Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have been assigned CTF project for IT Security for my final year project in school.

We are planning to have a flag that are base on SQL injection but for the user to overcome the challenge, they would have to compromise the database by dumping the entire database. Now the problem is that, with this vulnerability, there is also a way for the user to access the other database that are also residing on the same server(The database which our CTF application require to use).

My current solution is run a VMWARE machine to host the database and sql injection flag there. I'm planning to use ubuntu, is it a good choice for such purpose? I'm not sure if there is any better solution for it, if you have one please help..

share|improve this question
add comment

1 Answer

up vote 1 down vote accepted

No you do not want to store the data used for your CTF on the same machine you are running your CTF project from. Your machines where you store your data should be separate from your other CTF applications.

You wouldn't be the first CTF to get owned, so better be safe than sorry.

share|improve this answer
    
Thanks for the reply! Does my example below works? server 1 = Hosting CTF application + CTF database? Inside the server 1, VM machine 1= hosting sql injection flag? Should each flag be hosted in a separate VM machine? –  ysj Apr 20 '13 at 8:17
    
Prerably you run your host without anything on it, VM1 with CTF app + db, VM2 with 1st flag, VM3 with 2nd flag, etc. –  Lucas Kauffman Apr 20 '13 at 8:23
    
hmm.. to prevent vulnerability exist in host os? Is ubuntu a good choice as an OS to use? –  ysj Apr 20 '13 at 8:28
    
As long as its patched and hardened, sure why not. –  Lucas Kauffman Apr 20 '13 at 9:15
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.