How 0xchrisoliveira/secomp_2026_cybersec works
Banco CTF is an intentionally vulnerable educational banking web app, implemented in Java, Python, and C# with documented feature parity. Its user workflow runs from browser requests through server routes to account and identity operations backed by SQLite. The graph emphasizes the sampled Python route-registration flow and the sampled Java operation handlers; broader subsystem links follow the README’s documented organization, since their source was not sampled.
Main entry points: app.py Flask app · Main.java Java HTTP server · Program.cs ASP.NET host · app.js Python web client
Components 18
Browser client
- Python web client
python/front-end/js/app.js
Server runtime
- Flask app
python/back-end/app.py - Java HTTP server
java/back-end/core/Main.java - ASP.NET host
csharp/back-end/Program.cs
Identity
- Identity routes
python/back-end/usuario - Admin routes
python/back-end/usuario/admin.py - Java admin handler
java/back-end/usuario/AdminHandler.java - C# user endpoints
csharp/back-end/Usuario
Account operations
- Account routes
python/back-end/sistema - Transfer route
python/back-end/sistema/transferencia.py - Java account handlers
java/back-end/sistema - Java transfer handler
java/back-end/sistema/TransferenciaHandler.java - C# account endpoints
csharp/back-end/Sistema
Persistence
- Python bank data
python/back-end/banco.py - SQLite database
python/back-end/banco.py - Java bank data
java/back-end/core/Banco.java - C# bank data
csharp/back-end/Banco.cs
Other components
- Bank user
Connections 17
- Bank user → Python web client: uses
- Python web client → Flask app: sends HTTP requests
- Flask app → Identity routes: registers routes
- Flask app → Admin routes: registers routes
- Flask app → Account routes: registers routes
- Flask app → Python bank data: initializes database
- Python bank data → SQLite database: prepares
- Flask app → Java HTTP server: alternate implementation
- Java HTTP server → Java account handlers: dispatches requests
- Java HTTP server → Java admin handler: dispatches requests
- Java account handlers → Java transfer handler: includes transfer
- Java transfer handler → Java bank data: checks ownership
- Java HTTP server → Java bank data: prepares database
- Flask app → ASP.NET host: alternate implementation
- ASP.NET host → C# account endpoints: maps endpoints
- ASP.NET host → C# user endpoints: maps endpoints
- ASP.NET host → C# bank data: creates database