The UCSB International Capture The Flag (also known as the iCTF) is a distributed, wide-area security exercise, whose goal is to test the security skills of the participants.

It is the world's largest and longest-running educational hacking competition that integrate both attack and defense aspects in a live setting.

The iCTF contest is organized by Prof. Giovanni Vigna of the Department of Computer Science at UCSB together with Shellphish, and is held once a year (usually at the beginning of December, but it has been rescheduled a few times).

Announcement: The 2015 iCTF is going to be on Friday, December 4th, 2015. The competition will last 24 hours starting from 10:00 am, PST. Please see the details on the announcement page.


The UCSB Capture The Flag contest is multi-site, multi-team hacking contest in which a number of teams compete independently against each other.

In traditional editions of the iCTF competition, the goal of each team is to maintain a set of services such that they remain available and uncompromised throughout the contest phase. Each team also has to attempt to compromise the other teams' services. Since all the teams received an identical copy of the virtual host containing the vulnerable services, each team has to find vulnerabilities in their copy of the hosts and possibly fix the vulnerabilities without disrupting the services. At the same time, the teams have to leverage their knowledge about the vulnerabilities they found to compromise the servers run by other teams. Compromising a service allows a team to bypass the service's security mechanisms and to "capture the flag" associated with the service.

The iCTF Framework

The Security Lab at UCSB has made available to the public the iCTF framework, which is the software infrastructure used to run the competition.

The framework is available for download on GitHub:


The iCTF framework is free for both commercial and non-commercial use (donations are welcome!). The UCSB iCTF competition is based on the iCTF framework and similar competitions can leverage the same framework to create other fun and educational security competitions.

History and Background

The UCSB iCTF evolved from a number of previous security "live exercises" that were carried out locally at UCSB, in 2001 and 2002. The first wide-area edition of the UCSB CTF was carried out in December 2003. In that CTF, fourteen teams from around the United States competed in a contest to compromise other teams' network services while trying to protect their own services from attacks. The contest included teams from UCSB, North Carolina State University, the Naval Postgraduate School in Monterey, the West Point Academy, Georgia Tech, University of Texas at Austin, and University of Illinois, Urbana-Champaign.

In 2004, the UCSB CTF evolved into an international exercise (hence, the name "iCTF"), which included teams from the United States and Austria, Germany, Italy, and Norway.

Through out the years, new competition designs have been introduced that innovated the more "traditional" designs followed in the 2003-2007 competitions. More precisely, in 2008 the iCTF featured a separate virtual network for each team. The goal was to attack a terrorist network and defuse a bomb after compromising a number of hosts. In 2009, the participants had to compromise the browsers of a large group of simulated users, steal their money, and create a botnet. In 2010, the participants were part of a coalition that had to attack the rogue nation of Litya, ruled by the evil Lisvoy Bironulesk. A new design forced the team to attack the services supporting Litya's infrastructure only at specific times, when certain activities were in progress. In addition, an intrusion detection system would temporarily firewall out the teams whose attacks were detected. In 2011, the participants had to "launder" their money through the execution of exploits, which had some risks associated with them. This created an interesting exercise in evaluating the risk/reward trade-offs in network security. In both 2012, and 2013 teams had to "weaponize" their exploit and give them to the organizer, who would then schedule their execution. This last design was a first step towards the creation of a "cyber-range" where interesting network datasets can be created to support security research.

Point Of Contact

The UCSB International Capture The Flag (iCTF) is organized by Giovanni Vigna, at UCSB.

This is the contact information: