Hack.lu CTF 2026
Hack.lu CTF 2026 will take place online starting 18:00 UTC on October 23rd, 2026. The event is organized by FluxFingers. Registration will open some days before the CTF begins at https://flu.xxx.
Who
Everyone may participate! You can play solo or in a team. Challenges range from beginner-friendly to truly formidable.
When
The CTF runs for 48 hours.
What
Hack.lu CTF is a challenge-based Jeopardy event. Expect a mix of crypto, web security, reverse engineering, and binary exploitation tasks.
- Each challenge awards a dynamic number of points based on the number of solves.
- No DoS, automated scans, heavy traffic, or tampering with our infrastructure.
- If something feels unintentionally easy, please report it.
- Do not share flags or solutions with other teams.
- If you break a rule, we remove your points.
- Unless stated otherwise, flags follow the format flag{.+}.
While we would prefer everyone to play our CTF without any AI help, we know that is unrealistic today. So for those that like to outsource the fun and learning to the clankers, there is the Open bracket while humans that want the classic CTF experience can play in the Human bracket.
| Bracket | AI tooling |
|---|---|
Open | AI is allowed, as long as you follow the other rules. You are responsible for what your clankers do. |
Human | No AI or LLM help at all. For example (but not limited to): No ChatGPT, no Claude, no automated agentic systems, no AI search, no Copilot, no AI code summary, no AI-based reversing tools, etc. |
- Human teams also appear in the Open bracket, but not the other way around. So if you're a human team and are out-pwning all the clankers, you can still be number 1! However, only the Open bracket scoreboard will be uploaded to CTFtime.
- Pick your bracket in your profile settings. You must join the Human bracket before you start playing. You can switch to the Open bracket at any time which will move all your solves to the Open bracket.
- If you used AI on a challenge, leave the Human bracket before you submit the flag. Otherwise we will find and ban you :)
Our CTF is intended to be played by humans. We create challenges for those that enjoy playing them manually and that appreciate learning new things along the way. We're not anti-AI in general, we just don't think CTFs like ours are the right place for it. Use your clanker to find PHP RCEs instead!
AI has become very strong in solving challenges and finding vulnerabilities, and we therefore think it became impossible to create challenges that are fun and hard for humans and clankers at the same time. If you're looking for a CTF to test your AI-assisted hacking skills, that's not us.
"Hey Claude, solve this challenge" is like bringing a car to a marathon. Cars have their value and are obviously helpful tools, but they destroy the fun for those that just want to have fun competing with other runners.
Infrastructure sponsor
Hetzner is one of the largest web hosts and data center operators in Europe, offering dedicated servers, cloud servers, web hosting, storage products, and much more.
There are no announcements yet.