WSH 26 / Info
The what, where and how of WSH 26 — the Westminster School Hackathon. Full schedule, both tracks, and the prize structure. Anything still being finalised is marked below.
Kali Linux is a hard requirement. Install and update it before you travel. Bare metal, dual boot or a VM all count — a machine that boots into Kali on the day is what matters.
Some details are still landing. Schedule, prizes, judging weights, catering and exact timings are being finalised and will be published on this page.
Both days run 7:30am to 2:30pm. Timings are the current plan and may shift slightly on the day — the highlighted rows are the ones you cannot miss.
Two hard cut-offs. The CTF platform closes at 10:00 on Day 2 and project submissions close at 11:40. Nothing is scored after those times.
Both run in parallel across the two days, so you can engage with one or both depending on your skill level.
Challenges are released on a self-hosted CTFd board across both days. Solve, submit the flag, take the points. Beginner challenges go live at 9:00 on Day 1, with intermediate and advanced tiers following as the event runs. The platform closes at 10:00 on Day 2.
Build something real in cybersecurity, complementing the CTF track. A starter kit — a GitHub repository with backend code and free API integrations — is distributed to every team at the Day 1 briefing. Submit by 11:40 on Day 2, then pitch it in two to five minutes.
Your whole team works the CTFd challenge board for both days. One result.
Your whole team is heads-down on the security project for both days. One result.
They run in parallel, so the same team can enter both. Two submissions, two results.
Seven categories, three difficulty tiers — beginner, intermediate and advanced. Beginner challenges open at 9:00 on Day 1 and the board grows from there.
SQL injection, XSS, authentication flaws.
Analyse compiled binaries to reveal their logic.
Ciphers, encoding, key-breaking.
Hidden messages buried within media files.
Digital evidence and file analysis.
Open-source intelligence gathering.
Wildcard challenges spanning several domains.
One bonus challenge, revealed on the day.
The project must relate to cybersecurity — it complements the CTF track rather than running off in its own direction. Some directions teams take:
One showcase project per school. Each school may showcase a single project, chosen by the school's computer teacher from its two competing teams.
A starter kit ships to every team. A GitHub repository with backend code and free API integrations, distributed at the Day 1 hackathon briefing at 11:00. You are not starting from a blank editor.
Submit by 11:40 on Day 2, then pitch in two to five minutes. Judges deliberate at 1:30 and awards are at 2:00.
WSH 26 is an interschool event open to students across GEMS schools. You enter as a team of four to six. Entry is first come, first served: only the first 10 schools to register can participate, and each school fields two teams. Contact your computer science or IT department to register. Exact year-group eligibility is being confirmed and will be published here.
No. The board runs beginner, intermediate and advanced tiers, so there is a genuine entry point for first-timers as well as material that will stretch experienced teams. Beginner challenges open first, at 9:00 on Day 1.
No. Teams are four to six people — four is the minimum as well as six being the maximum. Each school enters two competing teams, so speak to your computer science or IT department if you are unsure how teams are being formed at your school.
It puts every team on the same footing with the same tooling available, and it removes an entire class of "it doesn't work on my machine" from the CTF track. It applies to project entrants too, so the room is running one environment.
Yes — the tracks run in parallel. Declare it at registration. Both entries are judged independently, so you are competing on two boards with the same team.
Browser-based AI assistants are allowed for hackathon projects only. Any AI used during the CTF is strictly prohibited. Local AI agents, offline LLMs and any locally deployed weights are prohibited on both tracks, and breaching that disqualifies you from the affected track. Volunteers run periodic device checks across both days.
Not quite. A starter kit — a GitHub repository with backend code and free API integrations — is distributed to every team at the Day 1 briefing. You build on top of it during the event. What you must not do is arrive with your own part-finished project.
Places are first come, first served: the first 10 schools to register can participate. Each participating school may showcase one project, selected by the school's computer teacher from its two competing teams.
Still being finalised, along with catering and exact room allocation. Anything outstanding will be published on this page ahead of the event.
Certificate or team award.
Certificate or team award.
Digital or physical, for everyone who takes part.
Rankings pulled from the CTFd platform, updated live through both days.
Enquiries, technical issues and administrative requests, routed per category.