mitre-cyber-academy / ctf-scoreboard-archive Goto Github PK

Repository for the Deprecated MITRE Capture the Flag scoreboard.

License: Apache License 2.0

Ruby 70.89% JavaScript 0.36% CoffeeScript 1.10% CSS 2.29% HTML 25.36%

ctf-scoreboard scoreboard ruby rails mitre ctf-platform ctf-framework

ctf-scoreboard-archive's Introduction

This Scoreboard is Deprecated

This scoreboard is no longer maintained and any Pull Requests will be ignored. Please checkout ctf-scoreboard for our maintained version of this scoreboard.

CTF-Scoreboard

What is this?

This repository is for the scoreboard used to run MITRE capture the flag competitions. For the registratration app see this repository.

How to Run Locally

Install ruby.
In your terminal run gem install bundle
Run bundle install
Install postgres to your system (and create a role with your system username)
Run bundle exec rake db:create
Run bundle exec rake db:schema:load
Run bundle exec rake db:seed
Run bundle exec rails s
Open the webpage shown in your terminal from the last command in your browser.
Login to the scoreboard as email: root, password: ChangePa$$w0rd and change the password.

How to Run with Docker

Install docker and docker-compose for your platform
Clone this project to your local system
Create a .env_vars file in the root containing the contents SECRET_KEY_BASE=<put your secret key here!>
From this directory on your system run docker-compose up -d
Run docker-compose run web rake db:create
Run docker-compose run web rake db:schema:load
Run docker-compose run web rake db:seed
The scoreboard should now be running at http://<your-ip>:3000
Login to the scoreboard as email: root, password: ChangePa$$w0rd and change the password.

How do I contribute?

Fork the repository on github
Run git clone [address]
Make your edits
View your edits
Run the git add and commit commands. Please make sure your commit messages are descriptive.
Run git push origin master
Submit a pull request

ctf-scoreboard-archive's People

Contributors

Stargazers

Watchers

Forkers

fmagazu frohoff bryansingh afrioni swtruffle gitcollect jkuofm27 ctf-dashbrdz attackgithub ethicalsecurity-agency

ctf-scoreboard-archive's Issues

Optimize score calculation methods

There is currently a ridiculous amount of time wasted in calculating the user ordering in filter_and_sort_players in the division model and most likely the score function in the player model (it takes nearly a second for these to process on every request and it is called on nearly every page which is slowing down the whole application). These should be rewritten to use SQL queries directly by doing a left join on the data and summing all directly in SQL. It is not very rails like but it will save a huge amount of time.

Will probably need to use rails .joins method with a left join for this, and then use the order method somehow.

Optimize Challenge board page

Currently the slowest page in the application is the challenge board, optimizing the number of queries made from this page would help performance significantly.

Scoreboard should not error when divisions are blank

It should just show a message stating there are no divisions. As of right now it throws a 500 error.

Adding a new player the “set password” field is marked as “Optional.”, but it isn’t actually optional.

Title

No option for pulling importing data to rails admin

Currently there is no easy way to export the data from one scoreboard instance and import it into another. If we are going to continue spinning up 2 different scoreboards for college and hs students then this needs to be added.

Probably something like https://github.com/stephskardal/rails_admin_import will work nicely for this.

Add option for multiple divisions in the same game

Allowing for us to have a high school division and a college division on the same scoreboard.

For this we will most likely need to add a Opened Challenges model for tracking which challenges are opened for each division and then have 2 different lists of top 5 teams. Might need to have a dropdown on the teams lists to make it easier to see the top teams for each division.

[Bug] Markups escaped in the admin dashboard

On the admin dashboard:

There is a visual bug:

The game will stop accepting submissions <strong><span id="major-tom"></span> on May 8 17, 12:11 EDT </strong>.

Markups are escaped.

Downloading VPN certificate for a team does not work for admins

Currently the administrators can see the download link however when they click it they get the cryptic "something went wrong" message. Message is:

NoMethodError (undefined method 'key_file_name' for #<Admin:0x007f7e74f56618>):

Submitted flags are not deleted when a team is deleted

Submitted flags belong to a player but players don't have_many submitted flags. This relations needs to be added along with a dependent delete_all.

NoMethodError in Users#show

When signed in as n00bs and click on the team name the following error occurs when viewing own profile and other team profile:

ctf-scoreboard/app/views/users/show.html.haml
undefined method `[]' for nil:NilClass

The line highlighted;

If you need help please connect to our IRC channel at #{@game.irc}

Are there any "users" created in the test db?
Does not happen when logged in as the other team and view n00b profile, but it does happen when viewing own profile.

Look into brightbox for easier nginx and passenger deployment.

Migrated from Trello

All of our metrics do not work.

geo
flags/min
currently logged in

Reevaluate what metrics we even want and then make those work. Remove the rest.

Address eCTF student feedback

The flags/min feed that is shown doesn’t really make much sense
On the challenges list, it’d be nice to show the challenge name rather than just the point value
Also on the challenges list, the color-coding is a bit confusing and hard to notice

Topics

You may want to add those topics:

ctf-platform
ctf-framework

to better reachability of this repository.

Seed terms of service in the database

Seed the database with some default terms of service that at least contains rules and information about the scoreboard.

[Request] Regex flag support

For now flags are strings, but it could be great to support regex flags to allow range of answers or multiple flags (more than just case sensitive or not).

Force_close does not work

When a game is closed & logged in as admin, both force_closed and closed do not show a challenge as red

Browsing to /messages while not logged in throws an error

Title

Starting state is a little confusing

I'm the person who implemented it and yet I just got confused by it, so it has to make almost zero sense to anyone else using the scoreboard. It needs some description text that says something along the lines of "This only applies to newly created divisions, and does not update the current state of existing divisions."

Deleting a division does not delete the users with it.

This is a little annoying, I don't think we'll be mass deleting divisions by mistake. It is probably safe to just add dependent => destroy for the players of a division.

Ruby version

Why the gemfile specially require ruby '2.3.1', ruby 2.3.3 or ruby 2.4.0 won't work?

Can it be replaced by ruby '>= 2.3.1'?

ActiveRecord::RecordNotFound

I did these steps in this order:

Install ruby.
In your terminal run gem install bundle
Run bundle install
Install postgres to your system (with a role that have the name of my user)
Run 'bundle exec rake db:create'
Run 'bundle exec rake db:schema:load'
Run bundle exec rails s
Open the webpage shown in your terminal from the last command in your browser.

And opening the browser I have an error: ActiveRecord::RecordNotFound in GamesController#show.

Extracted source (around line #29):

27  def load_game
28    @game = Game.instance
29    raise ActiveRecord::RecordNotFound unless @game
30    unless current_user.nil?
31      now = Time.zone.now
32      if now < @game.start

Full trace:

app/controllers/application_controller.rb:29:in `load_game'
activesupport (4.2.7.1) lib/active_support/callbacks.rb:432:in `block in make_lambda'
activesupport (4.2.7.1) lib/active_support/callbacks.rb:164:in `block in halting'
activesupport (4.2.7.1) lib/active_support/callbacks.rb:504:in `block in call'
activesupport (4.2.7.1) lib/active_support/callbacks.rb:504:in `each'
activesupport (4.2.7.1) lib/active_support/callbacks.rb:504:in `call'
activesupport (4.2.7.1) lib/active_support/callbacks.rb:92:in `__run_callbacks__'
activesupport (4.2.7.1) lib/active_support/callbacks.rb:778:in `_run_process_action_callbacks'
activesupport (4.2.7.1) lib/active_support/callbacks.rb:81:in `run_callbacks'
actionpack (4.2.7.1) lib/abstract_controller/callbacks.rb:19:in `process_action'
actionpack (4.2.7.1) lib/action_controller/metal/rescue.rb:29:in `process_action'
actionpack (4.2.7.1) lib/action_controller/metal/instrumentation.rb:32:in `block in process_action'
activesupport (4.2.7.1) lib/active_support/notifications.rb:164:in `block in instrument'
activesupport (4.2.7.1) lib/active_support/notifications/instrumenter.rb:20:in `instrument'
activesupport (4.2.7.1) lib/active_support/notifications.rb:164:in `instrument'
actionpack (4.2.7.1) lib/action_controller/metal/instrumentation.rb:30:in `process_action'
actionpack (4.2.7.1) lib/action_controller/metal/params_wrapper.rb:250:in `process_action'
activerecord (4.2.7.1) lib/active_record/railties/controller_runtime.rb:18:in `process_action'
actionpack (4.2.7.1) lib/abstract_controller/base.rb:137:in `process'
actionview (4.2.7.1) lib/action_view/rendering.rb:30:in `process'
actionpack (4.2.7.1) lib/action_controller/metal.rb:196:in `dispatch'
actionpack (4.2.7.1) lib/action_controller/metal/rack_delegation.rb:13:in `dispatch'
actionpack (4.2.7.1) lib/action_controller/metal.rb:237:in `block in action'
actionpack (4.2.7.1) lib/action_dispatch/routing/route_set.rb:74:in `dispatch'
actionpack (4.2.7.1) lib/action_dispatch/routing/route_set.rb:43:in `serve'
actionpack (4.2.7.1) lib/action_dispatch/journey/router.rb:43:in `block in serve'
actionpack (4.2.7.1) lib/action_dispatch/journey/router.rb:30:in `each'
actionpack (4.2.7.1) lib/action_dispatch/journey/router.rb:30:in `serve'
actionpack (4.2.7.1) lib/action_dispatch/routing/route_set.rb:817:in `call'
rack-pjax (0.8.0) lib/rack/pjax.rb:12:in `call'
bullet (5.2.1) lib/bullet/rack.rb:12:in `call'
warden (1.2.6) lib/warden/manager.rb:35:in `block in call'
warden (1.2.6) lib/warden/manager.rb:34:in `catch'
warden (1.2.6) lib/warden/manager.rb:34:in `call'
rack (1.6.4) lib/rack/etag.rb:24:in `call'
rack (1.6.4) lib/rack/conditionalget.rb:25:in `call'
rack (1.6.4) lib/rack/head.rb:13:in `call'
remotipart (1.2.1) lib/remotipart/middleware.rb:27:in `call'
actionpack (4.2.7.1) lib/action_dispatch/middleware/params_parser.rb:27:in `call'
actionpack (4.2.7.1) lib/action_dispatch/middleware/flash.rb:260:in `call'
rack (1.6.4) lib/rack/session/abstract/id.rb:225:in `context'
rack (1.6.4) lib/rack/session/abstract/id.rb:220:in `call'
actionpack (4.2.7.1) lib/action_dispatch/middleware/cookies.rb:560:in `call'
activerecord (4.2.7.1) lib/active_record/query_cache.rb:36:in `call'
activerecord (4.2.7.1) lib/active_record/connection_adapters/abstract/connection_pool.rb:653:in `call'
actionpack (4.2.7.1) lib/action_dispatch/middleware/callbacks.rb:29:in `block in call'
activesupport (4.2.7.1) lib/active_support/callbacks.rb:88:in `__run_callbacks__'
activesupport (4.2.7.1) lib/active_support/callbacks.rb:778:in `_run_call_callbacks'
activesupport (4.2.7.1) lib/active_support/callbacks.rb:81:in `run_callbacks'
actionpack (4.2.7.1) lib/action_dispatch/middleware/callbacks.rb:27:in `call'
actionpack (4.2.7.1) lib/action_dispatch/middleware/reloader.rb:73:in `call'
actionpack (4.2.7.1) lib/action_dispatch/middleware/remote_ip.rb:78:in `call'
actionpack (4.2.7.1) lib/action_dispatch/middleware/debug_exceptions.rb:17:in `call'
actionpack (4.2.7.1) lib/action_dispatch/middleware/show_exceptions.rb:30:in `call'
railties (4.2.7.1) lib/rails/rack/logger.rb:38:in `call_app'
railties (4.2.7.1) lib/rails/rack/logger.rb:20:in `block in call'
activesupport (4.2.7.1) lib/active_support/tagged_logging.rb:68:in `block in tagged'
activesupport (4.2.7.1) lib/active_support/tagged_logging.rb:26:in `tagged'
activesupport (4.2.7.1) lib/active_support/tagged_logging.rb:68:in `tagged'
railties (4.2.7.1) lib/rails/rack/logger.rb:20:in `call'
actionpack (4.2.7.1) lib/action_dispatch/middleware/request_id.rb:21:in `call'
rack (1.6.4) lib/rack/methodoverride.rb:22:in `call'
rack (1.6.4) lib/rack/runtime.rb:18:in `call'
activesupport (4.2.7.1) lib/active_support/cache/strategy/local_cache_middleware.rb:28:in `call'
rack (1.6.4) lib/rack/lock.rb:17:in `call'
actionpack (4.2.7.1) lib/action_dispatch/middleware/static.rb:120:in `call'
rack (1.6.4) lib/rack/sendfile.rb:113:in `call'
railties (4.2.7.1) lib/rails/engine.rb:518:in `call'
railties (4.2.7.1) lib/rails/application.rb:165:in `call'
rack (1.6.4) lib/rack/lock.rb:17:in `call'
rack (1.6.4) lib/rack/content_length.rb:15:in `call'
rack (1.6.4) lib/rack/handler/webrick.rb:88:in `service'
/home/noraj/.rvm/rubies/ruby-2.3.1/lib/ruby/2.3.0/webrick/httpserver.rb:140:in `service'
/home/noraj/.rvm/rubies/ruby-2.3.1/lib/ruby/2.3.0/webrick/httpserver.rb:96:in `run'
/home/noraj/.rvm/rubies/ruby-2.3.1/lib/ruby/2.3.0/webrick/server.rb:296:in `block in start_thread'

Logout does not work from admin console

Currently attempting to logout from rails admin throws an error for admins. Can still log out from the regular application page.

Create functional and integration tests for the scoreboard

At this point the scoreboard has grown to a point where there's a lot of things we should be testing when we make changes. A test suite would be a nice addition along with Travis CI integration.

HTML Format error

[Question] Contact

What is the best place to talk with you about this CTF platform?

I see that the MITRE cyber academy mail is [email protected] but this is may be not teh best place to talk.

Have you a public IRC channel, slack or gitter chat or whatever? Because actually the only way to talk to you is through the MITRE mail or issue.