WebSocket-based ctf platform dynamic container traffic penetration method

Abstract

The application provides a WebSocket-based CTF platform dynamic container traffic penetration method, uses WebSocket technology to forward TCP traffic, cooperates with a connector used on a user side to penetrate TCP traffic load with the CTF platform, and uses the advantage of WebSocket on the application layer to realize HTTPS encryption and CDN protection. In the WebSocket traffic routing, the application finely controls the intranet target IP address and port that can be accessed by each WebSocket connection, the user can only access a port of a specific address through the WebSocket connection obtained by application to perform intranet penetration connection, and cannot directly perform penetration to an unauthorized address on the user side, so that the problem solving environment of the player in the competition process is not disturbed by external factors, and the method of the application can be applied to a single device, thereby reducing the cost of the player and platform operation and maintenance.

Description

Technical Field

[0001] This invention belongs to the field of cybersecurity competition technology, specifically relating to a method for dynamic container traffic penetration in a CTF platform based on WebSocket. Background Technology

[0002] The cybersecurity training platform (hereinafter referred to as the training platform) is a teaching and training platform used for information security education and security drills. It provides near-realistic training scenarios, allowing users to recreate real-life vulnerability environments at a low cost, thereby learning information security technologies. To test learning effectiveness, CTF (Capture the Flag) competitions have become increasingly popular. CTF competitions provide participants with multiple simulated experimental environments, each with a target answer string (called a flag). After successfully solving a problem, participants submit the flag to the training platform to participate in the ranking. During the challenge, each participant has their own problem container, isolated from other participants' environments, and the flag values ​​in different containers are also different. This significantly increases the cost of cheating, thus reducing cheating behavior, and allows for direct detection of even simple cheating attempts. It also prevents participants from irreversibly damaging the problem environment during the challenge, thus delaying other participants' progress. If a participant unintentionally damages their environment, they can restart the container to restore their solution.

[0003] For dynamic challenges, there are already some mature solutions, such as CTFd-Whale, but there are always some drawbacks that limit these solutions in certain scenarios. Ensuring comfortable access to the container for contestants has always been a difficult requirement in competition platform development, especially in scenarios with numerous restrictions.

[0004] For example, the school server only has a single domain name resolution, does not support wildcard domains, and does not support self-signed certificates. All traffic needs to be forwarded through a CDN, then audited by a bastion host, decrypted into plaintext HTTP traffic, and then forwarded to the contestant's server. The contestant has no control over the CDN, bastion host, or domain name. The bastion host security group only opens one channel: bastion host port 443 -> server port 80. Other ports on the server are inaccessible from the outside, even with direct IP address connections. In this context, new tunneling techniques are needed for secure traffic tunneling.

[0005] Current technologies generally employ FRP (Functional Reverse Proxy Application) and VPN for traffic traversal. FRP is used for intranet penetration, reverse-promoting traffic from the intranet server to an external server with full port and wildcard domain permissions. Then, a remote API (Application Programming Interface) is used to control the external server for traffic relay, thereby enabling interaction between the container services on the external and intranet servers. Conventional VPN technology connects contestants to the competition subnet, and then configures routing tables within the subnet to allow contestants to directly connect to the problem container. Both FRP and conventional VPN solutions have certain drawbacks:

[0006] The FRP scheme has the following disadvantages:

[0007] (1) Limitations of application scenarios

[0008] FRP technology requires a smooth network connection between the relay server and the internal network server. If the internal network server is completely isolated, this solution is unusable. In special scenarios such as school / government servers, applying this solution may require more than one server to act as a jump server for traffic forwarding, or even seeking a third-party server to host the competition, abandoning the organization's original server.

[0009] (2) Stability cannot be guaranteed

[0010] All container traffic in this scheme is connected through a relay server. All contestants must use the same server to route traffic. If the relay server goes down, all contestants will be unable to complete the problem at the same time until the relay server is restored.

[0011] (3) There are potential safety risks.

[0012] To route pure TCP traffic, the relay server needs to expose its raw TCP ports, preventing the use of acceleration technologies like CDNs and firewalls. This makes it highly vulnerable to attacks and system crashes. Furthermore, due to the need for widely open ports, the server cannot implement HTTPS protection for IP addresses and ports, and can only transmit traffic as pure TCP, creating a vulnerability to man-in-the-middle attacks.

[0013] VPN solutions have the following drawbacks:

[0014] (1) Security issues

[0015] The VPN solution also fails to solve the problem of isolating internal network servers, requiring multiple jump servers for relaying. It also still presents certain security issues, as all contestants transmit question traffic in pure TCP traffic within the same internal network, which poses a risk of man-in-the-middle attacks.

[0016] (2) The usage process is complicated

[0017] VPN solutions require participants to install specific VPN software on their computers and manually configure underlying system services such as routing tables, which significantly impacts the user experience and is prone to errors, potentially disrupting the competition. Various competition problems caused by VPN misconfigurations also plague competition organizers and educational institutions.

[0018] (3) The deployment process is complicated

[0019] VPN solutions require the establishment of private subnets, and in addition to the competition server, one or more jump servers are needed to provide services, which greatly increases the cost and workload of hosting the competition.

[0020] (4) Unable to perform fine-grained access control

[0021] VPN solutions connect users to a subnet, allowing them to access all device IP addresses and open ports within that subnet. While routing tables can restrict access, each environment requires manual configuration to ensure that specific participants can access their own environment while being unable to access other participants' environments, significantly increasing operational pressure. Summary of the Invention

[0022] To address the aforementioned problems in the existing technology, this invention provides a method for dynamic container traffic penetration in a WebSocket-based CTF platform. The technical problem to be solved by this invention is achieved through the following technical solution:

[0023] This invention provides a method for dynamic container traffic penetration in a CTF platform based on WebSocket, applied to a CTF platform where the CTF platform communicates with the user client. The method includes:

[0024] S100, each contestant sends a creation request to the CTF platform using their client to request a question container;

[0025] S200, the CTF platform automatically creates a challenge container based on the creation request, and sets the destination address for accessing the challenge container and the link address for the CTF platform to connect to the user terminal; wherein, the link address corresponds to the destination address;

[0026] S300, the CTF platform forwards the link address to the corresponding user terminal, so that each contestant can send an access request to the CTF platform through the user terminal to access the link address;

[0027] S400, the CTF platform verifies whether the link address carried in the access request is valid. If it is valid, it sends the result of the validity of the link address back to the user.

[0028] S500, the user terminal creates an access server locally based on the determination result, and sends a connection request to the CTF platform to establish a WS connection through the valid link address determined by the determination result.

[0029] S600, the CTF platform establishes a WS connection with the user terminal and a TCP connection with the question container according to the connection request.

[0030] Beneficial effects:

[0031] 1. Compared to FRP technology, which uses the WebSocket protocol (an upgrade from HTTP), this invention uses HTTPS to encrypt traffic content to ensure security without being blocked by bastion hosts. Similarly, this invention can also utilize CDN technology, which is unavailable in existing technologies, to enhance protection. Furthermore, WebSocket connections use nanoIDs for connection differentiation, offering a much higher degree of randomness than random port numbers. It is not limited by IP addresses or port numbers, allowing for routing of any number of container traffic. This effectively prevents hackers from brute-forcing and polluting other participants' problem-solving environments through enumeration, significantly improving security. The CTF platform of this invention only needs to provide basic HTTP services; external defenses such as CDNs, bastion hosts, and firewalls do not affect the implementation of this invention. It can be used on servers with any security protection requirements, thus having a wide range of applications. The method of this invention can be deployed on a CTF platform without additional servers or other facilities, resulting in low operational costs.

[0032] 2. Compared to VPN technology, which involves complex routing configuration and installation, this invention only requires configuring the mapping rules for WebSocket connections to the corresponding IP address and port on the server side. On the user side, they only need to download a single connector and enter the WebSocket address obtained from the training platform to answer questions directly without any configuration. Therefore, the operation and maintenance cost is low and the invention is easy to use. In addition, this invention provides fine-grained access control for WebSocket, eliminating the possibility of contestants connecting to other devices through subnets.

[0033] The present invention will be further described in detail below with reference to the accompanying drawings and embodiments. Attached Figure Description

[0034] Figure 1This is a flowchart illustrating a method for dynamic container traffic penetration in a WebSocket-based CTF platform provided by the present invention.

[0035] Figure 2 This is a schematic diagram illustrating the process of a dynamic container traffic penetration method for a WebSocket-based CTF platform provided by the present invention;

[0036] Figure 3 This is a schematic diagram of the application of the WebSocket CTF platform provided by the present invention. Detailed Implementation

[0037] The present invention will be further described in detail below with reference to specific embodiments, but the implementation of the present invention is not limited thereto.

[0038] Combination Figures 1-3 This invention provides a method for dynamic container traffic penetration in a CTF platform based on WebSocket, applied to a CTF platform where the CTF platform communicates with the user client. The method includes:

[0039] S100, each contestant sends a creation request to the CTF platform using their client to request a question container;

[0040] The user terminal is equipped with a connector for connecting the user terminal to the CTF platform. The CTF platform is hosted on a website, and the user terminal accesses the CTF platform by entering a URL on the website.

[0041] In this step, each contestant sends a creation request to the CTF platform via a webpage on the website through their client to apply for a question container.

[0042] S200, the CTF platform automatically creates a question container according to the creation request, and sets the destination address for accessing the question container and the link address for the CTF platform to connect to the user terminal; wherein, the link address corresponds to the destination address; there is a mapping relationship between the link address and the destination address.

[0043] S300, the CTF platform forwards the link address to the corresponding user terminal, so that each contestant can send an access request to the CTF platform through the user terminal to access the link address;

[0044] S400, the CTF platform verifies whether the link address carried in the access request is valid. If it is valid, it sends the result of the validity of the link address back to the user.

[0045] S500, the user terminal creates an access server locally based on the determination result, and sends a connection request to the CTF platform to establish a WS connection through the valid link address determined by the determination result.

[0046] The website employs a CDN protection mechanism and a bastion host to maintain its security. Since the WebSocket protocol is an upgrade from the HTTP protocol, HTTPS encryption technology used to protect HTTP, along with technologies such as CDN and bastion hosts, will not block normal WebSocket connections. For risky access, the CDN can still block access through HTTP negotiation requests via WebSocket to protect the server.

[0047] S600, the CTF platform establishes a WS connection with the user terminal and a TCP connection with the question container according to the connection request.

[0048] The CTF platform has management rights over the WS connection. Contestants can only access specific ports through fixed WS connections, and other ports are inaccessible.

[0049] This invention provides a method for dynamic container traffic penetration in a CTF platform based on WebSocket. It uses WebSocket technology for TCP traffic forwarding, and employs a connector on the user end to pass through the TCP traffic load with the CTF platform. It leverages the application-layer advantages of WebSocket to implement HTTPS encryption and CDN protection. This invention finely controls the internal network target IP address and port accessible by each WebSocket connection during WebSocket traffic routing. Users can only perform internal network penetration connections through the obtained WebSocket connections and access a specific address and port. Direct penetration to unauthorized addresses is impossible on the user end, thus ensuring that the contestants' problem-solving environment is not interfered with by external factors during the competition. This method can be applied to a single device, reducing the cost for contestants and platform maintenance.

[0050] In one specific embodiment of the present invention, S200 includes:

[0051] S210, the CTF platform automatically creates a question container based on the creation request, and the question container is a server;

[0052] S220, the CTF platform sets the destination address TCP-1 for accessing the question container and the WebSocket address for the CTF platform to connect to the user's client, and uses the WebSocket address as the connection address;

[0053] S230, the CTF platform caches the destination address and the link address in its own storage space.

[0054] In one specific embodiment of the present invention, S300 includes:

[0055] S310, the CTF platform forwards the link address to the corresponding user terminal;

[0056] S320, each contestant fills in the link address through the connector on the user end, so that the connector sends an access request to the CTF platform to access the link address.

[0057] In one specific embodiment of the present invention, S400 includes:

[0058] S410, the CTF platform queries its own storage space to see if there is a destination address for a question container corresponding to the link address, based on the link address carried in the access request;

[0059] S420, if the CTF platform has a target address for a question container corresponding to the link address in its own storage space, it determines that the link address entered by the connector is valid and sends the determination result of the link address being valid back to the connector.

[0060] In one specific embodiment of the present invention, S500 includes:

[0061] S510, the connector creates an access server locally based on the determination result, and displays the access address of the access server to the contestant through the website; the access server has a corresponding access address;

[0062] S520, the contestant uses the access address as the question address through their own user terminal and sends a first connection request to the access server to establish a TCP connection, thus establishing a TCP connection with the access server.

[0063] S530, after the connector detects the first connection request on the access server, it sends a second connection request to the CTF platform to establish a WS connection; wherein, the second connection request carries a link address that is determined to be valid.

[0064] In one specific embodiment of the present invention, S600 includes:

[0065] S610, after receiving the second connection request, the CTF platform establishes a WS connection with the connector through the link address;

[0066] S620, the CTF platform establishes a TCP connection with the question container based on the destination address corresponding to the link address.

[0067] In one specific embodiment of the present invention, after S600, the WebSocket-based CTF platform dynamic container traffic penetration method further includes:

[0068] Each participant generates attack task traffic data on the user end and sends it to the access server.

[0069] The access server sends the traffic data to the connector;

[0070] The connector sends the traffic data to the CTF platform via a WS connection established with the CTF platform;

[0071] The CTF platform sends the traffic data to the question container via a TCP connection;

[0072] The question container generates response data based on the traffic data, and forwards the response data to the CTF platform via a TCP connection;

[0073] The CTF platform forwards the response data to the connector via the WS connection;

[0074] The connector forwards the response data to the access server;

[0075] The access server forwards the response data to the user terminal, and displays the response data on the user terminal.

[0076] Compared to FRP technology, which uses the WebSocket protocol (an upgrade from HTTP), this invention uses HTTPS to encrypt traffic content to ensure security without being blocked by bastion hosts. Similarly, it can utilize CDN technology, which is unavailable in existing technologies, to enhance protection. Furthermore, WebSocket connections use nanoIDs for connection differentiation, offering a much higher degree of randomness than random port numbers. Unrestricted by IP addresses or port numbers, it can route traffic to any number of containers, effectively preventing hackers from brute-forcing and contaminating other participants' environments through enumeration, significantly improving security. The CTF platform of this invention only needs to provide basic HTTP services; external defenses such as CDNs, bastion hosts, and firewalls do not affect its implementation. It can be used on servers with any security protection requirements, thus having wide applicability. The method of this invention can be deployed on a CTF platform without additional servers or other facilities, resulting in low operational costs.

[0077] Compared to VPN technology, which involves complex routing configuration and installation, this invention only requires configuring the mapping rules for the WebSocket connection to the corresponding IP address and port on the server side. On the user side, they only need to download a single connector and enter the WebSocket address obtained from the training platform to answer questions directly without any configuration. Therefore, the maintenance cost is low and the invention is easy to use. In addition, this invention provides fine-grained access control for WebSocket, eliminating the possibility of contestants connecting to other devices through subnets.

[0078] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this invention, "a plurality of" means two or more, unless otherwise explicitly specified.

[0079] Although this application has been described herein in conjunction with various embodiments, those skilled in the art will understand and implement other variations of the disclosed embodiments by reviewing the accompanying drawings, the disclosure, and the appended claims in carrying out the claimed application. In the claims, the word "comprising" does not exclude other components or steps, and "a" or "an" does not exclude a plurality.

[0080] The above description, in conjunction with specific preferred embodiments, provides a further detailed explanation of the present invention. It should not be construed that the specific implementation of the present invention is limited to these descriptions. For those skilled in the art, various simple deductions or substitutions can be made without departing from the concept of the present invention, and all such modifications and substitutions should be considered within the scope of protection of the present invention.

Claims

1. A method for dynamic container traffic penetration in a CTF platform based on WebSocket, characterized in that, Applied to a CTF platform, where the CTF platform communicates with the user client, the WebSocket-based CTF platform dynamic container traffic penetration method includes: S100, each contestant sends a creation request to the CTF platform using their client to request a question container; S200, the CTF platform automatically creates a challenge container based on the creation request, and sets the destination address for accessing the challenge container and the link address for the CTF platform to connect to the user terminal; wherein, the link address corresponds to the destination address; S300, the CTF platform forwards the link address to the corresponding user terminal, so that each contestant can send an access request to the CTF platform through the user terminal to access the link address; S400, the CTF platform verifies whether the link address carried in the access request is valid. If it is valid, it sends the result of the validity of the link address back to the user. S500, the user terminal creates an access server locally based on the determination result, and sends a connection request to the CTF platform to establish a WS connection through the valid link address determined by the determination result. S600, the CTF platform establishes a WS connection with the user terminal and a TCP connection with the question container according to the connection request.

2. The method for dynamic container traffic penetration in a CTF platform based on WebSocket according to claim 1, characterized in that, The user terminal is equipped with a connector for connecting the user terminal to the CTF platform.

3. The method for dynamic container traffic penetration in a WebSocket-based CTF platform according to claim 2, characterized in that, The CTF platform is hosted on a website, and users access the CTF platform by entering the URL on the website.

4. The method for dynamic container traffic penetration in a WebSocket-based CTF platform according to claim 3, characterized in that, S100 includes: Each contestant sends a creation request to the CTF platform via a webpage on the website through their client to request a question container.

5. The method for dynamic container traffic penetration in a WebSocket-based CTF platform according to claim 3, characterized in that, S200 includes: S210, the CTF platform automatically creates a question container based on the creation request, and the question container is a server; S220, the CTF platform sets the destination address TCP-1 for accessing the question container and the WebSocket address for connecting the CTF platform to the user's client, and uses the WebSocket address as the connection address; S230, the CTF platform caches the destination address and the link address in its own storage space.

6. The method for dynamic container traffic penetration in a WebSocket-based CTF platform according to claim 3, characterized in that, The S300 includes: S310, the CTF platform forwards the link address to the corresponding user terminal; S320, each contestant fills in the link address through the connector on the user end, so that the connector sends an access request to the CTF platform to access the link address.

7. The method for dynamic container traffic penetration in a WebSocket-based CTF platform according to claim 3, characterized in that, The S400 includes: S410, the CTF platform queries its own storage space to see if there is a destination address for a question container corresponding to the link address, based on the link address carried in the access request; S420, if the CTF platform has a target address for a question container corresponding to the link address in its own storage space, it determines that the link address entered by the connector is valid and sends the determination result of the link address being valid back to the connector.

8. The method for dynamic container traffic penetration in a WebSocket-based CTF platform according to claim 3, characterized in that, The S500 includes: S510, the connector creates an access server locally based on the determination result, and displays the access address of the access server to the contestant through the website; the access server has a corresponding access address; S520, the contestant uses the access address as the question address through their own user terminal and sends a first connection request to the access server to establish a TCP connection, thus establishing a TCP connection with the access server. S530, after the connector detects the first connection request on the access server, it sends a second connection request to the CTF platform to establish a WS connection; wherein, the second connection request carries a link address that is determined to be valid.

9. The method for dynamic container traffic penetration in a WebSocket-based CTF platform according to claim 8, characterized in that, The S600 includes: S610, after receiving the second connection request, the CTF platform establishes a WS connection with the connector through the link address; S620, the CTF platform establishes a TCP connection with the question container based on the destination address corresponding to the link address.

10. The method for dynamic container traffic penetration in a WebSocket-based CTF platform according to claim 8, characterized in that, Following S600, the WebSocket-based CTF platform dynamic container traffic penetration method also includes: Each participant generates attack task traffic data on the user end and sends it to the access server. The access server sends the traffic data to the connector; The connector sends the traffic data to the CTF platform via a WS connection established with the CTF platform; The CTF platform sends the traffic data to the question container via a TCP connection; The question container generates response data based on the traffic data, and forwards the response data to the CTF platform via a TCP connection; The CTF platform forwards the response data to the connector via the WS connection; The connector forwards the response data to the access server; The access server forwards the response data to the user terminal, and displays the response data on the user terminal.

Images