#Introduction

GZ::CTF is an open-source Capture-The-Flag platform built on ASP.NET Core. Upstream it gives organizers highly customizable jeopardy challenges (Static Attachment, Dynamic Attachment, Static Container, Dynamic Container), dynamic scoring with first-blood bonuses, on-demand container distribution over Docker or Kubernetes, real-time scoreboard and submission monitoring over SignalR, TCP-over-WebSocket traffic proxying, Redis/PostgreSQL backends, and object-storage support. For anything that ships in upstream unchanged, the canonical reference is the official documentation at gzctf.gzti.me.

This site documents a fork of that platform. The fork keeps the entire jeopardy platform intact and adds a live, tick-based competition engine on top of it: an Attack & Defense (A&D) mode and a King of the Hill (KotH) mode. These are the additions documented here — everything else behaves as upstream.

#King of the Hill

From the ChallengeType.KingOfTheHill definition in Enums.cs:

ONE shared container per challenge that all teams attack; each tick the team whose rotating token sits in the marker (/koth/king) controls it and earns hold points, and is penalized if the service breaks. Every few ticks the hill resets to base and the per-challenge score leader is briefly network-blocked. Reuses the A&D round/checker/scoreboard engine — handled by explicit cases like A&D.

So KotH reuses the same round/checker/scoreboard machinery as A&D, but instead of a service per team there is a single hill that teams fight to occupy.

#The per-tick checker contract

Each tick, the engine runs a checker against the relevant service container(s). The checker reports one of four statuses, defined by the AdCheckStatus enum in Enums.cs (compatible with the enochecker3 contract):

#The mental model

The most important idea for organizers: a single game can mix all three families of challenge at once — jeopardy challenges, A&D challenges, and KotH challenges — within the same game and the same scoreboard infrastructure. Nothing forces a game to be "an A&D game" or "a jeopardy game."

What decides whether a given challenge is driven by the live engine is a single helper, UsesAdEngine(), defined on ChallengeType in src/GZCTF/Utils/Enums.cs:

/// <summary>
/// Does it run on the shared A&D engine (rounds, ephemeral checker,
/// per-tick scoring, scoreboard) — Attack & Defense or King of the Hill.
/// </summary>
public bool UsesAdEngine() => type is ChallengeType.AttackDefense or ChallengeType.KingOfTheHill;

If UsesAdEngine() is true, the challenge is routed to the AdEngine; otherwise it follows the normal jeopardy path. The two new types also participate in the existing type predicates, which were extended to recognize them:

// A&D is per-team (dynamic-ish) and uses containers, so
// IsDynamic() and IsContainer() both return true for it (and for KotH).

public bool IsDynamic() => type is ChallengeType.DynamicAttachment or ChallengeType.DynamicContainer
    or ChallengeType.AttackDefense or ChallengeType.KingOfTheHill;

public bool IsContainer() => type is ChallengeType.StaticContainer or ChallengeType.DynamicContainer
    or ChallengeType.AttackDefense or ChallengeType.KingOfTheHill;

public bool IsAttackDefense() => type is ChallengeType.AttackDefense;
public bool IsKingOfTheHill() => type is ChallengeType.KingOfTheHill;

The practical consequences of these helpers:

When authoring, you choose the engine for a challenge by setting its ChallengeType to AttackDefense or KingOfTheHill (the values are serialized as those strings). For example, in a challenge definition:

type: AttackDefense   # or: KingOfTheHill

See Challenge YAML and Templates for the full authoring schema, and appsettings for engine-wide configuration.

#Where to next

#License

The core platform is licensed under the GNU Affero General Public License v3.0 (AGPLv3) as published by the upstream project, GZTimeWalker/GZCTF. This documentation describes only the A&D and KotH additions made by this fork; for upstream behavior, configuration, and any restricted-component terms, consult the upstream project and its official documentation at gzctf.gzti.me.