The OWASP CTF
Most CTFs end when you break something. This one starts there.
BSides Philadelphia 2026 is hosting the OWASP CTF — the secure development competition that ran at DEF CON 34. You find real vulnerabilities in OWASP's deliberately vulnerable applications, patch them, and score when your fix passes an automated regression test.
How it works
Four steps, repeated as many times as you can manage before the scoreboard closes.
- Pick a target
Choose one of six deliberately vulnerable OWASP applications and a challenge from its pool. Each one maps to a real, disclosed vulnerability class from the OWASP Top 10.
- Find the flaw
Read the code, reproduce the vulnerability, and understand why it works. This is the part that looks like a normal CTF.
- Patch it and open a PR
Fix the vulnerability properly — not by deleting the feature — and submit your patch as a pull request against the event branch.
- Score automatically
A GitHub Action runs that challenge's regression test against your patched application. A passing test scores immediately. No manual grading, no waiting on a judge.
Unusually for a CTF, this one asks you to use one. Claude Code, Copilot, Cursor, or a harness you wrote yourself — all fair game, all encouraged.
That isn't a shortcut around the competition, it's the point of it. Reviewing code, locating the flaw, and writing a patch you'd actually merge, with an agent working alongside you, is the skill this event exists to build. OWASP publishes a Secure Agent Playbook for exactly this workflow, and it's worth reading before you arrive.
321 challenges, six applications
Pick the stack you already know, or use the day to learn one you don't.
| Application | Challenges | Focus |
|---|---|---|
| VulnerableApp | 110 | The deepest pool, spanning most of the OWASP Top 10 |
| WebGoat | 69 | Guided Java lessons with a teaching path through each flaw |
| DVWA | 55 | PHP security at three escalating difficulty levels |
| Security Shepherd | 40 | Web and mobile training challenges |
| Juice Shop | 38 | Modern JavaScript stack, Web Top 10 focus |
| VAmPI | 9 | REST API security and broken object-level authorization |
Before you compete
- A GitHub account — you sign in with it to claim your row on the leaderboard and to submit patches
- A laptop you can run a local development environment on
- An AI coding agent, if you use one. Optional, but encouraged
- A valid conference badge. The CTF is included in registration
- Everything happens against your own copy of the target application. Nothing is pointed at the conference network or at other competitors
- Patches must fix the vulnerability, not disable the feature or the test
- Don't share solutions while the competition is running
- The BSides Philadelphia Code of Conduct applies here as everywhere else
Details still to come
Competition hours, the BSides event branch, team rules, and prizes are confirmed closer to December 11. Full challenge documentation and the leaderboard live at ctf.owasp.org.
Visit ctf.owasp.org (opens in a new tab)