Free training · high schools and BTS

Train for 'Passe ton hack d’abord !'

Two challenges to solve here, without an account. Then, with your teacher, Lockbay labs, free for your team until the end of the competition.

  • In 2026: 19 January to 6 February, online
  • Teams of 2 to 6 students
  • From high school to BTS

Practice challenge · no account needed

Find the flag

The welcome kiosk of the Bremorel High School robotics club is responding strangely. Here is its server response. A developer forgot something inside.

HTTP/1.1 200 OK
Server: borne-accueil/2.3
Content-Type: text/html; charset=utf-8
X-Debug-Note: TE9DS0JBWXtsZXMtZW4tdGV0ZXMtcGFybGVudH0=
Cache-Control: no-store
Toolbox

Lockbay does not organise 'Passe ton hack d’abord !' and is not affiliated with it. The competition is organised by the French Ministry of National Education and COMCYBER: official page (opens in a new tab), 2026 rules (PDF, opens in a new tab).

The challenges

Every competition category, and the labs to prepare for it

The 2026 rules announce around fifteen challenges in these categories. No competition challenge is included here: the rules prohibit publishing challenge statements and solutions.

  1. Web security

    See how a web page gets compromised (injection, file read by mistake, another user's record), then understand the fix.

    • SQLi SQL injection
    • WebSec Cross-site scripting (XSS)
    • CMDi Command injection
    • LFI Local file inclusion
    • Broken access control Insecure direct object references (IDOR)
    • SSTI Server-side template injection

  2. Network security

    Read a network capture, spot a scan or suspicious connection, and write the rule to detect it.

    • Network capture analysis Read a capture Wireshark-style
    • Write detection rules Suricata-style rules
    • Enterprise Wi-Fi audit 802.1X, guest network, rogue access point
    • Segment a network Zones, VLANs and traffic flow matrix

  3. Cryptography

    Distinguish between encoding, hashing and encryption, and know which one truly protects a secret.

    • Applied cryptography Hashing, AES, RSA, signatures
    • PKI and TLS Certificates, internal CA, HSTS
    • Secrets management Leaks, zero-downtime rotation, vault

  4. Programming

    No pure programming lab: this one involves reading an API's code, finding what breaks and fixing it, backed by tests.

    • Fix the vulnerability Fix API code, backed by tests

  5. Open-source intelligence

    Find public information from hints.

    • Open-source intelligence What a company exposes, and how to reduce it

  6. And more

    The rules end their list with 'etc.': log analysis, incident investigation and privilege escalation are CTF classics.

    • SIEM Log analysis
    • Incident Incident response
    • Static sample analysis PE header, indicators, YARA rule
    • PrivEsc Linux privilege escalation

Some labs involve exploiting a vulnerability in an isolated environment; others focus on fixing or detecting it. Outside a dedicated environment, attacking a system is a criminal offence.

For teachers

Mentoring a team? Access is free.

  1. Create your teacher account

    No credit card required: your name, your school and a few lines about your team.

    Create my teacher account

  2. We approve and activate the labs licence

    We review each request and approve the account manually. For a competition team, we grant your school a free labs licence until 31 August 2027 for 35 students. You are the administrator.

  3. Your students join your class

    You create a class and give its code to your students. They can launch labs with no weekly launch limits.

The labs licence includes labs and classes; courses are not included. The dates for the 2027 competition are not yet published: the official schedule takes precedence.