This is a scoring server built using Ruby on Rails by the Military Cyber Professionals Association (MCPA). It is free to use and extend under the MIT license (see LICENSE file). The goal of this project is to provide a standard generic scoring server that provides an easy way to add and modify problems and track statistics of a Cyber Capture the Flag event. While it's not recommended, this server can be hosted with your challenges but we do recommend sand-boxing your challenges so they do not affect the scoring server.
Want to see it in action? Live Demo hosted here!
What's different about HackTheArch?
We created this application after using the PicoCTF platform for our annual CTF. It was okay, but we found it lacking some features that we wanted. We wanted a way to be able to offer competitors hints for a cost, and we also wanted a way to create and modify problems from a web interface. We looked around and didn't see any others that met our requirements. CTFd: no web admin interface for creating challenges. Root The Box: We didn't like all the extra stuff with the bank accounts and it just seemed too complex for our needs. So we decided to roll our own scoring server and now you can benefit from our hard work! This application implements an optional dynamic hint system which will deduct points for requesting hints and also implements a web interface for creating and modifying hints and challenges. We hope you enjoy this application and are open to feedback so let us know what you like, hate, would like to see added, etc...
- Ruby version 2.3.1p112
- Activation and password reset e-mails depend on Heroku SendGrid add-on configuration (this feature can be optionally disabled or easily modified to be used with other mailers)
- To store challenge pictures in the production environment, you'll need to modify 'config/initializers/carrier_wave.rb' to work with your cloud storage solution
- See Gemfile for further requirements
- For the latest stable release either download the latest tagged release here, or checkout the 'master' branch. For the latest features and a less-stable version, checkout the 'dev' branch.
This app is presently designed to be deployed in a heroku environment. We highly recommend this configuration. A few things must be configured to deploy to Heroku:
- Create a
HOSTenvironment variable that contains the url for your app (e.g., HOST=hackthearch.herokuapp.com).
- For mailer support, add the sendgrid addon before deploying (
heroku addons:create sendgrid:starter). More info on Sendgrid here.
- For live streaming (submissions, chat, etc...), add the Redis To Go addon.
- Create a
It can be deployed outside a heroku environment but will require some alternative for sending account activation e-mails (or alternatively activation e-mails can be disabled in the admin console)
- To initialize the database, run:
bundle exec rake db:seed. After initialization, the admin login credentials will be: [email protected] : password
- Important: It is highly advised that you change the admin credentials post-deployment
- For other deployment options, keep reading.
- A Dockerfile is included along with a docker-compose.yml for deploying a containerized version of HackTheArch. More detailed instructions can be found in: DOCKER_README.md.
wiki.More configuration details on our project
Contribute and Contact
Want to help?
- Want to add a new feature or fix a bug? Check out a branch and submit working code with tests via pull request to merge into the 'dev' branch.
- Check out the slack channel for more.
- Test coverage would be a good place to start: here
- Base code derived from the Rails Tutorial by Michael Hartl