Terms & Conditions

PBCTF 5.0, run by Point Blank.

The boring page that keeps the fun page online.

You are about to spend eight hours attacking things on purpose. This is the part where we agree on which things. Register for PBCTF 5.0 and you accept everything below. If something here is ambiguous, ask us first. "I assumed it was in scope" has never once worked as a defence, at this or any other CTF.

1. Who can play

One account per human. We can count, and so can the database.
Register with details that are actually yours. Team and display names must not be offensive, discriminatory, or pretending to be someone else. We reserve the right to rename anything that makes us wince, and we will pick something worse than what you had.
Teams may have up to 2 members. Two. Your third friend is welcome to hover behind you and provide commentary.
Team composition is locked once the clock starts. There is no transfer window.
Your account is your responsibility. Anything done through it is treated as done by you and your teammate.

2. When it happens

10:00 to 18:00 IST on 26 July 2026. Eight hours. Submissions outside that window are not scored, no matter how good the flag is.
We may pause, extend, or shorten the window if something operational goes sideways. If that happens you will hear about it through the official channels, not through rumour.

3. What you are allowed to attack

Two lists. Please read both, especially the second one.

In scope: the challenge files, the binaries, and the challenge specific endpoints listed on the Challenges page. That is the whole list. It is a short list on purpose.

Out of scope, no exceptions, not even clever ones:

This scoring platform. Its web interface, its API, and its login form. Somebody tries ' OR 1=1 on that login every single year. It has never worked, and we always see it.
The servers, containers, networks, DNS, and hosting that keep this thing standing.
The scoreboard. We know it looks like a challenge. It is not a challenge.
Other participants: their accounts, their sessions, their submissions, their laptops, their snacks.
Anything belonging to Point Blank, the college, or any third party that was not explicitly handed to you as a target.

4. Things that will end your CTF

The list below is illustrative, not exhaustive. Creativity is celebrated in the challenges and not in the rule lawyering.

Attacking or degrading the competition infrastructure. This is the one we are not funny about. Any attempt to disrupt, damage, overload, or gain unauthorised access to the scoring platform or the systems hosting it, including denial of service, resource exhaustion, container escape, or lateral movement beyond a challenge boundary, results in the immediate disqualification of your entire team. Intent is irrelevant. Whether anything actually broke is irrelevant. Do not test this clause.
Burying us in traffic. Automated scanning, fuzzing, or brute forcing aimed at the platform or at challenge infrastructure at a rate that ruins it for everyone else. If your solution needs forty thousand requests per second, it is not an exploit, it is an invoice. Where a challenge is meant to be brute forced, the description will say so and will tell you the acceptable rate.
Bothering other teams. Attacking, impersonating, phishing, or otherwise poking at another team's accounts or infrastructure. Compete with them, not against their session cookie.
Sharing flags or solutions outside your team while the clock is running. Chats, stories, group DMs, paste sites, all of it. Receiving them counts too, so "someone just sent it to me" is not a loophole. The group chat is not your team.
Collusion between teams, or quietly running submissions through several accounts. We look at timing data. Timing data is extremely chatty.
Abusing a platform or scoring bug. If you find a way to hand yourself points, read unreleased challenges, or skip the intended flow: tell us. Good faith reports are never penalised, get a public thank you, and have historically been rewarded with food. Using it silently is the fastest route to section 9.
Publishing solutions before 18:00. Write-ups are genuinely encouraged. After the buzzer.

5. Flags

Unless a challenge says otherwise, flags look like pbctf{...} and are case sensitive.
Submit the flag. Not the flag plus your notes, not a screenshot, and not flag{...} because you pasted from a different CTF.
Submission rate limits apply. Guessing loudly is not a category.
Flags are unique to this event. A flag recycled from somewhere else will not validate, and we will be a little sad that you tried.

6. Points

Each challenge is worth what the Challenges page says it is worth. Some use dynamic scoring, so a challenge is worth less once half the room has solved it. Early birds, worms, and so on.
Ties break on the timestamp of your most recent scoring solve. Earlier wins. Eight hours is not as long as it sounds.
Hints may cost points. This will always be shown before you unlock one, so nobody gets ambushed. Pride is free, but it does not appear on the scoreboard.

7. AI, agents, and your credit card

Use whatever tooling you like. Models, agents, autocomplete, a suspiciously confident chatbot. Our official recommendation, however, remains the brain (the organ); if you hit the rate limit on this one, feel free to grab a coffee. For the love of the game, and in the spirit of good faith, try solving at least one thing with it.

Your agent does not get its own scope. Sections 3 and 4 apply to everything acting under your account, autonomous or otherwise. If your agent decides twenty minutes in that the scoreboard looks interesting and starts scanning it, that is your disqualification, not the model's. "It did that by itself" is a confession, not a defence. Read the scope before you hand over the keys.
We do not pay your API bill. Not tokens, not credits, not subscriptions, not the overage alert you get halfway through a rev challenge. The entire prize pool is 1,000 USD. If your agent spends more than that grinding a 50 point crypto challenge, you have managed to lose money at a free event, which is impressive but not reimbursable.
Rate limits still apply to robots. An agent looping on a challenge endpoint counts as automated traffic under section 4, and it will not occur to your agent to be considerate about it. Put the limits in the prompt or keep a hand on the kill switch.
Anything you paste into a third party tool has left our control. Challenge files, fine. Your own credentials, your teammate's details, or the contents of an internal system you happen to be poking at, less fine. That is on you.
A model solve is still your solve. If we ask how you got a flag, we expect an explanation. "The model did it" is not one, and top placements do get asked.
The sincere bit. We had a genuinely good time designing these problems, and that fun is the part we are actually trying to hand you. It does not survive being outsourced. The flag is the receipt, not the point.

8. Be a decent human

Treat other participants, volunteers, and organisers with respect. Harassment, hate speech, threats, and sustained disruptive behaviour in any competition channel get you removed from the event, and depending on severity, reported to the institution. There is no funny version of this section and we are not going to write one.

9. How we enforce this

We can inspect platform logs, submission history, and infrastructure telemetry when investigating a suspected violation. We have a great deal of logging. An unreasonable amount, frankly. Somebody spent their weekend on it.
Consequences scale: a warning, removal of specific points, or disqualification of the team and forfeiture of any prize.
Organiser decisions are final. We will explain our reasoning where we reasonably can. We will not be litigating it at 17:40 with three challenges still open.

10. What we collect

What you gave us at registration, your submissions, and ordinary technical logs such as IP address and timestamps, all used to run and moderate the competition.
Team names, display names, scores, and solve times are public on the scoreboard. That is the entire point of a scoreboard.
We do not sell any of it. We may publish aggregate statistics afterwards, the sort where the most identifying detail is "one team solved this with four minutes left".

11. Liability

Challenge material is provided as is, for educational purposes. Some of it is hostile by design, because that is the genre. Run it in something you control and are willing to lose. We are not responsible for damage to your own systems or data, and we would gently suggest not doing reverse engineering on the laptop that holds your thesis.

12. Changes

We may amend these terms before or during the event where fairness or clarity requires it. Anything material gets announced through the official channels, and whatever is on this page at the time is the version that counts.

Questions, confessions, bug reports

Found a platform issue, suspect a violation, or genuinely cannot tell whether something is in scope? Ask in the official contact WhatsApp group before you proceed. You can also just call one of us, since we are almost certainly in the same building. Asking first is never penalised. Asking afterwards occasionally is.

Good luck. Have fun. Leave the scoreboard alone.

Last updated 25 July 2026.
Written by Dhruv puri, I would be sad if you didn't read the whole thing :(