Capture the Flag
Two highly experimental competitions, split across the two days of the conference, deliberately built around different formats and philosophies.
Overview
The BSidesLisbon CTF is a competition for anyone who's passionate about security and wants to try harder and have fun.
Ethiack is running the CTF for the second year in a row at BSidesLisbon 2026.
The focus for this edition is to create two highly experimental competitions split between the two days of the conference. Both competitions were created to deliberately follow different formats and philosophies.
First up a Speed Pwning bracket-based CTF, fast, head-to-head, human-only. Following we will host the first Ethiack SOHO Smashup, a home office hardware exploitation event in the spirit of Pwn2Own's SOHO category, where AI-assisted exploitation is explicitly encouraged.
One competition measures raw individual skill under time pressure, the other measures what hackers can achieve against real consumer hardware with modern tooling.
You can pre-register for the Speed Pwning CTF here but make sure to read the rules below first!
| Event | Speed Pwning CTF | Ethiack SOHO Smashup |
|---|---|---|
| Format | 1v1 single-elimination bracket | Live hardware exploitation |
| Participants | 8 | No Limit - On-site registration |
| Qualifiers | None | None |
| AI usage | Not allowed | Encouraged |
| Material | Bring your own Laptop with an HDMI port/dongle | Firmware released weeks in advance |
Speed Pwning CTF
Format
Two players go head to head. Each match presents both competitors with the same CTF challenge at the same moment. The first to submit a valid flag advances. Losers are eliminated.
- Single-elimination bracket
- 30 minute matches
- 8 participants
- No qualifiers - entry is by registration, first come first served
- Brackets are drawn at random
Rules
No AI. At all.
This is the core rule of this competition. No LLMs, no AI coding assistants, no AI-powered decompilation or reverse engineering aids, no AI-backed autocomplete. The event is designed to measure how fast a human can hack the planet. Competitors should expect their environment to be constrained accordingly.
This is a highly experimental format that tries to contradict the heavy use of AI in CTFs, as such, the team of dedicated Ethiack judges will have full autonomy to make any decisions final.
Therefore, standard tooling is permitted (debuggers, disassemblers, proxies, personal tools or libraries) as long as the AI native features of said tools are not used during the competition.
Failure to comply with these rules may result in disqualification.
Categories
There are three categories in play: pwn, misc and web.
The players will decide what category they are going to play before each match based on a veto process where each player can decide to not play a category. The remaining category will dictate the challenge played by both players during the match.
Streaming
Each match will be streamed live to the on-site television.
Spectators are welcome to join us in the lounge area to listen to the shout casting and analysis of each match.
Registration
Participants need to pre-register here and they will be hand picked according to their CTF and vulnerability research backgrounds. This year we decided against organizing qualifiers since we cannot control the use of AI in online CTFs and it contradicts the philosophy of this competition. The team of Ethiack judges that are tasked with evaluating each submission may reach out to you to confirm your experience.
Participants must have a BSides Lisbon 2026 ticket to be eligible for participation.
Tie Breakers
In case no player captures the flag until the end of the allocated time, the jury will analyse the match and decide the person that is closest to the flag. Each challenge will have intermediate guidelines to guide the decision.
No Shows
Participants must be present in the lounge area 15 minutes prior to the timeslot allocated for their matches to set up their PC and ensure that the capture card works and we are able to cast their screen onto our streaming setup. Failure to do so will result in disqualification.
Prizes
1st, 2nd and 3rd places are guaranteed prizes given during the closing ceremony on the 2nd day of the conference.
Ethiack SOHO Smashup
Concept
Modelled on the SOHO Smashup category at Pwn2Own. Two pieces of real, aging office equipment will be placed on the floor:
- One office router - TBD
- One printer - TBD
Participants attack them live, in the lounge area, in front of an audience.
The objective
Participants are welcome to get creative on the best ways to exploit these devices. We will accept submissions for any kind of vulnerabilities. You just need to meet us at the lounge area to schedule your attempt.
Hack the world, be creative! Goodies will be awarded for successful exploitation attempts.
Firmware release
Firmware images for both devices will be released in the next couple weeks before the event so don’t forget to follow Bsides Lisbon’s and Ethiack’s social media to be the first to know the targets. This is a preparation-heavy contest by design: participants are expected to arrive with a quasi-working exploit chain idea and demonstrate it live, but are also welcome to hang out with us in the lounge area and collaborate with other researchers to find a bug on the spot.
AI tooling
AI-aided exploitation is welcome.
Participants are free to use LLMs, agentic tooling, AI-assisted binary analysis, automated fuzzing harnesses generated with AI support, or anything else that helps. Our interest here is to showcase what hackers can accomplish against real embedded targets. So feel free to use and abuse them.
Rules
- Devices will be in their default or lightly-configured out-of-the-box state
- We will try to reset the devices between each attempt (please try your best to not brick our devices :)
- Each attempt will be limited to 10 minutes but with the possibility of repetition according to demand.
- Full write-ups are required after the event with the possibility of participating in a show and tell session at the end of the last day
- 0-days found on site are subject to responsible disclosure to the affected vendors, coordinated by the organisers
BSidesLisbon CTF Team
