Your infrastructure is broken. You have two hours.

A capture-the-flag for people who build and run software. You inherit servers, pipelines and a cloud account that were all set up in a hurry. Find what's wrong, fix it, and collect a flag for every fix that holds.

How to get in

What you'll be fixing

Three areas, one environment. Every problem in it is one that turns up in real infrastructure.

Servers and their config

The basics, which is where most of the trouble starts.

Web server
Virtual hosts, headers, and whatever it's been told to proxy.
Database server
Listening wider than it should, with passwords that would fit on a sticky note.
SSH server
Keys, ciphers, and a root login nobody remembers turning on.

Pipelines and Kubernetes

How code gets from a commit to running somewhere.

GitHub Actions
A build token that can do a great deal more than build.
Pipelines
Unpinned, unreviewed, and deploying from branches nobody protects.
Kubernetes
One pod with the run of the whole node.

Cloud infrastructure

Misconfigurations that cost real money, or worse.

Storage
A bucket that's more public than anyone intended.
Networking
Firewall rules open to the whole internet in all the wrong places.
Identity
Roles that can do everything, attached to things that need nothing.

1 PM to 4 PM

Two of those three hours are the CTF itself, start to finish. The scoreboard freezes five minutes before it ends, and the debrief is where you find out how everyone else fixed it.

Where: Leapfrog Technology, Kathmandu. Open in Google Maps

  1. Check-inFind a seat, get on the Wi-Fi, open a terminal
  2. BriefingThe rules, a tour of the environment, how scoring works
  3. CTFFix, check, submit flags. The scoreboard freezes at 3:25
  4. BreakFinal scores get checked
  5. DebriefThe top players walk through their fixes, then the results

Rules

Short, and enforced. Ask an organizer if anything's unclear.

You play solo
One person, one laptop, one scoreboard entry. Ask the organizers, not the person next to you.
Stay in your environment
Fix the systems you're given. The scoreboard, the venue network and other players' environments are off limits.
Hints cost points
A nudge costs 10% of a challenge's points. A bigger hint costs 25%.
Look things up
Docs, man pages, search engines and LLMs are all fair game.
Ties
Go to whoever reached the score first. The organizers' call is final.

How to get in

Registration comes with an entry challenge. It's short, and it's the same kind of thing you'll be doing on the day.

  1. Find the entry flag

    It's on this server. It looks like DevopsDowntime{…}.

  2. Register with it

    Paste the flag into the registration form. No flag, no seat.

    Open the registration form

  3. Bring your own laptop

    Anything with a terminal and a browser will do.