Instructions & Rules of Engagement

APPSEC Hackathon 2026 — read this before you start your first challenge.

About the event

You are testing Vipani, an e-commerce web application — storefront, cart, checkout, everything a marketplace needs to run.

25 vulnerabilities are hidden across it. Find each one, exploit it, and capture the flag behind it.

25 vulnerabilities. 24 hours. One application.

Instances

Each challenge runs as your own short-lived lab instance, spun up when you click Start on that challenge. The challenge page tells you what it expects and links back here for anything general.

Rules of engagement

This is a controlled, fully authorized environment — the challenges are meant to be broken. That authorization covers the challenges you are given, and nothing else that runs the event.

In scope
  • The challenge apps served at your own lab URL.
  • Any technique the challenge invites, against your own requests and session.
  • Your own tooling — scripts, Burp/ZAP, fuzzers — within the posted rate limits.
  • Everything your lab exposes: source, responses, headers, error messages.
Out of bounds
  • The platform itself — scoreboard, login, submission, or anything that launches or routes labs.
  • Other participants — their labs, sessions, accounts, or flags.
  • Denial of service, of any kind.
  • Reaching past a lab to the host or network underneath it.
  • Social engineering, and physical or out-of-band attacks.
  • Sharing flags, write-ups, or exploit code while the event is live.
Crossing this line — especially attacking the platform, another participant, or attempting denial of service — is grounds for disqualification at the organizers' discretion.

Flag instructions

A flag looks like FLAG{XXXXXXXXXXXXXXXXXXXX} — braces plus 20 uppercase Base32 characters (A–Z, 2–7). Submit it exactly as you found it — matching is case- and whitespace-sensitive, so paste, don't retype.

Ensure you document your findings and preserve the write-up.

Scoring

Every challenge shows its point value on its card, generally higher for harder challenges. A flag scores once — resubmitting one you already own adds nothing. The scoreboard ranks by total points.

Lab lifecycle

60 min
maximum lab lifetime
5 min
warning before shutdown

A lab auto-terminates 60 minutes after you start it. The clock runs from the moment you start it, whether you are working or not, and does not reset. You get a heads-up about 5 minutes before it expires — there is no idle timeout, so you do not need to keep clicking to stay alive.

Stopping and restarting a lab is safe and does not lose your score. Flags and points live on the scoreboard, separate from the lab.

You may have 1 lab running at a time. Starting another at the limit will ask you to stop one first, and names the ones you have open.

Conduct

Attack only what you're told to, keep your flags to yourself, and don't spoil the game for anyone else. Flag sharing, attacking the platform or other players, or using someone else's identity all end the same way — a warning, then disqualification.

When something breaks

First, stop and restart the lab — it is safe, costs no score, and clears most stuck states. If it is still broken, or you hit a platform problem (the site, login, or flag submission), contact the event help desk with the challenge name and roughly when it happened. Support can help with the platform; they won't give hints on the puzzles.

Everything here describes a controlled, authorized environment built for this event. The techniques you use are for these challenges only — not for any system you don't own or don't have written permission to test.