How utkristauwa/cits-3006-project works
This repository documents a CTF challenge set, not a runnable application: three machines each have five core vulnerabilities, with two additional advanced challenge chains. The graph preserves the documented machine stages and the explicitly listed advanced attack steps. The available tree has no implementation excerpts, so it does not establish runtime wiring, network topology, or how challenges are deployed; the edges show documented challenge membership or sequence only.
Main entry points: README.md Machine A
Components 26
Machine A
- Machine A
README.md - Web: IDOR
README.md - Network: ARP spoofing MITM
README.md - Horizontal PE: group misconfig
README.md - Vertical PE: leaked backup
README.md - RE: XOR encoded
README.md
Machine B
- Machine B
README.md - Web: server-side template injection
README.md - Network: unauthenticated Redis exposure
README.md - Horizontal PE: JWT forgery
README.md - Vertical PE: SUID library hijacking
README.md - RE: transformed validation
README.md
Machine C
- Machine C
README.md - Web: XSS
README.md - Network: anonymous Rsync disclosure
README.md - Horizontal PE: IDOR
README.md - Vertical PE: privileged script path hijack
README.md - RE: obfuscated secret recovery
README.md
Advanced challenges
- AES-CTR nonce reuse
README.md - Known-plaintext attack
README.md - Keystream recovery
README.md - XOR flag decryption
README.md - AI prompt injection
README.md - Instruction override
README.md - Protected data and flag extraction
README.md
Other components
- CTF participant
Connections 23
- CTF participant → Machine A: solves
- CTF participant → Machine B: solves
- CTF participant → Machine C: solves
- Machine A → Web: IDOR: includes
- Machine A → Network: ARP spoofing MITM: includes
- Machine A → Horizontal PE: group misconfig: includes
- Machine A → Vertical PE: leaked backup: includes
- Machine A → RE: XOR encoded: includes
- Machine B → Web: server-side template injection: includes
- Machine B → Network: unauthenticated Redis exposure: includes
- Machine B → Horizontal PE: JWT forgery: includes
- Machine B → Vertical PE: SUID library hijacking: includes
- Machine B → RE: transformed validation: includes
- Machine C → Web: XSS: includes
- Machine C → Network: anonymous Rsync disclosure: includes
- Machine C → Horizontal PE: IDOR: includes
- Machine C → Vertical PE: privileged script path hijack: includes
- Machine C → RE: obfuscated secret recovery: includes
- AES-CTR nonce reuse → Known-plaintext attack: enables
- Known-plaintext attack → Keystream recovery: enables
- Keystream recovery → XOR flag decryption: enables
- AI prompt injection → Instruction override: enables
- Instruction override → Protected data and flag extraction: enables