deckar01 / ctfd Goto Github PK

<your_CTFd_instance>/admin/teams?field=id&q=%27+or+1%3D%3D1+--

yields a type error

  File "/usr/local/lib/python3.5/dist-packages/flask/app.py", line 1982, in wsgi_app
    response = self.full_dispatch_request()
  File "/usr/local/lib/python3.5/dist-packages/flask/app.py", line 1614, in full_dispatch_request
    rv = self.handle_user_exception(e)
  File "/usr/local/lib/python3.5/dist-packages/flask/app.py", line 1517, in handle_user_exception
    reraise(exc_type, exc_value, tb)
  File "/usr/local/lib/python3.5/dist-packages/flask/_compat.py", line 33, in reraise
    raise value
  File "/usr/local/lib/python3.5/dist-packages/flask/app.py", line 1612, in full_dispatch_request
    rv = self.dispatch_request()
  File "/usr/local/lib/python3.5/dist-packages/flask/app.py", line 1598, in dispatch_request
    return self.view_functions[rule.endpoint](**req.view_args)
  File "/sotb/CTFd/CTFd/utils.py", line 285, in decorated_function
    return f(*args, **kwargs)
  File "/sotb/CTFd/CTFd/admin/teams.py", line 35, in admin_teams_view
    return render_template('admin/teams.html', teams=teams, pages=None, curr_page=None, q=q, field=field)
  File "/usr/local/lib/python3.5/dist-packages/flask/templating.py", line 134, in render_template
    context, ctx.app)
  File "/usr/local/lib/python3.5/dist-packages/flask/templating.py", line 116, in _render
    rv = template.render(context)
  File "/home/shyft/.local/lib/python3.5/site-packages/jinja2/environment.py", line 1008, in render
    return self.environment.handle_exception(exc_info, True)
  File "/home/shyft/.local/lib/python3.5/site-packages/jinja2/environment.py", line 780, in handle_exception
    reraise(exc_type, exc_value, tb)
  File "/home/shyft/.local/lib/python3.5/site-packages/jinja2/_compat.py", line 37, in reraise
    raise value.with_traceback(tb)
  File "/sotb/CTFd/CTFd/themes/admin/templates/teams.html", line 1, in top-level template code
    {% extends "admin/base.html" %}
  File "/sotb/CTFd/CTFd/themes/admin/templates/base.html", line 67, in top-level template code
    {% block content %}
  File "/sotb/CTFd/CTFd/themes/admin/templates/teams.html", line 189, in block "content"
    {% if pages > 1 %}
TypeError: unorderable types: NoneType() > int()

It would also be useful to help populate dynamic server info based on the team in the challenges.

for instance, if teams all have unique servers (team_name.somedomain.com) you could pre-populate the challenges so that team kangaroo sees kangaroo.somedomain.com and team zebra see zebra.somedomain.com

Or if you wanted to only deploy challenges to select teams (for extra red team activites)

admins being able to create teams prior to the event would be useful here.

/admin/chals

Add some indicator of whether a challenge is hidden or not.

change color or add one of these icons to it.

Add a way to submit secret/bonus flags.

Proposal

1. Create a page called "Bonus"
2. Add a table called bonuses with title, flag, and points columns
3. Add an admin page for creating bonuses
4. Show the list of titles on the "Bonus" page
5. Add a table called bonus_captures with foreign key columns to the bonus and team tables
6. Add a bonus flag input to the "Bonus" page
7. Add an API endpoint that:
   • looks up bonus flag input
   • inserts into bonus_captures when found
   • inserts into awards when found
8. Add an indicator to the title list on the "Bonus"

Include teams with 0 points in the scores API response.

Setup a way to push system events to an external score board.

I figure a short walkthrough or points of note about a given challenge would be helpful for admins that don't have intimate knowledge of that challenge. I imagine that it would just be a textarea in the challenge create/edit html and an additional column in the db. nothing fancy. it would be nice to not have a separate platform to store simple text notes.

I feel like this would be relatively simple to implement as a plugin. Challenges created prior to the plugins installation would need no alteration as the fields usage is optional.

someone mentioned this on the CTFd issues.

This would be beneficial for staging events or in training environments where account info is distributed to participants before the event.

Lots of the registration code could be reused to this end.

It might be interesting to have challenges that lower in value for as teams solve them.

This would have the effect of having to store a store as opposed to calculate a score as is currently done in https://github.com/deckar01/CTFd/blob/master/CTFd/scoreboard.py.

This might break 3rd normal form, but hang in there...

In keeping with the theme of having new challenge types as plugins is wise.

A few additional db columns woud need to be created to support the new challenge type.

• base_value (the max points)
• decay_rate (percentage to decrease with each solve; 5% = .05
• minimum_value (minimum points)

In order to display the current "worth" of the challenge. This is what you assign on a
challenge_base_value * 1 - (challenge_decay_rate * number_of_solves)

You would have to calculate this at solve time
calculated_value = challenge_base_value * 1 - (challenge_decay_rate * number_of_solves) ) if calculated_value < challenge_minimum_value: Teams.team[x].score += challenge_minimum_value else: Teams.team[x].score += calculated_value
(I'm dumb and can't format thing correctly.)

It doesn't seem unreasonable to me for that score column to be located in the Teams table.

These are just a few ideas I had regarding the subject.

someone has done some work on this front already. CTFd#330 (comment)

Thoughts or ideas?

someone mentioned this as a feature request in the upstream issues.

This would be useful for our event because we have an 8 hour period where the challenges are going to be off-line. At least the scoreboard and the ability to submit flags will be.

Rather than shuffling around the ctf end times, could we implement a "pause" and "unpause" button. under config-> CTF time

I believe this would be easy enough to implement via javascript.
we could manipulate the start time to be 100 years in the future for Pause and yesterday (whatever that is ) for Unpause.

Is it worth messing with?

Lock a challenge until another challenge (or set of challenges) is complete.

Sometimes it makes sense to put a challenge in multiple categories.

For instance, a challenge that involves bruteforcing a crypto challenge might involve a lot of programming as well as crypto.

creating a tag cloud or search box at the top that allows players to see all challenges that have some programming, crypto, or forensics aspect.

it gives the challenge creators some flexibility in creating challenges that require overlapping skillsets without having to determine what the "most important" skill is.

just my thoughts.

Not sure about how this would be implemented.