kCTF
kCTF is CTF infrastructure written on top of Kubernetes. It allows you to manage, deploy, and sandbox CTF challenges.
Try it – it takes 5 minutes to get started
We built kCTF to help CTF organizers have great CTF infrastructure tooling, and to give challenge authors an environment where they can build and test their challenges without having to learn about Kubernetes, while also allowing Kubernetes experts to use all the features they are accustomed to.
| Versatile | Specialized | Secure |
|---|---|---|
| A simple challenge can be configured in a single Dockerfile. More complex deployments can use all Kubernetes features. | Common CTF needs are provided as services (proof of work, healthchecks, DNS and SSL certificates, network fileshare). | kCTF was built by Google’s Security Team with the goal of hosting untrusted, vulnerable applications as part of CTF competitions. |
Preview
You can have a local challenge running in 5 minutes.
See the Local Testing Walkthrough to get started with a local challenge.
Google Cloudshell Codelab
To try this out on a real server, try out the Google Cloudshell codelab.
Online demo
We have a fake challenge running, you can see what an isolated challenge would look like by connecting directly to:
nc kctf.vrp.ctfcompetition.com 1337
If you are able to break out of it, you can earn up to $133,337 USD.
Tip: Execute bash -i 2>&1 to get an interactive bash session.
Available Documentation
- Local Testing Walkthrough – A quick start guide showing you how to build and test challenges locally.
- kCTF in 8 Minutes – A quick 8-minute summary of what kCTF is and how it interacts with Kubernetes.
- Google Cloud Walkthrough – Once you have everything up and running, try deploying to Google Cloud.
- Custom Domains – How to add custom domains for your challenges.
- Troubleshooting – Help with fixing broken challenges.
- CTF playbook – How to set up your cluster and challenges to scale during a CTF.
- Security Threat Model – Security considerations regarding kCTF including information on assets, risks, and potential attackers.
- kCTF VRP Setup – Demonstrate an exploit against our kCTF demo cluster based on the challenges presented on this page.