HTB University CTF 2024 — 205th out of 2,000+ teams

We took LoboSec into the HTB University CTF 2024 — a student-only, Jeopardy-style competition with over 2,000 teams from universities worldwide — and finished 205th overall, inside the top 10% of the field.

For a team competing in its first international university bracket, that was a good baseline to measure ourselves against.

How we split the board

With a large challenge board and a limited number of players, we didn't try to cover everything. Members claimed the categories they were strongest in and worked in pairs so that nobody sat on a challenge alone for hours:

Web — enumeration first, then hunting for injection and authentication flaws in the provided applications.
Cryptography — looking for misuse of otherwise sound primitives rather than trying to break the primitives themselves.
Forensics — packet captures and file artifacts, reconstructing what had happened from what the organizers left behind.

Anything solved got written up in our Discord immediately, so the technique was available to the rest of the team while the clock was still running.

What went well

The pairing worked. Newer members were able to contribute real solves because they were sitting next to someone who had seen the pattern before, and the running notes meant a trick discovered in one challenge often unlocked another.

Focusing on three categories instead of spreading thin also kept our momentum up — we were finishing challenges rather than half-starting a dozen of them.

What we'd do differently

Two things stood out afterwards:

Earlier triage. We spent time on challenges that turned out to be far above our current level. A quick pass over the whole board first — rating each challenge before committing to it — would have saved hours.
Reverse engineering and pwn coverage. These were our thinnest categories, and they're where the points concentrate at the top of the scoreboard. That gap shaped the practice sessions we ran afterwards.

Placing in the top 10% of 2,000+ teams in our first university bracket set the floor for what we expect from ourselves. The next goal is depth in the categories we skipped.

Want in on the next one?

Rosters are open to every member, including people solving their first challenge. Join the Discord and we'll add you to the next sign-up.