DefCamp Capture the Flag (D-CTF) 2026 Quals
- Starts
- Ends
- Runs for
- 48 hours
- Format
- Jeopardy (online)
- Rating weight
- 69.75 - Flagship
- Teams registered
- 14
Run by CCSIR.org, with prizes listed on CTFtime.
What the organisers say
Mark Your Calendars! The DefCamp Capture the Flag (D-CTF) Qualification Phase is Locked and Loaded for 2026! Get ready to dive into the most electrifying and audacious security CTF competition in Central and Eastern Europe—DefCamp Capture The Flag (D-CTF)! This is where the sharpest hackers and IT masterminds come together to push their skills to the limit, battling it out with top CTF teams from around the globe.
Prep briefing
What past editions were made of
Counted across 17 challenges from 2025, 2024, 2023, using the categories the scoreboards themselves used. Two things to hold in mind while reading it. The archive indexes challenges that someone published a solution to, not whole scoreboards, so this is the shape of what people wrote about rather than of everything that was set. And where a scoreboard gave no category the challenge lands in misc, so a large misc slice means “unlabelled” rather than “miscellaneous”.
- pwn 67%(6)
- stego 22%(2)
- crypto 11%(1)
What to have open when it starts
Pwn
Get the offset and the libc base mechanically, so the thinking is spent on the chain rather than on arithmetic.
- Cyclic pattern generator and offset finder
- Buffer overflow offset finder
- Libc base address calculator
- ROP gadget finder
- Pwntools exploit script generator
New to this? Read Binary exploitation
Stego
Run the sweep rather than guessing the tool. The solver tries the standard carriers in order and tells you which one held something.
- Automatic steganography solver
- LSB steganography extractor
- PNG chunk analyzer
- Audio spectrogram and SSTV decoder
- Zero-width character and text steganography decoder
New to this? Read Steganography
Crypto
Have the cipher identifier open on the first paste. Most of the round-one crypto is a classical cipher or an RSA parameter mistake, and both are recognised faster than they are solved.
- Cipher identifier and automatic decoder
- RSA decryption and attack runner
- XOR cipher decoder and key recovery
- Vigenere cipher solver with automatic key recovery
- Modular arithmetic and number theory toolkit
New to this? Read Classical ciphers and frequency analysis, XOR and the cost of reusing a key, RSA and the parameters that break it
The challenges people wrote about most
From previous editions, ordered by how many published solutions each attracted. Reading two solutions to one of these is the closest thing to a warm-up for this event that exists.