Opportunity brief
ABOUT THE EVENT
An international online Capture The Flag competition from CyberHX and Team CyberXoX. Round 01, the 12-hour Qualifier, runs on 18 September 2026 from 10:00 AM to 10:00 PM IST (04:30 to 16:30 UTC). The top teams return for the 12-hour Grand Finale on 25 to 26 September 2026. Jeopardy format, teams of 1 to 4, free entry, open worldwide, challenges from Easy to Expert. Unstop registration closes on 15 September 2026.
EVENT SNAPSHOT
- Round 01, Qualifier: 18 September 2026, 10:00 AM to 10:00 PM IST (04:30 to 16:30 UTC), 12 hours
- Round 02, Grand Finale: 25 to 26 September 2026, 12 hours, start time to be announced
- Winners announced: 26 September 2026
- Mode: Online, played on ctf.cyberhx.com
- Format: Jeopardy. Two separate 12-hour rounds, 24 hours of competition in total
- Team size: 1 to 4 members. Solo entries welcome
- Entry fee: None
- Challenge domains: Web Exploitation, Cryptography, Reverse Engineering, Digital Forensics, OSINT, Binary Exploitation, Miscellaneous
- Difficulty: Easy, Medium, Hard, Expert
- Eligibility: Open to anyone, anywhere, at any skill level
- Registration on Unstop closes: 17 September 2026, 12:00 AM IST
- Listed on CTFtime: ctftime.org/event/3346
WHAT IS NULL ORIGIN
Null Origin is a Jeopardy-style CTF written by active practitioners: hand-crafted scenarios modelled on real vulnerabilities, not contrived puzzles. It runs on CyberHX's own security-hardened competition platform, the same platform that hosted ZeroDay Heist 2026, a CTFtime-rated event with 85 competing teams.
CyberHX is a cybersecurity community based in Bhopal, India. Team CyberXoX, the organising team, is a rated CTFtime team that competes internationally. Null Origin is their first two-round international edition.
THE MISSION
Every challenge hides a flag. Your team finds it, submits it on the platform and earns the points. Scoring is per team: each challenge counts once, whoever on the team solves it. Ties break on the earliest solve. A live scoreboard tracks every team through the round. Hints exist and cost points, so use them deliberately.
CHALLENGE DOMAINS
- Web Exploitation: find and chain the flaws in live web applications, from injection and authentication bypass to logic errors the framework never protected against.
- Cryptography: break what was implemented wrong, from misused primitives and weak randomness to protocol mistakes that leak the key.
- Reverse Engineering: pull binaries apart without source, recover the logic and make them give up what they were built to hide.
- Digital Forensics: reconstruct what happened from disk images, memory dumps, packet captures and logs, then prove it with the flag.
- OSINT: turn public traces into intelligence by pivoting across identities, metadata, infrastructure and time.
- Binary Exploitation (Pwn): take control of vulnerable programs through memory corruption, from classic stack overflows to modern mitigation bypass.
- Miscellaneous: the problems that fit no single category, including steganography, scripting and puzzles that test how you think under a clock.
DIFFICULTY LEVELS
The board runs from Easy to Expert. Easy challenges are real entry points for first-time players, not filler. Medium and Hard reward depth and speed. Expert is reserved for teams that want to be tested. Points scale with difficulty, and the count per level is revealed when the board opens.
ROUND 01: QUALIFIER
- Date: 18 September 2026
- Time: 10:00 AM to 10:00 PM IST (04:30 to 16:30 UTC)
- Duration: 12 hours, online, Jeopardy format
- Who plays: every registered team
The board opens at 10:00 AM IST and closes at 10:00 PM IST. Teams are ranked by total points, with ties broken by earliest solve. The top-performing teams qualify for the Grand Finale. The qualification cut-off will be announced by the organisers.
ROUND 02: GRAND FINALE
- Date: 25 to 26 September 2026
- Duration: 12 hours, online. Start time to be announced
- Who plays: qualifying teams only
A fresh board for the teams that made the cut. Winners are announced on 26 September 2026.
Null Origin is 24 hours of total competition split across two separate 12-hour rounds. Participants do not play continuously for 24 hours.
REWARDS & PRIZES
Null Origin rewards top-performing teams with a combination of premium cybersecurity training, certifications, hands-on labs, cloud credits and career opportunities from CyberHX and our official partners.
1st Place
- $500 Render Cloud Credits
- 1-Year OffSec Proving Grounds Practice Access
- CRTP Voucher by Altered Security
- INE Learning Path + Certificate - any one domain
- CPPT (Certified Practical Penetration Tester) by CyberHX - worth $99
- MITRE ATT&CK Lab Access by CyberHX
- Internship Opportunity with CyberHX
2nd Place
- $300 Render Cloud Credits
- 1-Year OffSec Proving Grounds Practice Access
- INE Learning Path + Certificate - any one domain
- CPPT (Certified Practical Penetration Tester) by CyberHX - worth $99
- MITRE ATT&CK Lab Access by CyberHX
- Internship Opportunity with CyberHX
3rd Place
- $100 Render Cloud Credits
- 1-Year OffSec Proving Grounds Practice Access
- INE Learning Path + Certificate - any one domain
- CPPT (Certified Practical Penetration Tester) by CyberHX - worth $99
- MITRE ATT&CK Lab Access by CyberHX
- Internship Opportunity with CyberHX
WHO CAN PARTICIPATE
Anyone, from anywhere in the world, at any skill level. Students, cybersecurity enthusiasts, CTF players, ethical hackers, penetration testers, bug bounty hunters, security researchers, reverse engineers, digital forensics and OSINT practitioners, developers who care about security, and working security professionals.
Beginners are welcome. No prior CTF experience is required, and a team of one is a valid team.
WHY PARTICIPATE
- Realistic challenges modelled on real vulnerabilities, written by practitioners
- An international field on a live scoreboard, listed on CTFtime
- Twelve hours of hands-on offensive security across seven domains
- A progression from Easy to Expert, so a first-timer and a veteran both leave with something
- A partner ecosystem of INE, OffSec, Altered Security, Render and Unstop
- A shot at the Grand Finale, the podium and the rewards revealed with the winners
- Certificates, lab access and internship opportunities for top performers
- A permanent record: write-ups are welcome once the event ends
WHAT YOU NEED
- A laptop, a stable connection and a modern browser
- Your usual toolkit. Typical picks: a Linux VM, Python, Burp Suite, Ghidra or IDA, Wireshark, pwntools
- An Unstop registration, then an account on ctf.cyberhx.com created with the same email address. Only registered participants can submit flags
- A team of 1 to 4 created or joined on ctf.cyberhx.com before 10:00 AM IST on 18 September. Team changes lock when the round starts
RULES
- Play ethically. Everything the challenge intends is allowed: reverse engineering, exploitation, cryptanalysis, forensics and research against the challenge targets themselves
- Do not attack the competition infrastructure: the scoreboard, the submission system, accounts, hosting or anything not designated as a challenge target
- Do not attack other players or teams, their infrastructure or their sessions
- Do not share flags or solutions with other teams, or publish them, before the event ends
- Do not brute-force the flag form or script around attempt limits and cooldowns
- Do not run denial-of-service traffic against challenge targets
- Do not buy, sell or trade flags, hints or accounts
- One account per person. Duplicate accounts are removed and their solves voided
- Found a vulnerability in the platform itself? Report it to support@cyberhx.com instead of exploiting it. Good-faith reports are welcome
- Violations lead to removal of solves, a ban, or disqualification of the whole team
- Organiser rulings on scoring, disputes and conduct are final
IMPORTANT DATES
- Now: registration open on Unstop
- 17 September 2026, 12:00 AM IST: Unstop registration closes
- Before 18 September, 10:00 AM IST: create your ctf.cyberhx.com account and settle your team
- 18 September 2026, 10:00 AM to 10:00 PM IST: Round 01, Qualifier
- 25 to 26 September 2026: Round 02, Grand Finale (12 hours, time to be announced)
- 26 September 2026: winners announced
FAQ
- Is registration free? Yes. There is no entry fee.
- Who can participate? Anyone, anywhere in the world, with no restrictions on age, country or experience.
- Can I participate alone? Yes. A team of one is a valid team.
- What is the maximum team size? Four members, including the team leader.
- Do I need previous CTF experience? No. Easy challenges are built as entry points.
- Is the competition online? Yes, entirely. Nothing is played on site.
- How long is each round? Twelve hours each.
- Is it really 24 continuous hours? No. Two separate 12-hour rounds, a week apart.
- How does qualification work? Qualifier teams are ranked by points, then earliest solve. The top-performing teams advance. The cut-off will be announced.
- When is the final? 25 to 26 September 2026, 12 hours. Start time to be announced.
- What tools do I need? Your own. A Linux VM, Python, a web proxy, a disassembler and a packet analyser cover most of the board.
- Where will the CTF run? On ctf.cyberhx.com, not on Unstop. Register on Unstop, then create your platform account with the same email.
- How are winners selected? By total points on the Grand Finale board, ties broken by earliest solve.
- What rewards are available? Finale qualification, partner-backed winners' rewards, the CPPT certificate, MITRE ATT&CK lab access, internship opportunities and digital certificates for top performers. Further details will be announced.
- How do I contact the organisers? nullorigin@cyberhx.com.
SUPPORT AND CONTACT
- Event queries: nullorigin@cyberhx.com
- Platform and account help during the event: support@cyberhx.com
- Sponsorship and partnerships: partners@cyberhx.com
OFFICIAL LINKS AND REGISTRATION
- Register: on this Unstop page, before 15 September 2026
- Official website: nullorigin.cyberhx.com
- Competition platform: ctf.cyberhx.com
- CTFtime: ctftime.org/event/3346
- Follow: X @nulloriginctf, Instagram @nulloriginCTF, LinkedIn: Null Origin CTF
Register on Unstop, create your account on ctf.cyberhx.com with the same email, build your team, and be on the board at 10:00 AM IST on 18 September.