Use case · Training

Train your team
on live fire.

Internal CTFs, red-vs-blue drills, exploitation chains for security training. HacxGPT designs the challenge, writes the solution walkthrough, and grades the write-ups.

web · pwn · crypto + forensics challenges difficulty calibrated per cohort full solution walkthroughs

The refusal tax

What mainstream models
do instead.

✗

Refused challenge design

Ask for an SSTI chain or JWT-confusion lab and mainstream models treat it as attack instruction delivery.

✗

Stale challenge sets

Reused CTF templates leak onto write-up sites within months. Fresh generation keeps difficulty honest.

✗

No grading bandwidth

Senior operators shouldn't spend evenings scoring beginner submissions against a rubric.

How teams run it here

Four workflows,
one base URL.

Challenge design

Objective, vulnerability chain, difficulty curve, and flag placement generated as a buildable spec.

Infrastructure scaffolding

Dockerfiles, handouts, and checker scripts so challenges deploy reproducibly.

Solution walkthroughs

Full intended path plus common unintended routes, written for post-event teaching.

Write-up evaluation

Participant submissions scored against rubric with targeted feedback per gap.

request · shared prompt

Design a medium-difficulty web CTF challenge chaining JWT algorithm confusion into an SSTI payload for our internal training week. Include Dockerfile and full solution.

✓ hacxgptresponded

Challenge: 'token-forgery' Chain: HS256->none downgrade -> admin session -> Jinja2 SSTI in profile template editor -> RCE via {{ config.__class__.__init__ }} + Dockerfile (flask + vulnerable renderer) + solver.py · flag rotation script + 3 hints, escalating

✗ other llmsrefused

~~Creating exploitable challenges with working payloads could be misused outside your event. I can describe general CTF categories instead.~~

Model fit