ogp-ctf-2024 - 用于培训开发人员寻找漏洞的网络CTF

项目说明

OGP CTF 2024

A web CTF built to train de in secure coding while having fun! This was built completely on + NextJS, CTFd, and Cloudflare Access to protect boxes. Blogpost incoming!

Challenges

| Category | Points | Title | Box | Challenge |
|----------|--------|-------------------|---------------------|------------------------------------------------------------------------------------------------------------|
| Easy | 100 | hello world | hello-world | Welcome to your OPENING challenge! Try to get the flag... |
| Easy | 100 | access denied | access-denied | Seems like a simple API but I can't get the admin's flag! |
| Easy | 100 | prompt reply | smart-home | Wow, this smart home can fetch the weather! I wonder whether it needs a special key... |
| Easy | 100 | cross word | cross-word | A preview generation feature! Try to trigger getFlag()! |
| Easy | 100 | open sesame | open-sesame | I don't have the password to this, but maybe I can try something else? Credits |
| Easy | 100 | case closed | case-closed | Oof, this is a protected route. How can I get around it? (source code provided) |
| Easy | 100 | one time password | one-time-password | Wow, that's a really weak OTP! |
| Medium | 150 | chat bot | chat-bot | This AI chat bot is hiding a secret! |
| Medium | 150 | orm nom nom | orm-nom-nom | This only allows a certain user to get the real flag! How can I bypass this filter? (source code provided) |
| Medium | 150 | mask mandate | mask-mandate | Is it that hard to crack an NRIC? |
| Medium | 150 | camera path | smart-home | Cool, there's a camera photo feature! But something looks wrong... |
| Hard | 200 | ser | smart-home | This smart home fetches live data! |
| Hard | 200 | two time password | two-time-password | This generates an uncrackable OTP now! Or is it? (source code provided) |

Explanation

| Category | Points | Title | Box | Explanation |
|----------|--------|-------------------|---------------------|----------------------------------------------------------------------------------------------------------------------------------------------------|
| Easy | 100 | hello world | hello-world | A simple open redirect . |
| Easy | 100 | access denied | access-denied | A simple nested Insecure Direct Object Reference . |
| Easy | 100 | prompt reply | smart-home | Prompt injection demonstrating that LLMs cannot keep a secret without hard filters. |
| Easy | 100 | cross word | cross-word | A simple cross-site scripting . |
| Easy | 100 | open sesame | open-sesame | A simple SQL injection . |
| Easy | 100 | case closed | case-closed | This highlights a lesser-known weakness in NextJS inconsistent use of case-sensiti, especially when setting protected routes. |
| Easy | 100 | one time password | one-time-password | A simple brute-forceable weak OTP. |
| Medium | 150 | chat bot | chat-bot | A hardened LLM chat bot against leaking secrets, but still fallible. |
| Medium | 150 | orm nom nom | orm-nom-nom | This highlights a lesser-known weakness in Prisma ORM that allows % or _ wildcards when using filters. |
| Medium | 150 | mask mandate | mask-mandate | When the birth year and a masked NRIC as per guidelines is known, there are only about 10 possible combinations which makes it very easy to crack. |
| Medium | 150 | camera path | smart-home | A path tra in file read, obscured by a base64 background image format, and OpenAI o1's built-in security filters. |
| Hard | 200 | ser | smart-home | A ser request forgery caused by path concatenation, and OpenAI o1's built-in security filters. |
| Hard | 200 | two time password | two-time-password | Use of Math.random() for generating OTPs is inherently crackable. |

项目信息

开发语言：TypeScript

Star 数：103

技术要点

该项目属于CTF思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A web CTF for training developers in bug hunting and secure coding!展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。