Skip to content
Welcome to HackTheArch! A free open source scoring server for cyber Capture the Flag competitions!
JavaScript Ruby HTML CSS CoffeeScript Go Other
Branch: master
Clone or download
Type Name Latest commit message Commit time
Failed to load latest commit information.
app Use higher precedence boolean operators Aug 1, 2019
bin Add files from upgrade Feb 20, 2019
config Introducing swarm services option Jul 21, 2019
db Introducing swarm services option Jul 21, 2019
lib Introducing swarm services option Jul 21, 2019
log Initialize repo Jul 29, 2015
public Initialize repo Jul 29, 2015
test Use correct name Jul 21, 2019
vendor/assets Initialize repo Jul 29, 2015
webconsole Checking in a working web console, w/ minor UI bug Jul 31, 2019
.dockerignore Ignore stack yml files in docker Jul 21, 2019
.env_sample Updating rails and ruby Feb 20, 2019
.gitignore Move .env file; avoid accidentally pushing secrets Feb 17, 2018
.ruby-version Add files from upgrade Feb 20, 2019
.travis.yml Update ruby version in travis file Feb 20, 2019 Update docs for new release Feb 20, 2019
Dockerfile Multi-stage build Jul 20, 2019
Gemfile Upgrading to patched versions of gems Jul 20, 2019
Gemfile.lock Setup dev stack definition; Fix CVE's in lock file Jul 20, 2019
LICENSE Initial commit Jul 29, 2015
Procfile Adding sign-in/up/out pages and functionality Aug 30, 2015 Update demo URL Jul 21, 2019
Rakefile Initialize repo Jul 29, 2015 Add note about release notes Feb 20, 2019 Initialize repo Jul 29, 2015
dev-stack.yml Checking in a working web console, w/ minor UI bug Jul 31, 2019
docker-bake.hcl Checking in a working web console, w/ minor UI bug Jul 31, 2019
prod-stack.yml Checking in a working web console, w/ minor UI bug Jul 31, 2019


Build Status Heroku Code Climate Coverage

This is a scoring server built using Ruby on Rails by the Military Cyber Professionals Association (MCPA). It is free to use and extend under the MIT license (see LICENSE file). The goal of this project is to provide a standard generic scoring server that provides an easy way to add and modify problems and track statistics of a Cyber Capture the Flag event. While it's not recommended, this server can be hosted with your challenges but we do recommend sand-boxing your challenges so they do not affect the scoring server.

Want to see it in action? Live Demo hosted here and screenshots here!

What's different about HackTheArch?

We created this application after using the PicoCTF platform for our annual CTF. It was okay, but we found it lacking some features that we wanted. We wanted a way to be able to offer competitors hints for a cost, and we also wanted a way to create and modify problems from a web interface. We looked around and didn't see any others that met our requirements. CTFd: at the time, had no web admin interface for creating challenges. Root The Box: We didn't like all the extra stuff with the bank accounts and it just seemed too complex for our needs. So we decided to roll our own scoring server and now you can benefit from our hard work! This application implements an optional dynamic hint system which will deduct points for requesting hints and also implements a web interface for creating and modifying hints and challenges. We hope you enjoy this application and are open to feedback so let us know what you like, hate, would like to see added, etc...


  • Ruby version 2.6.1
  • Activation and password reset e-mails depend on Heroku SendGrid add-on configuration (this feature can be optionally disabled or easily modified to be used with other mailers)
  • To store challenge pictures in the production environment, you'll need to modify 'config/initializers/carrier_wave.rb' to work with your cloud storage solution
  • See Gemfile for further requirements

Deployment Options

Manual Deployment

  • To manually deploy HackTheArch, be sure to download the latest stable release here, or checkout the 'master' branch. For the latest features and a less-stable version, checkout the 'dev' branch.


  • A Dockerfile is included along with a docker-compose.yml for deploying a containerized version of HackTheArch. More detailed instructions can be found in: the Docker README.


  • A few things must be configured to deploy to Heroku:

    1. Create a HOST environment variable that contains the url for your app (e.g.,
    2. For mailer support, add the sendgrid addon before deploying (heroku addons:create sendgrid:starter). More info on Sendgrid here.
    3. For live streaming (submissions, chat, etc...), add the Redis To Go addon.


  • All deployments of HackTheArch require some a way to send account activation e-mails (or alternatively activation e-mails can be disabled in the admin console). With Heroku, you can use the Sendgrid plugin, otherwise, you'll need to configure the mailer options in config/environments/production.rb.
  • To initialize the database, run: bundle exec rails db:seed. After initialization, the admin login credentials will be: : password
  • Important: It is highly advised that you immediately change the admin credentials post-deployment
    • While any user may be made an admin, it can only be done manually in the database. This is to prevent privilege escalation through the web interface.

More configuration details on our project wiki.

Contribute and Contact

Want to help?

  • Want to add a new feature or fix a bug? Check out a branch and submit working code with tests via pull request to merge into the 'dev' branch.
  • Check out the slack channel for more.
  • Test coverage would be a good place to start: here



You can’t perform that action at this time.