Capture the flag

You first sign up to the CTF on your own at Mendix.com/ctf with the email address associated with your Mendix account (if you have one). Shortly before the event starts, you will get access to an app that contains the challenges, scoreboard, and teams. There, you can create a team, invite people, and join teams.

If you don’t have a team yet, you can search for other team members at the event itself or ask other participants in the #ctf25 channel on the Mendix Community Slack. Not a member yet? Create an account here.

There are two main ways to participate in CTF25: by hacking and by following workshops. Strictly speaking, there is no prior hacking skill required, but knowledge of Mendix development will greatly help. The competition will have multiple challenges, with difficulty levels varying from beginner to expert. There will be a range of workshops that introduce hacking for those unfamiliar with security or hacking with tips and tricks to get you started. Like the hacking challenges, there will be a range of workshops for different people, at varying difficulty levels, across three time zones.

Keep in mind that hacking is an exercise that is technical in nature, which means that some familiarity and experience with the technical aspects of Mendix and web applications go a long way.

Although not strictly necessary, there are a few things that can make participation in the CTF significantly easier:

Knowledge of JavaScript and the Mendix Client API:

• https://docs.mendix.com/apidocs-mxsdk/apidocs/client-api/

Access to or experience with a local web proxy, such as Burp Suite or OWASP Zap

• https://portswigger.net/burp/communitydownload
• https://www.zaproxy.org/download/

Satellite locations are places around the world where our customers and partners host an in-person location for the Capture the Flag. You can select a satellite location in the registration form if you want to participate at that location. The satellite location host will reach out after you register to welcome you and share more details about what to expect.

On October 9, the Mendix office is open from 8 AM till 9 PM. You cannot stay at the office overnight. On October 10, the office will be open from 8 AM till 7 PM.

Each satellite location has its own opening and closing times. Please, contact your satellite location host for specific information. They will reach out when you register.

For those who are new to hacking, there will be beginner workshops on security and hacking Mendix applications during the event. There will also be coaches on site and online who can give tips and hints to teams concerning the challenges. Note that this is still a competition, which means that as the difficulty of the challenges increases, the number of hints and the level of details provided by coaches will decrease significantly.

The S-Unit provides security training on Mendix, which is a great way to prepare for the event. Also keep an eye on the meetups because several organizers will host meetups about security.

The CTF will center around Mendix applications. As such, there will be several Mendix-specific types of vulnerabilities related to the domain model, access rules, microflows, etc. However, Mendix applications are still web applications, so you may also encounter more traditional web application vulnerability types.

The CTF will use a Jeopardy-style scoring mechanism, where challenges have fixed and pre-determined values. In case of ties, the winner will be determined based on flag submission time.

A dedicated support crew is available throughout the event to make sure everything runs smoothly. We expect everyone to treat each other with respect and human decency.

Hotel nhow Rotterdam – in the same building

Room Mate Bruno Hotel – across the street

Hotel New York – 5-minute walk

Suite Hotel Pincoffs Rotterdam – 13-minute walk

ss Rotterdam – 25-minute walk