First blood is the first valid solve of a given challenge in a competition. The team or player who gets it is said to have drawn first blood. Second and third blood work the same way for the next two solves. Events use it as a bragging right, a bonus-point trigger, or both.
Example
A board opens at 10:00. At 10:41 team nullbyte submits the correct flag for web-200 before anyone else. The scoreboard feed posts "first blood: nullbyte, web-200". At 10:58 and 11:20 two other teams solve it, taking second and third blood.
Because ranking depends on submission time, the order is only as fair as the start. Everyone needs the same opening time, and the platform should record the timestamp when it accepts the flag, not when the player's request left their laptop.
How events reward it
- Announcement only. A feed or chat post, no points.
- Bonus points. A percentage of the challenge's value for the first few solvers.
- Tie-break. The team that reached a score first ranks higher.
Bonuses reward speed as well as skill, so keep them small next to challenge values. The CTF scoring guide compares the options.
On CTF7
CTF7 ranks the first three solves of each challenge and shows them on the challenge's solve list. Organizers can switch on an optional blood bonus for those three solves. On a frozen scoreboard, solves made after the freeze do not reveal blood ranking to rivals. Players also earn extra XP for a first blood.
Learn more
Read the CTF scoring guide for worked examples and tools, or browse all CTF guides.
Related terms
Browse the full CTF and cybersecurity glossary for more terms.
