Will you have a flag format?

Yes, it will be "IW{....}". I'll update the rules page in a minute.

Cool! Nice to see a proper CTF after the recent two disasters.

Please consider cherry-picking this commit, it's nice to have a json scoreboard to keep track :)
https://github.com/balidani/tinyctf-platform/issues/6

Hi arturo,
thanks for pointing it out.
I've implemented a JSON scorebord for ctftime.org myself: https://ctf.internetwache.org/scoreboard/json
I should probably rename the URL to 'scoreboard.json'.

I'll post an update when I came up with a final solution.

Update: I changed the url from "scoreboard/json" to "scoreboard.json" and added the link to the rules page.
JSON scoreboard: https://ctf.internetwache.org/scoreboard.json

Hi Essa,
please elaborate. What's wrong with it?

They admit themselves (https://github.com/balidani/tinyctf-platform#caveats) that they didn't even try to address an entire class of vulnerabilities, which is CSRF. Login CSRF comes into mind especially in this scenario: https://github.com/balidani/tinyctf-platform/blob/master/server.py#L85 It would be nice to fix that before the CTF.

Hi Niklas,
yeah, I read that and was semi-okay with it, because:
a) attacking the infrastructure and teams is prohibited (okay, okay, hackers don't really care about rules ;) ). CSRF'ing flags for other teams doesn't make sense. The login-csrf scenario is good, but after reloading the page you'd notice the attack and the attacking team would be disqualified. So probably not worth the risk of being disqualified. Okay, you could still use "throw-away" accounts to get the flags and use them with your main account.
b) the victim would need to browse a prepared page of the attacking team.

You have a valid point with a) and at the end of day we're playing a security related game and shouldn't ship with major vulnerabilities. I'm going to spend a few minutes to fix that.

Thanks for bringing this to my attention!

Update: I've pushed a fix for the CSRF issues.

Awesome :)

Why are challenges not sorted by difficulty? Why should I get only 50 points for a challenge I spent a few hours on but only 90 points for a challenge I can solve in 10 minutes?

I can not log in to site. is there any problem?

@JGC The site is up and running and there shouldn't be any problem. Pm on freenode #iwctf to discuss details.

@Gulshan: That's just our idea/concept. If you want to be at the top, you have to solve all challenges regardless of their difficulty :)

Thank you for hosting an awesome CTF! Had fun all the way until there were no flags left to take ;). 10/10 would ctf again.

In my opinion, this is a good CTF. Most of challenges are nice, but quite simple and BarParty is just a time-wasting challenge.
Thanks the organizer and hope to see some harder challenges next year.

As gehaxel said on IRC, it's hard to find a good balance between not enough and too many hints, I think he did rather well, there were no challenges that said exactly "this is how you solve it", but there were a few that could have used just a little more hints (which they got eventually and we managed to finish all the challenges).

I wish there would have been a few more stegano and forensics challenges, although some of the crypto ones felt like forensics ;)
While the script used for the website was very good, the layout could have been a little better, the faint green glow on completed challenges was hard to see, I ended up creating a custom CSS. On the plus side, the website was always responsive and fast.
The communication on IRC was top-notch and there didn't seem to be any flag sharing, even though the flags were not customized for teams.

Overall a good CTF, I enjoyed it and will surely participate in the next one!

One last thing, I found it a little confusing that the website said "the challenges are not sorted by difficulty", yet the points were different. This could have led to teams that solved easier challenges having more points than teams that solved the harder ones.
I guess a good solution would have been to have same amount of points for all challenges, but it's possible that the ctf script didn't allow that.

Very fun and learning challenges. I really enjoyed it. even though i didn't solved much crypto, But the Coding,Web and MISC challenges were so much fun. TNX organizers and I gave 5-star to this ctf. Well done.

Great CTF!

Interesting CTF, my team managed to solve all challenges and I must say that I had great time during contest.

I liked this one a lot: good organization and creative tasks. I also think the way of scoring challenges: 50, 60, 70, 80, 90, ... was a good idea as their level was somehow comparable.

Really nice CTF. Great support from admins - there was someone on IRC channel all the time in case of problems. I wouldn't mind if some of the tasks were slightly more difficult, but I understand that this was not supposed to be DefCon Quals. It's good that there are still ctfs where beginner and medium teams can still solve something.

We had a great time in our hackerspace with this one, it was nice that there was some simple ones where we could show people how it works.

Great CTF. Had a lot of fun, learnt a few new things. Thank you.

Constructive Crit: As others have said, the green rings on the challenge board were hard to see, but overall a very well run competition. Will be looking forward to next year.

Great event .... admins are always available .... always responsive .. and helpful .... I learned a lot from the challenges really a lot
waiting for the next year to join the same CTF it is one of the best I ever seen I gave it five and I wish I could give it more

also the clear flag format was very very helpful

Hello,

thanks for the critiques!

I would be happy if you could spare a minute and fill out the feedback form: https://docs.google.com/forms/d/1FDtd3lLscW4pvwEonh0rKeHiWsGOY5STlo-ElauyE-M/viewform

Kinds regards,
gehaxelt

where can i find the writeup?

@shui bi have you tried here: https://ctftime.org/event/290/tasks/ ? ;)

@gehaxelt please send scoreboard to the ctftime :)

@ariel: Did that right after the CTF yesterday and it told me "Results sent successfully". Did it again with the same response.