wtfd-tech / wtfd

CTF-Engine, written in go (WIP)

WTFd

a CTFd-like Server in go

Configuration

At start, a config.yaml is generated. You should edit it with the settings you need

The Challenge info Dir shall look like that:

├── chall-1
│   ├── meta.yaml
│   ├── README.md
│   └── SOLUTION.md
├── chall-2
│   ├── meta.yaml
│   ├── README.md
│   └── SOLUTION.md

For each Challenge you need a meta.yaml, a README.md and a SOLUTION.md

The meta.yaml shall look like that:

points: <How many points the challenge should have>
uri: "<Protocol and user of your ssh Challenges (e.g. `ssh://chall-1@%s`>"
deps: [<Dependencies the Challenge has>]
flag: "<The flag>"
author: "<The author of the challenge>"
title: "(optional) the title of the challenge, else the directory name is used"

The README.md and SOLUTION.md are markdown files (syntax). The SOLUTION.md contents can only be seen by users who already solved the challenge

Building WTFd yourself

You need to have go, sqlite3 and yarn installed

git clone https://github.com/wtfd-tech/wtfd
cd wtfd
make

Running WTFd

Now you can finally start wtfd by downloading it from the releases, giving it permissions chmod +x wtfd and running it ./wtfd

WTFd is HTTP only, if you need HTTPS use a reverse proxy like Traefik or nginx

Development notes

To make working with the TypeScript easier, you can do

make js-run

to automatically compile the JS on changes

wtfd's Issues

Bugreport über externe Server versenden

Footer-Template unwanted a-Tag

When the footer-Template is rendered, there is an a-Tag around the first cell, that should not be there and disrupts the layout.

<a>
    <div class="flexcell flex-left">
        MISSING
    </div>
</a>

oauth login with github, gitlab, twitter, ...

scrolling does not work

One can only scroll with touch/mouse clicks and not with the mousewheel

Switch from xorm to another ORM, because xorm has problems

GORM would be an option

create api documentation

https://github.com/OAI/OpenAPI-Specification/blob/master/versions/3.0.2.md

Password Change Dialog

Es sollte, wenn man auf die E-Mail adresse klickt ein Dialogfeld geöffnet werden, in dem man ein neues Password vergeben kann

api testing

blocked by #40

split db stuff from the rest into the internal/db package

Inventory notification

Your tool/software has been inventoried on Rawsec's CyberSecurity Inventory:

• https://inventory.rawsec.ml/ctf_platforms.html#WTFd

What is Rawsec's CyberSecurity Inventory?

An inventory of tools and resources about CyberSecurity. This inventory aims to help people to find everything related to CyberSecurity.

More details about features here.

Note: the inventory is a FLOSS (Free, Libre and Open-Source Software) project.

Why should you care about being inventoried?

Mainly because this is giving visibility to your tool and improve its referencing.

Badges

The badge shows to your community that your are inventoried. It looks good but also shows you care about your project, that your tool is referenced.

Feel free to claim your badge here: http://inventory.rawsec.ml/features.html#badges, it looks like that , but there are several styles available.

Want to thank us?

If you want to thank us, you can help make our open project better known by tweeting about it! For example:

So what?

That's all, this message is just to notify you if you care. Else you can close this issue.

Email Verification

Optionally requre users to verify their E-Mail Address by sending them a verification link

split config loading into it's own package (internal/config)

maybe with a config interface, with implementations for json/yaml, env, ...

Prevent user from clicking register if form is empty

Man kann aktuell einen leeren register-dialog absenden

Notifications

It would be nice to be able to send notifications to users to announce information during an event. This system could also be used, to send a push notification if someone overtakes you on the leaderboard, so that the competition is a bit more exciting.

split html generation/serving into it's own package (internal/html)

Admin Page

a page for admins to monitor users, change settings, ... would be 1nice

Features:

• User Deletion/Modification
• Challenge locking (so that nobody can solve it (if there is a bug))-
• Fancy Graphs and tables

Add option to restrict E-Mail domains

Add an option that allows only E-Mails from specific domains (e.g. @tu-dortmund.de)
This probably needs #16 to be implemented to be effective

export js, css libraries into npm

Rate Limiting

Irgendeine Art von DoS-Protection implementieren. Idealerweise mit eigenem SSH-Server, damit man sein OpenSSH nicht kaputt machen muss

SMTP: Allow different username

The SMTP implementation currently ties the login username to the sender address. There should be an option to set it independently

Gereral Fix Branch

Use e.g. branch general-fixes for minor changes to keep them apart from other branches, where they don't belong. Then merge this branch with regularity.

custom css

Icon

We need an Icon

Gorilla (?) does not set the correct mime types

Firefox refuses to load bundle.js when X-Content-Type-Options: nosniff
-> Info

The resource from “http://localhost:8080/static/bundle.js” was blocked due to MIME type (“text/plain”) mismatch

WTFd Segfaults because of invalid (chall-) dependencies

If a challenge depends on a challenge that does not exist, it causes a nil dereference and WTFd crashes

Admin tool to show wrong flags

It would be nice to have an overview of the wrong solutions people come up with. If a wrong flag appears multiple times, it could be a sign, that a challenge is misleading and further information should be added.

Scrollbar abschalten

Die Scrollbar wird nicht benötigt, sie kann daher abgeschaltet werden.

make readme great

a better readme with images, config eamples and more would be great

Bug reporter

Ein Bug-Symbol im challenge-info dialog, mit dem man Fehler zur Challenge melden kann.

Use Redis for Cookie storage

split styling from application

and remove the foss-ag skin

First blood

It would be nice to see who solved a challenge first.

Major Refactoring

Steps for refactoring:

• Document API #33
• Start server side project from scratch
  • Split the server into multiple packages
    • internal/api API
    • internal/http HTTP
    • internal/db Database Stuff
    • internal/smtp Email stuff
    • internal/config Config loading (optionally with multiple ways of defining configs)
    • internal/ws Websocket stuff for leaderboard and more
  • Implement the new API
• Develop new functions against a REST-Testing framework e.g. go-http-test

RFC

Add more features for starting the competition

There should be an option to decide how much of the challenges is to be seen before the competition starts

A timer for when the competition starts would be good too

CI

Now that we moved to github we need a new CI

split api into it's own package (internal/api)

Challenge category tabs

Remove leaderbord entry for "user created"

We should not store dataponts for when users are created, because that leads to there being a huge blank space on the diagram from when the first users are created before the event to the actual data while it is running.

The "Recommended Solution" area is not in part of the scrollable section

Enable setting a start date for the Competition

that start date could also be the first date of the graph, ...

related #61

Docker Image

A docker Image would be nice

implement api.yml