I have been assigned CTF project for IT Security for my final year project in school.

We are planning to have a flag that are base on SQL injection but for the user to overcome the challenge, they would have to compromise the database by dumping the entire database. Now the problem is that, with this vulnerability, there is also a way for the user to access the other database that are also residing on the same server(The database which our CTF application require to use).

My current solution is run a VMWARE machine to host the database and sql injection flag there. I'm planning to use ubuntu, is it a good choice for such purpose? I'm not sure if there is any better solution for it, if you have one please help..

1 Answer 1


No you do not want to store the data used for your CTF on the same machine you are running your CTF project from. Your machines where you store your data should be separate from your other CTF applications.

You wouldn't be the first CTF to get owned, so better be safe than sorry.

  • Thanks for the reply! Does my example below works? server 1 = Hosting CTF application + CTF database? Inside the server 1, VM machine 1= hosting sql injection flag? Should each flag be hosted in a separate VM machine?
    – ysj
    Commented Apr 20, 2013 at 8:17
  • Prerably you run your host without anything on it, VM1 with CTF app + db, VM2 with 1st flag, VM3 with 2nd flag, etc. Commented Apr 20, 2013 at 8:23
  • hmm.. to prevent vulnerability exist in host os? Is ubuntu a good choice as an OS to use?
    – ysj
    Commented Apr 20, 2013 at 8:28
  • As long as its patched and hardened, sure why not. Commented Apr 20, 2013 at 9:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .