Obsidian Labs
CTF 2026.
Security challenges across multiple domains.
Compete individually over four hours.
Challenge Arena
Loading challenges…Find your next challenge. Inspect the evidence. Submit your flag.
Challenges open soon
Released challenges will appear here when the competition starts.
Scoreboard
The leading five competitors, and where you stand.
Standings refresh every five minutes. Your verified score updates immediately.
| Rank | Participant | Solves | Score |
|---|---|---|---|
| Loading scoreboard records... | |||
Your dashboard
Welcome back to Obsidian Labs CTF.
Certificate name
Use the full name you want on your certificate.
Recent solves
Announcements
Challenges
Create, review, and manage challenge availability.
Event controls
Import challenges
Paste challenge JSON, then preview the results before applying the import.
Participant Accounts & Access Controls
ACTIVE PARTICIPANTSIssue certificates
Generate up to 10 certificates per batch, then publish them when ready.
Administrative Audit Trail
SECURITY COMPLIANCE LOGCompetition guide
Release times, challenge categories, rules, and common questions.
The release schedule
Challenges unlock in hourly waves. The arena count reflects the challenges currently shown.
Challenges across Introductory Web Security, Cryptography, and Digital Forensics.
Intermediate Web Vulnerabilities, Memory Analysis, and Binary Reverse Engineering.
Dynamic-scoring problems, binary exploitation (pwn), and complex forensics artifacts.
High-point breakthrough cryptanalysis and advanced multi-stage CTF puzzles.
Challenge categories
Choose a domain to filter the challenge directory.
Cryptography
Public-key RSA factorization, elliptic curve cryptography (ECC), lattice reductions, custom block cipher attacks, and hash length extension.
Digital Forensics
Volatile RAM memory forensics (Volatility), PCAP network traffic packet carving, raw disk image analysis, file header repair, and steganography.
Web Security
Server-Side Request Forgery (SSRF), prototype pollution, SQL injection bypasses, JWT signature forgery, insecure direct object references (IDOR), and GraphQL flaws.
Reverse Engineering
x86_64 ELF and PE binary static/dynamic disassembly, control-flow graph deobfuscation, anti-analysis traps, bytecode VMs, and firmware reversing.
Miscellaneous
Open Source Intelligence (OSINT), esoteric encoding algorithms, Python jailbreak escapes, automation scripting puzzles, and signal analysis.
Binary Exploitation
Linux memory corruption, classic and advanced buffer overflows, Return-Oriented Programming (ROP chains), heap exploitation, and format string vulnerabilities.
Rules & fair play
Competition rules
Strictly enforced operational guidelines for Obsidian Labs CTF 2026.
Individual Participation
Obsidian Labs CTF 2026 is strictly an individual competition. Sharing flags, hints, solution methodology, or account credentials between participants triggers automated detection, result nullification, and disqualification.
Target Boundaries
Attacking, probing, or flooding competition infrastructure, scoring systems, authentication APIs, or fellow competitors is strictly prohibited. Denial of Service (DoS/DDoS) results in instant IP banning and legal referral.
Canonical Flag Format
All valid challenge solutions conform to the canonical regex pattern OBSIDIAN{...} unless explicitly instructed otherwise in the problem brief. Validation is timing-safe.
Dynamic Point Scoring
Every 10 participant solves reduce a challenge’s base value by 50 points, down to 50% of its original value. Earlier solves receive the adjusted base value too. The first participant earns an extra 50 first-blood points; that bonus does not decay.
Hint Point Deductions
Optional hints are provided for difficult problems. The point cost of each unlocked hint is permanently deducted from your competition total upon user confirmation and cannot be refunded or undone.
Scoreboard Freeze & Certs
The public scoreboard is frozen during the final hour (19:00–20:00 IST). At conclusion, all participants with verified legal names receive digitally signed, verifiable PDF and vector SVG Certificates of Achievement.
Frequently asked questions
Frequently Asked Questions
Authoritative answers to common questions about Obsidian Labs CTF 2026.
1. When does Obsidian Labs CTF 2026 start and end?
The tournament commences on Saturday, 31 October 2026 at 16:00 IST (UTC+05:30) and concludes at 20:00 IST. It is a single-round, continuous 4-hour competition.
2. How are challenges released during the competition?
Challenges are revealed in hourly waves at 16:00, 17:00, 18:00, and 19:00 IST. The arena displays only challenges available to you and counts the cards currently shown.
3. What categories of challenges will be featured?
Six core categories: Cryptography, Digital Forensics, Web Security, Reverse Engineering, Miscellaneous, and Binary Exploitation (Pwn).
4. Can I participate as part of a team?
No. Obsidian Labs CTF 2026 is strictly an individual competition. All registrations, flag submissions, rankings, and certificates are tied to individual accounts.
5. How does the dynamic scoring formula work?
A 500-point challenge stays at 500 for solves 1–9, drops to 450 at solve 10, then 400 at solve 20, and stops at 250 from solve 50 onward. The rule applies to every challenge and all earlier solvers. First-blood bonuses stay fixed at 50 points.
6. Are hints available and do they affect my score?
Yes, certain problems offer hints for purchase. Unlocking a hint permanently deducts the stated point cost from your total score upon confirmation. Hint costs are non-refundable.
7. What is the official flag submission format?
All flags conform to the canonical regex pattern OBSIDIAN{...} unless explicitly instructed otherwise in the challenge description. Submissions are checked with timing-safe comparisons.
8. How do I obtain my verified Certificate of Achievement?
Ensure your verified legal name is set in your Dashboard profile. Upon conclusion of the tournament and final verification of the scoreboard, all active participants can download their cryptographically signed, verifiable PDF and vector SVG certificates.