Harvard CS50x · Final Project

HackWarsThe Vulnerabilities Strike Back

A Star Wars-themed, deliberately vulnerable web application - a hands-on Capture The Flag where you hack your way from the Rebel base to the Emperor's Dark Archive.

Objective: recover all 14 flags  ·  format CTF{…}

The Mission

What it is

HackWars is a single, story-driven Flask web app riddled with realistic security holes. There's no account system - every visitor gets their own anonymous run through the galaxy, unlocking pages in sequence as they exploit each vulnerability and collect the flag hidden behind it. It was built as my final project for Harvard's CS50x and later grown into a full 14-flag CTF, complete with a separate privilege-escalation bonus box.

Built entirely by me as my CS50x program-completion project. It's intentionally insecure by design - meant to be run locally or on an isolated host for learning and CTF play, never exposed on a network you care about.

The Arsenal

Vulnerabilities to exploit

Fourteen flags spanning the web-security classics, ramped from level 0 to 5 - each one a different technique, all woven into one continuous Star Wars narrative.

Recon

Information Disclosure

Secrets hidden in plain sight - page source, comments, and a leaked credential dump.

Injection

Stored XSS

Slip a script past a naive filter into the ImperialNet comment wall and watch it fire.

Injection

SQL Injection

Several layers, from a classic auth bypass to a targeted, column-aware payload.

Access

Broken Access Control

Reach the admin panel with no credentials, then walk records by ID (IDOR).

Trust

Header Spoofing

An X-Forwarded-For the server trusts a little too much.

Crypto

Caesar Cipher

An encoded flag that only gives itself up once you shift it back.

Bonus · pwn

Privesc → Steganography

SSH into Palpatine's terminal, escalate via a sudo misconfig (GTFOBins), and dig a flag out of an image as root.

Patience

Easter Eggs

Rewards for reading to the very last line of the opening crawl.

Under the Hood

How it's built

A deliberately compact stack - the point is the vulnerabilities, not the framework. Everything runs from a single container with no shared state, so it's trivial to stand up.

PythonFlaskJinja2 gunicornSQLiteDocker HTML / CSSLinux / SSH
  • Story-driven & stateful - sequential unlocks tracked per browser via signed-cookie sessions.
  • Single-container deploy - no database writes, no session store, so it scales sideways for free.
  • Bonus vulnbox - a separate SSH image for the privesc + stego capstone.

Quick Start

Run it

# clone and launch the app
git clone https://github.com/JJuly02/CS50-Hackwars
cd CS50-Hackwars/project
docker compose up --build
# → open http://localhost:8000

# optional: the bonus SSH box (#12)
cd ..
docker compose -f docker-compose.bonus.yml up --build
# → ssh ...@localhost -p 2201

Prefer bare Python? pip install -r requirements.txt then flask run. Full challenge catalog & solutions live in the repo.