Key takeaways
- Raw Ops replaces flags with vulnerability reports. There is nothing to guess and nothing to paste into a Discord DM.
- Every accepted finding is triaged and scored with CVSS 4.0, so points track real-world impact, not how obscure a puzzle was.
- Chaining weaknesses is encouraged. A low-severity leak that unlocks account takeover is worth far more as a chain than as two separate bugs.
- It works as a VAPT simulation for students, a skills-first hiring round and a realistic exercise for internal red teams.
What "anti-CTF" actually means
A classic jeopardy CTF is a set of puzzles. Each challenge hides a string such as CTF7{This_is_an_example_flag}, and a correct submission marks it solved. That model is great for learning techniques, and we run plenty of jeopardy CTFs ourselves.
But nobody in a real penetration test is handed a flag. A tester gets a scope, a target and a deadline, and delivers a report that a developer can reproduce and a manager can prioritize. Raw Ops is built around that deliverable. We call it the anti-CTF because it deliberately removes the one thing every CTF has in common: the flag.
In a Raw Ops round, participants attack a realistic application or environment, write up what they find and submit it for triage. Reviewers validate each report, assign a CVSS 4.0 severity and award points. The leaderboard moves when a finding is accepted, not when someone types the right string.
Why flags stop measuring real skill
Running and playing CTFs, we kept seeing gaps between what a flag scoreboard measures and what a security team needs:
- Binary outcomes. A flag is either right or wrong. A player who found a real but partial issue, such as an IDOR that leaks email addresses but not passwords, gets zero.
- Author-shaped thinking. Many challenges reward guessing the author's intended path. Real targets have many paths, and some of the best findings are ones nobody planned.
- Flag sharing. A static string can be copied in seconds. Dynamic flags and anti-cheat help a lot, but a report written in your own words is far harder to fake.
- No communication signal. A scoreboard tells you nothing about whether someone can explain impact, write reproduction steps or suggest a fix. In a real engagement, that is half the job.
How a Raw Ops bug hunting competition works
A Raw Ops event follows the same lifecycle as a scoped VAPT engagement, compressed into a competition window:
- Brief and scope. Participants receive rules of engagement: in-scope hosts, out-of-scope actions (for example, no denial of service), test accounts and the reporting format.
- Recon and hunting. Teams map the attack surface, enumerate endpoints, review client-side code and probe business logic, just as they would on a client target.
- Reporting. Each finding is submitted as a structured report with a title, affected asset, reproduction steps, evidence, impact and a proposed CVSS 4.0 vector.
- Triage. Reviewers reproduce the issue, reject invalid or out-of-scope submissions, merge duplicates and confirm or adjust the severity.
- Scoring. Accepted findings earn points based on the triaged CVSS 4.0 severity. Chained findings are scored on their combined impact.
- Debrief. Organizers review report quality and findings across teams, which makes Raw Ops a teaching tool as well as a competition.
Triage is the heart of the format. Budget reviewer time like you would budget challenge writing: line up experienced reviewers and a clear rubric before the event starts.
CVSS 4.0 scoring and why chains win
We score with CVSS 4.0, the current version of FIRST's Common Vulnerability Scoring System. Using an industry standard means players learn a vocabulary they will use on the job, and it gives triagers a shared, defensible way to settle severity disputes. You can try vectors yourself in the CVSS 4.0 calculator, and see how scoring models differ across formats in our guide to CTF scoring.
The CVSS 4.0 base metrics that matter most in a competition are:
| Metric | Abbrev. | What triagers ask |
|---|---|---|
| Attack Vector | AV | Network, adjacent, local or physical access? |
| Attack Complexity | AC | Does the attacker need to bypass protections outside their control? |
| Attack Requirements | AT | Do specific deployment conditions, such as a race window, need to exist? |
| Privileges Required | PR | None, a low-privilege user or an admin account? |
| User Interaction | UI | None, passive or active interaction from a victim? |
| Vulnerable System impact | VC / VI / VA | Confidentiality, integrity and availability impact on the target itself |
| Subsequent System impact | SC / SI / SA | Impact that spills over to other systems, such as a victim's browser or a downstream service |
A pre-authentication remote code execution on the target, with no user interaction and full impact on the vulnerable system, is written like this:
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N # base score 9.3 (Critical)The split between vulnerable and subsequent systems is one of the most useful changes in version 4.0. A stored XSS usually has limited impact on the application server but real impact on other users' sessions, and CVSS 4.0 lets triagers express that precisely instead of arguing about the old "scope changed" flag.
Why chaining is encouraged
Real attackers rarely win with one bug; they combine small weaknesses into something much worse. Raw Ops rewards that thinking. Consider three findings on one target:
- A verbose error that leaks internal user IDs (low severity alone)
- An IDOR on
/api/v2/users/{id}that lets any logged-in user change another user's email (high alone) - A password-reset flow that trusts the account's email address
Reported separately, each is scored on its own impact. Reported as a chain, "enumeration to takeover of any account", it is scored on the combined outcome, which is what a real client cares about. The exact point mapping is an event decision, but the principle holds: demonstrated impact beats a pile of disconnected low-severity bugs.
What a winning report looks like
A triager can only accept what they can reproduce, so report quality is scored implicitly. Strong teams write reports that look like professional VAPT deliverables:
Title: IDOR in profile API allows account takeover of any user
Asset: https://target.example/api/v2/users/{id} (in scope)
Weakness: CWE-639 Authorization Bypass Through User-Controlled Key
Severity: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Summary
Any authenticated user can change another user's email via PATCH,
then take over the account through the password-reset flow.
Steps to reproduce
1. Log in as test user A; note session cookie.
2. PATCH /api/v2/users/1042 {"email":"[email protected]"}
3. Request a password reset for user 1042; the link goes to attacker.
4. Log in as user 1042.
Evidence request/response pairs, screenshots, timestamps
Impact full takeover of any account, including admins
Remediation enforce object-level authorization on user ID server-sideNo flag, no guessing, no ambiguity: a developer could fix this from the report alone. That is the bar. If you teach report writing, the OWASP Web Security Testing Guide is a good companion reference for methodology and weakness naming.
Raw Ops vs a jeopardy CTF
Both formats have a place. Here is how they compare:
| Jeopardy CTF | Raw Ops | |
|---|---|---|
| Unit of scoring | Correct flag | Accepted vulnerability report |
| Points reflect | Challenge difficulty set by the author | Triaged real-world impact (CVSS 4.0) |
| Partial credit | Rarely | Yes, every valid finding counts |
| Skills tested | Isolated techniques across categories | Recon, exploitation, chaining, reporting |
| Flag sharing risk | Mitigated with dynamic flags | No flags to share |
| Organizer effort | Challenge authoring up front | Target build up front, triage during the event |
| Best for | Learning, large open events, beginners | VAPT training, hiring, advanced finals |
Many organizers combine them: an open jeopardy qualifier to filter a large field, followed by a Raw Ops final for the top teams. For a wider comparison of formats, see our guide to CTF formats and the post on attack-defense vs jeopardy.
Who should run a Raw Ops event
- Universities and training programs. Raw Ops works as a VAPT simulation that turns web security theory into a graded, realistic engagement. See CTF7 for universities and training providers.
- Hiring teams. A report tells you how a candidate thinks, communicates and prioritizes, which a flag count never will. It pairs naturally with a hiring CTF; our guide to hiring security talent with CTFs goes deeper.
- Enterprises and conferences. Internal AppSec teams sharpen methodology on a safe target, and a Raw Ops track gives experienced conference attendees something beyond the usual jeopardy board. See enterprises and security conferences.
Planning your first Raw Ops event
A short checklist we walk every organizer through:
- Choose a target that looks real: a multi-role web app with an API, authentication and business logic, not a list of isolated bugs.
- Write clear rules of engagement: scope, forbidden actions, test accounts and what counts as a duplicate.
- Publish the report template and the CVSS 4.0 rubric before the event so teams know the bar.
- Line up triagers and a service level for review, so the leaderboard stays live instead of catching up at the end.
- Decide how chains are scored and say so in the rules.
- Plan a debrief that walks through the best reports.
You do not have to build the target yourself. The CTF7 team offers custom challenge development and can help plan and build a Raw Ops round; tell us what you need. Start with the Raw Ops format page, compare plans on pricing, or tell us about your event on host my event.
Where to go next
- Compare with the other route into security work. CTF vs bug bounty explains how a time-boxed competition differs from open-ended, paid testing of live systems.
- Prepare to write. Copy the vulnerability report template and practice scoring findings in the CVSS 4.0 calculator.
- Zoom out. See where report-based play sits among cybersecurity competition types.
- Plan one. The Raw Ops format page covers how events are set up, and host my event starts the conversation.
