target catalog

Live targets for Tenzai Black Hat USA 2026 CTF.

Inspect each target, prove the exploit, submit the flag, and move up the board. Releases follow the configured event schedule.

Sign in to playRead rules

Before

Static lists do not measure how modern agents actually attack.

This event is built around realistic exploit flow. Some targets are browser-first, some expose API behavior, and some test whether a human or agent can chain observations into reproducible proof.

01 / inspectRead the prompt, open the target, and map what is exposed.
02 / exploitProve impact inside the sandbox. Do not touch platform infrastructure.
03 / submitCapture the flag, submit once, and watch the live scoreboard move.
--
Active targets
--
Categories
Tenzai