How 0xdun0/duno works
DUNO is a Flask-based hands-on security training platform. Learners work through graded OWASP labs, isolated CTF challenges, and DUNO Kids lessons; community members can submit machine packages for validation and administrative review before publication. Core authentication and SQLite support these experiences. The graph preserves the README’s major product areas; some relationships for documented but unsampled features are omitted where the excerpts do not establish their callers.
Main entry points: challenges/routes.py Challenge Routes · database.py SQLite Access · brute_force/routes.py Lab Routes · kids/routes.py Kids Lessons
Components 26
Platform Core
- Authentication
core/auth.py - SQLite Access
core/database.py
Security Labs
- OWASP Labs
modules - Lab Routes
modules/brute_force/routes.py - Lab Logic
modules/brute_force/logic.py - Security Levels
core/security_levels.py
CTF Challenges
- Challenge Routes
modules/challenges/routes.py - Challenge Catalog
modules/challenges/catalog.py - Runner Client
modules/challenges/runner_client.py - Challenge Runner
services/challenge-runner/app.py - Runner Core
services/challenge-runner/runner_core.py - Flag & Solves
modules/challenges/solves_service.py - Challenge Events
modules/challenges/events.py
Community Machines
- Submission Routes
modules/machine_submissions/routes.py - Package Validator
modules/machine_submissions/validator.py - Dockerfile Scanner
modules/machine_submissions/scanner.py - Audit Worker
modules/machine_submissions/worker.py - Review State
modules/machine_submissions/state_machine.py - Review Console
modules/machine_submissions/admin_routes.py
Learning & Docs
- Kids Lessons
modules/kids/routes.py - Lesson Content
modules/kids/kids_content.py - Kids Progress
modules/kids/kids_db.py - Documentation
core/docs_manager.py
Other components
- Learner
- Machine Contributor
- Administrator
Connections 27
- Learner → Authentication: signs in
- Learner → Lab Routes: uses labs
- Lab Routes → Security Levels: gets level
- Lab Routes → Lab Logic: runs lab
- Lab Routes → OWASP Labs: serves labs
- Lab Routes → SQLite Access: reads user state
- Learner → Challenge Routes: starts challenges
- Challenge Routes → Challenge Catalog: looks up challenge
- Challenge Routes → Runner Client: controls instance
- Runner Client → Challenge Runner: calls API
- Challenge Runner → Runner Core: dispatches runtime
- Challenge Routes → SQLite Access: stores instance
- Challenge Routes → Flag & Solves: submits flag
- Challenge Routes → Challenge Events: emits events
- Flag & Solves → SQLite Access: records solves
- Machine Contributor → Submission Routes: uploads package
- Submission Routes → Package Validator: validates package
- Submission Routes → SQLite Access: records submission
- Administrator → Review Console: reviews machines
- Review Console → SQLite Access: reads review data
- Audit Worker → Dockerfile Scanner: scans image config
- Audit Worker → Review State: advances review
- Learner → Kids Lessons: studies lessons
- Kids Lessons → Lesson Content: loads lesson data
- Kids Lessons → Kids Progress: updates progress
- Kids Lessons → SQLite Access: reads lesson records
- Learner → Documentation: consults guides