NECTF{no_escape}

What you were signing up for

A jeopardy CTF is a board of locked doors, and you get to pick which one you try.

There is no opponent to attack and no network to defend. There is a grid: categories across, challenges down, each one a self-contained artifact — a website, a binary, a photograph, a packet of ciphertext — with a string hidden inside it in the form NECTF{…}. Find the string, paste it into the box, take the points.

NO ESCAPE CTF was deliberately built as an on-ramp. The brief we published said easy to low-medium, and we meant it: a first-timer could open the welcome challenge, view source, and be on the scoreboard inside a minute. From there the board got progressively less forgiving, and by hour twenty the leaders were the people still awake and reading PDF metadata.

Everything in it was wrapped in a Christmas story — Santa's lost keys, a hacked mailbox, a star over Bethlehem — because a challenge with a narrative is a challenge people finish.

How the night actually went

Twenty-four hours, and the two that decided it.

A retrospective that only lists wins is marketing. This one includes the hour we got wrong, because that hour is the reason v2 is being built differently.

The event ran clean for most of its length — infrastructure held, the board stayed up, players moved through the easy tier fast. What we underestimated was how much of the difficulty curve ended up sitting in two challenges, and how much damage a late correction does when several hundred people have already committed a night to a wrong answer.

Format & infrastructure

One board, two rooms.

NECTF ran hybrid, which for us meant something stricter than “we also streamed it.” The onsite cohort at a college campus in Roorkee, Uttarakhand and every remote player worldwide hit the same CTFd instance, the same challenges, and the same scoreboard — no separate onsite bracket, no local advantage. A team in the hall and a team eight time zones out were competing on identical terms.

Challenge infrastructure was spread deliberately: static drops on Firebase, dynamic web targets on Heroku dynos, and two raw TCP services so the pwn and crypto tracks could not be solved by reading a page. Compute was sponsored by DigitalOcean.

The look you are reading right now is the event's own: the same neon CTFd theme, the same Hack monospace, and the navy and crimson sampled straight out of the NECTF logo file.

Who ran it

F7 CONQUERORS

An Indian CTF team listed on CTFtime under the aliases F7 CONQUERORS and NO ESCAPE. NO ESCAPE CTF was our event as organisers rather than players, and it earned the team 40.34 organiser points in the 2022 season.

NECTF v2 — not scheduled yet

v1 was the on-ramp. v2 is the building.

We built the first one so nobody would bounce. Easy to low-medium, a free flag in the source, a narrative to carry beginners through. It worked — and it is not what we want to run next.

v2 is a full hacking suite. Multi-stage chains instead of single-artifact puzzles. Real infrastructure you have to move through rather than one endpoint you have to read. Challenges that assume you already own a methodology and are built to find out whether it survives contact. Authors on Discord for the entire clock, and no corrections shipped in the last hour — because we have already made that mistake in public.

It is not on the calendar. Running it properly costs infrastructure, months of authoring, and a room full of people who actually want it. The waitlist is how we find out whether that room exists. Hit the threshold and we start building; you hear from us before anyone else does, and nothing else ever lands in your inbox.