Obsidian Labs
CTF 2026.
The competition has ended.
Sign in to explore the challenges and check your flags in practice mode.
Final competition standings are frozen.
Challenge Arena
Loading challenges…Practice at your own pace. Check flags without changing your competition score.
No practice challenges available
Use the challenge directory to view the questions currently available for practice.
Scoreboard
The leading five competitors, and where you stand.
Final competition standings.
| Rank | Participant | Solves | Score |
|---|---|---|---|
| Loading scoreboard records... | |||
Your dashboard
Welcome back to Obsidian Labs CTF.
Certificate name
Use the full name you want on your certificate.
Recent solves
Announcements
Challenges
Create, review, and manage challenge availability.
Event controls
Import challenges
Paste challenge JSON, then preview the results before applying the import.
Participant Accounts & Access Controls
ACTIVE PARTICIPANTSIssue certificates
Generate up to 10 certificates per batch, then publish them when ready.
Administrative Audit Trail
SECURITY COMPLIANCE LOGChallenge guide
Practice access, challenge categories, and common questions.
Post-event access
Keep exploring the challenges.
The competition ended on 31 October 2026. The final scoreboard is frozen, and challenges are available for a limited practice period.
See the access countdown at the top of the page for the closing time.
- Sign in, open a challenge, and use Check flag to verify your answer.
- All available challenges, including the participant gift and reserve challenges, are open for practice.
- Question points remain visible as the final competition value. Practice awards no points or first-blood bonuses.
- You can retry questions you solved or exhausted during the competition. Submission rate limits still apply.
- Hints are available without score deductions during practice. Final standings and competition solve counts stay unchanged.
- Challenge pages, downloads, and flag checking close when the practice timer expires.
Challenge categories
Choose a domain to filter the challenge directory.
Cryptography
Public-key RSA factorization, elliptic curve cryptography (ECC), lattice reductions, custom block cipher attacks, and hash length extension.
Digital Forensics
Volatile RAM memory forensics (Volatility), PCAP network traffic packet carving, raw disk image analysis, file header repair, and steganography.
Web Security
Server-Side Request Forgery (SSRF), prototype pollution, SQL injection bypasses, JWT signature forgery, insecure direct object references (IDOR), and GraphQL flaws.
Reverse Engineering
x86_64 ELF and PE binary static/dynamic disassembly, control-flow graph deobfuscation, anti-analysis traps, bytecode VMs, and firmware reversing.
Miscellaneous
Open Source Intelligence (OSINT), esoteric encoding algorithms, Python jailbreak escapes, automation scripting puzzles, and signal analysis.
Binary Exploitation
Linux memory corruption, classic and advanced buffer overflows, Return-Oriented Programming (ROP chains), heap exploitation, and format string vulnerabilities.
Rules & fair play
Competition rules
Strictly enforced operational guidelines for Obsidian Labs CTF 2026.
Individual Participation
Obsidian Labs CTF 2026 is strictly an individual competition. Sharing flags, hints, solution methodology, or account credentials between participants triggers automated detection, result nullification, and disqualification.
Target Boundaries
Attacking, probing, or flooding competition infrastructure, scoring systems, authentication APIs, or fellow competitors is strictly prohibited. Denial of Service (DoS/DDoS) results in instant IP banning and legal referral.
Canonical Flag Format
All valid challenge solutions conform to the canonical regex pattern OBSIDIAN{...} unless explicitly instructed otherwise in the problem brief. Validation is timing-safe.
Practice & question points
Scoring has ended. Each question displays its final competition point value for reference. Correct practice checks award no points, change no challenge values, and grant no first-blood rewards.
Hints during practice
During practice, available hints can be read without spending points. Hints purchased during the competition remain part of the frozen competition results.
Scoreboard Freeze & Certs
Final competition standings are frozen. Practice does not change your rank or score. Certificates, when published by the organizers, are available from your dashboard.
Frequently asked questions
Frequently Asked Questions
Authoritative answers to common questions about Obsidian Labs CTF 2026.
1. Is the competition still running?
No. The competition ran on 31 October 2026, 16:00–20:00 IST. You can now check flags for practice until the access deadline shown at the top of the page.
2. Do I need to wait for challenge waves?
No wave schedule applies during practice. Browse the challenges currently available in the arena; its count reflects the cards shown by your filters.
3. What categories of challenges will be featured?
Six core categories: Cryptography, Digital Forensics, Web Security, Reverse Engineering, Miscellaneous, and Binary Exploitation (Pwn).
4. Can I participate as part of a team?
No. Obsidian Labs CTF 2026 is strictly an individual competition. All registrations, flag submissions, rankings, and certificates are tied to individual accounts.
5. Will practice change my score?
No. A correct flag shows a confirmation only. Competition scores, ranks, first-blood rewards, solve counts, and challenge point values remain unchanged.
6. Are hints available and do they affect my score?
Available hints are free to read during practice. They do not deduct points or change your final competition result.
7. What is the official flag submission format?
All flags conform to the canonical regex pattern OBSIDIAN{...} unless explicitly instructed otherwise in the challenge description. Submissions are checked with timing-safe comparisons.
8. How do I obtain my verified Certificate of Achievement?
Set your full name in your dashboard profile. If the organizers publish a certificate for your account, the download will appear in your dashboard.