– Bring yourself and a laptop, everything else you need is provided at the stand.
– The competition runs in rounds with a limited number of seats per round, so sign up to reserve your slot.
– Each player gets their own isolated instance of the target – no attacking other players, other seats, or shared infrastructure.
– Points are awarded per challenge. Hints are available so ask the organizers.
– Ties are broken by furthest progress, then by time, then by fewest hints used.
– Rules are not static. Organizers may adjust, add, or clarify rules during the competition – check in with us if you’re unsure. Our word is final.
– No tool restrictions. Use anything you want: your own scripts, public tooling, custom loaders, whatever gets the job done. If you wrote it the night before, even better.
– No DoS / DDoS. No flooding, no resource exhaustion, no crashing the environment for everyone else. Break in, don’t break things.
– Don’t destroy the infrastructure. You’re allowed to compromise the target – you’re not allowed to wipe it, brick it, or leave it in a state where the next player can’t play. If you’re not sure whether an action crosses that line, ask first.
– No teaming, no flag sharing, no solution sharing during the competition. Watching over a shoulder, passing hints between seats, or coordinating between rounds is cheating. Talk shop all you want after the round ends.
– No tampering with other players’ progress or with the flags/samples once found – no hiding, moving, or modifying them for anyone else.
– Scope is what we tell you it is. The organizers will define scope before each round (which machines, which segments, which samples). Touching anything outside scope – including the venue’s own network, other DefCamp infrastructure, or the internet at large – is an instant disqualification.
– Respect privacy. Any data you come across in the challenges stays in the challenges. Don’t post it, don’t exfiltrate it off the stand, don’t share it.
– Responsible disclosure. If you find a bug or vulnerability we didn’t plant, tell us. Don’t weaponize it against the environment or against DefCamp itself.
– Comply with the law. Local, national, international – all of it applies. If it would be illegal outside this room, it’s illegal inside this room too.
– Stay civil. Trash talk is fine, disrespect toward other players, organizers, or DefCamp staff is not. Same goes for the stand itself – treat the hardware like it’s yours.
– Time’s up means time’s up. When the round ends, hands off the keyboard.
– Violations can mean anything from a warning, to point deductions, to being pulled from the round, to a ban from future editions. Organizers decide.
– Meridian Malware is meant to be hard but fair. Play smart, play mean, play clean.
