2026
PwnZone
Rules
Read these rules before you register. By creating an account you agree to follow them.
- Format
- Jeopardy-styleOnline pre-qualifiers
- Finals
- 9 OctLive 11:15 EAT, Fri 9 Oct
- Flag format
- safctf{...}Case-sensitive
Eligibility
- You must be 18 or older.
- Safaricom employees and their immediate families may play but are not eligible for prizes.
- You must give accurate details when you register. Prizes and finals invitations are checked against them.
Teams and accounts
- Teams may have up to 3 members. Solo players are welcome.
- Each person may belong to one team only. One account per person.
- Team names and usernames must not be offensive, impersonate others or contain personal data.
- Keep your login details private. You are responsible for everything done on your account.
- Team membership is locked once the pre-qualifiers start.
Flags and scoring
- Flags look like
safctf{example_flag}. Submit the whole flag, including the braces. - Teams are ranked by total points. Ties are broken by the time of the last correct submission. The earlier team ranks higher.
- Challenges go live at 11:15 EAT on Friday 9 October 2026. The finals end at 16:00 EAT on Friday 9 October 2026.
- Do not submit flags in bulk or guess flags by brute force. Rate limits apply and repeated wrong attempts are logged.
- The scoreboard is final only after the organisers have reviewed it. Results and the top 30 are confirmed by the organisers.
Fair play
- Do not share flags, solutions, hints or exploits with anyone outside your team while the pre-qualifiers are running.
- Do not collude with other teams, and do not run multiple accounts to gain an advantage.
- Do not post live write-ups or solve walkthroughs publicly until the organisers announce the pre-qualifiers are over.
- Do not attack, disrupt or spy on other players or their machines.
- Do not tamper with the scoreboard, the CTF platform, or your own score.
- You may use public tools and public documentation unless a challenge says otherwise. You must understand and be able to explain what you submit.
Scope and safety
Attack only the targets given in a challenge. Everything else is out of scope.
- No denial-of-service, flooding or heavy scanning against challenge servers.
- No attacks on the CTFd platform, Safaricom production systems, the network you play from, or other players.
- Do not try to break out of a challenge container or sandbox, or attack the host it runs on.
- Do not use or keep data you find that is not part of the challenge. Stop and report it instead.
- Challenge files may contain malware-like samples. Open them only in a virtual machine you control.
If you find a real vulnerability in the CTF platform or in Safaricom systems, stop and report it to the organisers. Do not exploit it. Responsible reports are welcome. Send an email to bugbounty@Safaricom.co.ke.
Support
- If a challenge is broken or unreachable, report it to the organisers. Do not try to fix it yourself.
- Organisers may fix, replace or remove a challenge during the event. Score adjustments are made at their discretion.
Finals
- The top 30 teams from the pre-qualifiers are invited to the in-person finals.
- Finalists must be able to attend in person and bring valid identification. Dates and venue are shared with qualified teams directly.
- Finalists may be asked to explain their solutions before an invitation is confirmed.
- Prizes are announced by the organisers. Winners may be asked to verify identity and eligibility before any prize is awarded.
Penalties
Breaking these rules can lead to a warning, a point deduction, disqualification of your team, or a ban from future events. Serious or illegal activity may be reported to the relevant authorities.
The organisers' decisions are final. Rules may be updated during the event. Any change is posted on the platform and applies from the time it is posted.
Play fair. Hack responsibly. Have fun.