Pentathon 2024 marked a milestone as India’s first national-level Vulnerability Assessment and Penetration Testing (VAPT) exercise of unprecedented scale. Organized by National Critical Information Infrastructure Protection Centre (NCIIPC) in collaboration with All India Council for Technical Education (AICTE), Traboda was chosen as the technology partner to facilitate the event. The event showcased the growing emphasis on
cybersecurity talent development in India. With an impressive turnout and participation, Pentathon 2024 set a new standard for cybersecurity challenges, integrating a comprehensive approach through online qualifiers and a high-stakes onsite finale.

• Stage I: Online Qualifier Round
  • Format: Jeopardy-style Capture
  • The Flag (CTF) competition
• Stage II: Onsite Finals
  • Round 1: Jeopardy-Style CTF
  • Round 2: Simulated VAPT Exercise

The first stage of Pentathon 2024 was a rigorous online qualifier held in March 2024. This phase engaged participants in a jeopardy-style Capture The Flag (CTF) competition, hosted on Traboda’s CTF platform. Participants tackled 27 unique challenges across various categories, including Web and API, Forensics, Reversing, OT (Operational Technology), Pentesting, Android, Binary Exploitation, and more. Traboda developed these challenges to provide an immersive experience. The event statistics speak volumes about its success:

Stage II of Pentathon 2024, held in April 2024 offered in-person mentorship and training led by experts from Traboda and NCIIPC. The onsite round was structured in two parts:

Round 1 (Jeopardy-Style CTF):

Starting at 12:00 PM on the second day, one team and one individual were selected every two hours, culminating in the final selection of 15 teams and 15 individuals. These participants were granted access to the simulated metro system for Round 2. A shared instance of the system was then made available to the remaining teams and participants for Round 2.

Round 2 (Simulated VAPT Exercise)

Objective: Participants engaged in a realistic VAPT scenario hosted on Traboda’s CTF platform, tasked with exploiting vulnerabilities within a simulated metro system. This round required participants to achieve objectives such as gaining Remote Code Execution (RCE) on an IT Administrator’s machine, stopping the train, crashing the train etc.

Evaluation: Conducted by an expert panel from NCIIPC and Traboda, participants
were assessed on their ability to navigate and achieve various milestones within
the metro network environment.

• gement and Reach: The event’s extensive participation highlighted a strong interest in cybersecurity across India, positioning Pentathon 2024 as a benchmark for future VAPT exercises.
• Challenge Design: The balanced difficulty ensured engagement from novice to expert participants, fostering learning and competition.
• Operational Success: The seamless management of high platform traffic and support requests highlighted Traboda’s robust event management capabilities in handling global-level events.

Pentathon 2024 effectively established VAPT as a key competitive activity, contributing to the advancement of India’s cybersecurity ecosystem. With high participation rates, an innovative challenge format, and expert-led evaluations, the event emphasized the importance of skill-building and community engagement in cybersecurity.