c4t-but-s4d/s4dfarm

Attack & Defense CTF Farm based on DestructiveFarm

S4DFarm

This is a fork of DestructiveFarm, rewritten by the C4T BuT S4D team over the years.

Running:

• Change the ./server/app/config.py file to your liking (don't forget to change the SERVER_PASSWORD).
• Change external_redis password in docker-compose.yml (of you're planning to use it).
• docker compose up --build -d
• GLHF

Some screenshots:

s4dfarm's Issues

Authorization header uses non constant time password comparison.

Authorization passwords are checked like: if auth != config['SERVER_PASSWORD']
https://github.com/C4T-BuT-S4D/S4DFarm/blob/master/server/app/auth.py#L16

An attacker could potential recover the password faster then guessing. A guessed password that has the first byte correct takes longer to check then a password that has the first byte wrong. Once the first byte is found, one can find the next byte and so on.

https://sqreen.github.io/DevelopersSecurityBestPractices/timing-attack/python

The attacker would need a lot of requests, as there can be quite some jitter and noise in the network, so it's not a very realistic attack, but might be feasable with enough samples.