FYP 17059

Han Yu

Supervisor: Dr. S. M. Yiu

A CTF Platform for Cybersecurity Training in HKU

Comparison of CTFd and FBctf
1. Registration control:

They both provide options for free registration or reserving the rights for administrators to manually register new teams. In addition, FBctf also can approve new teams by registration tokens sent by administrators. CTFd discloses come of the functionalities, including certain pages, challenges, to anonymous users while FBctf only serves registered users.

2. Game control:

Both FBctf and CTFd keep the records of the game start and end time, but only FBctf includes timer in game panel and can hold events in competitive way. During the game, FBctf supports in time announcements and game pause or termination. On the other hand, CTFd is more suitable for a training platform as it sets no time limit for solving challenges and provide a interface while clearly divide challenges into different challenges.

3. Database refresh and game storage

Both FBctf and CTFd support game import and export. The content could be full game or particular part of settings, such as team logos and challenges. Each time administrators make challenges to CTFd, it will be automatically saved with the account and when come back to CTFd, these changes will remain. However, changes made to FBctf will lose after restart of the server and recompilation of the source code. So it is necessary for administrators to import necessary part of the game before exit and import it again after next login.

4. Challenge Setting

FBctf support different categories of challenges by default, including quiz level, flag level and base level with different setting layout, while CTfd use the same template for all challenges. For FBctf, Level Quiz is the basic level designed for challenges with simple question and simple answer format. The basic layout includes title, description, flag, keep point, capture point fields, and hint, hint penalty, countries (a symbol for challenges) fields are optional. Level Flags and Bases are built based on this layout but added attachment and link fields.

Level Flags challenges are mostly associated with additional files or links to provide interactive problems during the competition. Teams may be directed to vulnerable servers for exploitation or manipulate certain files. Unlike jeopardy style challenges involved in Level Flags and Quiz, a special King of the Hill game type is introduced in Level Bases. The link will direct teams to a target server and each team compete to take control of the server. The scores depend on the time that they can hold the target server.

In the contrast, CTFd use one default template for creating challenges, which includes name, category, value(points), static/regex key (flags), file attachments and hints. It supports two different type of answers, static key which is the simple answer in text format and regex keys which is compared with regular expressions. As shown in figure 1, Regex keys is checked by match() method in python and administrators have to write specific regular expression for answers of each challenge.

5. Grading Mechanism

CTFd simply assign points to each challenge and add up those of solved problems for final score, while FBctf employs a more complicated grading mechanism for different levels of challenges.

For levels, FBctf sets two fields Default Bonus and Default Bonus Dec. Default Bonus represents the value received when the first team reaches particular level and scores received by following teams will be Default Bonus minus corresponding Bonus Dec. The later a team arrives at a new level, the less bonus it is awarded.

Additionally, FBctf also uses similar mechanism for each challenge. Bonus field represents scores for the first team to capture this challenge and -Dec field is used to calculate scores for following teams. And both -Dec and Default Bonus Dec can be set to zero, that is all teams arrive at the same stage can get equal scores regardless of their precedence.

As discussed in the above, FBctf needs to assign score to teams based on the length of time they hold the control of the target system in Level Bases. So it needs some mechanism to keep track of the duration time. In control panel, it includes a field called Base Cycle, which represents the number of seconds between two Base check. Each time a Base check is made, team holding the target system will be awarded with certain amount of scores.