Challenge Rules

1. Scope

Hack n Roll challenges are designed for educational security research. Authorization to test applies only to challenge environments, instances, files, and targets explicitly provided by Hack n Roll.

That authorization does not extend to Hack n Roll infrastructure, other users, or external systems. Techniques you learn here should be applied only against authorized challenge environments, never against systems you do not own or have explicit permission to test.

You are responsible for how you use the knowledge gained on this Platform. Unauthorized testing against third-party systems is illegal and not condoned by Hack n Roll.

Official competitions or events may publish additional rules regarding collaboration, automation, AI usage, and disclosure timelines. Follow those rules when they apply.

2. Allowed Techniques

Within authorized challenge environments, you may use standard security research techniques, including but not limited to:

• Web exploitation within the intended challenge scope.
• Reverse engineering and binary analysis.
• Binary exploitation (pwn) against challenge targets.
• Cryptography and cryptanalysis.
• Digital forensics.
• Steganography.
• Network analysis and protocol inspection within challenge scope.
• Use of publicly available tools, frameworks, scripts, and AI assistants to support learning and challenge solving. You remain responsible for understanding, validating, and submitting your own solutions.
• Connecting through VPN or Tor.

Real exploits may exist inside intentionally vulnerable challenge environments. Those techniques must never be used against systems outside authorized environments.

If a specific challenge or official competition restricts certain techniques (including AI usage), follow the challenge description and any posted rules for that challenge or event.

3. Forbidden Activity

The following activities are strictly prohibited:

• Attacking Hack n Roll infrastructure, including the frontend, backend, database, and other services, or hosting environment.
• Attacking other users, their accounts, or their personal systems.
• Denial-of-service attacks against Hack n Roll infrastructure, challenge infrastructure, or other users.
• Unauthorized access to systems outside the scope of an official challenge.
• Exploiting production services outside the intended challenge scope.
• Exploiting Platform vulnerabilities instead of reporting them via Responsible Disclosure.
• Exploiting unintended vulnerabilities or information leaks in challenge environments for unfair advantage instead of reporting them.
• Sharing flags or full solutions outside the official Solution thread (see Community Guidelines).
• Brute-forcing authentication systems, credentials, or challenge solutions.

4. Flag and Solution Sharing

Flags and full solutions may be shared only in the official Solution thread for each challenge, after you have personally solved it.

• Do not publish or disclose flags anywhere else, including GitHub, YouTube, Discord, blogs, social media, private websites, or any other platform or communication channel.
• Do not share flags through public chats, private messages, emails, or any other direct communication.
• Educational write-ups, videos, livestreams, and research content are welcome, provided they do not reveal flags, complete solutions, or significant spoilers outside authorized areas (the official Solution thread after you have solved the challenge).
• Challenge authors must not publish flags, solutions, or spoilers before official release, or outside permitted areas after release.

5. Enforcement

Violations may result in score removal, solve invalidation, account suspension, or permanent ban. Attacks on Platform infrastructure or other users may also be reported to relevant authorities.

When in doubt, ask in the appropriate forum category or review our FAQ. For security issues affecting Hack n Roll itself, use Responsible Disclosure.