awesome-mobile-CTF - This is a curated list of mobile based CTFs, write

项目说明

awesome-mobile-CTF

This is a curated list of mobile based CTFs, write-ups and mobile apps. Most of them are android based due to the popularity of the platform.

Inspired by android-security-awesome, osx-and-ios-security-awesome and all the other awesome security lists on .

Mobile CTF challenges

* Google CTF 2021
* Google CTF 2020 writeup 1, writeup 2
* Hackti CTF Mobile 2020
* Trend Micro CTF 2020
* KGB Messenger
* ASIS CTF — ShareL Walkthrough
* Android re challenges
* Android app for IOT CTF
* CyberTruck Challenge 2019 (Detroit USA)
* Matryoshka-style Android re challenge
* Cybertruckchallenge19
* You Shall Not Pass - BSides Canberra 2019
* Mobile challenges collection
* BSidesSF 2018 CTF
* h1-702-2018-ctf-wu
* THC CTF 2018 - Reverse - Android serial
* Android crack me challenges
* OWASP crack me
* Rednaga Challenges
* iOS CTF
* Android Hacking Event 2017: AES-Decrypt
* Android Hacking Event 2017: Token-Generator
* Android Hacking Event 2017: Flag-
* Android Hacking Event 2017: You Can Hide – But You Cannot Run
* Android Hacking Event 2017: Why Should I Pay?
* Android Hacking Event 2017: Esoteric
* Android Hacking Event 2016: StrangeCalculator
* Android Hacking Event 2016: Re
* Android Hacking Event 2016: ABunchOfNative
* Android Hacking Event 2016: DynChallenge
* PicoCTF-2014: Pickle Jar - 30
* PicoCTF-2014: Revenge of the Bleichenbacher
* Android MIT LL CTF 2013
* E Bsides Challenge
* Crack-Mes
* GreHack-2012 - GrehAndroidMe
* Hackplayers.com Crackmes (in Spanish so an extra challenge): crackme 1
* Hackplayers.com Crackmes (in Spanish so an extra challenge): crackme 2
* Hack.Lu's CTF 2011 Reverse Engineering 300/)
* Androidcracking.blogspot.com's Crackme’s: cracker 0
* Androidcracking.blogspot.com's Crackme’s: cracker 1
* Insomnia'hack-2K11
* CSAW-2011: Re
* Defcon-19-quals: Binary_L33tness
* Crack me's
* SecuInside: CTF2011
* EnoWars-CTF2011: broken_droid
* Anonim1133
* Challenge4ctf
* Ctfpro
* CTFDroid
* Android_ctf
* Robot CTF Android
* Cl.ctfk
* Cryptax

CTF Writeups

2022

* NahamCon CTF 2022 Write-up: Click Me! Android challenge
* MRCTF2022-Stuuuuub

2021

* H 2021 CTF - writeup 1, writeup 2
* Write-up du CTF Android
* Cellebrite 2021 CTF – In Heisenberg’s Android Device
* Cellebrite 2021 CTF – Marsha’s iPhone (FFS and Backup)
* Cellebrite 2021 CTF – Beth’s iPhone
* Cellebrite CTF 2021 Writeup
* H 2021 — Mobile challenge writeup - writeup 1, writeup 2
* CTF Write-Up: Kryptonite
* NahamCon 2021 Writeups
* BELKASOFT CTF MAY 2021: WRITE-UP

2020

* Trend Micro CTF 2020 — Keybox writeup
* STACK the Flags 2020: Mobile Challenges Write Up writeup 1, writeup 2
* Hackti CTF Mobile Writeup
* CyberSpaceKenya CTF
* Magnet Summit 2020 CTF (Anroid)
* Magnet Summit 2020 CTF (iOS) writeup 1, writeup 2
* Google CTF 2020: Android writeup 1, writeup 2
* RaziCTF 2020 WriteUp: Chasing a lock
* DFA/CCSC Spring 2020 CTF
* AppSecIL CTF)
* SunshineCTF 2020 write-up

2019

* DroidCon, SEC-T CTF 2019
* You Shall Not Pass - BSides Canberra 2019
* CyberTruck Challenge 2019 — Android CTF
* Bsidessf-ctf-2019-mobile-track
* BsidesSF CTF - Challenge: Part 1, Part 2
* CTF on a Budget - Magnet User Summit 2019 - Mobile

2018

* H1 202 2018 / H1 202 CTF
* H1-702 CTF (Capture the Flag)
* BSidesSF 2018 CTF — Android Re/Forensic Challenge
* Hack the Android4: Walkthrough (CTF Challenge)
* Google CTF Quals 2018
* Ilam CTF: Android Reverse WriteUp
* 8st SharifCTF Android WriteUps: Vol I, Vol II
* ASIS 2018 Finals: Gunshop
* H1-202 CTF - Writeup
* M1Con CTF Write up
* AES decode with Cyberchef

2017

* BSides San Francisco CTF 2017 : pinlock-150
* BSides San Francisco CTF 2017 : flag-recei
* BSidesSF CTF wrap-up
* itsC0rg1's mobile challenge and BSides SF CTF
* Insomni'hack Teaser 2017 : mindreader-250
* 2017_labyREnth: mob1_ezdroid
* 2017_labyREnth: mob2_routerlocker
* 2017_labyREnth: mob3_showmewhatyougot
* 2017_labyREnth: mob4_androidpan
* 2017_labyREnth: mob5_iotctf

2016

* LabyREnth
* 2016_labyREnth: mob1_lastchance
* 2016_labyREnth: mob2_cups
* 2016_labyREnth: mob3_watt
* 2016_labyREnth: mob4_swip3r
* 2016_labyREnth: mob5_ioga
* 2016_labyREnth: mob6_ogmob
* Holiday hack challenge: Part 01
* Holiday hack challenge: Part 02
* Holiday hack challenge: Part 04a
* Holiday hack challenge: Part 04b
* Holiday hack challenge: Part 04c
* Holiday hack challenge: Part 04d
* Holiday hack challenge: Part 04e
* Holiday hack challenge: Part 04f
* Holiday hack challenge: Part 5
* 0ctf-2016
* Google-ctf-2016
* Google-ctf-2016: ill intentions 1
* Google-ctf-2016: ill intentions 2
* Cyber-security-challenge-belgium-2016-qualifiers
* Su-ctf-2016 - android-app-100
* Hackcon-ctf-2016 - you-cant-see-me-150
* RC3 CTF 2016: My Lil Droid
* Cyber Security Challenge 2016: Dexter
* Cyber Security Challenge 2016: Phishing is not a crime
* google-ctf-2016 : little-bobby-application-250

2015

* Rctf-quals-2015
* Insomni-hack-ctf-2015
* 0ctf-2015
* Cyber-security-challenge-2015
* Trend-micro-ctf-2015: offensi
* codegate-ctf-2015: dodocrackme2
* Seccon-quals-ctf-2015: red-apk-1
* Seccon-quals-ctf-2015 - red-apk-2
* Pragyan-ctf-2015
*
* Opentoall-ctf-2015: android-oh-no
* 32c3-ctf-2015: libdroid-150
* Polictf 2015: crack-me-if-you-can
* Icectf-2015: Husavik

2014

* Qiwi-ctf-2014: not-so-one-time
* Fdfpico-ctf-2014: droid-app-80
* Su-ctf-quals-2014: commercial_application
* defkthon-ctf 2014: web-300
* secuinside-ctf-prequal-2014: wooyatalk
* Qiwi-ctf-2014: easydroid
* Qiwi-ctf-2014: stolen-prototype
* TinyCTF 2014: Ooooooh! What does this button do?
* 31c3-ctf-2014: Nokia 1337
* Asis-ctf-finals-2014: numdroid
* PicoCTF-2014: Droid App
* NDH2k14-wargames: crackme200-ChunkNorris

2013

* Hack.lu CTF 2013: Robot Plans
* CSAW Quals CTF 2015: Herpderper

2012

* Atast CTF 2012 Bin 300

Misc

* Nuit du Hack's 2k12 & 2k11 (pre-quals and finals) Android Crackme’s 2

Mobile apps:

Android

* Allsafe
* InsecureShop
* OWASP: OMTG-Hacking-Playground
* Damn insecure and App (DIVA)
* Damn-
* Damn Hybrid Mobile App (DVHMA)
* Owasp: Goatdroid Project
* InjuredAndroid
* ExploitMe labs by SecurityCompass
* InsecureBankv2
* Sie ‘Password Manager’ app)
* sievePWN
* ExploitMe Mobile Android Labs
* Hacme Bank
* Android Labs
* Digitalbank
* Dodo bank
* Oracle android app
* Urdu app
* MoshZuk File
* Appknox
* Vuln app
* Damn FirefoxOS Application
* Android security sandbox

iOS

* ExploitMe Mobile iPhone Labs
* Owasp: iGoat
* Damn iOS App (DVIA)
* Damn iOS App (DVIA) v2

APIs:

* Vapi
* VAmPI
*
* vAPI

Web apps:

Node

* Damn Web Service
* Damn NodeJS Application
* Damn Ser Application
* OWASP: Juice Shop
* Damn Node Application
* Intentionally node.js application
*
* OWASP: NodeGoat
*
* Xtreme Web Application (XVWA)

PHP

* OWASP: Broken Web Applications(BWA)
* Damn Web Application (DVWA)
* Damn Web Services(DVWS)
* OWASP Hackademic Challenges
* OWASP: Insecure Web App Project
* OWASP: WebGoat
* Bwapp
* Beebox
* XVWA - Badly coded web application
* Drunk Admin Web Hacking Challenge
* Peruggia
* Mutillidae
* Btslab
* OWASP: Bricks
* The ButterFly Security Project
* WackoPicko
*
* GameOver
* LAMPSecurity Training
* Metasploitable
* Metasploitable 2
* Metasploitable 3
* Hackazon
* Twiterlike
* UltimateLAMP

Sql

* SQLI-labs
* Testenv

Python

* Google Gruyere

Java

* Owasp: WebGoat
* Puzzlemall
* Hacme Books
* Bodgeit
* OWASP: Web Goat

Ruby on Rails

* Hacme Casino
* RailsGoat

C++

* Hacme Travel

.NET

* OWASP: WebGoat.NET
* Hacme Bank
*

ColdFusion

* Hacme Shipping

Mobile security resources

* Mobile app pentest cheatsheet
* Android security awesome
* Android security reference
* Awesome-linux-android-hacking
* iOS security awesome
* awesome-iOS-resource
* Mobile security wiki
* iPhone wiki
* Nyxbone
* Nowhere
* Secmobi

Infosec resources

* OSX-iOS-re
* OSX-security-awesome
* Awesome-web-hacking
* Awesome-windows-exploitation
* windows-pri
* Awesome-Hacking
* Awesome-re
* Aweasome-Frida
* Awesome-security
* Awesome-fuzzing
* Awesome-wifi-security
* Android o
* OSX-security-awesome
* Infosec_Reference
* PayloadsAllTheThings
* Awesome-malware-analysis
* Linux-re

Mobile security standards

* OWASP Mobile Security Project
* OWASP Top 10 - 2016
* OWASP Mobile Application Security Standard (MASVS)
* OWASP Mobile Security Testing Guide (MSTG)

Credits

*
*
*
*

项目信息

开发语言：未知

Star 数：1164

技术要点

该项目属于CTF思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕This is a curated list of mobile based CTFs, write-ups and vulnerable apps. Most of them are android based due to the popularity of the platform. 展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。