Introduction

Hack4Gov was a memorable event for me because it was my very first in-person Capture the Flag (CTF) competition. The event was held at the Golden Prince Hotel in Cebu, Philippines, on August 15, 2023. There were seven (7) competing teams. As someone who was relatively new to the CTF environment, being able to participate in a physical competition alongside other cybersecurity enthusiasts gave me an exciting opportunity to test my skills, learn from others, and experience the collaborative and competitive nature of cybersecurity firsthand. I still can’t believe this event was three (3) years ago.

Meet the Team

A big part of the experience was, of course, the team itself. Having teammates with different ways of approaching problems made the competition much more interesting. One person might notice something in a file or piece of information that someone else had overlooked, while another might immediately recognize a technique that could be useful. Instead of everyone trying to solve the same problem independently, we could divide our attention across different challenges and share what we discovered. There were plenty of moments where we were unsure about an approach or had to bounce ideas off each other, but that was also what made the experience enjoyable. Looking back at the team photo now, I think less about the individual challenges we were working on at that moment and more about the fact that we were all there together, experiencing our first CTF competition as a team.

The Challenges

The challenges covered several areas of cybersecurity, including forensics, web, programming, and other categories that required different approaches. This variety was one of the things I found most interesting about the competition because there was no single technique that could solve everything. A forensic challenge might require examining a file or extracting information hidden within it, while a web challenge could involve inspecting how an application behaved or looking for weaknesses in its implementation. Other challenges required programming, scripting, or simply thinking carefully about the information provided in the challenge description.

A lot of the work also involved using different tools to investigate what we were given. Instead of immediately knowing the answer, we often had to inspect files, analyze data, test hypotheses, and use the appropriate tools to narrow down what was happening. Some approaches worked, while others led us completely away from the solution. That trial-and-error process was probably one of the most accurate representations of what the competition felt like. At the time, getting stuck on a challenge could be frustrating, especially while watching the clock, but, those moments are some of the parts I remember most. The technical side of the competition was not simply about knowing a list of tools; it was about knowing when and why to use them. I have written a few writeups for those interested.

Our performance

By the end of the competition, our team had accumulated 1180 points. Seeing our score on the scoreboard was a satisfying moment because it represented all the time we had spent investigating challenges, testing different approaches, and working together. The scoreboard also added another layer to the competition. Every flag we submitted immediately affected our position, so there was always a sense of progress whenever we managed to solve something. At some point, we were at the top of the leaderboard which was very exhilirating. At the same time, there were challenges that remained unsolved, which is simply part of the experience of competing under a time limit. Looking back at the scoreboard now, the 1180 points feel less like a number that defines how well we performed and more like a snapshot of what our team was able to accomplish on that particular day.

The Top 5 Scorers

To this day, I still couldn’t believe I’d be included in the top 5 scorers. There were like 28 individual competitors. I was in disbelief after hearing my name being called to come up to the stage for a group photo, my teammates were telling me that it really was my name that they were calling.

What I learned

Hack4Gov gave me a much better appreciation for how broad a CTF competition can be. Working across categories such as forensics, web, and programming meant that we could not rely on one particular skill or tool. A challenge might require analyzing a file, investigating an application, writing or modifying a script, or simply noticing a detail that initially seemed insignificant. I learned that technical knowledge is only part of solving a CTF challenge; understanding the problem, forming a hypothesis, testing it, and knowing when an approach is no longer useful are equally important.

The competition also showed me the value of approaching technical problems collaboratively. Something that seemed confusing to one person could become much clearer when another teammate looked at it from a different angle. Sharing findings, discussing possible attack paths, and comparing different ideas helped us make progress even when we were not immediately sure what the intended solution was. Those aspects of the competition are just as memorable to me as the technical challenges themselves. Hack4Gov was a good example of how cybersecurity combines technical knowledge with curiosity, problem-solving, and teamwork.

Conclusion

Looking back at Hack4Gov 2023 a few years later, the experience feels more than just a CTF that I participated in. I remember the challenges we worked through, the different tools and techniques we used, the moments when we were stuck, and the excitement of finally getting a flag and being at the top of the leaderboard. I also remember the people who made the experience possible. I am especially grateful to our coaches, sir Paul and miss Aya, who supported and guided us throughout the competition and helped make the experience as meaningful as it was. Their guidance, along with the time and effort my teammates put in, played an important role in making my first in-person CTF such a memorable experience.