Assess real talent. Hire verified cybersecurity engineers.
Ricoz CTF Platform replaces theoretical multiple-choice quizzes with live, hands-on Capture The Flag assessments. Candidates prove their practical skills in Web Exploitation, Cryptography, and Reverse Engineering.
Engine Architecture
Ricoz CTF Assessment Stack
Monorepo
Next.js 15 & Fastify
Enterprise Stack
Database
MongoDB + Mongoose
Dual-Resilient Engine
Engineered with 3 distinct access roles.
Every endpoint and portal view is enforced via Fastify JWT authentication and authorize guards.
Full Tenant Control
Manage company profiles, invite reviewers, publish assessments, configure passing criteria, and manage all challenges.
API: GET /api/auth/admin-only
Challenge Authoring
Author challenges with secret flags, hints, docker image endpoints, categories, points, and dynamic score formulas.
Global Candidate Analytics
Inspect live assessment leaderboards, monitor flag submission frequency, and detect abnormal solve anomalies.
Domain Models & Persistence
Schema in packages/database
User
Platform & tenant users with RBAC
Company
Tenant organizations hiring talent
Assessment
Cybersecurity skill assessment batches
Challenge
Hands-on CTF labs and challenges
Submission
Candidate flag submissions & score history
AssessmentCandidate
Candidate test session & progress state
Hands-on Vulnerability Labs
Seeded challenges ready to test via the database seed.
SQLi Administrative Bypass
Analyze legacy login queries and bypass authentication via union-based SQL injection vulnerability.
Flag Format
ricoz{sql_injection_bypass_success_2026}
JWT None Algorithm Escalation
Exploit flawed token signature validation logic to forge an admin role JWT header.
Flag Format
ricoz{jwt_none_alg_privilege_escalation}
RSA Fermat Modulus Factorization
Extract confidential secrets by factorizing close-prime RSA modulus keys with custom scripts.
Flag Format
ricoz{fermat_factorization_revealed_keys}
ELF License Keygen Crack
Disassemble stripped x86_64 ELF binary and reverse anti-debugging routines to generate license keys.
Flag Format
ricoz{anti_debug_stripped_binary_mastery}
Try the Authentication & Role System
Sign in using the pre-seeded Admin, Reviewer, or Candidate accounts, or register a new user to test the Fastify JWT APIs.