I've attended several CTF contests and I'd like to implement a CTF system for my students. I asked Google about designing such system but it's fruitless. Any ideas?
As mentioned by this.josh, you can look at multiple already existing vulnerable applications in this question or you might try to find existing CTF source codes - for example, look at the OWASP hackademic challenges. You might just take one of these and modify them slightly for your students. Also, try to contact authors of past CTF's - they might help you by giving their source codes. Here's a handy calendar of various CTF challenges with appropriate links.
I once stumbled upon a OS VM machine which is called Metasploitable, it is made by the creators of Metasploit and is used as a target machine for practicing.
It is, and this is a quote from the page:
Ubuntu 8.04 server install on a VMWare 6.5 image. A number of vulnerable packages are >included, including an install of tomcat 5.5 (with weak credentials), distcc, tikiwiki, >twiki, and an older mysql.
If you go through some exploits yourself, you can assign these tasks to your students and give them some guidelines.
Here is the link:
And a link for the metasploit framework
And last but not least, Backtrack 5, if you havnt already introduced your students to this OS and compilation of pentest software:
Instead of creating a new demo system with intentional vulnerabilities from scratch, take a look first at the existing ones:
Google's Gruyere codelab, "Web Application Exploits and Defenses" http://google-gruyere.appspot.com/
OWASP's WebGoat: https://www.owasp.org/index.php/Category:OWASP_WebGoat_Project
organizer of previous CTF events here.
First thing, write down a simple score board system, then decide how many and which categories you would like to have on ur event. If you look at this photo https://p.twimg.com/Ad_ncp0CAAE7L_I.jpg:large < its the last CTF I organized at codebits.eu it was an event for 10 teams with 4 elements each.
It had 4 categories:
- Web apps
If you want to have a look at some sample CTF challenges I have a list of websites I can provide you with:
-http://balgan.eu/?page_id=67 << (My Website)
Hope its helpeful, feel free to ask more question if u need some help!
You might take a look at the International Capture The Flag run by folks at UCSB.
If case anyone still needs an ingame management system for CTF's my research team wrote our own scoreboard which we have now made available to the world at: http://www.ptcoresec.eu/?p=347