PwnHub - CTF Collaboration Platform

A collaborative Capture The Flag (CTF) platform built with bash-stack, designed for cybersecurity teams competing in CTF competitions.

---

Features

Authentication & Security

• Secure user registration and login with password hashing
• Session management with configurable timeouts
• User profiles with specialties and display names
• Basic brute force protection
• File upload validation

Challenge Management

• Challenge tracking across multiple categories (Web, Pwn, Crypto, Reverse, Forensics, Misc)
• Status updates (Not Started, In Progress, Solved)
• Team collaboration with member assignment
• Shared notes per challenge
• Simple scoring system
• File upload and download for challenges

Security Tools

Basic security tools for CTF competitions:

Category	Tools Available
Text & Encoding	JSON Formatter, Hash Identifier, Base Converter, URL Encoder/Decoder
Cryptography	Caesar Decoder, GCD/LCM Calculator, Prime Tools, JWT Decoder
Web Security	Timestamp Converter, JWT Token Analysis
Analysis	Pattern Detection tools

Wordlist Management

• Collection of common wordlists for penetration testing
• Custom wordlist uploads with metadata
• SQL injection payload collection
• Directory and subdomain enumeration lists
• Download functionality for team sharing

Team Collaboration

• Live status tracking with periodic updates
• Shared notes per challenge
• Progress tracking and team statistics
• Specialty tracking for team members
• Real-time coordination using HTMX

---

Installation

Prerequisites

• Linux system (tested on Arch-based distributions)
• Bash shell (4.0+)
• TCP server: tcpserver (ucspi-tcp) or netcat
• Optional: Node.js + npm for Tailwind development

Quick Start

# Clone the repository
git clone https://github.com/Maybe4a6f7365/PwnHub.git
cd PwnHub

# Make scripts executable
chmod +x start.sh core.sh pages/**/*.sh

# Configure (optional)
nano config.sh

# Launch PwnHub
./start.sh

# Access at http://localhost:3000

Development Mode

# Enable Tailwind CSS watching
TAILWIND=true ./start.sh

---

Project Structure

PwnHub/
├── pages/                    # Application routes & API
│   ├── index.sh             # Main interface
│   ├── api/                 # REST API endpoints
│   │   ├── challenges.sh    # Challenge management
│   │   ├── tools/           # Security tool implementations
│   │   ├── wordlists/       # Wordlist handlers
│   │   └── team.sh          # Team collaboration
│   └── uploads/             # Dynamic file serving
├── static/                  # Frontend assets
│   ├── style.css           # UI styles
│   └── script.js           # Client-side logic
├── includes/               # Shared utilities
│   ├── auth.sh            # Authentication library
│   └── icons.sh           # Icon definitions
├── data/                   # Application data
├── core.sh                # bash-stack framework
├── config.sh              # Configuration
└── LICENSE                # MIT License

Security Features

• Password hashing with multiple rounds
• Input validation and sanitization
• Basic rate limiting protection
• File upload validation
• Session security with secure tokens

---

Configuration

Key configuration options in config.sh:

# Basic settings
PROJECT_NAME=PwnHub
ENABLE_SESSIONS=true

# Security settings
MIN_PASSWORD_LENGTH=8
SESSION_TIMEOUT=3600
MAX_LOGIN_ATTEMPTS=5

# File upload settings  
MAX_UPLOAD_SIZE=52428800
ALLOWED_UPLOAD_EXTENSIONS="txt,py,sh,md,js,zip,tar,gz"

# Performance settings
API_RATE_LIMIT=100

---

Deployment

Docker Deployment

# Build container
docker build -t pwnhub .

# Run with port mapping
docker run -p 3000:3000 pwnhub

Manual Deployment

# Install dependencies (Arch Linux)
sudo pacman -S ucspi-tcp

# Install dependencies (Debian/Ubuntu)
sudo apt-get install ucspi-tcp

# Launch server
./start.sh

Security Note: This is built for learning and small CTF teams, not production use. If you deploy it, use proper access controls like Cloudflare tunnels, ngrok, or VPN. Be careful about who you give access to.

---

Development

Adding New Security Tools

1. Create tool script in pages/api/tools/your-tool.sh
2. Add tool card to pages/api/tools.sh
3. Follow existing patterns for consistency
4. Test with various inputs

Extending Wordlist Collections

1. Add wordlist metadata to pages/api/wordlists.sh
2. Implement download handler if needed
3. Include source attribution

---

License

This project is licensed under the MIT License - see the LICENSE file for details.

Built with bash-stack

---

Contributing

Contributions are welcome. Please ensure:

• All scripts are tested and follow existing patterns
• Security practices are maintained
• Documentation is updated for new features
• Code style is consistent with the project