Introduction
In January 2018, I received an invitation to participate in DKHOS, one of Turkey's most prominent Capture The Flag (CTF) competitions. Our team, KHORNE, entered with dual objectives: to secure first place and to donate all prizes to The Foundation for Children with Leukemia in Turkey.
Competition Overview
DKHOS is the successor to previous competitions DKH and DKHO (Dunyayi Kurtaran Hacker & Dunyayi Kurtaran Hackerin Oglu), organized by Invictus/Prodaft. The competition has established itself as Turkey's most innovative CTF event, incorporating unique physical elements—including placing an actual flag on the Bosphorus Bridge.
Image source: Twitter @ctfturkey
Team Strategy and Execution
Our approach emphasized specialization and clear task allocation. Each team member focused on their area of expertise, allowing us to tackle challenges efficiently. The competition structure required:
- Initial momentum - Rapid solving of easier challenges to build confidence
- Specialized focus - Distributing complex problems to subject matter experts
- Perseverance - Working through multiple nights with minimal sleep
- Motivation maintenance - Regular reminders of our charitable objective
A critical moment occurred during the second night when team morale temporarily faltered:
"Remember why we're doing this. We're so close to making those children happy!"
After four days of intense competition, including working through regular business days and overcoming inter-team disputes, we achieved victory among 478 competing teams.
Technical Challenge Design
The competition incorporated several innovative elements:
- Real-world scenarios - Challenges derived from authentic security situations
- Educational progression - Tasks structured to build and reinforce knowledge
- Live competition - A Twitch "hacking royale" where selected competitors tackled a machine with seven flags
Critical Analysis
While the competition was well-executed overall, several aspects warrant critical examination:
Competition Design Issues
- Point distribution imbalance - Group challenges awarded disproportionate points (up to 700) relative to individual challenges, creating scoring inequities
- Non-technical challenge elements - Some challenges relied on cultural knowledge rather than technical skill (e.g., inferring "WhatsApp service" from the Turkish phrase "naber")
- Anti-cheating measures - Despite effective monitoring, legitimate teams faced unwarranted accusations
Security Industry Implications
A significant observation concerns Turkey's cybersecurity landscape, which emphasizes offensive security (red teaming) while neglecting defensive measures. As an Application Security Engineer with defensive security interests, I would recommend evolving the competition format toward Attack and Defense rather than purely Jeopardy-style challenges.
Conclusion
Our victory in DKHOS CTF represents both a personal achievement and a contribution to a worthy cause. The competition provided valuable learning opportunities while highlighting areas for improvement in CTF design and broader security education.
I will be publishing detailed technical write-ups of specific challenges in subsequent posts, focusing on methodologies and security principles that can be applied in enterprise environments.
Note: This post reflects experiences from 2018 and the security landscape has evolved significantly since then.