Platypwn

❔ What: A hybrid 18 hour-long intermediate Jeopardy Capture the Flag event!
🕛 When: 2026-11-13T17:00:00Z – 2026-11-14T11:00:00Z (download ics file)
📍 Where: Online and at our university right here, which is easily reachable with S7 from Berlin.
💬 Contact: Join our Discord server.
⛳️ Challenges: Various challenges in categories which may include rev, web, crypto, osint, and more.
👥 Teams: Every team size is welcome in the online competition! The team size for on-site teams is 4.
🤖 AI: Online teams may use AI without restrictions. On-site teams are expected not to use AI excessively (more details below).
🏆 Prizes: There will be prizes for the first three teams on-site.
💰 Sponsoring: In case you are interested in sponsoring, don’t hesitate to send us an email.

Timeline

User and team registration will open shortly before the competition. Every team member needs to register.
CTF Start: 2026-11-13T17:00:00Z
CTF End: 2026-11-14T11:00:00Z
Infrastructure Teardown: 2026-11-21T11:00:00Z

Rules

Do not attack the infrastructure or other people! The website shows which IP/port combinations belong to the task, only those may be attacked. When in doubt, please reach out.
Do not share flags, solutions and hints with other teams before the end of the CTF.
The flag format is PP\{[-_!?A-Za-z0-9]+(::[-_A-Za-z0-9]{12})?\}.
The main language is English. If you do not speak English or in private communications with us, you can also use German.
The team size is not restricted for online teams. Everyone can participate (no student status or else required). On-site teams are restricted to a size of 4.
Brute forcing flags is forbidden (and won’t help you).

Credits: We adapted and modified these rules from saarCTF 2023 and Google CTF.

The aim of this CTF is to give participants the opportunity to practice their skills and have fun. We ask you not to spoil the fun for others. We want the competition to be an enjoyable experience for all participants, regardless of their gender, sexual orientation, ethnic group, religion, skill level, personal background or other criteria. Therefore, we do not tolerate harassment in any form. This is especially true for our Discord server. Be fair and friendly to everyone.

Communication

If you have a question or a problem (e.g. if a seemingly valid flag gets rejected or a challenge does not start), please reach out to us by opening a ticket in Discord. The main form of communication for the Platypwn is our Discord server where you can create tickets that we will process as fast as possible. Please use the ticket system instead of writing your questions in the open channels to not give other teams any hints by accident. After the CTF, feel free to openly discuss the challenges, for example in our Discord. If you do not want to use Discord at all, you can also email us at klub-cybersecurity-sprecher (at) hpi (dot) de (it will probably take longer to receive a reply via email). The main language is English. If you do not speak English or in private communications with us, you can also use German.

Responsible Disclosure

Responsible disclosure of vulnerabilities and serious bugs in the infrastructure will be rewarded with bonus points at our discretion as well as eternal glory in our hearts. Abusing these vulnerabilities will be penalized. If you have any doubts, please contact us.

Rule Enforcement

Violation of the rules or any other hostile behavior may lead to temporary or permanent exclusion from the competition or any other measure deemed appropriate by the organizing team. Be aware that any attempt of using a vulnerability in our infrastructure for cheating in the competition or other malicious purposes will lead to exclusion of the whole team. In cases not covered by the rules, we will decide according to our own judgement. We may change these rules before or during the competition.

AI Rules

For online teams, there are no restrictions on using AI as checking any restriction is hopeless anyway. Please keep in mind that your agent must also adhere to the rules and that you will be held responsible for rule violations caused by your agent! For example, DoS-like requests by your agent violate the rule to not attack our infrastructure and will be treated as an attack perpetrated by you personally! We encourage you to solve challenges on your own because it is more fun and you can learn more.

For on-site teams, it is only allowed to use AI to ask questions (similar to how you would use Google and StackOverflow) and for simple code completion. It is explicitly forbidden to use any challenge artifacts (code, pictures, binaries, …) as input for AI and that the AI or any direct artifacts of the AI (e.g. scripts) solve the challenge or interact with our infrastructure. Although you are on-site, we can not guarantee that you will comply with these rules, but we ask you to follow them out of respect for the other teams.

Results & Prizes

After the competition has ended, we will announce the official result in our Discord server. After that we will contact the prize winners on Discord or via email. The scoreboard will be uploaded to ctftime shortly after the competition end. There will be no prizes for online teams.

Prizes for on-site teams

TBD

Challenges

The Platypwn is a Jeopardy Capture the Flag event with challenges which may include:

Reverse Engineering
Crypto
OSINT
Web

All are created by students of our Club. We are aiming for around 15 challenges and the CTF will be 18 hours long. We try to have a mix of easier and tougher challenges to allow for a fun experience for beginners and veterans alike.

Challenges are primarily accessible via a Wireguard VPN. Once the competition has started, you can download the VPN configuration. The configuration can not be shared. Every team member needs to register.

Scoring

We use dynamic scoring. That means, flags which are solved more often will be worth less points. Every team that solves a challenge is awarded the same amount of points, the scores will be updated dynamically. The points for a flag may also increase again after other flags are solved more often.

There will be 2 score groups. One for everyone (online) and one for teams which are on-site at our university (HPI). They are entirely separate and don’t compete against each other.

If you are not present at HPI in person, please choose the Open Competition (Online) score group.

CTFtime points can only be earned in the online category.

On-site participation

We’ll be hanging out here. If you aren’t from HPI and want to join us in person, please send us an email. We’re always happy to see new faces :) As our university closes at 23:00 on Friday and reopens on 09:00 on Saturday, we won’t be there all day and you won’t be able to sleep at the venue.

Past Events

Platypwn 2025

The third Platypwn took place from 2025-11-15T9:00:00Z to 2025-11-16T21:00:00Z (36 hours in total). We had 4 blockchain, 5 crypto, 3 forensics, 5 misc, 5 OSINT, 2 pwn, 2 rev, and 4 web challenges (30 challenges in total). For hosting the CTF, we used Flugsicherung, our own CTF platform which was previously used for the Potsdam Cyber Games.

Past Events

Platypwn 2024

Our second Platypwn took place from 8th December 2024, 14:00 UTC until 9th December 2024, 18:00 UTC (online). We had 3 crypto, 3 forensics, 5 misc, 1 network, 3 OSINT, 2 pwn, 3 rev, and 8 web challenges. For hosting the CTF, we used Flugsicherung, our own CTF platform which was previously used for the Potsdam Cyber Games.

Platypwn 2023

The Platypwn was hosted for the first time on 28th October 2023, 12:00 UTC until 29th October 2023, 12:00 UTC (online). We had 4 crypto, 6 forensics, 7 misc, 3 network, 2 OSINT, 2 pwn, 2 rev, and 3 web challenges.

Platypwn

Timeline