Ret2Shell is a full-featured CTF (Capture The Flag) challenge platform built with a Rust backend (Axum web framework) and a SolidJS frontend. It manages the entire lifecycle of CTF competitions: game creation, challenge authoring (with Git-backed storage), team management, dynamic scoring (decay curves, milestones), and dynamic per-player challenge environments orchestrated on Kubernetes. The backend includes a custom Rune scripting engine for extensible challenge checkers, OAuth providers, and lifecycle hooks. It provides a REST API, a CLI client, event streaming (NATS), and a comprehensive admin web UI. Deployment is supported via Helm charts, docker-compose, or raw Kubernetes manifests. The platform handles authentication, captcha, email verification, media uploads, audit logging, and real-time communication via WebSocket/WSRX tunnels.
The repository is a comprehensive platform for AI red teaming education, hosting a series of Capture the Flag (CTF) challenges that target LLM vulnerabilities such as prompt injection, metaprompt extraction, and safety filter bypass. It is built as a modified version of Microsoft's Chat Copilot, integrating a multi-service architecture: a .NET Core chat backend with Semantic Kernel, a React frontend, a load balancer (Go), a scoring service (Flask/Celery), a picture submission service, and a challenge home page. The system is designed to be deployed via Docker Compose or Kubernetes, with each challenge running its own configured chat instance. While primarily an application, the repository also includes Jupyter notebooks using PyRIT for automated red teaming, blending application and research elements. The architecture is modular, with clear separation between services. The chat copilot backend provides real-time chat via SignalR, supports OpenAPI plugins, and integrates with Azure services (CosmosDB, Redis, Blob Storage, Content Safety). The scoring system supports both automatic (regex/LLM) and manual review, with CTFd flag submission. The platform is highly configurable through challenge JSON files, allowing different metaprompts, scorers, RAG inputs, and security settings. This makes it a flexible testbed for red teaming exercises. The repository demonstrates strong engineering practices with reusable components such as a generic repository pattern, authentication handlers, telemetry services, and a load balancer. However, it is tightly coupled to Azure and Semantic Kernel, and some features are intentionally insecure for educational purposes. The codebase is actively maintained and well-documented, making it suitable for both learning and running red teaming events.
Haaukins is a cybersecurity training and Capture The Flag (CTF) platform developed at Aalborg University. It orchestrates isolated lab environments for teams, combining Docker containers and VirtualBox VMs to deliver challenges. The system is built as a set of gRPC microservices: a central daemon manages event lifecycle, team assignments, and challenge verification; a store service provides persistence; and an exercise service defines challenge configurations. Participants access labs via a web frontend (Amigo) using browser-based RDP (Guacamole) or WireGuard VPN. The daemon also handles DNS/DHCP per lab subnet, real-time scoreboards via WebSocket, and keylogging for monitoring. The CLI client (hkn) allows administrators to manage events, teams, and exercises. The architecture is modular with clean interfaces for virtualization (Docker/VirtualBox) and storage (in-memory with hooks or gRPC backend), though some components show tight coupling and aging dependencies.