CTFd Capture The Flag Platform

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

Overview

CTFd is the popular open source Capture-The-Flag competition platform used by security teams, educators and event organisers to run training events, workshops and jeopardy-style competitions. It provides a challenge board, a live scoreboard, individual or team play, solve tracking, hints and a complete administration panel for authoring challenges, flags and pages, so you can focus on running your event instead of building infrastructure from scratch.

Application Stack

This image delivers CTFd fully installed and hardened, giving you a working competition platform within minutes of launch instead of assembling a Python environment, a WSGI server, a database and a reverse proxy by hand. CTFd runs in a dedicated Python virtual environment served by gunicorn with gevent workers, bound to the loopback interface and reverse proxied behind nginx on port 80, with MySQL 8.0 for durable state and Redis for caching. An unauthenticated health endpoint is provided for load balancer probes. Systemd manages CTFd, nginx, MySQL and Redis for automatic restarts and clean logging.

Secure First Boot

On the first boot of every instance, a one shot service generates a fresh MySQL password, a fresh application database password, a fresh Flask secret key and a fresh CTFd administrator password unique to that instance. Setup completes automatically, a demo challenge is seeded so the board is populated, and the credentials are written to a root only file. No shared or default password ever ships in the image, and there is no known default administrator login. Unlike community images that leave the setup wizard open to the first visitor, every deployment is secured from the moment it starts.

Getting Started

The CTFd web interface is served on port 80 through nginx. After launch, SSH into your instance and retrieve the generated administrator credentials from the root only credentials file, browse to your instance address and sign in with the administrator account, then start authoring challenges, configuring your event timeline and inviting players. CTFd derives its base URL from the request, so it answers correctly whether you reach it by public IP, private IP or a custom domain name.

Infrastructure Sizing

The recommended instance type is m5.large, which gives the gunicorn workers, MySQL and Redis ample CPU and memory for a typical event. Small training sessions can run comfortably on a smaller burstable instance such as t3.medium, while large competitions with many concurrent participants benefit from m5.large or larger.

cloudimg Support

24/7 technical support by email and chat. Our engineers help with CTFd deployment, challenge and event configuration, teams and users management, theme and plugin questions, version upgrades, performance tuning and MySQL database administration.

Use Cases

Run jeopardy style Capture-The-Flag competitions and hackathons with scoring, teams and challenge categories. Deliver corporate security training and hands on workshops with a live scoreboard to track participant progress. Stand up a private cyber range with scored challenges for a class or team. A self hosted, data owning alternative to hosted CTF services.

CTFd is a trademark of its respective owners. This image is not affiliated with, endorsed by, or sponsored by the CTFd project. All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.