CYBRARY Spin up a capture-the-flag event in minutes — not months.
Ad-hoc, scalable CTFs on demand. From a two-team lunch scrimmage to a full bracket arena, every event runs on the same Cybrary Forge labs engine that powers our training range — Jeopardy boards, attack/defense, King of the Hill and full network arenas, with signed rotating flags, automated checkers, an explainable scoreboard and a replay of every session.
- Formats
- 6
- Terrain profiles
- 5
- Scoring engines
- flag · attack/defense · SLA · KOTH · manual
- Infrastructure
- Fully simulated
Formats
Six competition formats, one engine
Pick the format that fits your group and timeframe. They differ in infrastructure, not just in the leaderboard — and the engine scales each one up or down on demand.
Independent challenges across categories, one shared scoreboard.
Terrain: Per-challenge sandboxes: a workstation, an artifact, or a single service.
Scoring: Static or decaying points per flag, first-blood bonuses, priced hints.
Every team gets a private copy of the same enterprise network.
Terrain: Full org: domain controller, file server, jump box, user subnet, DMZ.
Scoring: Objective flags plus containment and eviction checks per team copy.
One persistent network every team operates inside at once.
Terrain: Contested enterprise with shared services, shared logs, shared blast radius.
Scoring: Objectives, collateral penalties and rules-of-engagement violations.
Identical service stacks, rotating flags, automated checkers.
Terrain: Symmetric per-team vulnbox: web, database, queue and auth services.
Scoring: Attack points per stolen flag, defense points per SLA tick you keep up.
Hold contested targets and bank points every tick you keep them.
Terrain: A small set of high-value hosts everyone can reach and everyone wants.
Scoring: Hold ticks, contest events, and eviction of the previous holder.
Jeopardy objectives layered inside a live network competition.
Terrain: Network arena plus a challenge board scoped to what is in that network.
Scoring: Both engines write to the same ledger, so one board explains everything.
Terrain
Terrain we can stand up
Every profile is simulated on the Forge labs engine: routable-looking subnets, gateways, DNS and hosts a team can write down at kickoff and still rely on after a reset.
Active Directory org with a DMZ, user subnet and admin tier.
Symmetric vulnboxes for attack/defense: web, API, database, queue.
Identity provider, object storage, CI pipeline and admin consoles.
Flat plant network behind a jump host, with historian and HMI.
No network at all: disk images, memory captures, pcaps and binaries.
Under the hood
What the engine guarantees
The competition guarantees that make a result defensible after the event — every one inherited from the Cybrary Forge labs engine.
HMAC-signed rotating flags
Every flag is signed server-side and bound to event, team, service, store and round. Flags expire after a configurable window, so nobody banks captures and dumps them at the buzzer.
Automated checkers and SLA scoring
A deterministic scheduler plants flags, probes each service every round and awards defense points per tick the service stays healthy. Every probe lands in the ops timeline.
Explainable scoreboard
Scores are an append-only ledger. Boards recompute from scratch, staff can void a single event with a reason, and any total can be explained line by line.
Freeze, delay and host teams
The public board can lag live scoring, freeze near the end, and hide host or test teams while staff keep seeing the truth.
Priced hints and appeals
Hints unlock sequentially and cost points against the team's total. Teams file appeals; staff decisions are audited.
Full-session replay
Keystrokes, tool state and periodic ghost-screen keyframes are captured for every session, so an event can be replayed end to end and scored moments can be verified.
Anti-abuse and access audit
Rate limits, own-flag and duplicate guards, shared-IP detection, and an audit log of every allowed and denied roster action.
Operator console
Launch, reset, extend, pause and restore targets in bulk; open and close rounds; approve applications; mint invite codes; export the incident record.
Get started
Your first event is minutes away
Build the release, rehearse it with a host team, open registration, and operate the whole thing from one console. Nothing real executes — every host, service and packet in a Forge CTF is simulated, so you can run it anywhere, for anyone, at any scale.