Hugging Face's logo

Spaces:
Alpha-Team
/
CyberArena
Sleeping

App Files Community
CyberArena
File size: 12,585 Bytes
80a4a65
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
cb16781
 
 
 
 
 
 
 
 
 
 
 
 
80a4a65
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
"""Pure constants — no I/O, no imports beyond stdlib.

This module is the single source of truth for the topic catalog, the
difficulty / module maps, and the small strings the backend embeds
verbatim in HTTP responses (HTML fallback, terminal help text, etc.).
"""

import os


# --------------------------------------------------------------------------- #
#  Topic catalog (module key -> human-readable name + category + path)        #
# --------------------------------------------------------------------------- #

MODULE_TOPIC_MAP = {
    "xss": "ثغرات XSS (Cross-Site Scripting) - هجمات الحقن البرمجي في المتصفح",
    "sql-injection": "ثغرات SQL Injection - حقن استعلامات خبيثة في قاعدة البيانات",
    "csrf": "ثغرات CSRF (Cross-Site Request Forgery) - تزوير الطلبات عبر المواقع",
    "auth-bypass": "ثغرات المصادقة - تجاوز أنظمة تسجيل الدخول",
    "misconfig": "التكوين الأمني الخاطئ - إعدادات غير آمنة",
    "packet-analysis": "تحليل حزم الشبكة Network Packet Analysis",
    "firewall": "جدران الحماية Firewall Configuration",
    "scanning": "مسح الشبكات Network Scanning",
    "encryption-basics": "أساسيات التشفير Encryption",
    "hash-cracking": "كسر الهاش Hash Cracking",
    "log-analysis": "تحليل سجلات الخادم Log Analysis",
    "forensics": "الأدلة الرقمية Forensics",
}


CYBER_SECURITY_TOPICS = {
    # 1. Web Security
    "xss": {"name": "ثغرات XSS (Cross-Site Scripting)", "category": "Web Security", "path": "web-security"},
    "sql-injection": {"name": "ثغرات SQL Injection", "category": "Web Security", "path": "web-security"},
    "csrf": {"name": "ثغرات CSRF (Cross-Site Request Forgery)", "category": "Web Security", "path": "web-security"},
    "ssrf": {"name": "ثغرات SSRF (Server-Side Request Forgery)", "category": "Web Security", "path": "web-security"},
    "idor": {"name": "ثغرات IDOR (Insecure Direct Object Reference)", "category": "Web Security", "path": "web-security"},
    "lfi-rfi": {"name": "ثغرات تضمين الملفات LFI/RFI", "category": "Web Security", "path": "web-security"},
    "xxe": {"name": "ثغرات XML External Entity (XXE)", "category": "Web Security", "path": "web-security"},
    "command-injection": {"name": "حقن الأوامر البرمجية Command Injection", "category": "Web Security", "path": "web-security"},
    # New 10-module set (replaces the 13 above)
    "sqli":   {"name": "ثغرات SQL Injection",        "category": "Web Security", "path": "web-security"},
    "cmdi":   {"name": "حقن الأوامر Command Injection","category": "Web Security", "path": "web-security"},
    "auth":   {"name": "ثغرات المصادقة Auth Flaws",    "category": "Web Security", "path": "web-security"},
    "upload": {"name": "رفع الملفات الخبيثة Upload",    "category": "Web Security", "path": "web-security"},

    # 2. Network Security
    "packet-analysis": {"name": "تحليل حزم الشبكات Packet Analysis", "category": "Network Security", "path": "network-security"},
    "firewall": {"name": "إعدادات وجدران الحماية Firewall", "category": "Network Security", "path": "network-security"},
    "scanning": {"name": "مسح وتفحص الشبكات Network Scanning", "category": "Network Security", "path": "network-security"},
    "mitm": {"name": "هجمات رجل في المنتصف MITM Attacks", "category": "Network Security", "path": "network-security"},
    "dns-poisoning": {"name": "تسميم سجلات الـ DNS", "category": "Network Security", "path": "network-security"},

    # 3. Cryptography
    "encryption-basics": {"name": "أساسيات التشفير وفك الترميز", "category": "Cryptography", "path": "cryptography"},
    "hash-cracking": {"name": "كسر شفرات الهاش Hash Cracking", "category": "Cryptography", "path": "cryptography"},
    "rsa-aes": {"name": "خوارزميات التشفير المتقدمة RSA/AES", "category": "Cryptography", "path": "cryptography"},
    "steganography": {"name": "إخفاء المعلومات في الوسائط Steganography", "category": "Cryptography", "path": "cryptography"},

    # 4. Reverse Engineering & Binaries
    "binary-analysis": {"name": "تحليل الملفات الثنائية Binary Analysis", "category": "Reverse Engineering", "path": "reverse-engineering"},
    "assembly-cracking": {"name": "هندسة الأكواد العكسية وقراءة الأسمبلي", "category": "Reverse Engineering", "path": "reverse-engineering"},

    # 5. OS & Systems Security
    "linux-privesc": {"name": "تصعيد الصلاحيات في أنظمة Linux", "category": "Systems Security", "path": "systems-security"},
    "windows-privesc": {"name": "تصعيد الصلاحيات في أنظمة Windows", "category": "Systems Security", "path": "systems-security"},
    "active-directory": {"name": "اختراق وإدارة بيئة الـ Active Directory", "category": "Systems Security", "path": "systems-security"},

    # 6. Mobile Security
    "android-ios": {"name": "أمن تطبيقات الهواتف الذكية Android/iOS", "category": "Mobile Security", "path": "mobile-security"},

    # 7. Cloud Security
    "cloud-config": {"name": "أمن الخدمات السحابية وتهيئة الحاويات Docker/Kubernetes", "category": "Cloud Security", "path": "cloud-security"},

    # 8. Digital Forensics & Log Analysis
    "log-analysis": {"name": "تحليل سجلات الخادم والأنظمة Log Analysis", "category": "Digital Forensics", "path": "forensics"},
    "memory-forensics": {"name": "تحليل الذاكرة العشوائية Memory Forensics", "category": "Digital Forensics", "path": "forensics"},

    # 9. Code Fixing (Blue Team)
    "code-fixing": {"name": "تصحيح الكود المصاب بثغرات أمنية", "category": "تصحيح الكود (Code Fixing)", "path": "code-fixing"},
    "web-security": {"name": "تصحيح الكود المصاب بثغرات أمنية", "category": "تصحيح الكود (Code Fixing)", "path": "code-fixing"},
    "systems-security": {"name": "تصحيح الكود المصاب بثغرات أمنية", "category": "تصحيح الكود (Code Fixing)", "path": "code-fixing"},

    # 10. Vulnerability Hunter (Blue Team)
    "vulnerability-hunter": {"name": "صياد الثغرات Vulnerability Hunter", "category": "Vulnerability Hunter", "path": "vulnerability-hunter"},

    # 11. Web Exploitation (Red Team)
    "web-exploitation": {"name": "استغلال تطبيقات الويب", "category": "Web Exploitation", "path": "web-exploitation"},
    "xss": {"name": "ثغرات XSS", "category": "Web Exploitation", "path": "web-exploitation"},
    "sqli": {"name": "ثغرات SQL Injection", "category": "Web Exploitation", "path": "web-exploitation"},
    "csrf": {"name": "ثغرات CSRF", "category": "Web Exploitation", "path": "web-exploitation"},
    "ssrf": {"name": "ثغرات SSRF", "category": "Web Exploitation", "path": "web-exploitation"},
    "idor": {"name": "ثغرات IDOR", "category": "Web Exploitation", "path": "web-exploitation"},
    "lfi": {"name": "ثغرات LFI/RFI", "category": "Web Exploitation", "path": "web-exploitation"},
    "xxe": {"name": "ثغرات XXE", "category": "Web Exploitation", "path": "web-exploitation"},
    "cmdi": {"name": "حقن الأوامر", "category": "Web Exploitation", "path": "web-exploitation"},
    "auth": {"name": "ثغرات المصادقة", "category": "Web Exploitation", "path": "web-exploitation"},
    "upload": {"name": "رفع الملفات", "category": "Web Exploitation", "path": "web-exploitation"},
}


TOPIC_KEYWORDS = {
    "xss": ["xss", "cross-site", "حقن نصوص", "innerHTML", "script", "تعليق", "textContent"],
    "sql-injection": ["sql", "injection", "استعلام", "قاعدة بيانات", "database", "query", "select", "union"],
    "csrf": ["csrf", "forgery", "تزوير الطلبات", "طلب عبر المواقع", "token", "رمز الحماية"],
    "ssrf": ["ssrf", "server-side request", "تزوير الطلب من جانب الخادم", "طلب داخلي", "fetch"],
    "idor": ["idor", "direct object", "معرف", "رابط مباشر", "projectId", "userId", "OID"],
    "lfi-rfi": ["lfi", "rfi", "تضمين", "ملفات", "include", "file inclusion"],
    "xxe": ["xxe", "xml", "external entity", "كيان خارجي", "entity"],
    "command-injection": ["command", "أوامر", "exec", "system", "حقن الأوامر"],
    "packet-analysis": ["packet", "حزم", "شبكة", "pcap", "wireshark", "تحليل حزم"],
    "firewall": ["firewall", "جدار حماية", "جدران حماية", "قواعد المرور", "port", "منفذ"],
    "scanning": ["scan", "مسح", "فحص شبكات", "nmap", "منفذ مفتوح", "ports"],
    "mitm": ["mitm", "رجل في المنتصف", "منصف", "تسميم", "arp poisoning", "dns poisoning"],
    "dns-poisoning": ["dns", "poisoning", "تسميم سجلات", "نظام أسماء النطاقات"],
    "encryption-basics": ["encryption", "تشفير", "فك ترميز", "base64", "rot13", "caesar", "cipher"],
    "hash-cracking": ["hash", "هاش", "md5", "sha", "cracking", "كسر"],
    "rsa-aes": ["rsa", "aes", "خوارزميات التشفير المتقدمة"],
    "steganography": ["steganography", "إخفاء", "وسائط", "صورة", "ملف مخفي"],
    "binary-analysis": ["binary", "ثنائي", "ملف ثنائي", "قراءة الملفات الثنائية"],
    "assembly-cracking": ["assembly", "أسمبلي", "عكسي", "هندسة عكسية"],
    "linux-privesc": ["linux", "صلاحيات root", "تصعيد", "privilege escalation"],
    "windows-privesc": ["windows", "صلاحيات", "تصعيد", "administrator"],
    "active-directory": ["active directory", "دليل نشط", "kerberos", "domain controller"],
    "android-ios": ["android", "ios", "هاتف", "تطبيق ذكي", "موبايل"],
    "cloud-config": ["cloud", "docker", "kubernetes", "سحابية", "حاويات"],
    "log-analysis": ["log", "سجل", "سجلات", "خادم", "تحليل سجلات"],
    "memory-forensics": ["memory", "ذاكرة عشوائية", "forensics", "volatility"],
}


# Web exploitation module set (Red Team offensive) — used by
# app.core.module_router.challenge_type_for_module.
WEB_EXPLOIT_MODULES = {
    "xss", "sqli", "csrf", "ssrf",
    "idor", "lfi-rfi", "xxe", "cmdi",
    "auth", "upload",
}


# --------------------------------------------------------------------------- #
#  Embedded HTML / text the backend serves when AI generation fails            #
# --------------------------------------------------------------------------- #

FALLBACK_HTML = """<!DOCTYPE html><html dir="rtl" lang="ar"><head><meta charset="UTF-8"><style>body{margin:0;padding:40px;font-family:sans-serif;background:#0b0b12;color:#fff;display:flex;flex-direction:column;align-items:center;justify-content:center;min-height:100vh;text-align:center}h1{color:#00d4aa;font-size:22px;margin-bottom:16px}p{color:rgba(255,255,255,0.6);font-size:14px;line-height:1.8;max-width:500px}</style></head><body><h1>🔐 منصة APEX للتدريب</h1><p>بيئة التدريب التفاعلية جاهزة. اتبع التعليمات في لوحة المهام على اليمين لإكمال التحدي.</p></body></html>"""


HELP_TEXT = """الأوامر الأساسية (تعمل دائماً):
  ls, cat <file>, pwd, echo <text>, whoami, clear, help
  sha256sum <file>, md5sum <file>, sha1sum <file>
  base64 [-d] <file>     ترميز/فك Base64
  xxd <file>             عرض hex
  tr SET1 SET2 <text>    استبدال أحرف

الأدوات الخارجية (مفعّلة لهذا التحدي): انظر whitelist في Cheat Sheet.
  مثال:  python -c "print('hello')"
          openssl enc -d -aes-256-cbc -in f.enc -k SECRET
"""


# --------------------------------------------------------------------------- #
#  Certificate system tuning                                                 #
# --------------------------------------------------------------------------- #

CERT_REQUIRED_COMPLETIONS = 50
CERT_VERIFY_BASE_URL = os.environ.get("CERT_VERIFY_BASE_URL", "").rstrip("/")