Everything You Need to Know About the National Cyber League Preseason Game

By Taisa

Ready for the NCL Preseason Game? You will be after this!

This latest “Everything You Need to Know” Guide endeavors to compile the wisdom of the Player Ambassadors, National Cyber League (NCL) Game-makers at Cyber Skyline, and past training guides into a single blog post, with any additional pro tips that yours truly can offer.

Please add your own tips and feedback in the comments! (And consider applying for Feature Friday if there’s a technical subject you could write an entire blog post about!)

On this page, jump to:

Before

During

After

BEFORE THE PRESEASON GAME

ENSURE THAT YOU’RE REGISTERED!

Verify that you’re registered by opening your Cyber Skyline dashboard and seeing if the Spring 2021 Game tiles are present. You should be able to access the Spring 2021 Gymnasium which opened on February 15th.

If you’ve not yet registered:

  • Friday, March 5th—that’s tomorrow!—is the last day to register for $35.
  • Regular registration for $35 has been extended to Friday, March 12th!
  • Tuesday, March 9th, is the last day to do late registration for $45.
  • Late registration for $45 has been extended to Tuesday, March 16th!

Go here to register if you haven’t done so already:
https://cyberskyline.com/events/ncl/welcome

Your Coach Cannot Register You—You Must Register Yourself

Registration is a process which you must personally complete. Your Coach cannot complete a registration for you, but your Coach may or may not provide you with a Game Code which you can apply during registration to cover your registration fee.

LINK TO YOUR COACH

Check to see if you’re linked to your Coach by going to your Cyber Skyline dashboard, opening the Spring 2021 Gymnasium tile, clicking on the Leaderboard tab, and expanding the NCL Overall dropdown menu. You should see your Coach’s group as a filtering option.

If you are not already linked, use the Coach Observation Link provided by your NCL Coach to connect to your Coach on Cyber Skyline. It’s possible to link to multiple Coaches—as you can see, I’m already joined to three!

If You Don’t Have a Coach

You can play without having a Coach, but it’s not recommended.

If Cyber Skyline’s advanced cheating audit system—which I will awesomely nickname CheatNet™—flags you for cheating, the appeals process is only open to you if you have a faculty Coach advocating for you. To safeguard the secrets of how CheatNet™ works, your Coach is the only person allowed to examine the findings of CheatNet™ and respond on your behalf.

Try contacting the cybersecurity or I.T. professors at your school to see if you can wrangle a faculty member into coaching. Coaches participate for free, and, by playing under a Coach, you and your schoolmates can become part of a group and will be able to see each other’s progress throughout the Games. No matter how involved or uninvolved your Coach chooses to be, having one is always a good thing.

Send any interested faculty members this link so that they can learn more about becoming a Coach: https://cyberskyline.com/events/ncl/info#school-participation

KNOW THE RULES

Above all else, familiarize yourself with what does and does not constitute cheating.

Helpful analogies:

Players == Spy vs. Spy

During each Game, pretend you’re a spy, uncovering secrets and protecting them from other spies! Do not talk with anyone about the Preseason Game while the Preseason Game is underway.

CheatNet™ == Terminator

Pretend that Cyber Skyline’s CheatNet™ is advanced and ruthless, like the Terminator. Because it is. CheatNet™ will go back in time, know everything you did, and eliminate its enemies from the Leaderboard.

You may find yourself in an awkward situation if a friend begs you for clues or answers. Of course you want to help your friend! Here’s an example of the #1 best way to help:

“Yeah, that challenge is a tricky one! I can’t wait to talk about it after the Game is over. For now, it is my solemn duty as your friend to protect both of us from Cyber Skyline’s advanced and ruthless cheating audit system. You’re welcome!”

– You, Being an Excellent Friend

Think of it as practice for the cybersecurity working world, where you’ll need to remain hush-hush about daily operations and client information and whatever exciting government shenanigans you get yourself into. NCL Game values translate to workplace values—use NCL to help you hone career skills!

MARK YOUR CALENDARS

The Preseason runs for a little over a week, from Monday, March 15th, at 1 PM EST – Monday, March 22nd, 9 PM EST. (Mind the time zone!)

Notice that the Individual and Team Games, by comparison, will only run for three days each.

Why Is the Preseason So Long while the Other Games Are So Short?

Much of your score is going to depend on how much time you’re able to commit to the competition. Restricting the Indy and Team Games to the weekends levels the playing field for students who are busy on the weekdays. Almost everyone can set aside a weekend to play; only a few people can set aside an entire week, and those few would have an unfair advantage.

On the other hand, students who have competed in NCL before have a decided advantage over students who are playing for the first time. Allocating a full week for the Preseason gives those who need the practice and the warm-up a chance to acclimate to the competition before it goes full throttle. Accordingly, you’ll find some challenges in the Preseason being recycled from previous Games, which serves the dual purpose of bringing new players up to speed while sparing the Game Makers at Cyber Skyline from a gruesome, workaholism-related death.

The season is designed to give everyone an opportunity to thrive.

BOOKMARK RESOURCES

The rules prohibit asking anyone for help during the Games.

That means, during the Preseason, no discussing any Preseason content with:

❌Coaches.❌Humanoid AI systems.
❌Teachers / Mentors.❌Time travelers (including you).
❌Tutors.❌The spirits of your ancestors.
❌Classmates.❌Any demons you have pacts with.
❌Coworkers.❌Acquaintances of any kind, really.
❌Player Ambassadors.❌Strangers, too.
❌Family.❌Old-timers on ICQ, BBSes, etc.
❌Friends.❌Friendly folks on homework help websites.
❌Enemies.❌Randos on forums, social media, chat rooms, etc.
❌Alien lifeforms.❌Spam callers and other mischievous creatures.
❌Talking parrots.❌Any other sentient being not mentioned here.

Essentially, try to pretend that you’re the highest level of I.T. support in the entire galaxy, and there is no one to whom you can escalate your quandaries.

What resources, then, remain available to you during the Games?

✅OKSearch enginesAnything on the Internet that isn’t leaked NCL content is fair game. Say another CTF has done a similar challenge, though. Can you look at it? Yes! Feel free to read walk-throughs from other CTFs.
✅OKCryptoKait.comAll blog posts and practice challenges on the CryptoKait.com blog will always be available to you. ❤
✅OKNCL GymThere’s no penalty for looking at the solutions in the Gymnasium, and the Gym remains open even while a Game is underway.
✅OKNCL CrowdcastAll previous shows and bootcamps are available to replay on demand. Find lists of shows that pertain to specific NCL domains here.
✅OKCyber Skyline SupportIf you’re having a technical issue with the Game or need clarification on a challenge, submit a support ticket through your Cyber Skyline dashboard.
✅OKCyber Skyline SlackNo challenge discussions are allowed while a Game is underway, but the Cyber Skyline Slack is a good place to find folks saying very vague things in highly supportive and therapeutic ways.

SET UP YOUR CTF ENVIRONMENT

Depending on the equipment that’s available to you, and also your comfort level, setting up a CTF environment can mean different things.

If You Have Equipment Limitations (or Anxieties)

See my post this season on Low-tech Tooling: Competing From a Device You Can’t Install Tools On!

If You Have Permission to Install Goodies on a Computer

Using Kali Linux on a virtual machine is recommended by the NCL Game-makers(*). Installation is free, Kali is packed with tools, and a virtual machine will keep your host machine safe from oopsies. Check out these posts for help setting yours up:

If You Already Have a Virtual Machine

Ready to take your environment to the next level?? Read these posts on Windows Subsystem for Linux and containerizing with Docker:

Begin Troubleshooting

Prior to the Preseason, you can use the Gym to help you troubleshoot your environment. For example, if you notice that you’re having troubles related to your ISP, try switching your DNS server to 8.8.8.8 or 1.1.1.1, and also explore alternative tooling options. Working out your environment’s bugs in advance will save you time and frustration during the Games.

TOOL UP

Start building your toolkit based on what you’re seeing in the Gym. For additional ideas, browse the NCL Toolkit tag on CryptoKait.com.

You may only use tools and resources that are freely available to the majority of players.

Examples of tools that are OK (✅) and NOT OK (❌) to use in the NCL Games:

✅OKPublicly accessible, free tools. This includes free versions of tools—e.g. while IDA Pro is out, IDA’s free version is A-OK.
✅OKStudent versions of software.
✅OKCustom tools you’ve made yourself.
✅OKUbiquitous, widely-available tools, such as the Microsoft Office Suite (Word, Excel, etc.).
✅OKAny hypervisor (software that allows you to run a virtual machine); all are functionally the same for the purposes of NCL, but be mindful not to take advantage of any commercial integrations.
❌NONo software your company has made that can only be used internally.
❌NONo resources that are free to you now based on a prior subscription or fee.
❌NONo pay versions of software, with the exception of those that are widely distributed and freely accessible to most players (e.g. Windows, Microsoft Office Suite).

All Internet resources used during the game must be freely available to all players.

– NCL Rules of Conduct

PRACTICE

In the NCL Gymnasium

There is no better preparation for the Games than the NCL Gymnasium!

  • You’ll learn to navigate the Cyber Skyline platform.
  • Sample challenges are representative of what you’ll find in the Games.
  • Nothing you do in the Gym will show up on your Scouting Report.

I have definitely had people reach out to me after the competition ended saying that they should’ve listened when we said to do the Gym so here’s to hoping you all can learn from others’ mistakes.

–JeanaByte, What’s the National Cyber League Gym and How Do I Use It?

I recommend using the “Click to reveal solution” feature even if you don’t need help completing a challenge in the Gym. You’ll learn new tools and techniques from seeing how someone else would solve the same problem!

Pandora’s Box was the trickiest for me, so I’d like to spotlight Matt Watson’s walk-through of Pandora’s Box on YouTube, which he published with written permission from Cyber Skyline.

In CryptoKait.com’s NCL Practice Dojo™

CryptoKait.com hosts Cyber Skyline-approved NCL training guides and sample challenges with walk-throughs, organized by domain, in the CryptoKait Dojo™ (not its actual name; I’m on fire with these nicknames, huh!).

By Playing Games

Another great way to practice is by competing in other CTFs or playing games that teach you programming, assembly, or command line. If you’re a gamer, hop on Slack and ask fellow NCL competitors what games they recommend. (Just don’t ask me, because IMO there have been no good games since Lunar 2: Eternal Blue, and nothing will change my mind.)

RazviOverflow actively maintains a list of online games, puzzles, CTFs and other challenges for learning cybersecurity skills here. All the ones I’ve heard good things about are on this list.

And this isn’t a game exactly, but Sololearn’s bite-sized Python training modules are both fun and free!

CHOOSE YOUR HANDLE… WISELY

Consider using your real name for the competition instead of a handle, and don’t be shy about identifying your school. Using your real name can make it easier for recruiters and employers to pick you out on the Leaderboard. You’ll definitely get Googled as part of any background check; NCL is the sort of search result you want to have pop up!

Check out past Leaderboards for examples and inspiration.

To change your display name, go to your Cyber Skyline dashboard, click the Preseason Game tile for this season, and scroll down to Your Info.

DURING THE PRESEASON GAME

PARTICIPATION AND BRACKETING

If you can participate in the Preseason, you absolutely should. “Participation” in the Preseason Game is defined pretty loosely. You must make at least one submission attempt, and the answer doesn’t need to be correct.

Your participation and performance in the Preseason Game determine the Bracket you’ll be placed in during the Individual Game. Your Preseason performance will only impact your Individual Game Bracket, not your Team Game Bracket. Bracketing essentially resets with each new Game. Only your performance in the Individual Game will factor into your Team Game Bracket later.

Bracketing is a means of grouping players according to their level of experience:

Notice the Pewter Bracket. We’re going to talk about that in a second.

First, though, be aware that different Brackets do not get different challenges. Everyone participating in NCL is playing the exact same CTF. What each ranked Bracket does get, though, is its own Leaderboard, in addition to the Overall Leaderboard. This allows competitors in the Gold, Silver, and Bronze Brackets to compare themselves to other players of similar skill levels, but that’s not the only difference between a ranked player and an unranked player.

Ranked: Gold, Silver, and Bronze

Players in the Gold, Silver, and Bronze Brackets receive these perks:

  • They show up on the Leaderboard.
  • They receive a Scouting Report at the end of the Season.
  • They’re eligible to receive prizes.

The Scouting Report is a valuable addition to one’s LinkedIn and résumé, and prizes can be excellent conversation starters. Three hundred top performers in the Spring 2020 Individual Game received a high-quality challenge coin from the Player Ambassadors—imagine busting that out to show during an interview! Prizes vary: some come from the Player Ambassadors, there are awards and trophies from NCL and Cyber Skyline, and there will also be prizes from NCL’s partner, CompTIA.

But missing the Preseason would mean ending up in the Pewter Bracket and missing out on all those perks!

Unranked: Pewter

What placing in Pewter means is . . . your participation in the Individual Game [will be] somewhat of a waste of time and money.

– JeanaByte, Everything You Need to Know about the National Cyber League Preseason Game

The unranked Pewter Bracket is where folks land if they:

  • Do not participate in the Preseason.
  • Cheat.
  • Are otherwise unqualified to rank in the Individual Game, e.g. if they’re Coaches or Player Ambassadors.

Pewter is the Bracket of pure self-edification—which is undeniably a prize all its own. All I’m saying is that it doesn’t have to be your only prize!

Sandbagging

Is it possible to sandbag the Preseason in order to rocket to the top of an artificially low Bracket during the Individual Game? It is, but bear in mind that your overall Preseason performance and your Bracket will be disclosed on your Individual Game Scouting Report. Bragging to an interviewer that you were at the top of a Bracket you didn’t belong in could get awkward.

HOW SCORING WORKS

Your rank on the Leaderboard is determined by three factors:

  1. Score. Players with more points rank above players with fewer points.
  2. Accuracy. When two players have the same number of points, the player with the better accuracy will rank higher on the Leaderboard.
  3. Time of last correct submission. When two players are tied for both score and accuracy, the player who achieved their current score first will rank the highest.

The Impact of the Timer

You’ll notice a timer running during the Game—don’t let it scare you! It’s really just a countdown until the end of the Game. The amount of time you spend on individual challenges does not factor into your score. Definitely don’t rush to submit answers, because your accuracy matters far more than being the first player to reach the goal line.

The Impact of Using Hints

Using Hints will usually deduct points from your score. I say “usually” because some Hints are free. For Hints that are not free, the cost is nominal but variable. You’ll be warned how much beforehand and be prompted to confirm that you want to use a Hint before any irreversible transaction occurs.

Hints contain very basic information, designed to guide you in a general direction if you truly have no idea how to approach a challenge. If you already have a pretty good idea of what you’re probably supposed to do to solve a challenge, the Hint won’t help much.

If you use a Hint, it will show up on your web score report. Currently, Hint usage does not show on the downloadable NCL Scouting Report, but that may change in the future.

TAKE IT EASY IF YOU NEED TO

Now that you’ve been sufficiently cautioned away from the extreme of complete non-participation (PH33R TH3 P3WT3R), I can responsibly tell you that the Preseason is the one Game of the Season where you can take things easy if you need to.

All NCL competitors are students. If you’re a full-time student, that’s hard enough on its own, but maybe you’re also juggling other commitments like work or family, or you have other private struggles that are unique to you.

If you must sacrifice a portion of the competition, it’s safe to mostly let the Preseason pass you by, as long as you’ve participated enough to avoid the Pewter Bracket. The participation requirements are minimal, you have over a week to meet them, and the impact on your Scouting Report will also be minimal. There are also fewer challenge domains, and some Preseason challenges are repeats from previous Games, so, especially if you’re an NCL veteran, the edifying value may not be worth the time you’d have to take away from other things.

And that’s OK. Keep hanging in there, and come back swinging in the Indy.

OR… SNEAK UP ON THE PROS!

I’ve spent some time wondering how I managed to rank #1 in the Log Analysis module in the Spring 2020 Preseason Game.

I’ve concluded that while other, more experienced players are taking it easy or are focused elsewhere, that’s the best time to sneak up on them!!

If you are in a position to give the Preseason Game everything you’ve got, there’s every good reason to do it! A high rank in the Preseason Game definitely earns you bragging rights for your LinkedIn and résumé, it’s great preparation that helps to make you a more competitive player in the Indy and Team Games, and nothing gets complacent NCL veterans motivated during the Individual Game like seeing other students outranking them on the Leaderboard in the Preseason. It’s a win-win that gives everybody a place and time to shine!

GROW AND REFINE YOUR TOOLKIT

The pace of the Preseason Game gives you your last/best opportunity to develop your toolkit and troubleshoot your environment before everything goes to plaid during the Indy Game.

Just remember that you’re only seeing five of nine domains during the Preseason.

Domains in the PreseasonDomains NOT in the Preseason
Open Source Intelligence
Cryptography
Log Analysis
Network Traffic Analysis
Enumeration and Exploitation		Password Cracking
Forensics
Web Application Exploitation
Scanning and Reconnaissance

For domains that don’t appear in the Preseason Game, it might be worth reviewing those modules in the Gym and in the CryptoKait Dojo™.

TAKE NOTES

There are so many benefits to taking good notes during the NCL Games!

  • Writing things down activates different parts of your brain. You’ll not only improve memory retention for tools and techniques you’ve tried, but you’ll start thinking about the tough challenges in different ways.
  • You’ll be practicing real-world documentation skills that you’ll need in your career.
  • Notes will help jog your memory when you run your recaps.
  • Notes can help you avoid submitting the same wrong answer twice (which dings your accuracy twice!).
  • Notes will also help you in future Games and competitions when you come across similar challenges.


Remember:

(1) Don’t share answers with others—methodologies only, and only while a Game is not in progress.

(2) Do not publish your notes or writeups. Republishing NCL content violates the Terms of Service.

NCL pays Cyber Skyline to run the competition, but Cyber Skyline continues to own the challenges. This is how we keep costs low. Unfortunately, that means neither we nor the players are licensed to distribute challenge content or solutions. Please be respectful of this: we can’t keep NCL priced accessibly if challenges are distributed publicly.

–Paul Buonopane, Everything You Need to Know about the NCL from Someone Who Has Been Around as Long as Kait

FIDDLE WITH THE SOLUTION PARSER

Should you submit your answer as “fifty” or “50“? Should that address end in “Street” or “St.“? Should that URL have “https://” at the beginning?

The Gym was a good place to get a feel for the solution parser. I like to intentionally try inputting answers that don’t exactly match the ones given by the “Click to reveal solution” option, to see how much variation I can get away with.

The Preseason is going to be your last safe space before the Indy Game to work out any lingering anxieties you may have about the parser. Submitting incorrect answers will matter much more in the Individual and Team Games, since those are the Games that will primarily comprise your Scouting Report.

The parser is quite advanced (henceforth to be known as ParseNet™??), so the formatting of your answers will rarely be an issue. If you’re getting a submission kicked back as incorrect, it’s most likely that an important piece of information is missing.

That said, mistakes sometimes happen or possibilities get overlooked, so if you feel very certain that your answer is correct, yet the parser disagrees, definitely submit a support ticket to Cyber Skyline!

NO BLACKOUT

There will not be a Leaderboard blackout during the Preseason, but you’ll want to know what one is so it doesn’t take you by surprise during the later Games:

This is a big change [in Fall 2020]. During the final hour of each competition [except the Preseason], you’ll be unable to see the leaderboard. A tentative leaderboard will be published a few days after each competition, followed by a finalized leaderboard once the cheating audit is completed. 

– Paul Buonopane, What’s New in Cyber Skyline for Fall 2020

Everyone is eager to know and share their Individual and Team Game ranks, but it can be awkward if a school advertises its rank right away only to have that rank change upon completion of the cheating audit, so that’s how the Leaderboard blackout came into being. Only Individual and Team Game ranks receive that level of attention, though, so there’s no need to blackout the Preseason Leaderboard. Preseason rankings may likewise change after a cheating audit, but those rankings are far less likely to have been announced publicly.

AFTER THE PRESEASON GAME

IMPACT ON SCOUTING REPORT

To see how your Preseason Game performance and Individual Game Bracket will appear on your Scouting Report, check the bottom of page 2 of this sample Scouting Report.

DO A PRESEASON RECAP

Remember, you may only share methodologies, not answers, and only while a Game is not in progress!

The down time in between Games—that time after the Preseason Game ends but before the Individual Game begins—is prime time to run a recap of the Preseason.

The purpose of a recap is two-fold. You want to identify and address your areas of weakness, and you also want to celebrate your successes by sharing them with others, who will benefit from your mentorship.

There are lots of ways you can recap:

  • Compare notes with friends.
  • Check for methodologies (and share your own!) on Slack.
  • Return to the Gym and the CryptoKait Dojo™ to review domains where you struggled.

Now is the time to regroup and evaluate what everybody thought about their first real taste of the competition. Go over confusing topics and have everybody discuss their strategies together. Once the Individual Games start, they’re not going to be able to do that anymore. You want them to go into the Individual Games with as much prerequisite knowledge as possible. After it starts, they’ll be on their own.

– Aaron James, Using the NCL Games to Start a Cybersecurity Organization

EMBRACE A COMPETITIVE MINDSET

Envision the end of the Season now…

  • Your Scouting Report beefing up your LinkedIn and résumé…
  • Your school’s Power Rankings published…
  • Those CEUs ready for renewing your certifications…
  • Your victory, in the form of the new knowledge you’ll acquire and the existing skills you’ll validate…

How well do you see yourself and your classmates doing in the Individual Game?

How do you see yourself contributing to everyone’s success?

What legacy will you leave at your school?

What doors will that open?

How will you help make it all happen?

PROCEED TO THE INDIVIDUAL GAME GUIDE

There are some things you can do to prepare for the Individual Game, and not all of them are listed here! Check out my Fall 2020 “Everything You Need to Know” mega-guide to the Individual Game to get a jump on them, and stay tuned for wolfshirtz’s Spring 2021 guide, to be published here later this month!

Your feedback matters! What’s missing from this guide? What awesome nicknames would you give to CheatNet™, ParseNet™, and CryptoKait Dojo™? Tell us in the comments!

Published by Taisa

© 2020–2021 Taisa | NCL Player Ambassador | CryptoKait.com Webmaster | CompTIA Network+ and Security+

4 thoughts on “Everything You Need to Know About the National Cyber League Preseason Game”

  1. Pingback: Helping Students During the Games – CryptoKait
  2. Pingback: What Happens When the Season Is On and I Can’t Reach Out for Help? – CryptoKait
  3. Pingback: How to Run Recaps – CryptoKait
  4. Pingback: Everything You Need To Know About Rankings – CryptoKait

Leave a comment

This site uses Akismet to reduce spam. Learn how your comment data is processed.