OWASP CTF in a Box

Project Overview

OWASP CTF-in-a-Box is a self-hosted platform for running security-learning events. It gives an event everything it needs to run on one machine: team registration, a live leaderboard, an organizer admin panel, and a scoring pipeline. No cloud account, no managed services, and no ongoing bill.

The flagship format grades patches rather than exploits. Contestants fork a deliberately vulnerable application, fix the flaw, and open a pull request. An automated check runs the target's rubric against the patch and the score lands on the leaderboard. Contestants learn to write secure code by fixing insecure code, which is the skill most developers actually need.

• Challenge content plugs in through modules that run alone or together against the same leaderboard:

• Secure Development: patch-to-score challenges against deliberately vulnerable applications

• Quiz: a question bank for knowledge checks

• Jeopardy: a classic category-and-points board

• AI: externally hosted AI security challenges

The Secure Development module ships with six ready-to-use targets and 321 challenges, most of them built on OWASP projects such as WebGoat, Juice Shop, Security Shepherd, and VulnerableApp.

The project is built for the organizers who need this format the most and can least afford to become cloud operators to run it: university courses, OWASP chapter meetings, high-school clubs, conference villages, and weekend workshops. If you can run Docker Compose, you can run an event.