Skip to content

Releases

Flagprint 1.1.0

Flagprint 1.1.0 Latest
Latest

Choose a tag to compare

View all tags
@rj-karan rj-karan released this 11 Nov 06:21
v1.1.0
b4938a7

Sandbox image on GitHub Container Registry

No more building the generator sandbox yourself:

docker pull ghcr.io/rj-karan/flagprint-generator:latest

The plugin looks for this image first, then a locally built flagprint/generator, then falls back to plain Python.

Fixes

  • With several gunicorn workers, the very first flags could be computed with different secrets. The secret is now created once at startup and every worker reads the same database row.
  • Per-team files could be downloaded before a challenge's prerequisites were solved. Downloads now follow the same rule as the challenge itself.
  • Downloading from a flag-only or variants challenge returned 500; it is now 404.
  • "Null Pointers's" in the share alert pop-up.

Also

  • Admin monitor: one account lookup per team per page instead of one per row.
  • A clean README with a demo, screenshots and a comparison with other options.
  • CONTRIBUTING.md, SECURITY.md with private vulnerability reporting, a code of conduct, and a docker-compose.override.yml for script delivery.

Upgrade: git pull in the plugin folder and restart CTFd. No migration needed.

Assets 2
Loading

Flagprint 1.0.0

Flagprint 1.0.0

Choose a tag to compare

View all tags
@rj-karan rj-karan released this 11 Nov 06:08
v1.0.0
705b648

The first public release of Flagprint, a CTFd plugin that gives every team its own flag and its own files, and tells you who leaked a flag when one gets shared.

demo

Highlights

  • Per-team flags from a template like flag{st3g0_l0v3s_y0u_{team}}. Codes are an HMAC of challenge and team, so there is no flag table to manage.
  • Per-team files of any kind
    • Replace: a sample flag is swapped into text, binaries, pcaps and zip members.
    • Script: your generate.py builds each team's file in an offline Docker sandbox. Stego images, compiled crackmes, encrypted blobs.
  • Variants for fixed-answer challenges such as OSINT and trivia.
  • Leak attribution: a copied flag is "Incorrect" for the player and a live alert for you, with who copied whose flag.
  • Admin monitor: share alerts, all submissions with their owner, flag lookup, shared IPs, and an optional Hall of Shame.
  • Team flags panel on each challenge: every team's flag, their exact file, solve and sharing counts, and Regenerate.
  • Quiet by default: players never see the flag template. Install under a neutral folder name and nothing player-facing mentions Flagprint.
  • Hooks for instancer plugins to join the same detection.

Install

cd CTFd/CTFd/plugins
git clone https://github.com/rj-karan/ctfd-flagprint flagprint

Restart CTFd and open Admin → Flagprint. See the README for script delivery and Docker setup.

Compatibility: CTFd 3.8.x, teams and users mode. Tested in CI against CTFd 3.8.7 and 3.8.9.

Loading