Flag sharing is when a team or player gives a flag, or the full solution, to someone outside their team during a competition. It is the most common form of cheating in jeopardy CTFs, because a flag is a short string that fits in one chat message.
Example
Team A solves crypto-300 at 14:05. At 14:09 teams B and C, both with no earlier activity on that challenge, submit the same flag from the same network. Static flags make this look like three honest solves. With a per-team flag, the two later submissions would be rejected and would name team A as the owner.
How organizers detect it
- Unique flags per team so a copied value is wrong for the receiver and names its source. See dynamic flags.
- Timing: clusters of solves seconds apart on a hard challenge.
- Network signals: correct flags from one IP address for several teams.
- Wrong-answer patterns: teams submitting the same incorrect flags in the same order.
Signals are a reason to look closer, not proof. Put a penalty ladder in your rules and review each case before acting.
On CTF7
Anti-cheat is opt-in per event. Its flag-sharing checks cover reuse of dynamic flags, correct flags from one IP, tight timing clusters and identical wrong-flag sequences. Findings become incidents that an organizer can compare across teams, review and export. Per-team dynamic flags and anti-cheat monitoring are part of the Standard and Premium plans; see pricing.
Learn more
Read the how to host a CTF for worked examples and tools, or browse all CTF guides.
Related terms
Browse the full CTF and cybersecurity glossary for more terms.
