FAQ

A one-day Digital Investigation CTF — capture the flag competition — themed in homage to Person of Interest. You play an analog interface helping The Machine work investigations across six domains: forensics, OSINT, recon, lab, trivia, and the narrative Person of Interest track.

DFIR analysts, blue teamers, SOC investigators, threat hunters, students learning security, and curious newcomers. The architecture is calibrated for first-time interfaces and seasoned operators alike.

No. The first challenges in each category are accessible to anyone who's worked through a TryHackMe room or similar entry-level material. Harder challenges reward depth and curiosity.

The event runs 24 hours. Most active players spend 6–12 hours of actual solve time. You can drop in and out at will — there's no penalty for stepping away.

Yes. There is no entry fee.

Saturday, 19 September 2026, 03:30 UTC through Sunday, 20 September 2026, 03:30 UTC. That's 09:00 IST Saturday to 09:00 IST Sunday. Convert to your local timezone before showing up.

19 August 2026, 03:30 UTC — one month before the event. Before that date, the channel is closed.

Visit ctf.xposedornot.com, click ACCEPT ASSIGNMENT, provide an email address, display name, and password. Verify your email via the link sent to you. You're in.

Check spam first. Then try the resend option on the login page. If still nothing, contact ctf@xposedornot.com with your registered email.

Yes. Registration remains open during the event. Point values are fixed — late registrants earn the same points per challenge as early ones. The only advantage of registering early is having more time to solve.

Yes, from your Profile settings. Keep it appropriate — see the Protocols for conduct expectations.

Yes. Email ctf@xposedornot.com from your registered address. Deletion before the event removes you entirely. After the event, your handle may remain on the historical scoreboard in anonymized form.

No. Solo players are welcome. You'll be a team of one. Solo participation is fully supported.

Six analog interfaces per team.

After registering, go to Team → Create Team. Set a team name and a join token (a password your teammates will use to join). Share that token only with people you want on your team.

Get the team's join token from your captain. Go to Team → Join Team. Enter the team name and token.

No. Team membership locks at event start. Choose carefully.

Yes. The event is fully online and global. Distributed teams are common and often advantageous — someone is always awake.

The Discord #numbers channel has periodic team-finding moments. Post your interests, skills, and timezone. Others will too.

No. One designation per interface. Detected smurfing results in disqualification — see Protocols, File 04.

24 total — 22 core challenges across six categories, plus 2 hidden bonus challenges discovered through investigation.

Forensics, OSINT, Recon, Lab, Trivia, and Person of Interest (the narrative arc). Each category teaches a distinct skill in real-world digital investigation.

Most. The three Person of Interest challenges unlock sequentially — you must solve P100 to see P250, and P250 to see P450. The two bonus challenges are hidden by design and require discovery.

Standard DFIR toolkit. Wireshark for network captures. Volatility for memory dumps. Autopsy or FTK Imager for disk images. ExifTool, CyberChef, OpenSSL, a Linux command line. Nothing exotic. Specific challenges may name their tools in flavor text.

Yes. LLMs are tools, like grep or Wireshark. The challenges are designed to require execution, verification, and synthesis that LLMs alone don't reliably finish. Use them. They cannot complete the work for you.

Research is permitted and encouraged. Public documentation, past writeups of similar techniques, Stack Overflow — all fair. Plagiarized solutions to this event's specific challenges are not — every challenge is original.

Don't exploit it. Ping @admin in Discord with the challenge name and what you're seeing. Most "broken" challenges are actually solvable from a different angle than expected. If it's genuinely broken, we'll fix and announce.

Yes. Every challenge has been playtested before launch. If a challenge truly can't be solved by the intended path, it gets fixed mid-event with announcement.

Yes. Pick your battles. Some challenges may take 15 minutes; others, hours. Most teams have members working in parallel.

The standard format is number{some_text_here}. A small number of challenges may use a different format — they will state it explicitly.

Open the challenge from the challenges board. A modal appears. Paste the flag into the input field. Click Submit.

Effectively unlimited, but there is a brief cooldown between submissions to prevent automated brute-forcing.

Check, in order: case sensitivity, leading or trailing whitespace, the exact braces ({ and }), and the flag format spec for that challenge. If still wrong, you may be close but missing a transformation step.

Yes, unless a challenge explicitly states otherwise.

A correct flag is credited to your team. Individual submission attempts are tracked for anti-cheat but not displayed to teammates.

Within your team, yes. Between teams, no — see Protocols, File 01.

Each challenge has a fixed point value that does not change regardless of how many teams solve it. First solvers and last solvers earn the same points for the same challenge. Speed matters for tie-breaking, not for points.

The first team to solve a given challenge receives a flame icon next to that challenge on the scoreboard and an automated announcement in Discord, narrated by The Machine. Bragging rights only — no bonus points.

The team that reached the tied score first wins the tie. Earlier solves break ties.

At event end — 20 September 2026, 03:30 UTC. No submissions are accepted after that.

Yes. The scoreboard updates in real-time throughout the event.

No, but it's the primary live-communication channel. Event announcements, broken-challenge reports, team-finding, and admin contact all happen there. You'll feel less informed without it.

#numbers — the only public channel. Everything routes through there. By design.

General help is welcome — "what tool should I use for X format?" is fine. Direct solutions or flag fragments for the specific challenge you're stuck on are not. Work through the challenge yourself, or DM @admin if you're genuinely stuck.

Always wrap solutions, flag fragments, or revealing information in ||spoiler tags||. Always. One unwrapped spoiler in a public channel ruins the work for everyone scrolling.

Within your own team's private voice/screen channel, absolutely. Don't share screens that reveal another team's challenges or solutions in public channels.

DM @admin immediately. Provide screenshots if possible. Harassment results in immediate removal — see Protocols, File 03.

XposedOrNot. A one-person operations team for this first event. Patience is appreciated.

Ping @admin in the Discord #numbers channel for anything event-related. Email ctf@xposedornot.com for off-platform issues, account problems, or anything you'd rather not discuss publicly.

Best effort. During the event, most Discord questions are answered within 30 minutes. Response times may vary during overnight hours. For urgent issues, email ctf@xposedornot.com.

Email ctf@xposedornot.com from your registered email address. Describe what's happening. Include screenshots if possible.

No. The admin does not give challenge-specific solving help. DM @admin privately if you are genuinely stuck and need a nudge.

1st place: $750 USD. 2nd place: $500 USD. 3rd place: $250 USD. Plus eternal bragging rights for anyone who solves at least one challenge.

Winners based in India will be paid via UPI. International winners will be paid via wire transfer or PayPal. Coordination happens directly with the top three teams after the event. Tax responsibility falls on the winner per their jurisdiction.

Prize is awarded to the team. Distribution among team members is the team's decision.

First Blood on each challenge gives you flame icons on the scoreboard forever. Discovery of the hidden bonus challenges earns in-event recognition.

Most participants are. Anyone associated with running WATCHLIST (organizer, playtesters, backup admin) is ineligible for cash prizes. Other restrictions may apply if your jurisdiction prohibits accepting prizes from foreign events — your responsibility to know.

Within 1 hour of the scoreboard freeze. Announced in Discord and via email to the top three teams.

72 hours after the event ends. Posting earlier risks spoiling solutions for others still working through writeups themselves, or for late writeup readers.

Yes. Approximately one week after the event, after the writeup window has passed.

Yes. Credit the event and link back to ctf.xposedornot.com. The work you did is yours.

Likely, if the first event lands well. Stay subscribed for announcements.

A modern browser — Chrome, Firefox, Safari, or Edge. JavaScript must be enabled. Older browsers (IE, Edge Legacy) are not supported.

Use the "Forgot Password" link on the login page. A reset link will be sent to your registered email.

Clear cookies for ctf.xposedornot.com and log in again. If your browser blocks third-party cookies aggressively, allow them for this domain.

Yes, for connectivity. Some challenge interactions may have issues through certain Tor exit nodes. VPNs that route through countries on common blocklists may have flag-submission issues.

First, check from a different network — could be local DNS or ISP. Then check Discord; if it's a wider outage, we'll announce there. If only specific pages are broken, hard-refresh (Ctrl+Shift+R / Cmd+Shift+R).

Some forensics challenges have multi-gigabyte files (memory dumps, disk images). Ensure you have disk space and a reasonable connection. Files are CDN-hosted for fast download.

The infrastructure is hosted on CTFd Cloud with managed redundancy. In the unlikely event of an outage, we'll announce timing adjustments via Discord and email. Submissions may be honored retroactively for downtime.