Questions
FAQ
Quick answers to the things contestants ask most. Still stuck? Ask in the CTF Discord or find an organizer at the OWASP CTF area.
- No. Every target has challenges across a range of difficulty, and points scale with it. Start with a low-point challenge on any app and work up.
- Yes, and it's the default. Teams are optional: you can join or create one from your profile after signing in, up to four people.
- Yes. This is an in-person competition at the Las Vegas Convention Center and requires a valid DEF CON 34 badge.
- Your own laptop with the dev tools you like to work in, a GitHub account, and a charger (outlets go fast). Everything else runs in your fork and in CI.
- There's no flag to type in. Fork the target's repo under the OWASP-CTF org, fix the vulnerability on a branch in your fork, and open a pull request against the repo's
dc34-ctfbranch. That's the only branch the scorer watches, and there is no per-challenge branch. A GitHub Action builds your app, runs the rubric, and posts your score on the PR, usually in two to five minutes. See How to Play for a worked example. - No. The scoring pipeline builds and runs your patched app in CI, so a PR is enough. Running it locally is just faster to iterate against while you work out the fix.
- Yes, please do. Using AI to analyze and remediate these vulnerabilities is the skillset this event is built around, not something to hide or work around. Bring whatever you already use, and point it at your fork. OWASP's own Secure Agent Playbook will get you further faster. It gives an agent structured, OWASP-grounded procedures for code review, dependency and secrets scanning, and API assessment, mapped to the same Top 10 categories these challenges are graded against.
- Sign in with GitHub to claim your row on the live leaderboard and see a full per-app, per-challenge breakdown on your profile. Points are credited to the account that authored the pull request, so open your PRs from the same account you sign in with. Otherwise your score lands on a row you can't see.
- Some challenges offer one on your profile. Revealing a hint costs 10 points off your total, applied as soon as you reveal it, so save them for a challenge you're genuinely stuck on.
- Check the scoring comment on the PR. If it says the score wasn't recorded, that's on our side. Push another commit and the run will record it. If it shows zero challenges patched, the rubric still reproduced the vulnerability, so the fix didn't fully close it. Points also only count for the PR author's account.
- Yes, as many times as you like. Push another commit and it re-scores. Your best-ever result per challenge counts, so a later fix replaces an earlier miss and you can never lose points you've already banked, even if a later patch breaks a challenge you'd already solved.
- Yes. Prizes go to the top individuals and top teams overall. You must be present at the closing ceremony to claim.
- Find an organizer at the OWASP CTF area, or join the CTF Discord, where scoring questions, stuck runs, and organizer announcements go.
- This page only covers the CTF itself. For the full DEF CON 34 schedule (talks, villages, and timing), check HackerTracker.
Allied Ops · Blue Team Village
Blue Team Village encrypted that evidence file. This is the key that opens it.
fairpatch61gpg --decrypt <artifact>.gpg
First time on this site? You've landed in the OWASP Secure Development CTF: you find a real vulnerability in a real OWASP app, patch it, and ship the fix as a pull request. CI builds your patch and scores it automatically. There are no flags to type in. How to Play.
Key not working? Grab an organizer at the OWASP CTF area, or ask in the CTF Discord.