HASH 12.0 // Capture The Flagevent 0x0C // online

Collision

The HASH 12 interschool Capture The Flag. Crypto, web, forensics, reversing, cryptic: 28 challenges from warm-up to brutal. Every hash squeezes infinite inputs into 256 bits. Somewhere, two of them collide. Find yours.

Online · Jeopardy1–4 players28 challenges8725 ptsfree entry
Register your team ->Read the brief
kickoff in
--days
--hrs
--min
--sec
Date
15 Aug 2026
Format
Online · Jeopardy
Team
1–4 players
Challenges
28
Points
8725
01 // the brief

What is this?

jeopardy-style
solve // submit // score

A hash function squeezes everything into a fixed size, so inputs must eventually collide. Your job is to find where things break.

$ echo -n "collision" | sha256sum
9550e70a7c3619220570a6ed8b82684edbfc045b698027748b43afa2cadd6bae

COLLISION is the HASH 12 interschool Capture The Flag. Every challenge hides a flag string shaped like hash12{ ... }. Find it, submit it, bank the points.

The board runs from gentle warm-ups to genuinely brutal, so there is a rung for first-timers and competitive players alike. Bring curiosity and a terminal. No prior CTF experience needed, just the willingness to poke at things until they break.

02 // impact

Two inputs.One hash.

ahash12:5ax9c8olyu2273359096a84f0ab3f79df260ed7a8cb99a5d62cfc465bd9ec2f401cd856709
bhash12:yn3hjmrkg82273359096de09262a148c74a2a2eef0abc82fa04fe51b7db9cd873ddd2a344b
scanning // scroll to collide collision // first 40 bits identical // 1,341,856 tries

A real pair, found by birthday search. Matching all 256 bits would take longer than the universe has existed. Your flags will not.

03 // the lab

Break it yourself.

runs in your browser
crypto.subtle // no server
avalanche // sha-256type to hash
----------------------------------------------------------------
--

Change one character and roughly half of all 256 bits flip. That is the avalanche effect, and it is why you cannot steer a hash. You can only search.

sha-256 // birthday livetries 0000000 h/s
Ahash12:........scanning...
Bhash12:........scanning...
searching for a 24-bit prefix collision // expect ~2^12 tries
04 // categories

Five tracks. 28 flags.

easy -> insane
any order
01 // crypto
07

Crypto & Encoding

Ciphers, encodings, and real attacks. Read the shapes, doubt every assumption, and expect the obvious tool to be wrong.

Easy → Extreme
02 // web
03

Web Exploitation

Client-side auth and hidden pages. Read the source — the trust boundary is the browser, and it is thinner than it looks.

Easy → Hard
03 // forensics
04

Forensics & Stego

Images, network captures, and raw memory. The evidence is always in the file — usually in the part of it nobody looks at.

Easy → Insane
04 // reversing
04

Reversing & Misc

Programs that would rather not be understood. Take them apart, work out how they decide, and make them say yes.

Medium → Extreme
05 // cryptic
10

Cryptic Hunt

Trail puzzles and short paths. Images, ciphers, OSINT breadcrumbs — each answer unlocks the next file in the zip.

Easy → Hard
05 // the flow

How it runs.

Five steps from sign-up to the scoreboard. The board unlocks at kickoff and every challenge drops at once.

  1. step 01

    Register

    One captain signs up the team. Solo entries welcome — swap players up to kickoff.

  2. step 02

    Kickoff

    The board unlocks at the start time — every challenge drops at once.

  3. step 03

    Solve

    Work the challenges in any order. Crypto, web, forensics, reversing, and a ten-stage cryptic trail.

  4. step 04

    Submit

    Paste the flag to bank the points. Wrong guesses are free — keep trying.

  5. step 05

    Scoreboard

    Live ranking by points, ties broken by who reached them first.

06 // play fair

Rules of engagement.

break the challenges
not the platform
  1. 01No attacking the scoreboard, other teams, or infrastructure. Play the challenges, not the platform.
  2. 02No sharing flags or solutions until the CTF ends. Collusion between teams is disqualification.
  3. 03Automated scanners and brute-force against the provided files are fine; denial-of-service is not.
  4. 04Every flag is hash12{...}. Submit exactly what you find.
  5. 05Have fun, learn something, and write it up afterwards.
07 // faq

Questions.

01Do I need experience?
No. The easy tier is built for first-timers and hints are available on request. The top tier is genuinely brutal. There is a rung for everyone.
02What do I need to bring?
A laptop, a browser, and a terminal. Python 3 helps for scripting, and every file we ship is something you can open, run or parse yourself — no special toolchain required.
03How big can a team be?
One to four players. The captain registers; you can add or swap teammates right up to kickoff.
04What does a flag look like?
Every flag is hash12{...}. The prefix can be hash12 or HASH12; the text inside the braces is case-sensitive.
05Is it really free?
Yes. COLLISION is run by HASH 12 for the love of the game. Register a team and show up.
08 // lock your spot

Claim your seat on the board.

One account per player. Start a team and share its join code, or paste a code from your captain. Solo entries welcome; swap players right up to kickoff.

registration opencloses at kickoffflag hash12{ ... }
Sign up ->Log in