HKCERT CTF 2026 (Qualifying Round)
- Starts
- Ends
- Runs for
- 24 hours
- Format
- Jeopardy (online)
- Rating weight
- 10.31 - Rated
- Teams registered
- not published
Run by HKCERT, with prizes listed on CTFtime.
What the organisers say
HKCERT Capture The Flag 2026,” organised by the Hong Kong Computer Emergency Response Team Coordination Centre (HKCERT), the Hong Kong Productivity Council (HKPC) and the Digital Policy Office of HKSAR, is now in its sixth edition. It is one of the largest cybersecurity competitions in Hong Kong, featuring four categories: Secondary School, Tertiary, Open, and International.
Prep briefing
What past editions were made of
Counted across 9 challenges from 2025, 2024, using the categories the scoreboards themselves used. Two things to hold in mind while reading it. The archive indexes challenges that someone published a solution to, not whole scoreboards, so this is the shape of what people wrote about rather than of everything that was set. And where a scoreboard gave no category the challenge lands in misc, so a large misc slice means “unlabelled” rather than “miscellaneous”.
9 challenges is a thin sample. Read the split below as a hint about this event rather than as its profile, and lean on the linked editions instead - they are the actual record.
- web 100%(4)
What to have open when it starts
Web
Read the token before you read the source. A session cookie that decodes is the shortest path through half the web board.
- JWT decoder and signature verifier
- Flask session cookie decoder
- HTTP request replayer
- Directory and path scanner
- HTTP security header analyzer
New to this? Read Web attacks and session tokens
The challenges people wrote about most
From previous editions, ordered by how many published solutions each attracted. Reading two solutions to one of these is the closest thing to a warm-up for this event that exists.
- Flipper Herounknown · 2024 · 2 writeups
- Ec Fununknown · 2025 · 1 writeup
- Exp01unknown · 2024 · 1 writeup
- Exp01 Commentedunknown · 2024 · 1 writeup
- JSPyamlweb · 2024 · 1 writeup
- Mystizs Mini CTF 1web · 2024 · 1 writeup