Obsidian Labs
CTF 2026.
32 challenges across six security domains.
Compete individually over four hours.
Challenge Arena
0 / 32 ACTIVEFind your next challenge. Inspect the evidence. Submit your flag.
Challenges open soon
The first 8 challenges will appear here when the competition starts.
Scoreboard
The leading five competitors, and where you stand.
| Rank | Participant | Solves | Score |
|---|---|---|---|
| Loading scoreboard records... | |||
Your dashboard
Welcome back to Obsidian Labs CTF.
Certificate name
Use the full name you want on your certificate.
Recent solves
Announcements
Challenges
Create, review, and manage challenge availability.
Event controls
Import challenges
Paste challenge JSON, then preview the results before applying the import.
Participant Accounts & Access Controls
ACTIVE PARTICIPANTSIssue certificates
Generate up to 10 certificates per batch, then publish them when ready.
Administrative Audit Trail
SECURITY COMPLIANCE LOGVerify a certificate
Verify cryptographic authenticity of competition certificates.
Enter the unique 32-character hexadecimal verification identifier located at the bottom of the official Certificate of Achievement.
Competition guide
Release times, challenge categories, rules, and common questions.
The release schedule
32 scheduled problems released in 4 structured hourly waves of 8 challenges each.
8 challenges across Introductory Web Security, Cryptography, and Digital Forensics.
8 challenges: Intermediate Web Vulnerabilities, Memory Analysis, and Binary Reverse Engineering.
8 challenges: Dynamic-scoring problems, binary exploitation (pwn), and complex forensics artifacts.
8 challenges: High-point breakthrough cryptanalysis and advanced multi-stage CTF puzzles.
Challenge categories
Choose a domain to filter the challenge directory.
Cryptography
Public-key RSA factorization, elliptic curve cryptography (ECC), lattice reductions, custom block cipher attacks, and hash length extension.
Digital Forensics
Volatile RAM memory forensics (Volatility), PCAP network traffic packet carving, raw disk image analysis, file header repair, and steganography.
Web Security
Server-Side Request Forgery (SSRF), prototype pollution, SQL injection bypasses, JWT signature forgery, insecure direct object references (IDOR), and GraphQL flaws.
Reverse Engineering
x86_64 ELF and PE binary static/dynamic disassembly, control-flow graph deobfuscation, anti-analysis traps, bytecode VMs, and firmware reversing.
Miscellaneous
Open Source Intelligence (OSINT), esoteric encoding algorithms, Python jailbreak escapes, automation scripting puzzles, and signal analysis.
Binary Exploitation
Linux memory corruption, classic and advanced buffer overflows, Return-Oriented Programming (ROP chains), heap exploitation, and format string vulnerabilities.
Rules & fair play
Competition rules
Strictly enforced operational guidelines for Obsidian Labs CTF 2026.
Individual Participation
Obsidian Labs CTF 2026 is strictly an individual competition. Sharing flags, hints, solution methodology, or account credentials between participants triggers automated detection, result nullification, and disqualification.
Target Boundaries
Attacking, probing, or flooding competition infrastructure, scoring systems, authentication APIs, or fellow competitors is strictly prohibited. Denial of Service (DoS/DDoS) results in instant IP banning and legal referral.
Canonical Flag Format
All valid challenge solutions conform to the canonical regex pattern OBSIDIAN{...} unless explicitly instructed otherwise in the problem brief. Validation is timing-safe.
Dynamic Point Scoring
Challenge point values decay dynamically as more competitors solve them down to a minimum point threshold. Faster solves reward higher points.
Hint Point Deductions
Optional hints are provided for difficult problems. The point cost of each unlocked hint is permanently deducted from your competition total upon user confirmation and cannot be refunded or undone.
Scoreboard Freeze & Certs
The public scoreboard is frozen during the final hour (19:00–20:00 IST). At conclusion, all participants with verified legal names receive digitally signed, verifiable PDF and vector SVG Certificates of Achievement.
Frequently asked questions
Frequently Asked Questions
Authoritative answers to common questions about Obsidian Labs CTF 2026.
1. When does Obsidian Labs CTF 2026 start and end?
The tournament commences on Saturday, 31 October 2026 at 16:00 IST (UTC+05:30) and concludes at 20:00 IST. It is a single-round, continuous 4-hour competition.
2. How are challenges released during the competition?
32 challenges are scheduled across 4 hourly waves of 8 challenges each: Wave 1 at 16:00 IST, Wave 2 at 17:00 IST, Wave 3 at 18:00 IST, and Wave 4 at 19:00 IST. 6 reserve challenges remain on standby.
3. What categories of challenges will be featured?
Six core categories: Cryptography, Digital Forensics, Web Security, Reverse Engineering, Miscellaneous, and Binary Exploitation (Pwn).
4. Can I participate as part of a team?
No. Obsidian Labs CTF 2026 is strictly an individual competition. All registrations, flag submissions, rankings, and certificates are tied to individual accounts.
5. How does the dynamic scoring formula work?
Challenges use dynamic point decay. Each challenge starts at its initial point value and automatically decays toward the minimum floor as more competitors solve it. All earlier solvers dynamically receive the adjusted value.
6. Are hints available and do they affect my score?
Yes, certain problems offer hints for purchase. Unlocking a hint permanently deducts the stated point cost from your total score upon confirmation. Hint costs are non-refundable.
7. What is the official flag submission format?
All flags conform to the canonical regex pattern OBSIDIAN{...} unless explicitly instructed otherwise in the challenge description. Submissions are checked with timing-safe comparisons.
8. How do I obtain my verified Certificate of Achievement?
Ensure your verified legal name is set in your Dashboard profile. Upon conclusion of the tournament and final verification of the scoreboard, all active participants can download their cryptographically signed, verifiable PDF and vector SVG certificates.