{"id":26784714,"url":"https://github.com/theflash2k/ctfd-flag-validator","last_synced_at":"2025-03-29T10:29:25.783Z","repository":{"id":204793792,"uuid":"712665357","full_name":"TheFlash2k/CTFd-Flag-Validator","owner":"TheFlash2k","description":"A Simple CTFd Plugin that will act as a flag generator and validator","archived":false,"fork":false,"pushed_at":"2023-11-23T18:14:40.000Z","size":32,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2023-11-24T18:41:53.813Z","etag":null,"topics":["ctfd","ctfd-plugin"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/TheFlash2k.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null}},"created_at":"2023-10-31T23:50:13.000Z","updated_at":"2023-11-24T18:41:53.814Z","dependencies_parsed_at":"2023-11-23T18:39:07.048Z","dependency_job_id":"e02a716f-f13d-46f6-8fe5-61f5be3685b8","html_url":"https://github.com/TheFlash2k/CTFd-Flag-Validator","commit_stats":null,"previous_names":["theflash2k/ctfd-flag-validator"],"tags_count":0,"template":null,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/TheFlash2k%2FCTFd-Flag-Validator","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/TheFlash2k%2FCTFd-Flag-Validator/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/TheFlash2k%2FCTFd-Flag-Validator/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/TheFlash2k%2FCTFd-Flag-Validator/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/TheFlash2k","download_url":"https://codeload.github.com/TheFlash2k/CTFd-Flag-Validator/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":246171926,"owners_count":20735092,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ctfd","ctfd-plugin"],"created_at":"2025-03-29T10:29:25.249Z","updated_at":"2025-03-29T10:29:25.759Z","avatar_url":"https://github.com/TheFlash2k.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# CTFd-Flag-Validator\nA Simple CTFd Plugin (not really a plugin) that will act as a flag generator and validator\n\n\u003e **NOTE**: This only works with challenges that have a RegEx-based Flag and works only on TEAM Mode (along with the [**containers**](https://github.com/theflash2k/containers) plugin)\n\nThe working of this is as follows:\n\n- Creating an API using FastAPI and exposes two endpoints:\n  - `/flag` - This API takes two query parameters:\n    - `team_id`\n    - `chal_id`\n          \n    And generates a FLAG based on these parameters.\n  - `/check`\n    - Runs a check against the submitted flags and those in the database to check for duplicates.\n    - Also checks if someone without generating a flag, submitted it.\n\u003e Each team will have a single flag for a single challenge and that flag will be stored locally in `flags.db` file.\n\n---\n\n## Covered Scenarios\n\n- [x] Team-A generates a flag, Team-B submits it before Team-A `(Both teams will be banned)`\n- [x] Team-B generated a flag, Team-A submits it, Team-B doesn't submit `(Both teams will be banned) [Each team will have 1 flag generated per challenge, and that won't change no matter how many new instances are spawned]`\n- [x] Team-A somehow guesses the Regex and generates a flag and submits it `(Team-A will be banned for brute-forcing and not solving as intended)`\n- [x] Team-A and Team-B banned for using Team-A's flag. Team-C submit's Team-A's flag `(Team-C will be banned)`\n\n---\n\n## Environment Variables\n\n- `CTFD_ADMIN_TOKEN`    - The CTFd API Administrator Token\n- `CTFD_INSTANCE`       - The URL for the CTFd Instance\n- `DISCORD_WEBHOOK_URL` - **[OPTIONAL]** - The Webhook URL to post your Ban notifications on Discord (by default, Notifications are posted on CTFd as well.)\n- `API_HOST`            - **[DEFAULT: *0.0.0.0*]** - The host on which the API will listen on\n- `API_PORT`            - **[DEFAULT: *9125*]** - The port on which API will listen on\n- `VERIFICATION_DELAY`  - **[DEFAULT: *1*]** - The delay (in minutes), after which request to `/check` will be made.\n- `DB_NAME`             - **[DEFAULT: *flags.db*]** - The local database name in which flags and their detail will be stored\n\n---\n\n## Integration with CTFd docker-compose:\n\nIn order to integrate this with your CTFd `docker-compose`, just copy the following config into your CTFd's docker-compose:\n\n```yaml\n  flagvalidator:\n    build: . # Change this to the folder you have the source code + Dockerfile in.\n    ports:\n      - \"172.17.0.1:9512:9512\"\n    environment:\n      - CTFD_ADMIN_TOKEN=\n      - CTFD_INSTANCE=\n      - DISCORD_WEBHOOK_URL=\"\"\n      - API_HOST=\"0.0.0.0\"\n      - API_PORT=9512\n      - VERIFICATION_DELAY=1\n      - DB_NAME=\"flags.db\"\n    volumes:\n      - .:/app/\n    restart: always\n```\n\n\u003e Make sure that you paste this under the `services` key inside the `docker-compose.yml`.\n\n---\n\n## Setting up the plugin\n\nIn order to set this up, we need to run this inside docker. Both Dockerfile and docker-compose.yml have been provided to make it easier. The `flags.db` will be generated at run time and the current folder will be mounted inside the docker container.\n\n\u003e NOTE: If you're running a local `CTFd` deployment, make sure to modify the variables inside your docker-entrypoint scripts accordingly.\n\n---\n\n## Setting up a challenge:\n\nLet's suppose we have a challenge called `test_chal`, and we want to add a dynamic flag. The YAML config file is:\n\n```yaml\nname: \"test_chal\"\nauthor: \"TheFlash2k\"\ncategory: Test\ndescription: Some Descriptive Description\nvalue: 100\ntype: container\n\nextra:\n    initial: 100\n    decay: 1\n    minimum: 100\n    image: test_chal:latest\n    port: 8000\n    command: \"\"\n    volumes: \"\"\nbuild: ./src/\nflags:\n    - {\n        type: \"regex\",\n        content: \"CY243L{s4mpl3_fl4g_r3geX_[0-9a-zA-Z]{9}[1-9a-zA-Z]{9}[5-9a-eR-Z]{8}\",\n        data: \"case_insensitive\",\n    }\nstate: visible\nversion: \"0.1\"\n```\n\nNow, inside the `src/` folder, a Dockerfile can be as follows:\n\n```Dockerfile\nFROM php:7.0-apache\n\nENV BASE_DIR=\"/var/www/html\"\nCOPY ./src/ $BASE_DIR/\nCOPY ./docker-entrypoint.sh /\nRUN echo \"ServerName localhost\" \u003e\u003e \"/etc/apache2/apache2.conf\"\nENTRYPOINT [ \"/docker-entrypoint.sh\" ]\n```\n\nNow, inside the `docker-entrypoint.sh`, we need to fetch the flag from `http://172.17.0.1:9152` (or whatever your API_PORT is)\n\u003e NOTE: The IP is of `docker0` interface on your system\n\n\u003e Quick Fact: Using the `containers` plugin which I've forked, I set `CHALLENGE_ID` and `TEAM_ID` as environment variable on each container being deployed, therefore, the script uses these:\n\n```bash\nservice=http://172.17.0.1:9512\nflag=$(curl -s $service/flag\\?chal_id\\=$CHALLENGE_ID\\\u0026team_id\\=$TEAM_ID)\n# We now have the flag in $flag and can do whatever we want:\necho $flag \u003e /var/www/html/flag.txt\n```\n\nSimilarly, for your own containers, you will have to write a similar `docker-entrypoint.sh` and set that as your entrypoint to cater for dynamic flaging. The rest will be managed by this plugin.\n\n## Screenshots\n\n- On the CTFd Web Page\n![image](https://github.com/TheFlash2k/CTFd-Flag-Validator/assets/19727349/76e8d3f5-9fb2-4971-a082-fab1f71bb320)\n\n- Logs being generated\n![image](https://github.com/TheFlash2k/CTFd-Flag-Validator/assets/19727349/cac17bee-e843-44e8-9857-9360b34bb103)\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftheflash2k%2Fctfd-flag-validator","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ftheflash2k%2Fctfd-flag-validator","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftheflash2k%2Fctfd-flag-validator/lists"}