Hidden Wall Maze

Inspiration

This was inspired by PicoCTF challenges as well as TryHackMe rooms and the Bandit OverTheWire terminal game. While there are many great ways to learn and practice cybersecurity, they can sometimes get boring and dry, which is why we wanted to gamify this learning process while making users learn by doing.

What it does

It is a web and CLI game combined together to provide both an overview of basic cybersecurity concepts and challenges to put those skills in practice. The web-based game is a single-player and multiplayer game where players try to navigate a simple maze that has a "beast" that is moving around randomly to find the players and get them out. There are computers in the game that players can hover over and access, which will display a paragraph explaining a cybersecurity concept, such as cryptography or OSINT. These paragraphs also have some additional reading information for more curious players. A team or one player must read at least 3 of the paragraphs and learn before being able to unlock the door and move on to the terminal game. They may also access the terminal game download link before beating the web game if they feel like it is too easy. The terminal game is a hidden wall maze where players will have to navigate "blindly" until they hit walls, which will then remain in sight. To advance to the next level, they must retrieve a key on the map, navigate to the current level's door, and then solve a CTF-style question to get a password to the next level. They will also encounter Trivia Guards, which are opponents that require cybersecurity-related trivia questions to be defeated. This way, players will keep learning and testing their knowledge in an incentivized environment.

How we built it

The web-based game used HTML, JavaScript, and CSS. This was chosen because we did not need a large database for the backend since we were mainly just working with the game logic and handling HTTP requests. For this, we used Node.js and kept the game's logic in game.js so that the client and server could just share the same protocol with the protocol.js file. The CLI game was made with Python to control the game logic and create an interactive CLI. To let the user access the challenge files separately, we used a Docker image that holds all of the challenge directories, which in turn have the necessary challenge files. When a user gets to a door, a Python script will first build a Docker container and run it before another script initiates an SSH connection to the appropriate level in the Docker container, where the player accesses the challenge files. Each level is locked to owner-level read-only, which ensures players can't traverse levels without going through the maze. Since this is a text-based terminal, files like images can be opened by running a script that downloads them to the local machine, where the user can then do whatever they want with them. After they exit, they will be asked by the game to input the flag they found, which will be checked with a pre-made dictionary and will let the player move up or deny them. For the challenges themselves, a variety of tools such as CyberChef, openstego, and gcc were used to create these challenges. Once they were ready, they were shipped out to be put into the Docker image. Finally, we decided on the overall architecture we wanted, and used coding agents, Claude Code and Codex, to assist with programming these games.

Challenges we ran into

The biggest challenge was being able to connect the Docker image to the game through an SSH session. We had never used this type of architecture, and once we made an image with the Python scripts, the connection kept on closing. Aman add more

Accomplishments that we're proud of

We are proud of being able to complete and merge the web-based and CLI games to create one larger game. Additionally, we were able to figure out how to establish an SSH session with the Docker image through some trial and error and assistance from AI by making sure that we were connecting to the right port because it initially refused to do so.

What we learned

From this project, we learned how to correctly set up a Docker image with isolated files and be able to establish an SSH session to connect to it. This showed us that we didn't always need a whole VM if we wanted to access another machine remotely with the necessary files we wanted, and in an isolated environment. Additionally, we learned how a Node.js server is able to handle HTTP requests and run game logic on a web server.

What's next for Hidden Wall Maze

Additional advancements for Hidden Wall Maze could be to add more challenges that go deeper into cyber-related topics such as side-channel analysis. Another improvement could be to allow multiple multiplayer games at the same time, as the current server only supports 1 multiplayer game. For the CLI game, the current method of establishing an SSH session with the Docker image is only supported on Unix shells, limiting it to those with a Linux or Mac machine, so we would also like Windows users to access the challenges in the Docker image. This way, more players can learn together!