🎯 CTF Solver - Autonomous OWASP Juice Shop Agent Swarm

An autonomous AI agent swarm designed to solve OWASP Juice Shop CTF challenges using CrewAI.

🚀 Quick Start

1. Set up environment

# Create and activate virtual environment
python3 -m venv .venv
source .venv/bin/activate

# Install dependencies
pip install -e .

2. Configure API keys

Create a .env file with your API keys:

# CTFd Platform
CTFD_TOKEN=ctfd_your_token_here
CTFD_URL=http://10.1.1.20:8000

# Juice Shop Target
JUICE_SHOP_URL=http://10.1.1.20:37136

# LLM Providers
GEMINI_API=your_gemini_api_key
CROQ_API=your_groq_api_key

3. Run the solver

# Solve one 1-star challenge (proof of concept)
python src/ctf_solver/main.py

# Solve a specific challenge by ID
python src/ctf_solver/main.py --challenge 18

# Target a specific difficulty level
python src/ctf_solver/main.py --difficulty 250

# Solve all challenges (continuous mode)
python src/ctf_solver/main.py --all

📁 Project Structure

CRS_ai_agent/
├── src/
│   └── ctf_solver/
│       ├── config/
│       │   ├── agents.yaml     # Agent definitions
│       │   └── tasks.yaml      # Task definitions
│       ├── tools/
│       │   ├── ctfd_tools.py      # CTFd API tools
│       │   ├── knowledge_base_tools.py  # Knowledge base tools
│       │   └── browser_tools.py   # HTTP/browser tools
│       ├── crew.py             # Crew orchestration
│       └── main.py             # Entry point
├── knowledge_base/
│   ├── challenges/             # Golden knowledge per challenge
│   ├── writeup/                # GitHub writeup solutions
│   └── scripts/                # Knowledge base builder
├── reserach/                   # Research documentation
└── .env                        # Environment variables

🤖 Agent Architecture

Coordinator Agent (Groq/Llama 3.3 70B)

• Manages challenge selection and prioritization
• Tracks progress and handles retries
• Uses cost-effective Groq models for coordination

Exploit Agent (Gemini 2.5 Pro)

• Analyzes challenge requirements
• Executes exploits using tools
• Extracts and submits flags
• Uses powerful Gemini Pro for complex reasoning

🛠️ Available Tools

Tool	Description
get_unsolved_challenges	Lists all unsolved CTFd challenges
load_challenge_knowledge	Loads comprehensive knowledge for a challenge
navigate_to_url	Makes GET requests to Juice Shop
http_request	Makes custom HTTP requests (POST, PUT, etc.)
extract_flag	Extracts flag from response text
submit_flag	Submits flag to CTFd platform

📊 Challenge Difficulty

Difficulty	Points	Count	Strategy
⭐ 1-star	100	14	Navigation, simple payloads
⭐⭐ 2-star	250	14	SQL injection, parameter manipulation
⭐⭐⭐ 3-star	450	24	Complex exploits with writeups
⭐⭐⭐⭐ 4-star	700	22	Multi-step attacks
⭐⭐⭐⭐⭐ 5-star	1000	12	Advanced techniques
⭐⭐⭐⭐⭐⭐ 6-star	1350	9	Expert-level challenges

🎯 Goal

• Target: 10,000-30,000 CTF points
• Deadline: January 25, 2026
• Strategy: Start with 1-3 star challenges (15,700 points available)

📚 Knowledge Base

The golden knowledge base contains:

• CTFd challenge metadata and hints
• Step-by-step writeup solutions from GitHub
• Official guide sections from pwning.owasp-juice.shop
• Quick solution payloads

🔧 Development

# Run tests
pytest

# Format code
black src/
isort src/

⚠️ Legal Disclaimer

This tool is designed for authorized CTF competitions only. Only use against systems you have explicit permission to test.