Info & Rules

About

NNS CTF 2026 will take place from Friday, 4 September at 16:00 UTC to Sunday, 6 September at 16:00 UTC. You may participate individually or as a team. There is no team size limit.

There will be challenges in various categories such as web, misc, crypto, blockchain, DevSecOps, rev, pwn, community-made, and more.

Join our Discord server for announcements and support.

Prizes

Global:

1. 1024 EUR
2. 512 EUR
3. 256 EUR

Students category (Norway):

1. 2048 NOK
2. 1024 NOK
3. 512 NOK

Other prizes and bounties will be announced later. Prizes are subject to change prior to the event's start. Terms and conditions apply.

Rules

This document serves as the official rules for the CTF competition. The organizers may clarify or amend the rules.

1. Keep competition material within your team. Do not share flags, solutions, or hints with other teams while the event is running. Only challenges that are explicitly in the beginner category allow for educational hints and guidance.
2. Keep active challenges out of public discussion. Do not discuss them in public channels, streams, repositories, or social media. Open a private Discord ticket if something appears broken or unclear.
3. Stay within the challenge. Do not attack the platform, scoreboard, other teams, organizers, sponsors, or upstream service providers. Only target systems that a challenge explicitly puts in scope.
4. Avoid disruptive traffic. Do not port scan, broadly enumerate, brute-force flags, run denial-of-service attacks, or use automation that may degrade shared infrastructure unless a challenge explicitly requires it.
5. Use one team identity. Do not compete through multiple teams or accounts, and do not share team access outside your registered team.
6. Report platform issues privately. If you discover a vulnerability or gain unintended access, stop testing and notify the organizers through a Discord ticket.
7. Protect your own systems. You are responsible for your hardware, software, credentials, and data. Norske Nøkkelsnikere is not liable for damage to participant equipment.
8. Be nice. Play fairly and treat others with respect.

Additional rules apply to external challenge authors:

• Challenge authors can participate in the CTF, but cannot solve their own challenges.
• The challenge author must not share the idea, solution, flag, or other materials related to the challenge with team members or other players.
• Other members of the challenge author team can solve the challenge, but must not first blood the challenge.

AI Policy

We strongly recommend playing our CTF without the usage of large language models (LLMs), as it will offer a better experience. Our goal with the CTF is to share new and interesting ideas with the players, while creating a game for teams to compete in.

The CTF will be divided into different divisions: open, humans, and students. All teams will be placed in the open division by default. The division can be changed in the profile settings.

Human division rules are as follows:

1. Usage of AI/LLMs are prohibited during the competition and for writeups, with the following exceptions:
   • Google/DuckDuckGo (and any similar search engine) AI search overviews are allowed. Expanding (e.g. "show more") is not allowed. Attempting to "prompt" the search beyond normal search queries is not allowed. Examples:
     • OK: How is a HTTP request structured?
     • OK: How do I factor an RSA public key?
     • NOT OK: How do I solve: [code]
     • NOT OK: Explain: [code]
     • NOT OK: Write a snippet to exploit buffer overflow
2. Non-LLM-powered machine translation tools are allowed for natural language translation.
3. The human-specific rules will be enforced. Violators may be publicly shamed and banned.

See how to disable AI features in Google Search, VS Code, and JetBrains.

Students

The student category applies only to full-time students enrolled at a Norwegian school or university. Every member of a team competing in this category must be a student and must be able to provide proof of student status.

A team eligible for both an open-category prize and a student-category prize must choose one. We will award the remaining prize to the next eligible team, prioritized by score and last solve time.

Technical details

The flag format is NNS{[\x20-\x7A]+}.

NNS CTF is a jeopardy-style CTF. The score per challenge is dynamic and decays based on the total number of solves.

Participants do not need a VPN to access on-demand or instanced challenges. Challenges are available via ports 443 (TLS/HTTPS) and 1337 (TLS).

Terms for prizes

To claim a prize, we may ask for writeups of the hardest challenges you solved. Writeups must be submitted no later than 24 hours after the competition ends. We will contact relevant teams through their registered email address or Discord.

All prizes for NNS CTF 2026 are subject to verification and compliance with local laws and regulations, as well as Norwegian laws and regulations. Norske Nøkkelsnikere reserves the right to disqualify participants or withdraw prizes at its sole discretion. Winners must provide enough information to confirm eligibility and comply with all applicable laws, including reporting winnings where required. Some participants may be ineligible due to legal restrictions in their jurisdiction.