I'm on a mission to becoming a great penetration tester. This is a list of CTF's
Note: some links might or might not work so just try them.
Live Online Games
Recommended
Whether they're being updated, contain high quality challenges, or just have a lot of depth, these are probably where you want to spend the most time.
- http://pwnable.kr/ (one of the more popular recent wargamming sets of challenges)
- https://picoctf.com/ (Designed for high school students while the event is usually new every year, it's left online and has a great difficulty progression)
- https://microcorruption.com/login (one of the best interfaces, a good difficulty curve and introduction to low-level reverse engineering, specifically on an MSP430)
- http://reversing.kr/
- http://hax.tor.hu/
- https://w3challs.com/
- https://pwn0.com/
- http://www.smashthestack.org/
- http://ringzer0team.com/
- http://www.hellboundhackers.org/
- http://www.overthewire.org/wargames/
- http://counterhack.net/Counter_Hack/Challenges.html
- http://www.hackthissite.org/
- http://vulnhub.com/
Others
- http://hackthecause.info/
- http://bright-shadows.net/
- http://www.mod-x.co.uk/main.php
- http://scanme.nmap.org/
- http://www.hackertest.net/
- http://net-force.nl/
- http://securityoverride.org/ Some good concepts, but "canned" vulnerabilities (string matching on input) will frustrate knowledgable hackers and teach newbies the wrong lessons
Meta
- http://www.wechall.net/sites.php (excellent list of challenge sites)
- http://ctf.forgottensec.com/wiki/ (good CTF wiki, though focused on CCDC)
- http://repo.shell-storm.org/CTF/ (great archive of CTFs)
Webapp Specific
- http://demo.testfire.net/
- http://wocares.com/xsstester.php
- http://crackme.cenzic.com/
- http://test.acunetix.com/
- http://zero.webappsecurity.com/
Forensics Specific
Recruiting
Paid Training
Downloadable Offline Games
- http://www.badstore.net/
- http://www.owasp.org/index.php/Category:OWASP_WebGoat_Project
- http://www.owasp.org/index.php/Owasp_SiteGenerator
- Damn Vulnerable Web App
- Stanford SecureBench
- Stanford SecureBench Micro
- http://www.irongeek.com/i.php?page=security/mutillidae-deliberately-vulnerable-php-owasp-top-10
Virtual Machines
- https://pentesterlab.com/exercises/
- http://sourceforge.net/projects/metasploitable/files/Metasploitable2/
- Damn Vulnerable Linux (not currently live? local mirror)
Inactive or Gone
Just around for historical sake, or on the off-chance they come back.
- http://rootcontest.com/
- http://intruded.net/
- https://how2hack.net
- WebMaven (Buggy Bank)
- http://www.foundstone.com/us/resources/proddesc/hacmetravel.htm
- http://www.foundstone.com/us/resources/proddesc/hacmebooks.htm
- http://www.foundstone.com/us/resources/proddesc/hacmecasino.htm
- http://www.foundstone.com/us/resources/proddesc/hacmeshipping.htm
- http://hackme.ntobjectives.com/
- http://testphp.acunetix.com/
- http://testasp.acunetix.com/Default.asp
- http://prequals.nuitduhack.com
- http://www.gat3way.eu/index.php (Russian)
- http://exploit-exercises.com/ (challenges mirrored on vulnhub)
- http://damo.clanteam.com/
- http://p6drad-teel.net/~windo/wargame/
- http://roothack.org/
- http://ha.ckers.org/challenge/
- http://ha.ckers.org/challenge2/
- http://www.dc3.mil/challenge/
ReplyDeleteThis is really a good web internet site. Very good clean interface as well as good educational weblogs. We will likely be coming back quickly, thanks for the fantastic weblog. While these types of have a straps to hold child within location while you might be changing them, you should never child unattended when the pad is not buckled in order to anything.
For Enquires:
onlinehacker4hire @ gmail . com