HysterHack: Building a CTF Platform on CTFd (2024)Archived
HysterChat was a platform where students posted their work. I built a capture the flag platform on CTFd and wired it in, so security learning was something you could play.
HysterChat was a platform where students posted their work and talked to each other. My job was to make security learning part of it, as something you play rather than something you read.
How it started
Hysteresis is an edtech company, and the founder, Gokul Kumar Vishwanathan, came to my college to introduce their product, HysterChat.
I was deep in security at the time, and I was preparing for CEH, so looking at how an application holds up was what I was doing anyway. So I looked at HysterChat.
I found a vulnerability. I wrote up a proper assessment and sent it to them rather than doing anything else with it.
We met at a cafe near my college and talked. He liked the work and offered me an internship. No assessment, no rounds, no assignment.
Bengaluru, properly this time
This was the first time I moved to Bengaluru rather than visiting it.
Early days were rough. Small team, early startup, still looking for clients. I was going in and coming back and not much was landing.
Then Gokul asked me to integrate security learning into HysterChat.
That made sense for the product. It was already a place where students posted things and worked on their own material, so security was another subject that belonged there. The question was what form it should take.
Not a course. A game.Building HysterHack
I already knew what good looked like here, because I had spent a lot of hours on TryHackMe and Hack The Box.
Rather than building a challenge platform from scratch, I found CTFd, the open source platform most real capture the flag competitions run on. That was the base.
On top of it I built custom themes, custom pages, and a set of challenges I was genuinely happy with.
The part that was actually hard
HysterChat ran on WordPress. HysterHack ran on CTFd. Two separate systems, two separate user tables, and one company that wanted them to feel like one product.
So I wrote a WordPress plugin to connect them.
A user logs into HysterChat and lands in HysterHack already authenticated, without ever knowing there are two applications.
That plugin is the piece I am most pleased with, because it is the unglamorous work that makes the rest usable.
People used it
Colleagues at the company started playing the challenges. Real solves, real scoreboard, real arguments about who was ahead.
The source is on GitHub: custom_CTFd.
What happened to it
HysterChat became a stale product. Once the parent stopped moving, HysterHack had nothing to attach to, and we stopped developing it.
That sounds like a bad ending and it did not feel like one.
What it proved was that we could build the thing. A small team shipped a working security training platform, integrated into an existing product, with a real audience inside the company using it. The gap was never capability. It was customers.
We found those later, on other projects, and moved on to them.