hackedon / ctf-manager

Web app for managing a Capture the Flag tournament designed for SLIIT Hack Me If You Can CTF Tournament in 2019

About HackedON CTF Manager

The HackedON CTF Manager was developed for the express need of SLIIT annual Hack Me If You Can Capture the Flag event. It was hosted on HackedON servers and the participatings teams were allowed to login to submit their hard earned flags and track their progress. To that end, the CTF Manager app has the following functionality:

• Register Boxes and add Flags
• Register teams
• 2 User modes (ADMIN and USER)
• View complete summary of the CTF progress visually

The application was developed with security and reliability as a priority. The following features complements that goal.

• Flags are securely hashed using bcrypt before persisting to the database.
• Flag submission endpoint is rate-limited.
• Report upload endpoint is rate-limited and accepts only .doc or .docx filetypes.
• Redis is used to cache individual user profiles and CTF summary details greatly reducing load on the origin server. The caches are invalidated in a timely manner to ensure that content stays up-to-date as and when flags are submitted to the system.

Setup Process

The following are requirements for HackedON CTF Manager.

• All Laravel 5.8 requirements (PHP 7.2 and php extensions) (View Laravel 5.8 documentation)
• Apache / Nginx (Nginx preferred)
• Redis / Memcached Server (Redis preferred)
• predis/predis composer package (if Redis is used)
• MySQL or Laravel compliant database server (MySQL preferred)

The setup process is as follows.

• Clone the repository to your server’s document root. (eg: /var/www/html/ctf-manager)
• Provide proper file permissions for the www-data user
• Run composer install inside the ctf-manager directory.
• Make a copy of the environment file cp .env.example .env
• Generate application encryption key php artisan key:generate
• Update environment configuration.
  • APP_ENV, APP_DEBUG, APP_URL
  • Database details
  • CACHE_DRIVER=redis
  • REDIS_HOST, REDIS_PASSWORD
• Create database schema and populate it by php artisan migrate and php artisan db:seed respectively.
• Create new entry at /etc/nginx/sites-available to reflect the ctf-manager app and then sudo service nginx restart

License

The HackedON CTF Manager is open-source software licensed under the MIT license. The copyright notice below and this permission notice shall be included in all copies or substantial portions of the Software.

Copyright (c) 2019 HackedON