A framework to create, build, deploy, and monitor jeopardy CTF challenges with configurable structure and automation.
mkCTF is a Python-based framework for creating, building, deploying, and monitoring jeopardy-style capture-the-flag (CTF) challenges. It provides a configurable structure to streamline challenge integration with CTF infrastructure, automating tasks like healthchecks and configuration synchronization. The framework helps CTF organizers manage challenge lifecycles efficiently, from development to event deployment.
CTF organizers, cybersecurity teams, and educators who design and run jeopardy CTF events and need a standardized toolchain for challenge management.
Developers choose mkCTF for its automation capabilities, standardized challenge definitions, and built-in monitoring, which reduce manual effort and ensure challenge reliability during CTF competitions.
A CTF framework to create, build, deploy and monitor challenges
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
The `mkctf-monitor` tool runs regular healthchecks and reports status via an HTTP API, ensuring challenge reliability during events, as highlighted in the tools section.
Challenges are defined using YAML configurations with metadata like difficulty, category, and tags, promoting consistency across the CTF, as detailed in the Concepts section.
Specifically designed for Rancher-based deployments, with standard programs (build, deploy, healthcheck) that facilitate seamless integration, as mentioned in the philosophy and setup.
Provides HTTP APIs for configuration sync and healthcheck notifications, requiring HTTPS and basic authentication, enabling centralized management, as specified in the Dashboard section.
The README admits it's designed and tested on Linux only, which may not work reliably on other operating systems without additional setup, limiting cross-platform usability.
Optimized for Rancher-based infrastructures, so teams using other platforms like vanilla Kubernetes or cloud services may face significant integration hurdles.
Flags are stored in plaintext in the repository for rebuildability, posing a security risk if access is compromised, as warned in the Caution section.
The dashboard must implement specific HTTPS and authentication APIs, which could be a burden for teams without existing infrastructure, adding to setup complexity.