Capture the Flag Facebook Web Application

Facebook CTF is Now Open Source!

The Facebook CTF is a platform to host Jeopardy and “King of the Hill” style Capture the Flag competitions.

How do I use FBCTF?

  • Organize a competition. This can be with as few as two participants, all the way up to several hundred. The participants can be physically present, active online, or a combination of the two.
  • Follow setup instructions below to spin up platform infrastructure.
  • Enter challenges into admin page
  • Have participants register as teams
    • If running a closed competition:
      • In the admin page, generate and export tokens to be shared with approved teams, then point participants towards the registration page
    • If running an open competition:
      • Point participants towards the registration page
  • Enjoy!


The Facebook CTF platform can be provisioned in development or production environments.


The target system needs to be Ubuntu 14.04. Run the following commands:

This will place the code in the /var/www/fbctf directory, install all dependencies, and start the server. Be ready to provide the path for your SSL certificate’s CSR and key files. More information on setting up SSL is specific in the next session, but note that if you are just testing out the platform and not running it production, you want to use the instructions listed in the Development section below, as this takes care generating certificates for you. We will provide more info on generating your own certificates for production in the future.

The password for the user admin will be printed in the console at the end of provisioning, as it is randomly generated everytime the CTF platform is provisioned. We will add a way to change this password from the command line in the near future (in the meantime, you can figure out how to do it manually by looking at the import_empty_db function in./extra/

Once you’ve provisioned the VM, go to the URL/IP of the server. Click the “Login” link at the top right, enter the admin credentials, and you’ll be redirected to the admin page.


While it is possible to do development on a physical Ubuntu machine (and possibly other Linux distros as well), we highly recommend doing all development on a Vagrant VM. First, install VirtualBox and Vagrant. Then run:

This will create a local virtual machine with Ubuntu 14.04 using Vagrant and VirtualBox as the provider. The provisioning script will install all necessary software to the platform locally, using self-signed certificates. The credentials will be admin/password and the machine will be available on by default. You can find any error logs in/var/log/hhvm/error.log.

If you are using a non-english locale on the host system, you will run into problems during the installation. The easiest solution is to run vagrant with a default englisch locale:

Note that if you don’t want to use the Vagrant VM (not recommended), you can provision in dev mode manually. To do so, run the following commands:

Once you’ve provisioned the VM, go to the URL/IP of the server. Click the “Login” link at the top right, enter the admin credentials, and you’ll be redirected to the admin page.

Optional installation

If you are going to be modifying files outside of the Vagrant VM, you will need to synchronize the files using Unison (bi-directional file sync over SSH). Once Unison is installed, you can sync your local repo with the VM with the following command:


Note that the unison script will not sync NPM dependencies, so if you ever need to run npm install, you should always run it on the VM itself.

This step is not necessary if all development is done on the VM.


Download at Gitbub.


I started blogging around 2011 at #Ubuntupirates, #ProjectX and #pir8geek, I’m currently working as Network/Linux SysAdmin.

I’m a Linux,opensource advocate and interested in network security and InfoSec.

Leave a Reply