beast - Jeopardy-style CTF challenge deployment and manage

项目说明

<p align="center">
<img src="./docs/res/beast-logo.png" alt="Beast Logo">
</p>

<h3 align="center">Jeopardy-style CTF challenge deployment and management tool.</h3>

<p align="center">
<a href="
<img src=" alt="Netlify Status" />
</a>
<a href="
<img src=" alt="Build Status" />
</a>
<a href="
<img src=" alt="Apache License" />
</a>
</p>

Contents

O

Beast is a service that runs on your host(maybe a bare metal server or a cloud instance) and helps manage deployment, lifecycle, and health check of CTF challenges. It can also be used to host Jeopardy-style CTF competition.

Visit beast.sdslabs.co for the more details and documentation

If you're looking for the source code of playCTF, the frontend powered by Beast, visit

Features

For more details on the features, refer to Features

Supported Challenges

As of now beast support the following type of challenges:

Download

Assuming you have the docker installed, head over to Beast's releases page and grab the latest binary and setup.sh script.

Run the setup.sh script once. It will setup the required folders and configuration files for you.

Run the downloaded binary with

Tech Stack

Beast is written completely in Golang and comes with a clean REST API interface to trigger actions or interact with underlying functionalities.
The REST API server is implemented using gin go library and uses JWT as an authentication mechanism. Being written in go, Beast is compiled into
a single binary which can run on any linux distribution.

Beast uses Docker as a container runtimes to run challenges in a sandboxed en. Note that container does not provide a very strong isolation, but our host is safe as long as there is no 0-day in linux kernel itself. E container provide a security layer for the challenges, we follow some practices to harden those security measures.

We use Swagger for automatic generation of API documentation and you can find the docs at /api/docs/index.html from beast server root.

To save the state of the deployments and challenges beast uses SQLite as a database, all the information ranging from challenge deployment state to allocated ports and author information is stored in this database. This database is created automatically in the root of your beast configuration directory.

De

Beast go is under de; follow the below instructions to get started.

All the dependencies are already with the project, so no need to install any dependencies. The project uses go modules from go 1.18.X of dependency management. Make sure you any library used using go mod

Building

To build Beast from Source use the Makefile provided.

This will build Beast and place the binary in $GOPATH/bin/ and copy the necessery tools to the desired place. To build this in production make sure you also ha the static-content docker image in /extras/static-content

To run the API server for Beast, use the command beast run -v

Hot reloading support

Testing

To test use the sample challenges in the _examples directory. Use the challenge simple and try to deploy it using
Beast. Follow the below instructions.

You can find swagger API documentation here:

Building documentation

The documentation for the project lies in /docs. We use mkdocs to automatically generate documentation from markdown. The configuration file for the same can be found at mkdocs.yml. To view the documentation locally, create a en locally and install requirements.

Contributing

We are always open for contributions. If you find any feature missing, or just want to report a bug, feel free to open an issue and/or submit a pull request regarding the same.

For more information on contribution, check out our
docs.

Contact

If you have a query regarding the product or just want to say hello then feel
free to visit chat.sdslabs.co or drop a mail at

---

Made with :heart: by SDSLabs

项目信息

开发语言：Go

Star 数：80

技术要点

该项目属于CTF思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Jeopardy-style CTF challenge deployment and management tool.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。