This was the grand finale - a physical hardware challenge where teams had to cut real wires under time pressure. I wanted the CTF to end with something you can’t do at home behind a keyboard, something that gets your heart rate up.

I have a strong interest in AI, and wanted a challenge that did AI prompt attacks, and I wanted teams to get hands-on experience with it.

I wanted this challenge to show that two-factor authentication isn’t a silver bullet. Trevor Blackwood’s webmail is protected by TOTP-based 2FA, but the implementation has multiple flaws that let you bypass it entirely.

This was the biggest challenge in terms of flag count - eight flags across easy, medium, and hard tiers. I wanted to build a realistic company website with layered vulnerabilities that rewarded both breadth (finding many issues) and depth (chaining exploits together).

I wanted Challenge 1 to kick things off with something that felt like real forensic work, not just another web challenge. Teams needed to dig through smart meter traffic to find an illegal bitcoin mining operation hiding in plain sight.