable	Not required, mixed school affiliation is okay*	Not required, mixed school affiliation is okay*	Not applicable

US-Canada Eligibility for Finals
Global partner: NYU Tandon School of Engineering (Brooklyn, NY, USA)
All team members must be enrolled in an accredited undergraduate or graduate degree program at a university in the United States (including US Territories) or Canada. The corresponding brackets on the CTF platform are Undergraduate, Stacked (a team with both undergraduates and graduate students), or Graduate.
The top 10 eligible US-Canadian teams with the most points will be invited to participate in CSAW Finals, with the following caveat: The top 10 teams will be invited to compete in person at the NYU Tandon campus in Brooklyn, NY during Finals.
Only one “school team” per university will be allowed to qualify for Finals. A “school team” is defined as a team with members who all attend the same university/college.
Mixed teams* -- teams with students from different universities/colleges -- are permitted. A mixed team can have a maximum of 2 students from the same university/college, with up to 4 teammates total. For example: 2 students from University A can team up with 2 students from University B. Or, 2 students from University A can team up with 1 student from University B and 1 student from University C. Or, a mixed team could comprise 4 students all from different universities/colleges A maximum of 10 students from the same university and across multiple teams are eligible to qualify for Finals.
Educational level in Fall 2023 →	High school student	Undergraduate student	Graduate student	Non-student
Eligible to play in Quals	yes	yes	yes	yes
Team Size for Quals**	Unlimited	Unlimited	Unlimited	Unlimited
Eligible to qualify for Finals	no	yes	yes	no
Team size for Finals	NA	1 - 4 players	1 - 4 players	NA
Same School Required	NA	Not required, mixed school affiliation is okay*	Not required, mixed school affiliation is okay*	NA

General Recommendations for the Qualification Round

Teams will need regular access to a computer and an internet connection.
Teams should have unfiltered Internet access and the ability to install software.
Teams should join the CSAW CTF Discord channel and keep this open during the competition to be alerted of any updates. The Discord server will open when the competition starts on 08 September and will be made accessible at https://ctf.csaw.io/
Teams/players may play as much or as little as they want through the Qualification Round. We recommend dedicating as much time as you have to working through the challenges while still maintaining healthy habits.

Rules for the Qualifying Round & Other Important Information

To assist in clarifying the rules, this section is organized in a Frequently Asked Question format.

Where do teams register?

Registration is embedded in the CTF platform: ctf.csaw.io. Registration will remain open through the Qualification Round.

Who can participate in the Qualification Round?

The Qualification Round is open to players from around the world. Everyone is welcome to participate. Teams that intend to qualify for Finals should pay close attention to the Eligibility rules for their global region as detailed in the above pages.

Can I participate in CTF Finals if the global region where I am studying is not represented at CSAW? For example, students in South Korea.

You are eligible and encouraged to participate in the Qualification Round, but you are not eligible to qualify for Finals. We are sorry! If there is interest and support at your institution in becoming a CSAW global region, please contact the CTF Global Leads at csawctf@osiris.cyber.nyu.edu

Can I compete under multiple team names and/or for multiple teams?

No.

All players, regardless of bracket or intention to qualify for Finals, must compete under only one (1) team name. Playing for multiple teams, including sub teams or alias teams, constitutes cheating and will result in team disqualification.

Furthermore, teams should work independently. Sharing answers privately or publicly, or collaborating with another team constitutes cheating.

How many players can form a team during the Qualifying Round?**

There is no limit to the number of players on a team during the Qualifying Round. However, team members playing in the qualification round should be of the same education level or lower as the bracket of the team.

Additionally, teams should be aware that only 4 members of a qualifying team will be allowed to play during Finals. These 4 members must be listed on the team’s Profile page on the CTF platform prior to the end of the Qualification Round. Please make your best estimation of who would participate in Finals. Finalist team members will be confirmed during the enrollment verification process, whereby regional organizers ask students to submit enrollment documentation to confirm their student status.

Why do teams have to indicate who will be playing in Finals before the end of the Qualification Round?

The process for verifying enrollment is multi-stepped and time sensitive and so having this data upfront saves time for organizers.

Teams who intend to qualify for Finals should make their best estimate about who will play in Finals. For teams of 4 or less, this is relatively simple: list everyone on your team. For larger teams, the decision as to which players advance to Finals may be more complicated and so we recommend that you give this your best estimate.

Can a group of undergraduate players form a team with high school students?

It depends on the team’s bracket and region.

For example, a team that forms under the Undergraduate Bracket can play with students of a lower educational level (ie, high school students) during the Qualification Round. However, please be aware that for Finals, high school students will not be invited to compete.

A team that forms under the High School Bracket can play with students in high school plus students in a lower level of education. However, high school students are not eligible for CTF Finals.

Why can’t high school students qualify for finals?

There are a lot of exceptional high school teams/players as evidenced by the top performers in CSAW RED, PICO CTF and other competitions. CSAW CTF was designed for university students and so we are limiting eligibility at finals. That said, we encourage high school teams to join the Qualification Round. Playing in a variety of CTFs will help you excel and we look forward to seeing you at Finals when you are at university!

Can a group of undergraduate students form a team with graduate students?

Yes! We refer to this team structure as “Stacked.” Be sure to select the Stacked bracket when registering.

How are the brackets defined?

High School Bracket = team members are in high school; referred to as secondary school in some countries
Undergraduate Bracket = team members are undergraduate students studying at a university and enrolled in a degree program that typically results in a bachelor’s degree
Stacked Bracket = team members are a mix of undergraduate and graduate students
Graduate Bracket = team members are graduate students studying for an advanced degree; referred to as post-graduate study in some countries
Professional Bracket = team members are working in cybersecurity or a related field
Other Bracket = anyone who doesn’t fit into one of the above brackets

I am confused about eligibility. Who can I contact to answer my question regarding team eligibility?

Questions regarding eligibility can be directed to the CTF Global Leads at csawctf@osiris.cyber.nyu.edu. Please include the country/ies where you are participating in your email.

What is the purpose of the writeup embargo for 24 hours after Quals?

CSAW organizers will instate a 24 hour write-up embargo where we wish for teams to not post their write-ups online. Due to the importance of Quals as a Finals qualifying event, we take cheating very seriously. There are multiple measures in place to detect cheating used. As soon as we confirm the competition is over, an announcement will be released on Discord and channels will be open.

What constitutes cheating?

Playing for multiple teams, including sub teams or alias teams
Sharing answers privately or publicly, and/or collaborating with another team
Attacking the CTF infrastructure. Unless a challenge explicitly calls for such an attack, it is strictly forbidden to perform any kind of Denial of Service Attack (DoS/DDoS) against the servers or the competition's infrastructure.
Brute forcing flags is not tolerated or recommended.
Automatic vulnerability scanners such as SQLmap are prohibited.

How hard is CSAW CTF?

CSAW CTF is designed as a beginner-level university CTF. That said, it has a variety of problems -- some are easy and some are rather challenging. The goal is to create a competition that allows new students to learn while also providing more experienced students with an opportunity to hone their skills.

How do teams qualify for Finals?

Teams earn points by solving challenges. Finals eligibility and the type of teams invited to participate in Finals varies by region as defined above, see “[Region] Eligibility” tables.

Teams must earn 2 or more challenges to be initially considered for Finals.

be found on the regional webpages.

Qualifying round points are reported to CTFTime.

When will teams be notified of their finalist status?

Finalists will be notified of their status between 15 and 26 September 2023. Teams will receive notification directly from regional organizers via the team email that is registered on ctf.csaw.io.

Teams that qualify for Finals will be asked to verify their enrollment status before being offered an invitation to participate in Finals.

What is the format of Finals?

The Final Round follows a similar format to the Qualification Round. The Final Round of CTF is played on an online CTFd platform: ctf.csaw.io. The scoreboard will be public through most of the competition, but will be taken offline nearing the end of the competition. The competition lasts 36 hours. We expect approximately 30 challenges, with points ranging from 1 - 500. As per the regional eligibility criteria stated above, some teams will be competing in-person at Finals, and others will be competing online (remotely).

Are there prizes?

A 1st, 2nd, and 3rd place winning team is identified for each region based on total points scored during Finals. Final competition prizes vary by region and can be found on the regional webpages. Typically, the prizes are cash prizes, or technology, or some combination. For top teams in the US-Canada and MENA, the prize will also include a travel award.

When can I post my CTF write-ups online?

We highly encourage people to post challenge write-ups online, so that the community can benefit from the knowledge of solving the challenges. Official write-ups will also be posted soon after the competition is over.

How should I prepare for CSAW CTF?

The best way to prepare for CSAW CTF is to play CTFs. A calendar of competitions can be found here: CTFTime

How is my personal data used?

Personal data (ie, name, school, email) that is collected through the registration process is accessible only by the competition organizers and is used for the following purposes:

Reminding registrants of competition timelines, rules, and updates
Determining and contacting finalist teams and team members
Announcing the names of finalist and winning team members on csaw.io/ctf
Examining multi-year participation of teams and individual player
Determining and reporting total number of teams and total estimated individual participation
Determining and reporting demographic trends related to participation, such as what countries have the highest number of teams participating
Sending occasional updates regarding future CSAW events

Aside from announcing finalist and winners’ names, CSAW will not rent, sell, or share personal data with anyone other than the competition organizers.

Contact

Please direct your inquiries to the CTF Global Leads as follows: csawctf@osiris.cyber.nyu.edu

Issues with Email Verification & Password Reset on platform

If you have issues receiving your verification email during team registration and/or you can’t get your password to reset, please email the CTF Global Leads at csawctf@osiris.cyber.nyu.edu.