Don't worry, there aren't many!


HackTrinity is an individual competition. This means no sharing flags or solutions with anybody until after midnight on the 22nd of March. We'd love to see some write-ups of challenges after this time!


Only what is provided by the challenge descriptions is open for attack. Specifically, you should never be attempting to gain access to services running on any of the following domains:

  • *

Additionally, any challenges hosted on * should not be brute-forced or attacked in any way besides through content hosted on the site. Any challenge that might require brute-forcing or attacks on vulnerable services will be run in a CHAD instance.


Not exactly a rule, but if there are issues or corrections to be made about challenges, a CTFd notification will appear and a sound will play in your browser. We'll also post updates on Twitter.

Have fun!

The most important rule.