Secure Python CTF Engine

An interactive security lab that safely executes untrusted Python code.

Comment

Inspiration

One of the biggest security risks in software is executing untrusted user code. I wanted to build a Capture The Flag (CTF) platform where users solve challenges by writing actual Python code, rather than just answering multiple-choice questions. Because running untrusted code is incredibly dangerous, the core inspiration was building a custom, multi-layered defense system to execute payloads safely without letting attackers destroy the host server.

What it does

It is a web-based coding lab. Users submit Python scripts, and the backend safely runs them in a restricted sandbox. It checks if the code solves the challenge while blocking malicious attacks.

How we built it

  • Backend: Python and FastAPI for the API.
  • Database: SQLite and SQLModel to store challenges and users.
  • Security Layer 1: Python's ast (Abstract Syntax Tree) module to structurally block dangerous code before it runs.
  • Security Layer 2: Python's subprocess module to run code in an isolated environment.
  • Frontend: Vanilla HTML, CSS, and JavaScript. ## Challenges we ran into The hardest part was stopping hackers. First, I tried blocking bad words like "os", but attackers can bypass text filters easily. I solved this by using Python's ast library to scan the actual structure of the code, blocking dangerous functions completely. I also had to stop infinite loops (while True:) from crashing the server. I solved this by adding a strict 2-second timeout to the subprocess. ## Accomplishments that we're proud of I am proud of building a custom security sandbox from scratch without relying on heavy external tools like Docker. Writing a working Abstract Syntax Tree (AST) parser to successfully block evasive hacker payloads was a major technical milestone for me. ## What we learned I learned how to use Python's ast module for static code analysis. I also learned how to manage OS-level processes using the subprocess module, and how to connect a Vanilla JavaScript frontend to a FastAPI backend using CORS. ## What's next for Secure Python CTF Engine The realistic next step is implementing Docker containers. While the AST parser works well for this scope, true enterprise application security requires containerized isolation. I also plan to add a real user authentication system (login/passwords) and a live multiplayer leaderboard.

Built With

Share this project:

Updates