└── README.md


/README.md:
--------------------------------------------------------------------------------
  1 | # Practice your hacking skills with these CTFs
  2 | List of practice sites
  3 | <ul>
  4 |   <li><a href="https://github.com/BishopFox/cloudfoxable?tab=readme-ov-file">CloudFoxable: Open-source AWS penetration testing playground</a></li>
  5 |   <li><a href="http://www.itsecgames.com/">bWAPP</a></li>
  6 |   <li><a href="https://cryptopals.com/">Cryptopals</a> - Cryptographic programming challenges</li>
  7 |   <li><a href="https://ctfchallenge.co.uk/">CTF Challenge</a></li>
  8 |   <li><a href="https://ctf365.com/">CTF365</a></li>
  9 |   <li><a href="https://ctflearn.com/">CTFlearn</a></li>
 10 |   <li><a href="https://ctftime.org/">CTFTime</a></li>
 11 |   <li><a href="https://www.enigmagroup.org/">Enigma Group</a></li>
 12 |   <li><a href="http://www.gameofhacks.com/">Game of Hacks</a></li>
 13 |   <li><a href="http://google-gruyere.appspot.com/">Google Gruyere</a> - Vulnerable web app</li>
 14 |   <li><a href="https://xss-game.appspot.com/">Google XSS Game</a> - Cross-site scripting for beginners</li>
 15 |   <li><a href="https://www.hackthissite.org/">Hack This Site</a></li>
 16 |   <li><a href="https://hack.me/">Hack.me</a></li>
 17 |   <li><a href="https://www.hacking-lab.com/index.html">Hacking-Lab</a></li>
 18 |   <li><a href="https://www.hackthis.co.uk/">HackThis!!</a></li>
 19 |   <li><a href="https://www.hellboundhackers.org/">Hellbound Hackers </a></li>
 20 |   <li><a href="http://io.netgarage.org/">IO</a></li>
 21 |   <li><a href="https://github.com/bkimminich/juice-shop">Juice shop</a> - Vulnerable web app</li>
 22 |   <li><a href="https://microcorruption.com/">Microcorruption</a> - ARM disassembling</li>
 23 |   <li><a href="http://overthewire.org/wargames/">Over The Wire wargames</a></li>
 24 |   <li><a href="https://www.owasp.org/index.php/Category:OWASP_WebGoat_Project">OWASP WebGoat 1.2</a></li>
 25 |   <li><a href="https://picoctf.com/">picoCTF</a></li>
 26 |   <li><a href="https://portswigger.net/web-security">Portswigger’s Web Security Academy</a></li>
 27 |   <li><a href="https://pwn0.com/">pwn0</a></li>
 28 |   <li><a href="http://pwnable.kr/">pwnable.kr</a></li>
 29 |   <li><a href="https://pwnable.tw/">pwnable.tw</a></li>
 30 |   <li><a href="http://reversing.kr/">Reversing.kr</a></li>
 31 |   <li><a href="https://ringzer0team.com/">RingZer0 Team Online CTF</a></li>
 32 |   <li><a href="https://www.root-me.org/">Root Me</a></li>
 33 |   <li><a href="http://smashthestack.org/">SmashTheStack</a></li>
 34 |   <li><a href="http://www.try2hack.nl/">Try2Hack</a></li>
 35 |   <li><a href="https://www.prismacsi.com/en/typhoon-vulnerable-virtual-machines/">Typhoon vulnerable VM</a></li>
 36 |   <li><a href="https://w3challs.com/">W3Challs</a></li>
 37 |   <li><a href="https://github.com/cure53/XSSChallengeWiki/wiki">XSS Challenge Wiki</a></li>
 38 | </ul>
 39 | 
 40 | ---
 41 | <ul>
 42 |   <li><a href="https://github.com/roya0045/Pentest-practice">Pentest-practice</a></li>
 43 |   <li><a href="http://captf.com/practice-ctf/">Practice CTF List</a></li>
 44 | </ul>
 45 | 
 46 | ---
 47 | <h1>Practice CTF List / Permanant CTF List</h1>
 48 | 
 49 | <p>Here's a list of some CTF practice sites and tools or CTFs that are long-running. Thanks, RSnake for starting the original that this is based on. If you have any corrections or suggestions, feel free to email ctf at the domain psifertex with a dot com tld.</p>
 50 | 
 51 | <h2>Live Online Games</h2>
 52 | <h4>Recommended</h4>
 53 | <p>Whether they're being updated, contain high quality challenges, or just have a lot of depth, these are probably where you want to spend the most time.</p>
 54 | <ul>
 55 | 	<li><a href="http://pwnable.tw/">http://pwnable.tw/</a> (a newer set of high quality pwnable challenges)</li>
 56 | 	<li><a href="http://pwnable.kr/">http://pwnable.kr/</a> (one of the more popular recent wargamming sets of challenges)</li>
 57 | 	<li><a href="https://picoctf.com/">https://picoctf.com/</a>  (Designed for high school students while the event is usually new every year, it's left online and has a great difficulty progression)</li>
 58 | 	<!-- 
 59 | 	<li><a href="https://easyctf.com">https://easyctf.com/</a>  ()</li>
 60 | 	-->
 61 | 	<li><a href="https://microcorruption.com/login">https://microcorruption.com/login</a> (one of the best interfaces, a good difficulty curve and introduction to low-level reverse engineering, specifically on an MSP430)</li>
 62 | 	<li><a href="http://ctflearn.com/">http://ctflearn.com/</a> (a new CTF based learning platform with user-contributed challenges)</li>
 63 | 	<li><a href="https://cherryblog.in/">https://cherryblog.in/</a></li>
 64 | 	<li><a href="http://reversing.kr/">http://reversing.kr/</a></li>
 65 | 	<li><a href="http://hax.tor.hu/">http://hax.tor.hu/</a></li>
 66 | 	<li><a href="https://w3challs.com/">https://w3challs.com/</a></li>
 67 | 	<li><a href="https://pwn0.com/">https://pwn0.com/</a></li>
 68 | 	<li><a href="https://io.netgarage.org/">https://io.netgarage.org/</a></li>
 69 | 	<li><a href="http://ringzer0team.com/">http://ringzer0team.com/</a></li>
 70 | 	<li><a href="http://www.hellboundhackers.org/">http://www.hellboundhackers.org/</a></li>
 71 | 	<li><a href="http://www.overthewire.org/wargames/">http://www.overthewire.org/wargames/</a></li>
 72 | 	<li><a href="http://counterhack.net/Counter_Hack/Challenges.html">http://counterhack.net/Counter_Hack/Challenges.html</a></li>
 73 | 	<li><a href="https://www.hackthissite.org/">http://www.hackthissite.org/</a></li>
 74 | 	<li><a href="https://vulnhub.com/">http://vulnhub.com/</a></li>
 75 | 	<li><a href="http://ctf.komodosec.com">http://ctf.komodosec.com</a></li>
 76 | </ul>
 77 | 
 78 | <h4>Others</h4>
 79 | <ul>
 80 | 	<li><a href="https://backdoor.sdslabs.co/">https://backdoor.sdslabs.co/</a></li>
 81 | 	<li><a href="http://smashthestack.org/wargames.html">http://smashthestack.org/wargames.html</a></li>
 82 | <!--
 83 | 	<li><a href="http://hackthecause.info/">http://hackthecause.info/</a></li>
 84 | 	<li><a href="https://www.onlinectf.com/challenges/">https://www.onlinectf.com/challenges/</a></li>
 85 | 	<li><a href="http://bright-shadows.net/">http://bright-shadows.net/</a></li>
 86 | 	<li><a href="http://securityoverride.org/">http://securityoverride.org/</a> Some good concepts, but "canned" vulnerabilities (string matching on input) will frustrate knowledgable hackers and teach newbies the wrong lessons</li>
 87 | -->
 88 | 	<li><a href="http://www.mod-x.co.uk/main.php">http://www.mod-x.co.uk/main.php</a></li>
 89 | 	<li><a href="http://scanme.nmap.org/">http://scanme.nmap.org/</a></li>
 90 | 	<li><a href="http://www.hackertest.net/">http://www.hackertest.net/</a></li>
 91 | 	<li><a href="http://net-force.nl/">http://net-force.nl/</a></li>
 92 | </ul>
 93 | 
 94 | <h4>Meta</h4>
 95 | <ul>
 96 | 	<li><a href="http://www.wechall.net/sites.php">http://www.wechall.net/sites.php</a> (excellent list of challenge sites)</li>
 97 | 	<li><a href="http://ctf.forgottensec.com/wiki/index.php?title=Main_Page">http://ctf.forgottensec.com/wiki/</a> (good CTF wiki, though focused on CCDC)</li>
 98 | 	<li><a href="http://repo.shell-storm.org/CTF/">http://repo.shell-storm.org/CTF/</a> (great archive of CTFs)</li>
 99 | </ul>
100 | 
101 | <h4>Webapp Specific</h4>
102 | <ul>
103 | 	<li><a href="http://demo.testfire.net/">http://demo.testfire.net/</a></li>
104 | 	<li><a href="http://wocares.com/xsstester.php">http://wocares.com/xsstester.php</a></li>
105 | 	<li><a href="http://crackme.cenzic.com/">http://crackme.cenzic.com/</a></li>
106 | 	<li><a href="http://test.acunetix.com/">http://test.acunetix.com/</a></li>
107 | 	<li><a href="http://zero.webappsecurity.com/">http://zero.webappsecurity.com/</a></li>
108 | </ul>
109 | 
110 | <h4>Forensics Specific</h4>
111 | <ul>
112 | 	<li><a href="http://computer-forensics.sans.org/community/challenges">http://computer-forensics.sans.org/community/challenges</a></li>
113 | 	<li><a href="http://computer-forensics.sans.org/community/challenges">http://computer-forensics.sans.org/community/challenges</a></li>
114 | 	<li><a href="http://forensicscontest.com/">http://forensicscontest.com/</a></li>
115 | </ul>
116 | 
117 | <h4>Recruiting</h4>
118 | <ul>
119 | 	<li><a href="https://www.praetorian.com/challenges/pwnable/">https://www.praetorian.com/challenges/pwnable/</a></li>
120 | 	<li><a href="http://rtncyberjobs.com/">http://rtncyberjobs.com/</a></li>
121 | 	<li><a href="http://0x41414141.com/">http://0x41414141.com/</a></li>
122 | </ul>
123 | 
124 | <h4>Commercial/Freemium/Paid Training</h4>
125 | <ul>
126 | 	<li><a href="https://www.root-me.org/">https://www.root-me.org/</a> (well done set of challenges free for public use with optional paid commercial versions)</li>
127 | 	<li><a href="https://avatao.com/">https://avatao.com</a> (paid commercial training platform from a CTF team, though with a strong focus on secure app development)</li>
128 | 	<li><a href="http://heorot.net/">http://heorot.net/</a></li>
129 | </ul>
130 | 
131 | <h2>Downloadable Offline Games</h2>
132 | <ul>
133 | 	<li><a href="http://www.badstore.net/">http://www.badstore.net/</a></li>
134 | 	<li><a href="https://www.owasp.org/index.php/Category:OWASP_WebGoat_Project">http://www.owasp.org/index.php/Category:OWASP_WebGoat_Project</a></li>
135 | 	<li><a href="https://www.owasp.org/index.php/Owasp_SiteGenerator">http://www.owasp.org/index.php/Owasp_SiteGenerator</a></li>
136 | 	<li><a href="http://www.ethicalhack3r.co.uk/damn-vulnerable-web-app/">Damn Vulnerable Web App</a></li>
137 | 	<li><a href="http://suif.stanford.edu/~livshits/securibench/">Stanford SecureBench</a></li>
138 | 	<li><a href="http://suif.stanford.edu/~livshits/work/securibench-micro/">Stanford SecureBench Micro</a></li>
139 | 	<li><a href="https://www.irongeek.com/i.php?page=security/mutillidae-deliberately-vulnerable-php-owasp-top-10">http://www.irongeek.com/i.php?page=security/mutillidae-deliberately-vulnerable-php-owasp-top-10</a></li>
140 | </ul>
141 | 
142 | <h2>Virtual Machines</h2>
143 | <ul>
144 | 	<li><a href="https://pentesterlab.com/exercises/">https://pentesterlab.com/exercises/</a></li>
145 | 	<li><a href="https://sourceforge.net/projects/metasploitable/files/Metasploitable2/">http://sourceforge.net/projects/metasploitable/files/Metasploitable2/</a></li>
146 | 	<li><a href="http://www.damnvulnerablelinux.org/">Damn Vulnerable Linux</a> (not currently live? local <a href="/mirror/damnvulnerablelinux.com/">mirror</a>) </li>
147 | </ul>
148 | 
149 | <h3>Inactive or Gone</h3>
150 | <p>Just around for historical sake, or on the off-chance they come back.</p>
151 | <ul>
152 | 	<li><a href="http://rootcontest.com/">http://rootcontest.com/</a></li>
153 | 	<li><a href="http://intruded.net/">http://intruded.net/</a></li>
154 | 	<li><a href="https://how2hack.net">https://how2hack.net</a></li>
155 | 	<li><a href="https://www.mavensecurity.com/WebMaven.php">WebMaven (Buggy Bank)</a></li>
156 | 	<li><a href="http://www.foundstone.com/us/resources/proddesc/hacmetravel.htm">http://www.foundstone.com/us/resources/proddesc/hacmetravel.htm</a></li>
157 | 	<li><a href="http://www.foundstone.com/us/resources/proddesc/hacmebooks.htm">http://www.foundstone.com/us/resources/proddesc/hacmebooks.htm</a></li>
158 | 	<li><a href="http://www.foundstone.com/us/resources/proddesc/hacmecasino.htm">http://www.foundstone.com/us/resources/proddesc/hacmecasino.htm</a></li>
159 | 	<li><a href="http://www.foundstone.com/us/resources/proddesc/hacmeshipping.htm">http://www.foundstone.com/us/resources/proddesc/hacmeshipping.htm</a></li>
160 | 	<li><a href="http://hackme.ntobjectives.com/">http://hackme.ntobjectives.com/</a></li>
161 | 	<li><a href="http://testphp.acunetix.com/.asp">http://testphp.acunetix.com/</a></li>
162 | 	<li><a href="http://testasp.acunetix.com/Default.asp">http://testasp.acunetix.com/Default.asp</a></li>
163 | 	<li><a href="http://prequals.nuitduhack.com">http://prequals.nuitduhack.com</a></li>
164 | 	<li><a href="http://www.gat3way.eu/index.php">http://www.gat3way.eu/index.php</a> (Russian)</li>
165 | 	<li><a href="http://exploit-exercises.com/">http://exploit-exercises.com/</a> (challenges mirrored on vulnhub)</li>
166 | 	<li><a href="http://damo.clanteam.com/">http://damo.clanteam.com/</a></li>
167 | 	<li><a href="http://p6drad-teel.net/~windo/wargame/">http://p6drad-teel.net/~windo/wargame/</a></li>
168 | 	<li><a href="http://roothack.org/">http://roothack.org/</a></li>
169 | 	<li><a href="http://ha.ckers.org/challenge/">http://ha.ckers.org/challenge/</a></li>
170 | 	<li><a href="http://ha.ckers.org/challenge2/">http://ha.ckers.org/challenge2/</a></li>
171 | 	<li><a href="https://forensicswiki.org/wiki/DC3_Digital_Forensics_Challenge">http://www.dc3.mil/challenge/</a></li>
172 | </ul>
173 | 


--------------------------------------------------------------------------------