Merge remote-tracking branch 'origin/develop' into develop

Author: bkimminich

README.md

@@ -57,7 +57,7 @@ desired configuration in a file with the following format:
 ```yaml
 ctfFramework: CTFd | FBCTF | RootTheBox
 juiceShopUrl: https://juice-shop.herokuapp.com
-ctfKey: https://raw.githubusercontent.com/bkimminich/juice-shop/master/ctf.key # can also be actual key instead URL
+ctfKey: https://raw.githubusercontent.com/bkimminich/juice-shop/master/ctf.key # can also be actual key or comma-separated list of keys (CTFd only) instead of URL
 countryMapping: https://raw.githubusercontent.com/bkimminich/juice-shop/master/config/fbctf.yml # ignored for CTFd and RootTheBox
 insertHints: none | free | paid # "paid" handled as "free" for CTFd
 insertHintUrls: none | free | paid # optional for FBCTF; "paid" handled as "free" for CTFd

index.js

@@ -48,7 +48,7 @@ const questions = [
   {
     type: 'input',
     name: 'ctfKey',
-    message: 'Secret key <or> URL to ctf.key file?',
+    message: 'URL to ctf.key file <or> secret key <or> (CTFd only) comma-separated list of secret keys?',
     default: 'https://raw.githubusercontent.com/bkimminich/juice-shop/master/ctf.key'
   },
   {

lib/generators/ctfd.js

@@ -40,6 +40,9 @@ function createCtfdExport (challenges, { insertHints, insertHintUrls, insertHint
   }
 */
 
+  //  In the flags section of the returned data we iterate through the result of string splitting by comma, and compute the hash of the single flag key + challenge name.
+  //  Format expected is: challenge3,challenge description,category3,100,dynamic,visible,0,"flag1,flag2,flag3","tag1,tag2,tag3","hint1,hint2,hint3","{""initial"":100, ""minimum"":10, ""decay"":10}"
+  //  If we provide a single key with no commas, we do not incapsulate the output in a "" pair.
   return new Promise((resolve, reject) => {
     try {
       const data = []
@@ -55,7 +58,7 @@ function createCtfdExport (challenges, { insertHints, insertHintUrls, insertHint
               type: 'standard',
               state: 'visible',
               max_attempts: 0,
-              flags: hmacSha1(ctfKey, challenge.name),
+              flags: ctfKey.split(',').length === 1 ? hmacSha1(ctfKey, challenge.name) : `"${ctfKey.split(',').map(key => `${hmacSha1(key, challenge.name)}`).join(',')}"`,
               tags: challenge.tags ? `"${challenge.tags}"` : '',
               hints: insertChallengeHints(challenge),
               // hint_cost: insertChallengeHintCosts(challenge),