Sign up

Competition Information

Welcome to BCTF 2018 i.e. HITB-XCTF Dubai International CTF Competition!

BCTF is a Jeopardy-style Online Capture The Flag Competition presented by blue-lotus. The game is opened to all participants around the world, and with prizes. Teams can compete from any location. No restriction on the number of participants of any team.

BCTF 2018 is also the first qualifying contest of 5th Edition of XCTF International League ( The Champion will be invited to XCTF Finals 2019 (the location/date subject to change, qualified teams will be informed when the Finals location/date is confirmed). Other teams can also get the cumulative points to compete for other slots to the XCTF Finals 2018.

HITB-XCTF Dubai CTF will also use part of the challenges of BCTF 2018, and the on-site teams can both compete for the HITB-XCTF Dubai CTF awards and online BCTF 2018 awards. But only on-site teams can get the awards of HITB-XCTF Dubai CTF.

Competition Time

BCTF 2018 Online CTF

36 hours: From 27th November 10:00GST (UTC + 4) - 28th November 22:00GST (UTC + 4)

i.e. 27th November 14:00 Beijing Time – 29th November 02:00 Beijing Time

HITB-XCTF Dubai On-site CTF

30 hours: 27th & 28th November starting at 10:00GST (UTC + 4) and ending at 19:00GST (UTC + 4) on Day 1 and restarting on Day 2 at 10:00GST (UTC + 4) and ends at 17:00GST (UTC + 4))


Please join #BCTF on Freenode.

Email us at


1st place 1,000 USD (20% tax included), Qualified to XCTF Finals 2019

2nd place 500 USD (20% tax included)

3rd place 300 USD (20% tax included)

Top 6 ranked teams are required to submit their writeup to

Challenge Categories

everse engineering


web security

AI & blockchain


MISC (forensic, network analysis)

Score and Ranking

In most cases, flags are of format bctf{.+}. Please submit the entire flag, including BCTF{}, for score. If flag is in other formats, it will be clarified in the challenge description.

The score of each challenge will be dynamically calculated according to the number of solved teams.

Final ranking is determined by the total score of each team. In case of multiple teams with equal scores, the team that reached the score earlier ranks higher.

Contest rules

Teams breaking rules may be penalized or excluded from the competition.

It is not allowed for teams with independent accounts to cooperate, or share any flag/hints.

It is not allowed to attack the competition infrastructure. If flaws in the infrastructure are found, please report to us.

It is not allowed to sabotage or in any way hinder the progress of other competing teams. This includes attempting to destroy a challenge after you have completed it.

It is not allowed to generate large amounts of traffic. None of the challenges can be solved by running automated scanners.

It is not allowed to brute-force challenge flags/keys against the scoring site.

For placing teams to receive prizes, they must submit a full nand detailed writeup of each challenge, explaining how it was solved.

Organizers may rearrange/modify contest problems, proceedings, and rules.



Sponsors :

Technical Support: