upCTF: xSTF's First Worldwide CTF

Up until now, xSTF (my CTF team) had only ever organized in-person competitions here in Portugal. This year we did something we'd never done before: we hosted upCTF, a fully online, worldwide Capture The Flag. A real one, with teams from all over the world, a proper infrastructure, and months of work behind the curtain.

Wearing the organizer hat

This year I stepped up as Head of the Education Department at xSTF, which meant I wasn't just building my own challenges. I was responsible for the quality and quantity of every challenge the team shipped: reviewing, testing, and making sure the whole set was solid and fair before it went live.

It was double the work, and the competition weekend itself was intense. Two days of very little sleep, a lot of debugging, some infrastructure fires, a mountain of support tickets to answer, and more Docker than any human should deal with in 48 hours. But there's a very particular satisfaction in watching a global event run on something your team built from scratch, and in wearing the xSTF shirt with pride.

The challenges I authored

I built four challenges for upCTF this year:

• An interesting RSA challenge (crypto), the one I had the most fun designing.
• A simpler RSA warm-up (crypto), for people taking their first steps into number theory.
• An audio steganography challenge (misc): hide something in a sound, see who's listening closely.

And the big one: an elaborate web challenge that I'm genuinely proud of. It ended up hard enough that nobody solved it during the competition. There were a couple of intended bruteforce steps that I honestly didn't expect any self-respecting CTF player to actually grind through, but in the age of AI, bruteforce is fashionable again, so who knows.

That web challenge is such a nice piece of work that it earned its own dedicated write-up, with source snippets, diagrams, and the whole story of how it was meant to be solved: Behind the upCTF Web Challenge: Media Meeting.

What I took from it

Organizing something at this scale, the logistics, the infrastructure, the pressure of guaranteeing quality across an entire challenge set, taught me things no single challenge ever could. And doing it alongside the rest of the xSTF crew, honoring the shirt, made every sleepless hour worth it.