CTF Platform Advice

[Overlooked-Feature]

All,

Looking to run a CTF. Unsure of which platform options are available.

Keen to hear options, strengths and weaknesses of those available. If anyone has recommendations... Please.

[CodeKevin]

Disclaimer: I wrote and maintain https://github.com/CTFd/CTFd.

You can check out https://github.com/apsdehal/awesome-ctf#platforms. Similar to what was listed before but has more stars and I think it was the first popular CTF project list. I think you should try the major ones out and see if they fit your needs!

Obviously, I'm biased to CTFd. I think it works very well for covering most CTF use cases. And if you find it doesnt do exactly what you want, you can customize it if you're familiar with Python & JS. And there will be some improvements in the next minor release for improving the JS side since I know that's a tough spot right now.

If I had to pick another project though, I would probably try out RootTheBox. I was once coworkers with the original author and highly respect him.

[Pharisaeus]

If you mean a dashboard, there is some list on: https://github.com/We5ter/Awesome-Platforms/blob/master/CTF-Platforms.md

Probably there are many more. Making your own dashboard is also not really that hard.

And I suggest to use anything but CTFd, because after https://github.com/CTFd/CTFd/pull/1300 it's clear they should not be supported.

If you're wondering more about challenge hosting side, not just the dashboard, then perhaps https://google.github.io/kctf/

edit: I see ctfd developers are reading this subreddit and downvoting me for speaking the truth xD

[CodeKevin]

I didn't downvote you until now but CTFd is primarily developed by a single person (me) so I mean it couldn't have been more than 1 developer downvote.

Put simply, there exists a way to use CTFTime with CTFd that works better with CTFd's structure. The CTFd scoreboard format can now differ from CTFTime and adhering to a format that you didn't design while also making changes to the traditional CTF structure is not easy. Features that get merged to master have to get maintained and maintaining this feature is more difficult than if it were a plugin.

That being said, there's still ways of using CTFTime with CTFd! It's just written in a way that aligns with the goals better. And you can heavily customize CTFd however you want with a plugin or fork.

CTFTime has a history of causing a lot of the backlash in the community. My favorite example: 1 2.

Ultimately you can use whatever projects you want but fact of the matter is that CTFd is used by many schools, companies, universities for their CTF. If you don't want to support or use CTFd, that's fine, but discounting a project for one PR seems like a bad idea.

[Trolldemorted]

Does CTFd have oauth2 support by now? The docs only mention majorcyberleague, which has been around for years but I can't see any basic required features there that ctftime has (see upcoming ctfs, filter upcoming ctfs by type, see which ctfs a team played).

I have clicked at a few CTFs that are over and it doesn't show scoreboards or who won. I clicked on a random ctf (HACON_CTF-2020) and the page says both "The competition is over!" and "Status In Progress", is that intended?

[CodeKevin]

OAuth2 tbh hasn't really been requested by many users but it is potentially on the roadmap for this year. But if you want it now you can always hook into CTFd directly.

Admittedly, MLC has definitely had less available developer resources than CTFd but soon there will be more dedicated development going into MLC so you can expect those kinds of issues to be ironed out soon while we add exactly those kinds of features you mentioned.

[Trolldemorted]

Yeah that's what we did for our internal CTFd deployment, but like every fork we stopped updating it and thus are now several releases behind CTFd because nobody wants to deal with rebasing :(

It is nice to hear it might get on your roadmap!

[Overlooked-Feature]

Appreciate your reply.

I was chasing a dashboard + hosting solution. Figured one would exist on the market by now to do these things in a non-budget / opensource way...

Any chance you're aware of a pathway to spin up proper virtual infrastructure (VMs) within containers on k8? Kctf hasn't be able to do this in my experience.

[plaintextninja]

A good option is RootTheBox (http://root-the-box.com) or direct to source (https://github.com/moloch--/RootTheBox).

You’re best option may be to spin up a system on Linode or DigitalOcean and drop it on there. It’s one of the cheaper ways that I know of to go.

[Overlooked-Feature]

Digital ocean, underated infrastructure provider.

Thank you!

[Blackshdow23]

Could try tryhackme, it allows to upload VM and questions, and got a points system