VolgaCTF 2026 Final
- Starts
- Ends
- Runs for
- 10 hours
- Format
- Attack-Defense (onsite, Russia, Samara)
- Rating weight
- 25.00 - Strong field
- Teams registered
- 6
Run by VolgaCTF.org, with prizes listed on CTFtime.
What the organisers say
VolgaCTF is an international inter-university cybersecurity competition organised by a group of IT enthusiasts based in Samara, Russia. The final round is held onsite in Samara (venue TBA).
Prep briefing
What past editions were made of
Counted across 32 challenges from 2026, 2024, 2023, 2022, using the categories the scoreboards themselves used. Two things to hold in mind while reading it. The archive indexes challenges that someone published a solution to, not whole scoreboards, so this is the shape of what people wrote about rather than of everything that was set. And where a scoreboard gave no category the challenge lands in misc, so a large misc slice means “unlabelled” rather than “miscellaneous”.
- web 31%(10)
- crypto 19%(6)
- rev 16%(5)
- pwn 16%(5)
- stego 9%(3)
- forensics 6%(2)
- misc 3%(1)
What to have open when it starts
Web
Read the token before you read the source. A session cookie that decodes is the shortest path through half the web board.
- JWT decoder and signature verifier
- Flask session cookie decoder
- HTTP request replayer
- Directory and path scanner
- HTTP security header analyzer
New to this? Read Web attacks and session tokens
Crypto
Have the cipher identifier open on the first paste. Most of the round-one crypto is a classical cipher or an RSA parameter mistake, and both are recognised faster than they are solved.
- Cipher identifier and automatic decoder
- RSA decryption and attack runner
- XOR cipher decoder and key recovery
- Vigenere cipher solver with automatic key recovery
- Modular arithmetic and number theory toolkit
New to this? Read Classical ciphers and frequency analysis, XOR and the cost of reusing a key, RSA and the parameters that break it
Reversing
Identify the binary before you open it. Knowing it is a .pyc, a JAR or a stripped ELF decides the next hour.
- ELF, PE and Mach-O binary analyzer
- Strings extractor for binaries and blobs
- Python .pyc bytecode disassembler
- Java .class disassembler
- WebAssembly disassembler
New to this? Read Reverse engineering
Pwn
Get the offset and the libc base mechanically, so the thinking is spent on the chain rather than on arithmetic.
- Cyclic pattern generator and offset finder
- Buffer overflow offset finder
- Libc base address calculator
- ROP gadget finder
- Pwntools exploit script generator
New to this? Read Binary exploitation
The challenges people wrote about most
From previous editions, ordered by how many published solutions each attracted. Reading two solutions to one of these is the closest thing to a warm-up for this event that exists.
- Find the flagweb · 2022 · 2 writeups
- find_the_flag3web · 2024 · 2 writeups
- ponGOmisc · 2023 · 2 writeups
- Find the flag2web · 2023 · 1 writeup
- 2FAweb · 2022 · 1 writeup
- Acceleratedrev · 2023 · 1 writeup