Gabès Pentest
Register
OfficialGabès Pentest 2026

Competition rules

GABÈS PENTEST 2026 — Official Competition Rules

These rules govern the GABÈS PENTEST 2026 Pentest Challenge. All participants are expected to follow them to ensure a fair, secure, and competitive environment.

1. Eligibility and Team Formation

  • All players must meet the eligibility requirements published on the official event website.
  • Both teammates must be currently enrolled at the University of Gabès.
  • Each team must consist of exactly two eligible players.
  • Each participant may belong to only one team.
  • Participants must provide accurate registration information.
  • Organizers may request proof of enrollment.

Providing false information or registering with multiple teams may result in disqualification.

2. Registration and Participation

  • Teams must complete registration through the official event website.
  • Both teammates must fulfill the registration requirements.
  • Participation is confirmed only after the organizers accept the registration.
  • Players must complete the required on-site check-in and eligibility verification before competing.
  • Participants must follow the registration deadlines and instructions communicated by the organizers.

3. Competition Format

  • The Pentest Challenge consists of practical cybersecurity challenges conducted in authorized environments.
  • Players compete in teams of two.
  • Each player has an individual scoring account.
  • Challenge machines may contain user flags and root flags.
  • Players earn points by submitting valid flags through the official platform.
  • First-blood bonuses reward the earliest valid submissions.
  • Team rankings are calculated using the highest individual score within each team.

4. Flag Scoring

Players earn points by successfully submitting valid flags.

  • User Flag: Awarded for completing a machine's user-level objective.
  • Root Flag: Awarded for completing a machine's highest-privilege objective.

The following rules apply:

  • Each player earns points individually.
  • Flags must be submitted through the player's assigned account.
  • Only valid submissions accepted by the official competition platform count.
  • Each flag awards the points established by the official scoring system.
  • Submissions made after the competition ends will not count.

5. First-Blood Bonus System

First-blood bonuses reward players who submit valid flags before any other competitor.

User First Blood

  • Awarded to the first player who submits a machine's valid user flag.
  • The player receives the standard flag points plus an additional first-blood bonus.

Root First Blood

  • Awarded to the first player who submits a machine's valid root flag.
  • The player receives the standard flag points plus an additional first-blood bonus.

First-Blood Rules

  • User and root first bloods are awarded separately.
  • Each user flag has only one first-blood winner.
  • Each root flag has only one first-blood winner.
  • The earliest valid submission recorded by the official platform determines the winner.
  • First-blood bonuses are included in the winning player's individual score.
  • First-blood achievements also count toward the team's total first-blood count for tie-breaking purposes.

Flag values and first-blood bonus points will be displayed or communicated through the official competition platform.

6. Individual and Team Scoring

Each player accumulates points individually through valid flag submissions and first-blood bonuses.

Team Score = MAX(Player 1 Score, Player 2 Score)

The team's official score is the higher individual score of its two players.

Individual player scores are not added together.

Example:

  • Player 1: 50 points
  • Player 2: 45 points
  • Team Score: 50 points

If Player 2 later reaches 60 points, the team's score becomes 60 points.

First-blood bonuses are included in individual player scores and are not added again as separate team-score bonuses.

7. Rankings and Tie-Breaking

The official team leaderboard follows these ranking criteria, applied in order:

1. Highest Team Score

  • Teams are ranked by their official team scores.
  • The team with the highest score ranks first.

2. Highest Number of First Bloods

If two or more teams have identical scores:

  • The team with the greater number of first-blood achievements ranks higher.
  • User and root first bloods each count as one achievement.
  • First bloods earned by both teammates are combined.
  • First bloods earned by the lower-scoring teammate still count toward the team's total.

Team First-Blood Count = Player 1 First Bloods + Player 2 First Bloods

3. Earliest Score Achievement

If teams remain tied in both score and first-blood count:

  • The team that reached its final team score first ranks higher.
  • Official platform timestamps determine the order.
  • Any unresolved technical discrepancy will be reviewed using official competition records.

Final rankings are subject to verification by the organizers.

8. Qualification for Cyber Oasis 2.0

  • The top nine eligible teams in the final verified leaderboard qualify for Cyber Oasis 2.0 – Hack the Dunes in Zawia, Libya.
  • Qualification is determined using the official scoring and tie-breaking rules.
  • Teams must comply with all competition rules to retain their qualification.
  • Organizers will verify eligibility and final results before confirming the qualifying teams.
  • Additional requirements established by the receiving event will be communicated separately.

9. Authorized Testing Scope

All security testing must remain strictly within the competition's authorized environments.

Participants may test only the machines, applications, services, and systems explicitly designated as competition targets.

The following activities are prohibited:

  • Attacking the official event website or registration system.
  • Attacking or manipulating the scoring platform.
  • Attacking organizer infrastructure.
  • Attacking other participants' devices, accounts, or networks.
  • Targeting public websites or third-party systems.
  • Performing denial-of-service attacks.
  • Intentionally disrupting shared competition services.
  • Accessing systems outside the authorized scope.
  • Damaging or interfering with other teams' competition environments.

Players must respect all challenge-specific restrictions.

10. Fair Play and Collaboration

Collaboration between the two registered teammates is permitted and encouraged.

The following activities are prohibited:

  • Sharing flags, solutions, or challenge answers with other teams.
  • Receiving unauthorized assistance from individuals outside the registered team.
  • Submitting flags obtained through prohibited collaboration.
  • Manipulating the scoring system.
  • Exploiting unintended vulnerabilities in the competition platform.
  • Impersonating another participant.
  • Intentionally obstructing another team's progress.
  • Using prohibited techniques to gain an unfair advantage.

Technical documentation and security tools may be used in accordance with the authorized competition scope and organizer instructions.

Any restrictions concerning AI assistants or external services must be communicated to all participants before the competition begins.

11. Code of Conduct

Participants must maintain respectful, ethical, and professional behavior.

  • Respect competitors, organizers, volunteers, and mentors.
  • Follow venue safety instructions.
  • Respect other participants' equipment and belongings.
  • Avoid harassment, discrimination, threats, and disruptive behavior.
  • Report technical incidents or suspected rule violations to organizers.
  • Follow instructions issued by authorized competition staff.

Harassment, deliberate sabotage, and serious misconduct are prohibited.

12. Rule Violations and Disqualification

Organizers may investigate suspected rule violations.

Depending on the seriousness of a confirmed violation, penalties may include:

  • An official warning.
  • Removal of points associated with the violation.
  • Disqualification of a player or team.
  • Removal from the event for serious misconduct or safety concerns.

Organizers will review relevant evidence and official platform records before finalizing results.

13. Technical Issues and Official Announcements

  • Participants experiencing technical problems must notify competition staff promptly.
  • Official challenge updates and instructions will be communicated through organizer-designated channels.
  • Participants are responsible for following official announcements.
  • Rule clarifications affecting competition fairness will be communicated to all teams.
  • Technical disputes will be reviewed using available competition records.

14. Acceptance of the Rules

By registering for and participating in GABÈS PENTEST 2026, participants acknowledge that they have read, understood, and agree to follow these competition rules.

Participants are expected to demonstrate technical integrity, ethical conduct, and respect for the competition environment.

Compete fairly. Hack ethically. Respect the rules.