Hack The Box University CTF 2020 Recap

It’s a wrap! The second edition of our annual Hack The Box University CTF ended with the finals round on Saturday 6th of March 2021. The iconic Capture The Flag competition, aimed at university students only, counted almost double the number of participants compared to last year, with top-tier institutes joining from all over the world. 

How it all started…

Back in August 2019, @azik, Chief Commercial Officer at Hack The Box had the vision to thank all the educational institutions (around 200 at that time) for choosing our platform for their students’ cybersecurity training. 

Enrolling a university to Hack The Box was and always will be free, supporting our mission as a company to help all students, beginners, professionals worldwide by making cybersecurity training accessible to everyone. 

After intense brainstorming sessions, lots of spreadsheets, and some liters of coffee, @nfou, Head of Operations, and @r0adrunn3r, Community Manager at Hack The Box, decided to establish an annual HTB University CTF! A Capture The Flag event for students only, with the most gamified, fun, educational hacking content, covering the latest hacking attacks and techniques. A CTF that will make students fall in love with cybersecurity even more!

The first University Capture The Flag event was announced on October 9th, 2019! The qualification round was hosted on November 20th. It was a 24-hour CTF and 67 teams joined with a total of 360 players! 

...and how it’s going!

But this year’s edition was massive! We had 1,376 players and 204 universities participating from all around the world. It was a 48-hour non-stop cyber marathon for the students. A hacking playground to challenge themselves, learn new tricks, meet fellow students from any corner of this planet, and bring their university to the TOP! 

The CTF counted multiple top-tier universities and educational institutes participating! Just to name a few: 

• Massachusetts Institute of Technology

• Drexel University

• University of Edinburgh

• ITMO University

• KU Leuven

• University of Trento

• Sapienza University of Rome

• University of Twente

• Technical University of Denmark

We have been impressed by the high participation and advanced level of knowledge of all teams.

How was the CTF structured?

Like last year, the CTF was divided in two rounds: qualification round and finals round. For both rounds, the difficulty was from easy to hard so that any student can join; from the ones new to information security to students one step before their first cybersecurity or IT job. With all of these combined, the Capture The Flag event provided a unique experience to all students.

The only rules? Form a team of maximum 10 players and have fun!

Qualification Round CTF - Nov 2020

Friday, 20 November 2020 - Saturday, 22 November 2020.

As a pre-event, an opening ceremony was organized on Thursday, 19 November 2020. The participants had the chance to attend a series of panels delivered by Hack The Box employees and community members. 

• “Welcome Message” by Sotiria Giannitsari [@r0adrunn3r], Community Manager @ Hack The Box

• “Active Directory 101 - A Beginner's Guide” by Shaun Whorton [@egotisticalSW], Head of Content Delivery @ Hack The Box

• “A cybersecurity curriculum with Hack The Box” by Arjen Wiersma [@credmp4novi], Professor @ NOVI Hogeschool

• “Hack your way to market - Skills, Certs, Careers” by Nikos Fountas, Head of Operations @ Hack The Box

• “Advance your courses in a gamified way - Dedicated Labs for Universities” by Katerina Tasiopoulou, Business Development Manager @ Hack The Box

All the talks were recorded and are available for you here.

The hacking content for this round included more than 20 different challenges, from easy to hard difficulty level, distributed in multiple categories: Web, Pwn, Resersing, Hardware, Forensics, Crypto, Blockchain, and Misc.

The Winners - Qualification Round CTF

From the 204 teams starting the qualifiers, 18 teams made it to the finals.

Let’s give a huge shout-out for passing to the next phase to University of Edinburgh, Technical University of Denmark, University of West Attica, Dakota State University, Radboud University of Nijmegen the Netherlands, University of Perugia, KU Leuven, Universitatea din București, IT University of Copenhagen, Drexel University, Hasso-Plattner-Institut, Ecole Supérieure en Informatique Sidi Bel Abbes, ITMO University, University of Twente, University of Birmingham, Universidad Autónoma de Madrid, Technical University of Cluj-Napoca, Romania. The initial plan was to send only 15 teams to the finals round but the teams placed 16th - 18th had amazing write-ups and points so close to the 15th place that we decided this talent could not miss the finals!

The qualification round featured great prizes for the top 5, “Best Write-up”, and “Master Exploiter” teams.

• 1st Team: 6 Months HTB VIP & ParrotOS Stickers

• 2nd Team: 3 Months HTB VIP & ParrotOS Stickers

• 3rd Team: 1 Month HTB VIP+ & ParrotOS Stickers

• 4th Team: 1 Month HTB VIP+

• 5th Team: 1 Month HTB VIP+

• "Best Write-up" Team: 1 Month HTB VIP+

• "Master Exploiter" Team: 1 Month HTB VIP+

The prize list (worth £4,220) was powered by Hack The Box and Parrot Security OS.

CTF Finals - Mar 2021 

Friday, 5 March 2021 - Saturday, 6 March 2021.

The exclusive hacking content for the finals round included 19 challenges, always distributed in multiple categories, including an Active Directory mini lab which tested the skills of the participants to the limit. 24 hours of pure hacking competition!

The Winners - Finals Round CTF

1,300 players, 200 universities, 18 made it to the finals... 1 Grand Winner: give it up to the SIGINT team from the University of Edinburgh! Here is how the final podium looks like:

1. SIGINT - University of Edinburgh (United Kingdom)

2. INSSec - University of West Attica (Greece)

3. ITMO - ITMO University (Russia)

"Hack The Box University CTF was a really fun CTF where we competed against international universities. It had great challenges and an amazing community, we enjoyed getting together with like-minded people for a weekend of hacking. Would recommend this for anybody interested in having fun while learning cybersecurity."

SudoCr0wn - SIGINT, Team Captain

Ruling the scoreboard was a difficult mission. Make sure to keep your skills sharp because the 2021 edition seems already full of competition. Defending the title won’t be easy!

The finals decided the absolute winner of the CTF and included awesome prizes for the top 6 teams.

• 1st Team: Hack The Box 6 Months Dedicated Labs (premium training service, 10 users / 20 machines), HTB Hoodies & Stickers, ParrotOS T-Shirts, DigitalOcean $500 Free Trial Credit (per player) + Swag Box (one box with DigitalOcean goodies for the team)

• 2nd Team: Hack The Box 3 Months Pro Lab & 3 Months VIP+, HTB Desk Mats & Stickers, ParrotOS Caps, DigitalOcean $500 Free Trial Credit (per player)

• 3rd Team: Hack The Box 1 Month Pro Lab & 3 Months VIP+, HTB T-Shirts & Stickers, ParrotOS Mugs, DigitalOcean $500 Free Trial Credit (per player)

• 4th Team: Hack The Box: 1 Month VIP+, HTB Caps & Stickers

• 5th Team: Hack The Box: 1 Month VIP+, HTB Socks & Stickers

• 6th Team: Hack The Box: 1 Month HTB VIP+, HTB Stickers

This prize list (worth £14,999.70) was powered by Hack The Box, Parrot Security OS, and the great addition of DigitalOcean. Thank you for supporting us!

Prizes are surely one of the aspects that are making a CTF remarkable! We are already working on the 2021 edition (starting in November 2021) with the ambition of increasing even more the universities participating. If you are a company or organization looking to partner, email us at [email protected] and be part of the event!

We are extremely proud of organizing such a massive event aimed at university students, a crucial part for the growth and progress of the cybersecurity industry. Our mission is to make cybersecurity training fun and accessible to everyone: no better way to achieve that but joining forces with the institutions around the world responsible for spreading the knowledge. This is why we always welcome new universities to the Hack The Box platform and offer education-specific services and special academic discounts. 

Do you want to be the first to know more about the 2021 edition starting in November? Fill out the form at the end of the page and we will keep you posted before anyone else.

Until then, make sure to check out the Hack The Box CTF Platform, plenty of private and public CTFs being hosted there every month.

Not on Hack The Box yet? Join now and enroll your university for free. For any further information or support, please reach out to [email protected]. 

See you next year!

Hack The Box Team