Skip to content

ATTACK-DEFENSE FORMAT

Attack your opponents. Defend your services. Score every 30 seconds.

The most technically demanding CTF format. Zero Day Arena runs the full Attack-Defense game plane: VPN, vulnboxes, checkers, scoring. You bring the challenges. We handle the rest.

Book an A/D demo

The 30-second game loop.

Every tick, four things happen for every team and every service. This is the loop your players will live inside.

tick 0412 · 30s per tick

  1. 01
    Checkers run
    00–08s
  2. 02
    Flags rotate
    08–12s
  3. 03
    Attacks captured
    12–25s
  4. 04
    Score calculated
    25–30s

Teams submit flags they stole from rivals. Submission via HTTP or raw TCP on port 31337.

CHECKROTATECAPTURESCOREGAMEtick 0412T01fd7d3d64T021253e8adT03272a93f6T043c013f40T0550d7ea88T0665ae95d0
Attack-Defense game plane — datasheetRev. 2026-10

The infrastructure we run for you.

WireGuard VPN
/24 per team · hub-and-spokeOne /24 subnet per team. Hub-and-spoke topology. Teams connect once; their exploit scripts target 10.X.<team>.1.
Vulnboxes
Docker containers per team, same base image. Every team patches or owns the same vulnerabilities as everyone else.
Checker sandbox
Each checker runs as an isolated OS user in a temp directory. Egress filtered to the game network only. Time-limited.
Scoring formula
Attack + Defense + SLA. The formula is versioned, frozen before the event, and published in the rules. Every score can be rebuilt from the ledger.

What you actually do as an organizer.

You never touch the WireGuard config, the scoring formula, or the checker sandbox. That's our problem.

  1. 01

    Upload your checker

    A Python script or Go binary that validates your service. Our team reviews it before the event starts.

  2. 02

    Configure services

    Name each service, set the port, enable the checker.

  3. 03

    Set tick duration

    30 seconds is standard. Use longer ticks for teaching events.

  4. 04

    Launch

    The game starts, checkers run, scores update automatically.

Attack-Defense always starts with a demo.

A/D events have infrastructure requirements and team sizes that vary a lot. A 30-minute conversation lets us scope yours correctly, before anyone writes a checker.

Book an A/D demo

Response within 24 hours. A/D capacity is limited to one large event at a time.