gztimewalker / gzctf

The GZ::CTF project, an open source CTF platform.

GZ::CTF

English, 简体中文, 日本語

GZ::CTF is an open source CTF platform based on ASP.NET Core.

Important

To save your effort, please read the documentation carefully before using: https://docs.ctf.gzti.me/en

Warning

Since 01/01/2024, the database structure of the develop image is no longer compatible with previous versions. If you prefer to use it, please go to v0.17.

During the rapid development of new features, it is not recommended to use the develop image for production deployment, and the database structure changes will cause data loss.

Features 🛠️

• Create highly customizable challenges

  • Type of challenges: Static Attachment, Dynamic Attachment, Static Container, Dynamic Container

    • Static Attachment: Shared attachments, any configured flag can be accepted.
    • Dynamic Attachment: The number of flags and attachments must be at least the number of teams. Attachments and flags are distributed according to the teams.
    • Static Container: Shared container templates, no dynamic flag is issued, and any configured flag can be submitted.
    • Dynamic Container: Automatically generate and issue flags through container environment variables, and flag of each team is unique.

  • Dynamic Scores

    • Curve of scores:

      $$f(S, r, d, x) = \left \lfloor S \times \left[r + ( 1- r) \times \exp\left( \dfrac{1 - x}{d} \right) \right] \right \rfloor $$

      Where $S$ is the original score, $r$ is the minimum score ratio, $d$ is the difficulty coefficient, and $x$ is the number of submissions. The first three parameters can be customized to satisfy most of the dynamic score requirements.

    • Bonus for first three solves: The platform rewards 5%, 3%, and 1% of the current score for the first three solves respectively.

  • Disable or enable challenges during the competition, and release new challenges at any time.

  • Dynamic flag sharing detection, optional flag template, leet flag

• Teams score timeline, scoreboard. Teams can be grouped

• Dynamic container distribution, management, and multiple port mapping methods based on Docker or K8s

• Real-time competition notification, competition events and flag submission monitoring, and log monitoring based on SignalR

• SMTP email verification, malicious registration protection based on Google ReCaptchav3

• Ban specific user, three-level user permission management

• Optional team review, invitation code, registration email restriction

• Writeup collection, review, and batch download in the platform

• Download exported scoreboard, export all submission records

• Monitor submissions and major event logs during the competition

• Challenges traffic forwarding based on TCP over WebSocket proxy, configurable traffic capture

• Cluster cache based on Redis, database storage backend based on PGSQL

• Customizable global configuration, platform title, record information

• Support metrics and distributed tracing

• And more...

Demo 🗿

About i18n 🌐

Localization support is in progress, please refer to translate.ctf.gzti.me to learn more or participate in the translation work.

Contributors 👋

CTF hosted with GZ::CTF 🏆

Some event organizers have already chosen GZCTF and successfully completed their competitions. Their trust, support, and timely feedback are the primary driving force behind the continuous improvement of GZCTF.

• THUCTF 2022: Tsinghua University Network Security Technology Challenge
• ZJUCTF 2022/2023: Zhejiang University CTF
• SUSCTF 2022/2023: Southeast University Tiger Crouching, Dragon Coiling Cup Network Security Challenge
• DIDCTF 2022/2023: Gansu Political and Legal University CTF
• Woodpecker: The First Network Security Practice Competition of Shandong University of Science and Technology
• NPUCTF 2022: Northwestern Polytechnical University CTF
• SkyNICO Network Space Security Tri-school Competition (Xiamen University of Technology, Fujian Normal University, Qilu University of Technology)
• Hunan Police Academy Network Security Attack and Defense Competition
• W4terCTF 2023: The First Information Security Novice Competition of Sun Yat-sen University
• TongjiCTF 2023: The Fifth Network Security Competition of Tongji University
• CTBUCTF 2023: The First Network Security Competition of Chongqing Technology and Business University
• NPUCTF 2023 - The First Security Experimental Skills Competition of Northwestern Polytechnical University
• XZCTF 2023: The First Network Security Novice Competition of Zhejiang Normal University Xingzhi College
• ORGCTF 2023: Gongcheng Cup Freshman Competition of Harbin Engineering University
• SHCTF 2023: "Shanhe" Network Security Skills Challenge
• Tianjin University of Science and Technology 2023 College Student Maker Training Camp Network Security Group Selection
• HYNUCTF 2023: Xuantian Network Security Laboratory Recruitment Competition of Hunan Hengyang Normal University
• NYNUCTF S4: Recruitment Competition of Xuantian Network Security Laboratory of Nanyang Normal University
• The First Network Security Freshman Challenge of Shangqiu Normal University
• SVUCTF-WINTER-2023: Suzhou Vocational University 2023 Winter Freshman Competition
• BIEM CTF 2024：Beijing Institute Of Economics And Management - The first BIEM "Xin'an Cup" CTF competition
• BUAACTF 2024: Beihang University CTF
• San Diego CTF 2024: University of California, San Diego

The list is not in any particular order, and PRs are welcome for additions.

Special Thanks ❤️‍🔥

Thanks to NanoApe, the organizer of THUCTF 2022, for providing sponsorship and conducting Alibaba Cloud public network stress testing. This helped validate the service stability of the GZCTF standalone instance (16c90g) under the pressure of thousands of concurrent requests and 1.34 million requests in three minutes.

Stars ✨

gzctf's Issues

Misc: 在校赛中发现的问题和建议

加油，浅浅赞助了一点

之前提交过的issue不再赘述

新发现的Bug和不成熟的建议：

1. 系统日志、比赛监控内的实时刷新的列表会出现错乱的情况。例如监控中的提交记录，若选择“AC”筛选，刷新时会有“WA”或其他的条目刷新进来。不过无伤大雅啦
2. 动态附件目前似乎只支持附件人数比大于等于1的情况，否则会有队伍分配不到附件。不知道是否考虑增加10个人用9个附件这样的情况，即在反作弊和占用空间二者取得平衡
3. 目前上传动态附件似乎有总大小的限制。例如对于3MB左右的附件一次只能上传约13个左右，导致效率偏低。是否考虑通过读取本地文件？例如通过Volume映射一个本地位置，在此放置动态附件。既提高了效率又避免了前端上传文件大小限制
4. 是否考虑提供一个接口以方便管理员通过自动化程序接入接口实现对用户比赛的审核。例如提供一个接口A返回所有用户的个人信息、封禁状态等；B返回待审核的用户的个人信息；C用于提交审核结果，例如通过或驳回。我们还是很希望能从报名到导出成绩全在平台完成，无需借助在线表格，但目前来看可能还是会有点麻烦
5. 反作弊检查棒了大忙！在提交记录的“CD”栏可以看到作弊者的信息，但是只有一个队伍。通常来说封禁应当是封禁两者的，导致封禁时需要在“事件监控”和“提交记录”两个位置来回切换，找到对应的用户信息。是否考虑完善之，例如

队伍	用户	相关队伍	题目	操作
A	A1	B	1	（封禁按钮）
A	A1	B	1	（封禁按钮）

一不小心逼逼叨叨讲了这么多哈哈哈跟老奶奶的裹脚布一样，不过总之还是希望能看到GZCTF越变越好，早日看到破k stars的那天

Feat: 更细节的积分榜和个人信息模块

我们学校举办CTF赛事都是用师傅的平台，导出积分榜的时候只有战队名而没有成员的姓名、学号等信息，导致开具参赛证明时会有点麻烦。如果师傅的平台导出积分榜能有这些信息就好了。感谢。（目前我们做法是挂一个收集表让学生自己填信息进去，有点不优雅而且有隐患hhh）
比如这个样子：

排名	战队	姓名	学号	手机号
1	a1	张三/李四/王五	001/002/003	1/2/3
2	a2	A/B/C	004/005/006	4/5/6

以及，如果能在全局设置中设置所有新用户注册时强制跳转到个人信息页面进行信息填写也会方便许多。（这个我们目前做法是比赛开启审核，管理员定期连接到数据库对符合的信息批量过审核）

再次感谢师傅

AxiosError: Request failed with status code 405

进入首页页面无法显示内容，一片空白

新增比赛 和 编辑比赛显示下面的错误。编辑题目保存修改的的时候也是下面错误

AxiosError: Request failed with status code 405

Bug: character '@' in registry username is unexpectedly banned.

When using a Aliyun RAM(Resource Access Management) account to config a private docker registry, a username like below will be given.

Reference for RAM account format: https://www.alibabacloud.com/help/zh/ram/support/faq-about-ram-users

<UserName>@<AccountAlias>.onaliyun.com

Hence, a @ is needed for the registry username. But in the source code of K8sService.cs, this character was banned for injection proof. As I guess, it was prepared for the code in line 306, which concat strings to serialize a json as below.

// lines starts at 305 of K8sService.cs
            var auth = Codec.Base64.Encode($"{registry.UserName}:{registry.Password}");
            var dockerjson = $"{{\"auths\":{{\"{registry.ServerAddress}\":{{\"auth\":\"{auth}\"," +
                $"\"username\":\"{registry.UserName}\",\"password\":\"{registry.Password}\"}}}}}}";
            var dockerjsonBytes = Encoding.ASCII.GetBytes(dockerjson);

And if it's the purpose of these code, maybe we can do better. Using System.Text.Json to serialize the json which will not result in the injection in the string formatting.

var dockerjson = new {
    auths = new {
        registry.ServerAddress = new {
            auth = auth,
            username = registry.UserName,
            password = registry.Password
        }
    }
};
string jsonString = JsonSerializer.Serialize(dockerjson);

FYI, the codes above should work here.

部署请教

请问师傅平台有详细的部署教程吗？

GitHub Actions Container Retention Policy is Wrongly Configured

Currently the workflow is configured to preserve 5 untagged or COMMIT_SHA1 container images. However, this is not suitable as GZCTF is currently publishing multi-arch + provenance-enabled containers. These containers will have tags applied on a virtual image, which contains metadata of actual images. The actual images is not tagged. Therefore, the images of previous versions is removed.

$ docker pull ghcr.io/gztimewalker/gzctf/gzctf:v0.14.4
v0.14.4: Pulling from gztimewalker/gzctf/gzctf
manifest unknown

Workaround: disable image retention.

Reference:

• https://www.github.com/snok/container-retention-policy/issues/43
• https://www.github.com/snok/container-retention-policy/issues/63

Feature: Add statistic of registered users.

希望能够在用户管理/队伍管理等表格处增加相关用户个数显示，例如：

已显示30用户/共45用户

Feature: 希望添加讨论区功能和用户出题功能

BUG：普通用户在“用户信息”种无法修改为用户名中文，但管理员可以在后台修改

Feature: 希望能增加理论题功能，单选题、多选题

求助

可以帮忙看看这是什么情况嘛，大佬们，跪谢

Add GZCTF challenge templates for various categories

I've been using GZCTF for a while and collected some of my dynamic docker challenges as a template. Hope this repo can help other users design their docker image.

https://github.com/Lyther/GZCTF-Templates

Contains the following challenge categories:

• Crypto+Python
• Pwn
• Web
• Web+GoLang
• Web+PHP
• Web+PHP+MySQL
• Web+PHP+Pwn
• Web+Python

If you find this repo helpful, consider linking the repo as a challenge template :)

实力访问入口的地址不会自动复制到剪贴板

实力访问入口的地址不会自动复制到剪贴板
GZ::CTF v0.15.2-f2b179b7648676f78356d5d7e17f3f19fabe1663

Bug: failure sending mail with port 465

GZCTF    | [22-09-08 13:19:22.439 INF] AccountController: 发送用户密码重置邮件。 #Pending <>@::ffff:
GZCTF    | [22-09-08 13:21:36.055 ERR] MailSender: 邮件发送遇到问题
GZCTF    | System.Net.Mail.SmtpException: Failure sending mail.
GZCTF    |  ---> System.Net.Sockets.SocketException (110): Connection timed out
GZCTF    |    at System.Net.Sockets.Socket.AwaitableSocketAsyncEventArgs.ThrowException(SocketError error, CancellationToken cancellationToken)
GZCTF    |    at System.Net.Sockets.Socket.AwaitableSocketAsyncEventArgs.System.Threading.Tasks.Sources.IValueTaskSource.GetResult(Int16 token)
GZCTF    |    at System.Threading.Tasks.ValueTask.ValueTaskSourceAsTask.<>c.<.cctor>b__4_0(Object state)
GZCTF    | --- End of stack trace from previous location ---
GZCTF    |    at System.Threading.Tasks.TaskToApm.End(IAsyncResult asyncResult)
GZCTF    |    at System.Net.Sockets.TcpClient.EndConnect(IAsyncResult asyncResult)
GZCTF    |    at System.Net.Mail.SmtpConnection.ConnectAndHandshakeAsyncResult.InitializeConnectionCallback(IAsyncResult result)
GZCTF    | --- End of stack trace from previous location ---
GZCTF    |    at System.Net.Mail.SmtpConnection.ConnectAndHandshakeAsyncResult.End(IAsyncResult result)
GZCTF    |    at System.Net.Mail.SmtpClient.ConnectCallback(IAsyncResult result)
GZCTF    |    --- End of inner exception stack trace ---
GZCTF    |    at CTFServer.Services.MailSender.SendEmailAsync(String subject, String content, String to) in /home/runner/work/GZCTF/GZCTF/GZCTF/Services/MailSender.cs:line 56
GZCTF    | [22-09-08 13:21:36.057 INF] MailSender: 邮件发送失败！ #Fail <System>

Feature: Train mode

• Design database
  • TrainingChallenge
  • TrainingInstances
• Train Edit Page
  • TrainingChallenges can be imported from Challenges
• Training Page
  • Training Scoreboard
  • Group by Challenge Type
  • Allows some users to be removed from the scoreboard
  • Display the user bio and do something fun like hackergame

希望能有一个后台批量新增用户的功能

希望能有一个后台批量新增用户的功能，使用csv或excel批量导入用户信息（名称，密码，邮箱，队伍，手机号码什么的）

Feature: Easy way to update the GZCTF

目前更新GZCTF似乎只能重新部署镜像，而这会导致数据库的数据丢失。希望新增一个更新功能（或者一个更新用的docker-compose）

功能建议：增加题目管理模块

1、目前多个比赛中的题目假如有重叠的情况，需要针对多个比赛多次上传同一个题目，还是感觉有点麻烦

希望增加一个题目管理模块，从而在新建比赛之后可以直接从题库中勾选上对应的题目，从而提高赛题的复用率。

2、如果能增加题目管理模块的话，希望同时能支持给每道题目打上技术标签，如图片隐写、php反序列化这种标签，而不只是区分大的题目方向，这样方便于在管理员视角下勾选题目新建比赛。

希望GZ::CTF越来越好🎈

Bug: flag with Leet doesn't work

在 Leet 模式下，把 flag 加长到特别长的时候仍然提示 flag 不够复杂。
Leet 模式并没有把空格转换成下划线。

DbUpdateConcurrencyException when saving user to database

When every request comes in, I will update the LastVisitedUTC for user, and save to database.

user.LastVisitedUTC = DateTimeOffset.UtcNow;
await userManager.UpdateAsync(user);

With a higher version of EFCore and Identity, these changes that need to be updated will be cached, and save to database later.

But these caches, produced in a short time, have different ConcurrencyStamp, and EFCore will throw a DbUpdateConcurrencyException.

How can I reach the purpose properly?

Fatal Error

没有什么事，就是来点个赞

Feature: Webhook support for game events

Feature: OAuth account & register & login

flag模板的问题

flag模板只有在题目上线前的第一次编辑中生效，并且无法直接使用MyCTF{[GUID]}，他会提示复杂度过低，请问这该如何解决

No limitation of "available domains" when users change email address

用户自行修改邮箱时可以指定「可用邮箱域名列表」以外的邮箱域名。

不知道是 bug 还是 feature。

Bug: post cannot empty tag

ASP.NET Core 7.0

• ASP.NET Core 7.0
• EFCore 7.0
• MemoryPack
• Npgsql 7.0
• Npgsql.EntityFrameworkCore.PostgreSQL 7.0

Feature: verify the email address suffix

仅供校内同学参加的比赛需要在注册时限定使用校内邮箱注册，即限制邮箱地址后缀。

动态附件题目窗口中没有下载按钮

创建了misc类型的动态附件题目，使用了200个以flag命名的txt，上传之后发现题目窗口没有下载按钮
又尝试了更换文件类型、更换题目方向类型发现都没有下载按钮牛
GZCTF部署方式是单机docker，2023/7/10使用文档中的compose配置文件部署，师傅可以debug一下问题莫，需要什么debug信息请联系我

Announcement: Internationalization Support

Hello everyone,

We're glad to announce that we are going to support multiple languages for internationalization in the next major version (likely v0.18).

Currently, the below languages are in the progress and will likely be shipped in the next version:

• Chinese (zh-CN)
• English (en-US)
• Japanese (ja-JP)

Note that this list doesn't mean we only plan to support above languages, instead, we are finding translators in the community so that we can support even more languages!

If you have any interest, welcome to join us as a translator to contribute localized resources in your language and culture.

希望添加webhook功能

webhook用于往其他地方如qq群推送一二三血以及普通提交的消息

无法部署

docker部署时无限重启，查看日志报错如下
Unhandled exception. System.ArgumentNullException: Value cannot be null. (Parameter 'connectionString')
at Microsoft.EntityFrameworkCore.Utilities.Check.NotEmpty(String value, String parameterName)
at Microsoft.EntityFrameworkCore.NpgsqlDbContextOptionsBuilderExtensions.UseNpgsql(DbContextOptionsBuilder optionsBuilder, String connectionString, Action1 npgsqlOptionsAction) at Program.<>c__DisplayClass0_0.<<Main>$>b__1(DbContextOptionsBuilder options) in /home/runner/work/GZCTF/GZCTF/GZCTF/Program.cs:line 57 at Microsoft.Extensions.DependencyInjection.EntityFrameworkServiceCollectionExtensions.<>c__DisplayClass1_02.b__0(IServiceProvider p, DbContextOptionsBuilder b)
at Microsoft.Extensions.DependencyInjection.EntityFrameworkServiceCollectionExtensions.CreateDbContextOptions[TContext](IServiceProvider applicationServiceProvider, Action2 optionsAction) at Microsoft.Extensions.DependencyInjection.EntityFrameworkServiceCollectionExtensions.<>c__DisplayClass17_01.b__0(IServiceProvider p)
at Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteVisitor2.VisitCallSiteMain(ServiceCallSite callSite, TArgument argument) at Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteRuntimeResolver.VisitCache(ServiceCallSite callSite, RuntimeResolverContext context, ServiceProviderEngineScope serviceProviderEngine, RuntimeResolverLock lockType) at Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteRuntimeResolver.VisitScopeCache(ServiceCallSite callSite, RuntimeResolverContext context) at Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteVisitor2.VisitCallSite(ServiceCallSite callSite, TArgument argument)
at Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteRuntimeResolver.VisitConstructor(ConstructorCallSite constructorCallSite, RuntimeResolverContext context)
at Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteVisitor2.VisitCallSiteMain(ServiceCallSite callSite, TArgument argument) at Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteRuntimeResolver.VisitCache(ServiceCallSite callSite, RuntimeResolverContext context, ServiceProviderEngineScope serviceProviderEngine, RuntimeResolverLock lockType) at Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteRuntimeResolver.VisitScopeCache(ServiceCallSite callSite, RuntimeResolverContext context) at Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteVisitor2.VisitCallSite(ServiceCallSite callSite, TArgument argument)
at Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteRuntimeResolver.Resolve(ServiceCallSite callSite, ServiceProviderEngineScope scope)
at Microsoft.Extensions.DependencyInjection.ServiceLookup.DynamicServiceProviderEngine.<>c__DisplayClass2_0.b__0(ServiceProviderEngineScope scope)
at Microsoft.Extensions.DependencyInjection.ServiceProvider.GetService(Type serviceType, ServiceProviderEngineScope serviceProviderEngineScope)
at Microsoft.Extensions.DependencyInjection.ServiceLookup.ServiceProviderEngineScope.GetService(Type serviceType)
at Microsoft.Extensions.DependencyInjection.ServiceProviderServiceExtensions.GetRequiredService(IServiceProvider provider, Type serviceType)
at Microsoft.Extensions.DependencyInjection.ServiceProviderServiceExtensions.GetRequiredService[T](IServiceProvider provider)
at Program.

$(String[] args) in /home/runner/work/GZCTF/GZCTF/GZCTF/Program.cs:line 248
at Program.(String[] args)

部署问题

师傅您好，在第一个GZCTF目录下输入docker-compose up时，出现以下报错
xt) GZCTF | at Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteVisitor2.VisitCallSiteMain(ServiceCallSite callSite, TArgument argument)
GZCTF | at Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteRuntimeResolver.VisitCache(ServiceCallSite callSite, RuntimeResolverContext context, ServiceProviderEngineScope serviceProviderEngine, RuntimeResolverLock lockType)
GZCTF | at Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteRuntimeResolver.VisitScopeCache(ServiceCallSite callSite, RuntimeResolverContext context)
GZCTF | at Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteVisitor2.VisitCallSite(ServiceCallSite callSite, TArgument argument) GZCTF | at Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteRuntimeResolver.Resolve(ServiceCallSite callSite, ServiceProviderEngineScope scope) GZCTF | at Microsoft.Extensions.DependencyInjection.ServiceLookup.DynamicServiceProviderEngine.<>c__DisplayClass2_0.<RealizeService>b__0(ServiceProviderEngineScope scope) GZCTF | at Microsoft.Extensions.DependencyInjection.ServiceProvider.GetService(Type serviceType, ServiceProviderEngineScope serviceProviderEngineScope) GZCTF | at Microsoft.Extensions.DependencyInjection.ServiceLookup.ServiceProviderEngineScope.GetService(Type serviceType) GZCTF | at Microsoft.Extensions.DependencyInjection.ServiceProviderServiceExtensions.GetRequiredService(IServiceProvider provider, Type serviceType) GZCTF | at Microsoft.Extensions.DependencyInjection.ServiceProviderServiceExtensions.GetRequiredService[T](IServiceProvider provider) GZCTF | at Program.<Main>$(String[] args) in /home/runner/work/GZCTF/GZCTF/GZCTF/Program.cs:line 225 GZCTF | at Program.<Main>(String[] args) GZCTF exited with code 139

Feedback for “快速上手”

师傅们好，请教一个问题，我想修改发送验证邮件时，右下角的署名"GZCTF"，应该修改哪个文件，怎么修改呢？感谢各位师傅辛苦付出！

Bug: 时间显示不匹配

可能的复现操作：

1. 创建赛事，确定一个时间
2. 返回主页面查看赛事时间，正常
3. 修改赛事时间
4. 返回主页面赛事时间，出现不匹配现象

截图：

已经执行过：清除redis服务器内容

已经检查过：数据库相关位置内容为正确时间

I18n with structured logging in json

wip.

sendemail error

师傅好，很喜欢您团队做的平台

在搭建过程中，我运行了一下命令：
docker pull ghcr.io/gztimewalker/gzctf/gzctf:latest
docker-compose up

平台运行正常，但是在邮件验证时，报了下面的错误：

您看怎么解决

我的平台是ubuntu20.04LTS

Feature: Simple validation on user's field

建议添加对注册用户填写字段的自定义校验（例如正则校验）：

• 校验姓名（学号、或自定义的其他）字段是否符合相关要求
• 根据学号（或自定义的其他）字段，校验队伍内所有队员是否符合参赛分组要求

功能建议：根据dockerfile环境变量来确定暴露的端口（Docker后端）

我的我的，当这东西不存在吧

Feature: Custom flag environment variable

期望的功能室可以在配置文件或者全局设置中配置动态容器获取 flag 的环境变量。

默认是 GZCTF_FLAG，但这会导致某些默认以 FLAG 为环境变量的容器无法使用，必须重新构建。

Bug: Two curly braces appear when [GUID] is used as the flag template

Some minor issues that arise during use.

Hello,
Firstly, there are too few document descriptions, and many problems cannot be solved through documentation,
Then, the instance URL copy key is invalid,
Websocket cannot connect to ws link after setting according to the document,
I hope you can supplement the document,
Gzctf is a good project and we need it.

Feature: Port mapping service abstraction

Feature: Writeup collection and review

如何启动docker

如何启动docker，怎么访问gzctf

Bug：用户在修改邮箱后需要管理员手动激活

全局设置中「需要邮箱确认」为关闭状态时，用户在修改邮箱后会自动变成非激活状态，从而无法登陆。

Feature: Customize the weight of the first three bloods

• Game 添加相应字段（不可序列化 json，可存储为 mempack）
• 计算积分榜时直接使用

Optimization: 优化作弊检测逻辑

经测试目前作弊检测只针对动态附件/容器的串flag检测。请问是否考虑优化检测逻辑，如

1. 提交flag（特别是提交的flag是他人的）之前是否下载过提供的附件/容器是否被被打开过。显然不打开这些资源文件就交flag的是明显串flag行为。
2. 从下载附件/打开容器后到提交flag的时间是否过小（如小于某阈值）。显然过小是不太现实的。
3. 两次flag提交间隔过小

……以上只是我能想到的一些作弊检测逻辑，如果能实现的话就太棒了。感谢。

Feature Request: Set the maximum upload file size.

当上传大文件时会返回 Failed to read the request form. Request body too large. The max request body size is 30000000 bytes.

ASP.NET 这个默认值对于大带宽的服务器的确不够用，建议增加一个可自主调节的选项？

举办完校赛后的一些建议

首先很感谢GZTimeWalker提供的赛事平台，在管理时遇到以下一些问题希望平台能继续优化~

1. 相同队名的不同队伍可以参加同一场比赛，导致最后算分时不知道谁是谁
2. 希望能有对比赛结果一键导出excel的功能，不然查看某队信息还得先看队伍里的人是谁，然后再切到用户管理界面去找用户的信息，相当麻烦（
3. 对于个人赛如果能直接让选手直接以用户名参加，而不是新建队伍后再用队伍参加就更好了，不过这点可能会比较难改，也不是特别重要
   最后还是祝GZCTF越来越好~~