Scroll
Features
Everything you need to run a CTF
From challenge to prize-giving, without stitching together ten different tools.
Challenges & scoring
Sequential challenges with prerequisites, multi-question support with per-question scoring, and text, code, multiple-choice, or long-text solutions.
Live scoreboard
Team-based scoring with configurable max team size, wrong-answer penalties, and a cached real-time scoreboard over SSE. Manual adjustments can be tied to a challenge, so teams see the reason where it applies.
Accounts & access
TOTP 2FA, API tokens scoped to per-group read/write permissions, session management for users and admins, OAuth2/OpenID Connect login, and a built-in OAuth2/OIDC server.
Fair play, with evidence
Trap flags that never score but raise a security event, hidden canary tokens that catch AI-assisted answers, per-team submission rate limits, and a full audit log streamed live.
Backup & restore
Dump the database to object storage from the admin panel or on a cron schedule with automatic pruning, and restore it in place: migrations, plugin migrations and restart included.
Plugin system
Register custom challenge types, solution strategies, scheduler jobs, and frontend components. Plugins own their DB tables via Alembic migrations.
Preview
NexCTF in action
A look at the screens your players and admins use every day.
Multi-question, prerequisite-aware challenges
Each challenge can hold several scored questions, with S3-backed attachments, hints, and tags.
- Prerequisite enforcement between challenges
- Per-question points and hint costs
- Text, code, multiple-choice, or long-text answers
01 / 03
A ranking players want to keep checking
A cached, real-time scoreboard pushed over Server-Sent Events, with full solve history per team.
- Live updates, no page refresh
- Configurable max team size
- Manual bonus/penalty adjustments with reason tracking
02 / 03
Full control over your competition
An admin dashboard with audit logging, a file manager, broadcast notifications, and a one-shot/cron job scheduler.
- Full CRUD for challenges, questions, categories, hints, and tags
- Database backup and restore, by hand or on a schedule
- Custom Markdown pages and per-competition settings
03 / 03
Ready to get started?
Spin up your first CTF in minutes
One Docker Compose stack: Python/FastAPI backend, React frontend, Postgres, and Valkey.