What you'll be fixing
Three areas, one environment. Every problem in it is one that turns up in real infrastructure.
Servers and their config
The basics, which is where most of the trouble starts.
- Web server
- Virtual hosts, headers, and whatever it's been told to proxy.
- Database server
- Listening wider than it should, with passwords that would fit on a sticky note.
- SSH server
- Keys, ciphers, and a root login nobody remembers turning on.
Pipelines and Kubernetes
How code gets from a commit to running somewhere.
- GitHub Actions
- A build token that can do a great deal more than build.
- Pipelines
- Unpinned, unreviewed, and deploying from branches nobody protects.
- Kubernetes
- One pod with the run of the whole node.
Cloud infrastructure
Misconfigurations that cost real money, or worse.
- Storage
- A bucket that's more public than anyone intended.
- Networking
- Firewall rules open to the whole internet in all the wrong places.
- Identity
- Roles that can do everything, attached to things that need nothing.
Two hours, start to finish
Most of it is hands on keyboard. The scoreboard freezes five minutes before the end, and the debrief is where you find out how everyone else fixed it.
- BriefingRules, a tour of the environment, how scoring works
- Warm-upOne easy flag to prove your setup works
- PlayFix, check, submit flags
- FreezeThe scoreboard locks
- DebriefThe top players walk through their fixes
How to get in
Registration comes with an entry challenge. It's short, and it's the same kind of thing you'll be doing on the day.
-
Find the entry flag
It's on this server. Flags look like
{CTF_…}. -
Register with it
Paste the flag into the registration form. No flag, no seat.
Open the registration form -
Bring your own laptop
Anything with a terminal and a browser will do.