AlfaCTF Surf Edition: an on-site CTF
An on-site AlfaCTF in Saint Petersburg: SPbCTF challenges, practice in testing hypotheses, and my path from competing in CTFs to organising one at SUAI.
Context
AlfaCTF Surf Edition is an on-site information security competition held at Alfa-Bank’s main office in Saint Petersburg. I was invited to the venue in September 2025. The challenges were prepared by the SPbCTF team.
Before that I had taken part in CapyCTF by T-Bank, so AlfaCTF continued the same practice: unfamiliar conditions, limited time, and the need to take a guess all the way to an answer that can be checked. My CTF track includes two AlfaCTF events, one of them a stage at the bank’s headquarters.
In a CTF, the result of solving a challenge is a flag: a string the competition platform verifies. That makes feedback concrete. A good explanation still has to be backed by a working solution.
My role
I worked on challenges and discussed approaches. My backend and application security experience helped here: reading input data, noticing unusual behaviour and checking whether it matches the initial assumption.
The sequence that works for me:
- Understand what the challenge gives you and what result it asks for.
- Separate observed behaviour from assumptions about its cause.
- Test a small hypothesis and save the result so the team can reproduce it.
- If an approach gives no new signal, go back to the description and pick the next one.
This carries over to everyday development. When a service responds unexpectedly, you first reproduce the situation and find the boundary where expectation and reality diverge.
Why the on-site format helps
At the venue you can discuss approaches with other participants and see how people take apart the same problem. It is practice in working together under time pressure: explaining your hypothesis, passing on context and checking someone else’s assumption.
I singled out the SPbCTF challenges in a note after the event because of how inventive they were. This format keeps my interest in security alive beyond the university curriculum.
My CTF track
AlfaCTF and T-Bank CTF complement my experience organising SUAI CTF at the university. To me these are two sides of the same direction: solving challenges myself and helping to build an environment where others can practise.