Core Rules of Engagement

Purpose

The Virginia HS Cyber Cup is your chance to test your skills, learn from challenges, and work as a team. Here, you're an ethical hacker, and ethical hackers follow the rules of engagement. These rules keep the competition fair, keep everyone safe, and keep your skills on the right side of the law. They apply to all students, coaches, and sponsors.

Hacking outside the competition's authorized targets can break school policy and the Virginia Computer Crimes Act, even during a CTF. When in doubt, stop and ask a Game Master.

1. Authorized Scope Only

Attack only the specifically designated targets in your assigned challenges: cityinthe.cloud subdomains. Everything else is out of scope.

• In scope: challenge files and the cityinthe.cloud subdomains listed in your assigned challenges.

• Do not attack the infrastructure. This includes the Virginia Cyber Range, the Germanna Community College network, and all CTF infrastructure: the scoreboard, login and registration pages, the hosting platform, external communication channels (such as Discord), and any other platforms associated with the CTF.

• Never attack, scan, or interfere with other teams, their accounts, or their machines, or with the school network you compete from.

• No denial of service. Do not flood, crash, or slow down challenge servers or the platform. Automated scanning or brute force is allowed only when a challenge explicitly calls for it.

• Don't block scoring. Tampering with flag submission, scoring services, or other teams' ability to play is prohibited.

• Found an unexpected vulnerability? Stop and submit a ticket. Do not exploit it.

• If you are not sure a target is in scope, it isn't. Ask a Game Master first.

2. No Unauthorized External Interference

Keep your actions inside the challenge. Categories such as cryptography, binary exploitation, web security, forensics, reverse engineering, and OSINT are solved within the challenge's own parameters.

• Do not touch real-world systems, accounts, or people. OSINT challenges are passive research only: no contacting, messaging, or social engineering real individuals or organizations.

• Do not tamper with shared public resources, such as editing public wikis, posting to forums, or uploading files to third-party sites to solve a challenge.

• Do not use compromised challenge servers as a launch point to reach anything else.

• Do not deface, delete, or reset shared challenge instances in a way that ruins them for other teams.

3. AI and Tool Guidelines

AI assistants and LLMs are not allowed at any point during the competition. Only free tools may be used; paid licenses, subscriptions, and commercial tools are prohibited.

• No AI. Do not use ChatGPT, Claude, Gemini, Copilot, or any other AI assistant, chatbot, or LLM, including AI features built into other tools, browsers, or IDEs.

• No AI harnesses or agents. Custom-built or pre-built AI harnesses, agent frameworks, and scripts or tools that call an AI model (local or cloud) are prohibited, even if you wrote them yourself.

• Free tools only. Open-source tools and free editions of commercial tools are allowed. Examples: CyberChef, Ghidra, Wireshark, OWASP ZAP, pwntools, John the Ripper, Hashcat, Kali Linux tools, Burp Suite Community Edition, and IDA Free.

• No paid tools. Paid licenses, trials of paid tools, and premium subscriptions (for example Burp Suite Professional or IDA Pro) are not allowed.

• Do not use any tool to attack the platform, flood flag submissions, or harvest other teams' work.

• Not sure if a tool is allowed? Ask a Game Master before using it.

4. Fair Play and Team Integrity

Work only with your own registered team.

• No flag sharing. Do not give, receive, or trade flags, hints, or solutions with anyone outside your team during the event.

• One player, one account. Do not share credentials or let anyone play under your name.

• No outside help. Coaches, teachers, parents, and alumni may not solve challenges or give hints during competition time.

• No flag guessing or brute-forcing the submission system.

• No write-ups until the event closes. Publish solutions only after the Game Masters announce the competition is over.

Open question: Team size and roster rules (for example, max players per team, substitutions, mixed-school teams).

5. Conduct and Student Safety

Compete the way you'd want to be represented: respectful, honest, and safe.

• Follow your school division's Acceptable Use Policy and the Cyber Cup code of conduct at all times.

• No harassment, hate speech, or inappropriate content in team names, usernames, chat, or Discord.

• Protect your privacy. Do not post personal information (address, phone, school schedule) in public competition channels.

• Each team needs a registered adult sponsor or coach who is reachable during the event.

• Respect Game Masters and volunteers. Their rulings during the event are final.

6. Reporting Issues and Responsible Disclosure

If something looks broken, report it to a Game Master. Don't exploit it.

• Report bugs, unintended solutions, or platform vulnerabilities privately through the official support channel or ticket system.

• Do not share a discovered platform flaw with other teams.

• Report suspected rule violations by other teams to a Game Master, not in public chat.

• Good-faith reports will never be penalized and may earn recognition.

Open question: Which channel is official for support (Discord ticket, email, in-platform form)?

7. Enforcement and Consequences

Game Masters may act on any violation, scaled to its severity and intent.

Minor violations

Examples: Accidental out-of-scope scan, inappropriate username.

Possible consequence: Warning; required fix.

Moderate violations

Examples: Flag sharing, outside help, repeated minor violations.

Possible consequence: Point deduction; challenge disqualification.

Severe violations

Examples: Attacking the platform or other teams, DoS, harassment.

Possible consequence: Team disqualification; ban from future Cyber Cup events.

Severe violations are reported to the team's coach and school administration. Violations that may break the law can be referred to appropriate authorities.

8. Scoring

Each challenge is worth a fixed number of points. You get points by solving challenges. The team with the most points at the end of the competition wins. If two or more teams have the same score at the end of the competition, the team that reached their point total first will be ranked ahead of other teams with the same point total.

9. Questions and contact

Please email [email protected].