# utkristauwa/cits-3006-project architecture

> Architecture diagram of the GitHub repository utkristauwa/cits-3006-project, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-29). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/utkristauwa/cits-3006-project
- Repository: https://github.com/utkristauwa/cits-3006-project

## Overview

This repository documents a CTF challenge set, not a runnable application: three machines each have five core vulnerabilities, with two additional advanced challenge chains. The graph preserves the documented machine stages and the explicitly listed advanced attack steps. The available tree has no implementation excerpts, so it does not establish runtime wiring, network topology, or how challenges are deployed; the edges show documented challenge membership or sequence only.

Main entry points: [`README.md`](https://github.com/utkristauwa/cits-3006-project/blob/main/README.md) (Machine A)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_machine_a["Machine A"]
  node_machine_a_node["Machine A<br/>[README.md]"]
  node_a_web["Web: IDOR<br/>[README.md]"]
  node_a_network["Network: ARP spoofing MITM<br/>[README.md]"]
  node_a_horizontal["Horizontal PE: group misconfig<br/>[README.md]"]
  node_a_vertical["Vertical PE: leaked backup<br/>[README.md]"]
  node_a_re["RE: XOR encoded<br/>[README.md]"]
end

subgraph group_machine_b["Machine B"]
  node_machine_b_node["Machine B<br/>[README.md]"]
  node_b_web["Web: server-side template injection<br/>[README.md]"]
  node_b_network["Network: unauthenticated Redis exposure<br/>[README.md]"]
  node_b_horizontal["Horizontal PE: JWT forgery<br/>[README.md]"]
  node_b_vertical["Vertical PE: SUID library hijacking<br/>[README.md]"]
  node_b_re["RE: transformed validation<br/>[README.md]"]
end

subgraph group_machine_c["Machine C"]
  node_machine_c_node["Machine C<br/>[README.md]"]
  node_c_web["Web: XSS<br/>[README.md]"]
  node_c_network["Network: anonymous Rsync disclosure<br/>[README.md]"]
  node_c_horizontal["Horizontal PE: IDOR<br/>[README.md]"]
  node_c_vertical["Vertical PE: privileged script path hijack<br/>[README.md]"]
  node_c_re["RE: obfuscated secret recovery<br/>[README.md]"]
end

subgraph group_advanced["Advanced challenges"]
  node_d_nonce["AES-CTR nonce reuse<br/>[README.md]"]
  node_d_plaintext["Known-plaintext attack<br/>[README.md]"]
  node_d_keystream["Keystream recovery<br/>[README.md]"]
  node_d_flag["XOR flag decryption<br/>[README.md]"]
  node_e_injection["AI prompt injection<br/>[README.md]"]
  node_e_override["Instruction override<br/>[README.md]"]
  node_e_extract["Protected data and flag extraction<br/>[README.md]"]
end

node_player(("CTF participant"))

node_player -->|"solves"| node_machine_a_node
node_player -->|"solves"| node_machine_b_node
node_player -->|"solves"| node_machine_c_node
node_machine_a_node -->|"includes"| node_a_web
node_machine_a_node -->|"includes"| node_a_network
node_machine_a_node -->|"includes"| node_a_horizontal
node_machine_a_node -->|"includes"| node_a_vertical
node_machine_a_node -->|"includes"| node_a_re
node_machine_b_node -->|"includes"| node_b_web
node_machine_b_node -->|"includes"| node_b_network
node_machine_b_node -->|"includes"| node_b_horizontal
node_machine_b_node -->|"includes"| node_b_vertical
node_machine_b_node -->|"includes"| node_b_re
node_machine_c_node -->|"includes"| node_c_web
node_machine_c_node -->|"includes"| node_c_network
node_machine_c_node -->|"includes"| node_c_horizontal
node_machine_c_node -->|"includes"| node_c_vertical
node_machine_c_node -->|"includes"| node_c_re
node_d_nonce -->|"enables"| node_d_plaintext
node_d_plaintext -->|"enables"| node_d_keystream
node_d_keystream -->|"enables"| node_d_flag
node_e_injection -->|"enables"| node_e_override
node_e_override -->|"enables"| node_e_extract

click node_machine_a_node "https://github.com/utkristauwa/cits-3006-project/blob/main/README.md"
click node_a_web "https://github.com/utkristauwa/cits-3006-project/blob/main/README.md"
click node_a_network "https://github.com/utkristauwa/cits-3006-project/blob/main/README.md"
click node_a_horizontal "https://github.com/utkristauwa/cits-3006-project/blob/main/README.md"
click node_a_vertical "https://github.com/utkristauwa/cits-3006-project/blob/main/README.md"
click node_a_re "https://github.com/utkristauwa/cits-3006-project/blob/main/README.md"
click node_machine_b_node "https://github.com/utkristauwa/cits-3006-project/blob/main/README.md"
click node_b_web "https://github.com/utkristauwa/cits-3006-project/blob/main/README.md"
click node_b_network "https://github.com/utkristauwa/cits-3006-project/blob/main/README.md"
click node_b_horizontal "https://github.com/utkristauwa/cits-3006-project/blob/main/README.md"
click node_b_vertical "https://github.com/utkristauwa/cits-3006-project/blob/main/README.md"
click node_b_re "https://github.com/utkristauwa/cits-3006-project/blob/main/README.md"
click node_machine_c_node "https://github.com/utkristauwa/cits-3006-project/blob/main/README.md"
click node_c_web "https://github.com/utkristauwa/cits-3006-project/blob/main/README.md"
click node_c_network "https://github.com/utkristauwa/cits-3006-project/blob/main/README.md"
click node_c_horizontal "https://github.com/utkristauwa/cits-3006-project/blob/main/README.md"
click node_c_vertical "https://github.com/utkristauwa/cits-3006-project/blob/main/README.md"
click node_c_re "https://github.com/utkristauwa/cits-3006-project/blob/main/README.md"
click node_d_nonce "https://github.com/utkristauwa/cits-3006-project/blob/main/README.md"
click node_d_plaintext "https://github.com/utkristauwa/cits-3006-project/blob/main/README.md"
click node_d_keystream "https://github.com/utkristauwa/cits-3006-project/blob/main/README.md"
click node_d_flag "https://github.com/utkristauwa/cits-3006-project/blob/main/README.md"
click node_e_injection "https://github.com/utkristauwa/cits-3006-project/blob/main/README.md"
click node_e_override "https://github.com/utkristauwa/cits-3006-project/blob/main/README.md"
click node_e_extract "https://github.com/utkristauwa/cits-3006-project/blob/main/README.md"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_machine_a_node,node_a_web,node_a_network,node_a_horizontal,node_a_vertical,node_a_re toneBlue
class node_machine_b_node,node_b_web,node_b_network,node_b_horizontal,node_b_vertical,node_b_re toneAmber
class node_machine_c_node,node_c_web,node_c_network,node_c_horizontal,node_c_vertical,node_c_re toneMint
class node_d_nonce,node_d_plaintext,node_d_keystream,node_d_flag,node_e_injection,node_e_override,node_e_extract toneRose
class node_player toneIndigo
```

## Components

### Machine A

- [Machine A](https://github.com/utkristauwa/cits-3006-project/blob/main/README.md): `README.md`
- [Web: IDOR](https://github.com/utkristauwa/cits-3006-project/blob/main/README.md): `README.md`
- [Network: ARP spoofing MITM](https://github.com/utkristauwa/cits-3006-project/blob/main/README.md): `README.md`
- [Horizontal PE: group misconfig](https://github.com/utkristauwa/cits-3006-project/blob/main/README.md): `README.md`
- [Vertical PE: leaked backup](https://github.com/utkristauwa/cits-3006-project/blob/main/README.md): `README.md`
- [RE: XOR encoded](https://github.com/utkristauwa/cits-3006-project/blob/main/README.md): `README.md`

### Machine B

- [Machine B](https://github.com/utkristauwa/cits-3006-project/blob/main/README.md): `README.md`
- [Web: server-side template injection](https://github.com/utkristauwa/cits-3006-project/blob/main/README.md): `README.md`
- [Network: unauthenticated Redis exposure](https://github.com/utkristauwa/cits-3006-project/blob/main/README.md): `README.md`
- [Horizontal PE: JWT forgery](https://github.com/utkristauwa/cits-3006-project/blob/main/README.md): `README.md`
- [Vertical PE: SUID library hijacking](https://github.com/utkristauwa/cits-3006-project/blob/main/README.md): `README.md`
- [RE: transformed validation](https://github.com/utkristauwa/cits-3006-project/blob/main/README.md): `README.md`

### Machine C

- [Machine C](https://github.com/utkristauwa/cits-3006-project/blob/main/README.md): `README.md`
- [Web: XSS](https://github.com/utkristauwa/cits-3006-project/blob/main/README.md): `README.md`
- [Network: anonymous Rsync disclosure](https://github.com/utkristauwa/cits-3006-project/blob/main/README.md): `README.md`
- [Horizontal PE: IDOR](https://github.com/utkristauwa/cits-3006-project/blob/main/README.md): `README.md`
- [Vertical PE: privileged script path hijack](https://github.com/utkristauwa/cits-3006-project/blob/main/README.md): `README.md`
- [RE: obfuscated secret recovery](https://github.com/utkristauwa/cits-3006-project/blob/main/README.md): `README.md`

### Advanced challenges

- [AES-CTR nonce reuse](https://github.com/utkristauwa/cits-3006-project/blob/main/README.md): `README.md`
- [Known-plaintext attack](https://github.com/utkristauwa/cits-3006-project/blob/main/README.md): `README.md`
- [Keystream recovery](https://github.com/utkristauwa/cits-3006-project/blob/main/README.md): `README.md`
- [XOR flag decryption](https://github.com/utkristauwa/cits-3006-project/blob/main/README.md): `README.md`
- [AI prompt injection](https://github.com/utkristauwa/cits-3006-project/blob/main/README.md): `README.md`
- [Instruction override](https://github.com/utkristauwa/cits-3006-project/blob/main/README.md): `README.md`
- [Protected data and flag extraction](https://github.com/utkristauwa/cits-3006-project/blob/main/README.md): `README.md`

### Other components

- **CTF participant**

## Connections

- CTF participant → Machine A: solves
- CTF participant → Machine B: solves
- CTF participant → Machine C: solves
- Machine A → Web: IDOR: includes
- Machine A → Network: ARP spoofing MITM: includes
- Machine A → Horizontal PE: group misconfig: includes
- Machine A → Vertical PE: leaked backup: includes
- Machine A → RE: XOR encoded: includes
- Machine B → Web: server-side template injection: includes
- Machine B → Network: unauthenticated Redis exposure: includes
- Machine B → Horizontal PE: JWT forgery: includes
- Machine B → Vertical PE: SUID library hijacking: includes
- Machine B → RE: transformed validation: includes
- Machine C → Web: XSS: includes
- Machine C → Network: anonymous Rsync disclosure: includes
- Machine C → Horizontal PE: IDOR: includes
- Machine C → Vertical PE: privileged script path hijack: includes
- Machine C → RE: obfuscated secret recovery: includes
- AES-CTR nonce reuse → Known-plaintext attack: enables
- Known-plaintext attack → Keystream recovery: enables
- Keystream recovery → XOR flag decryption: enables
- AI prompt injection → Instruction override: enables
- Instruction override → Protected data and flag extraction: enables