echoCTF.RED - 开发、运行和管理CTF COMP的平台

项目说明

!echoCTF RED logo

![ci-tests]()
![Dependabot Updates]()
![Documentation Status]()

echoCTF is a pioneer computer security framework, de by
Echothrust Solutions, for running CyberSecurity exercises and competitions such
as Capture the Flag.

echoCTF allows building and running capture the flag competitions for network
penetration testing and security auditing on real IT infrastructure. It is
also used for security awareness and training purposes, by businesses and
educational institutes.

What is echoCTF.RED

echoCTF.RED _{(codename Mycenae),} is the first iteration of our online
long running CTF service, based on the applications from this repository.

It is a free online service that offers a controlled en, based on
real-life systems and services, to train and sharpen your offensive and
defensi skills. Scan, brute-force and do whatever it takes to
attack the systems and solve the real-life security scenarios to gain points.

For more information about our competitions visit or if
you'd rather see a li of our platform feel free to visit

Our main goals for echoCTF include:

* Completeness - Provide a complete set of tools and applications to develop, deploy and maintain cyber-security and Capture the Flag (CTF) competitions
* Modularity - Each component has a unique and clear role
* Expandability - echoCTF's components are designed to permit expansion

Quick start

The following instructions will get you up and running for de and testing. The Docker compose method do not include many of the automatic firewalling features that the non-container systems have and as such its not intended for production use.

_NOTE_: The following ports will be binded localy 1194/udp, 8080/tcp, 8082/tcp, 3306/tcp, 11211/tcp. If any of these ports are already in use the applications will fail to start.

Please note that the docker images are intended for de and testing use only. For production en we suggest to use the provided playbooks (under ansible/runonce) to setup the systems.

For more details check the echoCTF.RED :notebook_with_decorati:

Screenshots :eyes::candy:

<table>
<tr>
<td>
<center>
<img title="Admin page target update form" src="docs/screenshots/target-update-form.png" width="400px" />
Admin page target update
</center>
</td>
<td><center>
<img title="Guest user target view" src="docs/screenshots/target-guest-view.png" width="400px" /> Guest player target view</center>
</td>
<td><center>
<img title="Admin page target statistics" src="docs/screenshots/target-a.png" width="400px" />
Admin page target solving stats</center>
</td>
</tr>
<tr>
<td colspan="2"><img src=" title="Detailed view of Target Network" /></td>
<td><img src="docs/screenshots/networks-listing.png" title="Target Networks listing" /></td>
</tr>
</table>

Features

The list of features supported by the platform is really massive, the most
interesting are as following:

* System settings
* Configurable Event name
* Configurable Acti
* Configurable timezone
* Configurable event start / end dates
* Configurable registration opening / closing dates
* Leaderboard settings
* Independent Player and Team leaderboards
* Configurable before and after event start/end
* Support to show/hide 0 point players
* Team settings
* Configurable teams support
* Configurable mandatory teams flag
* Configurable team management
* Configurable number of maximum team members
* Configurable team instances
* Player and Registration settings
* Configurable acti required
* Support for global enable/disable registrations
* Configurable player profiles
* Configurable player avatar approval
* Configurable player profile
* Configurable default player homepage
* Configurable settings and memory key expiration timeout
* Configurable global and indi player number of restarts
* Twitter settings
* Configurable tagging accounts (via)
* Configurable automatic hashtags
* Quick share links on every event on frontend
* Support for configurable Targets and Challenges
* Target support for start/stop/logs/exec/healthchecks
* Unlimited flags per targets & challenges
* Configurable unique flags per players and teams
* Dynamic target networks
* Dynamic target en
* Dynamic target
* Support for public and private networks
* Support for ondemand start of targets
* Target documentation and metadata
* Multiple question/flag challenges
* Dynamic hints
* Configurable tracking of solving times for challenges and targets
* Support for target and challenge logos
* Support for player rating of targets & challenges
* Support for player contributed writeups
* Detailed activity streams
* Player o activity
* Player activity
* All platform activity
* Team based activity
* Network activity tracking and
* REST support
* Docker API support
* Help/Rules/FAQ/Instructions/Objecti
* URLs Management add/edit/delete/disable
* Separate player and admin interfaces and authentication databases
* Configurable SSL certificate details
* Dynamic CSS and ja o (css, js, per player, per url)
* Twitter & Linkedin support for publishing achie
* Support for static pages
* Li to the player(s)
* Stand-alone applications for activity streaming
* Bots for discord and twitter announcements
* websocket leaderboards
* websocket activity stream
* real time network through logstalgia and gource
* dynamic post claim flag actions
* Ad player and general moderation features
* Ban MX servers from registering
* Disable per player URLs
* Ban player username/email patterns
* Integrated OpenBSD (PF) firewall features
* Support for online subscriptions (Stripe integration)
* Detailed auditing of flags and network activity

NOTE: Dynamic firewall support and network tracking of players is not support on the docker-compose .

Disclaimer

The documents and guides in this repository are only examples and are not meant
to be used to setup production en.

Special care should be taken with securing access to your setups. The application
is designed to fit into our own setup process which takes care of these details for us.

Apply common logic when copy pasting commands and files :)

echoCTF is software that comes with absolutely no warranties whatsoever. By
using echoCTF, you take full responsibility for any and all outcomes that
result.

Keep in mind that the system comes up with absolutely no data. This means
that it is up to you to create targets, challenges, rules, instructions and
any other details you require.

项目信息

开发语言：PHP

Star 数：151

技术要点

该项目属于CTF思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A platform to develop, run and administer CTF competitions. This is the online echoCTF.RED platform source code展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。