A Star Wars-themed, deliberately vulnerable web application - a hands-on Capture The Flag where you hack your way from the Rebel base to the Emperor's Dark Archive.
The Mission
HackWars is a single, story-driven Flask web app riddled with realistic security holes. There's no account system - every visitor gets their own anonymous run through the galaxy, unlocking pages in sequence as they exploit each vulnerability and collect the flag hidden behind it. It was built as my final project for Harvard's CS50x and later grown into a full 14-flag CTF, complete with a separate privilege-escalation bonus box.
The Arsenal
Fourteen flags spanning the web-security classics, ramped from level 0 to 5 - each one a different technique, all woven into one continuous Star Wars narrative.
Secrets hidden in plain sight - page source, comments, and a leaked credential dump.
Slip a script past a naive filter into the ImperialNet comment wall and watch it fire.
Several layers, from a classic auth bypass to a targeted, column-aware payload.
Reach the admin panel with no credentials, then walk records by ID (IDOR).
An X-Forwarded-For the server trusts a little too much.
An encoded flag that only gives itself up once you shift it back.
SSH into Palpatine's terminal, escalate via a sudo misconfig (GTFOBins), and dig a flag out of an image as root.
Rewards for reading to the very last line of the opening crawl.
Under the Hood
A deliberately compact stack - the point is the vulnerabilities, not the framework. Everything runs from a single container with no shared state, so it's trivial to stand up.
Quick Start
# clone and launch the app git clone https://github.com/JJuly02/CS50-Hackwars cd CS50-Hackwars/project docker compose up --build # → open http://localhost:8000 # optional: the bonus SSH box (#12) cd .. docker compose -f docker-compose.bonus.yml up --build # → ssh ...@localhost -p 2201
Prefer bare Python? pip install -r requirements.txt then flask run. Full challenge catalog & solutions live in the repo.