Duke Cyber's CTF team recently traveled to St. Petersburg, Florida for the annual Raymond James CTF. Five members of the club (Britton Janet, David Jiang, David Shenkerman, Derock Xie, and Alex Mages), a mix of undergraduate and Master's in Cybersecurity students, spent the weekend meeting and testing their skills against other university CTF teams.
The Competition
The Raymond James CTF is an annual, invite-only cybersecurity competition hosted by Raymond James Financial at its St. Petersburg, Florida headquarters. The small team size and strict LLM budget set the competition apart from other university CTFs. Over seven hours, seventeen teams attacked each other's vulnerable applications, defended their own, and solved challenges across cryptography, forensics, web security, adversarial AI, and more.
A notably difficult challenge was a simulated cash register. Teams had to reverse engineer a credential and package it with a time-constrained session ID, then use it to spoof and write a manager's key card in an unknown format in order to open a physical cash drawer.
Another challenge involved reverse-engineering a provided circuit board, using probes to extract the firmware off of the onboard processor, then extracting and modifying the firmware to make the board reveal a secret flag.
The attack/defense segment centered on three custom applications, each with a large codebase to analyze. Teams enumerated the vulnerabilities in each, developed and applied patches to their own systems, and exploited the same flaws in other teams' systems. Extensive AI use proved essential for code analysis, a use case the team plans to prepare for next time.
Results
Duke Cyber finished 7th out of 17 teams. Most valuable was the hands-on lesson in how AI is reshaping security work, from reading unfamiliar code at speed to turning findings into patches and exploits under time pressure.
Members got to know students from the other invited universities and spent time with the Raymond James staff who made the event possible. Those conversations offered a look at the people and teams doing security work in the field, and what that means for our members entering the security job market.
Competitor Reflections
Derock Xie (Undergraduate, 2029): Artificial Intelligence has forever changed the way we must approach CTFs; this competition split the first third into no-AI, allowing AI only for the last two thirds. During the AI phase, using LLMs greatly accelerated the speed we could solve challenges, but we had to carefully balance speed with token spend to not hit the $100 limit given by the competition. Moving forward, improvements can be made to how we utilize AI, especially regarding the tools we give it and how we orchestrate everything.
Alex Mages (Undergraduate, 2027): The attack/defense section caught us off guard. We found some vulnerabilities in one service manually, were able to write some attack scripts from that, and the $100 OpenRouter credit they provided got us moving much quicker, but frankly, we didn't start spamming AI early enough. Using Docker to backup and restore snapshots of the app as we patched and broke things was essential, just not enough. I certainly underestimated how far $100 of AI could take us.