ctf-practice - Practice your hacking skills with these CTFs

项目说明

Practice Your Hacking Skills: CTF & Wargame Sites

> pass, July 2026. Statuses reflect checks against li and current project homes.
> Where a project relocated, the old URL is shown followed by an arrow to the current one.

Legend

| Symbol | Meaning |
| :---: | --- |
| ✅ | A, resolves and serves the intended content |
| 🔁 | Moved, old URL is stale or redirects, use the new one |
| ❌ | Discontinued, domain dead, parked, or project retired (shown ~~struck through~~) |
| ⚠️ | Reachable but stale, unmaintained, or gated behind a paywall/signup |

---

Index

<details open>
<summary><strong>✅ A (55)</strong></summary>

CloudFoxable · bWAPP · Cryptopals · CTFlearn · CTFTime · Google Gruyere · Google XSS Game · Hack This Site · HackThis!! · IO (Netgarage) · OWASP Juice Shop · Microcorruption · O · picoCTF · PortSwigger Web Security Academy · pwnable.kr · pwnable.tw · Re.kr · Root Me · SmashTheStack · Try2Hack · W3Challs · XSS Challenge Wiki · Pentest-practice · Practice CTF List (captf) · · scanme.nmap.org · WeChall · shell-storm CTF archive · Altoro Mutual (testfire) · Acunetix test.php · Acunetix testphp · Acunetix testasp · Zero WebAppSecurity · PentesterLab · Metasploitable 2 · Mutillidae · DVWA · Avatao · Typhoon VM · Counter Hack / Holiday Hack · Hack The Box · TryHackMe · Hacker101 · crackmes.one · webhacking.kr · Websec.fr · Hacksplaining · Defend the Web · Gracker · SANS DFIR challenges · picoGym · OWASP VWAD · exploit.education · Praetorian challenges

</details>

<details open>
<summary><strong>🔁 Moved (9)</strong></summary>

OWASP WebGoat · Hacking-Lab · RingZer0 · Damn Web App · Mutillidae · Exploit Exercises · SANS Forensics challenges · Praetorian challenges · picoCTF

</details>

<details open>
<summary><strong>❌ Discontinued (34)</strong></summary>

CTF Challenge · CTF365 · Enigma Group · Game of Hacks · Hack.me · Hellbound Hackers · pwn0 · cherryblog.in · hax.tor.hu · ctf.komodosec.com · Backdoor (SDSLabs) · mod-x.co.uk · hackertest.net · net-force.nl · ForgottenSec CTF wiki · wocares XSS tester · Cenzic CrackMe · forensicscontest.com · rtncyberjobs.com · 0x41414141.com · Heorot · BadStore · OWASP SiteGenerator · Stanford SecuriBench · SecuriBench Micro · Damn Linux · rootcontest · intruded.net · how2hack.net · WebMaven · Foundstone Hacme series · NT OBJECTi · Nuit du Hack prequals · gat3way.eu · damo.clanteam.com · p6drad-teel wargame · roothack.org · ha.ckers.org challenges · DC3 Digital Forensics Challenge

</details>

---

1. Core Practice Sites

| Status | Site | URL | Notes |
| :---: | --- | --- | --- |
| ✅ | CloudFoxable | github.com/BishopFox/cloudfoxable | AWS pentest playground, actively maintained |
| ✅ | bWAPP | itsecgames.com | Static page, project itself is frozen but downloadable |
| ✅ | Cryptopals | cryptopals.com | 8 sets of crypto challenges |
| ❌ | ~~CTF Challenge~~ | ~~ctfchallenge.co.uk~~ | Domain no longer serves the platform |
| ❌ | ~~CTF365~~ | ~~ctf365.com~~ | Cyber range shut down, no acti |
| ✅ | CTFlearn | ctflearn.com | User-contributed challenges, active |
| ✅ | CTFTime | ctftime.org | Event calendar and team rankings |
| ❌ | ~~Enigma Group~~ | ~~enigmagroup.org~~ | Long unmaintained, site no longer reliably up |
| ❌ | ~~Game of Hacks~~ | ~~gameofhacks.com~~ | Checkmarx retired the demo |
| ✅ | Google Gruyere | google-gruyere.appspot.com | Still hosted on App Engine |
| ✅ | Google XSS Game | xss-game.appspot.com | 6 levels, still live |
| ✅ | Hack This Site | hackthissite.org | Classic wargame, acti |
| ❌ | ~~Hack.me~~ | ~~hack.me~~ | eLearnSecurity folded into INE, sandbox service retired |
| 🔁 | Hacking-Lab | ~~www.hacking-lab.com/index.html~~ → hacking-lab.com | Now commercial, free tier at academy.hacking-lab.com |
| ✅ | HackThis!! | hackthis.co.uk | 50+ levels |
| ❌ | ~~Hellbound Hackers~~ | ~~hellboundhackers.org~~ | Offline, community dispersed |
| ✅ | IO (Netgarage) | io.netgarage.org | SSH wargame, still updated (2025 entries) |
| ✅ | OWASP Juice Shop | github.com/juice-shop/juice-shop | Repo moved from bkimminich to the juice-shop org |
| ✅ | Microcorruption | microcorruption.com | MSP430 embedded RE, not ARM (original note was wrong) |
| ✅ | O | o.org/wargames | Bandit, Natas, Le, etc. |
| 🔁 | OWASP WebGoat | ~~owasp.org/index.php/Category:OWASP_WebGoat_Project~~ → owasp.org/www-project-webgoat | OWASP retired the MediaWiki, repo at github.com/WebGoat/WebGoat |
| 🔁 | picoCTF | ~~picoctf.com~~ → picoctf.org | picoGym stays open year round |
| ✅ | PortSwigger Web Security Academy | portswigger.net/web-security | Free, best-in-class web labs |
| ❌ | ~~pwn0~~ | ~~pwn0.com~~ | long dead |
| ✅ | pwnable.kr | pwnable.kr | Binary exploitation |
| ✅ | pwnable.tw | pwnable.tw | Harder pwn set |
| ✅ | Re.kr | re.kr | RE challenges, slow but up |
| 🔁 | RingZer0 | ~~ringzer0team.com~~ → ringzer0ctf.com | Rebranded domain |
| ✅ | Root Me | root-me.org | 500+ challenges, free tier |
| ✅ | SmashTheStack | smashthestack.org | IRC-coordinated wargame network |
| ✅ | Try2Hack | try2hack.nl | One of the oldest still standing |
| ⚠️ | Typhoon VM | prismacsi.com | Download page up, VM not updated in years |
| ✅ | W3Challs | w3challs.com | Mixed category platform |
| ✅ | XSS Challenge Wiki | github.com/cure53/XSSChallengeWiki | Curated by cure53 |

2. Aggregators and Lists

| Status | Site | URL | Notes |
| :---: | --- | --- | --- |
| ✅ | Pentest-practice | github.com/roya0045/Pentest-practice | Repo intact, low activity |
| ✅ | Practice CTF List (captf) | captf.com/practice-ctf | Source of the section below |
| ✅ | WeChall | wechall.net/sites.php | Still the best cross-site challenge index |
| ❌ | ~~ForgottenSec CTF wiki~~ | ~~ctf.forgottensec.com/wiki~~ | Gone |
| ✅ | shell-storm CTF archive | shell-storm.org/repo/CTF | Moved off the repo. subdomain |
| ✅ | OWASP VWAD | vwad.owasp.org | Modern replacement for most " app" lists |

---

3. Practice CTF List / Permanent CTF List

> Originally compiled at captf.com, credited to RSnake for the original.

3.1 Li Games (Recommended)

| Status | Site | Notes |
| :---: | --- | --- |
| ✅ | pwnable.tw | High quality pwnables |
| ✅ | pwnable.kr | Popular wargame set |
| 🔁 | ~~picoctf.com~~ → picoctf.org | Great difficulty progression, stays online year round |
| ✅ | microcorruption.com/login | Excellent interface, MSP430 low-level RE |
| ✅ | ctflearn.com | User-contributed challenges |
| ❌ | ~~cherryblog.in~~ | Domain dead |
| ✅ | re.kr | Reverse engineering |
| ❌ | ~~hax.tor.hu~~ | Offline for years |
| ✅ | w3challs.com | Mixed categories |
| ❌ | ~~pwn0.com~~ | Dead |
| ✅ | io.netgarage.org | Still maintained |
| 🔁 | ~~ringzer0team.com~~ → ringzer0ctf.com | Rebranded |
| ❌ | ~~hellboundhackers.org~~ | Offline |
| ✅ | o.org/wargames | Active |
| 🔁 | ~~counterhack.net/Counter_Hack/Challenges.html~~ → counterhack.net | Now centered on SANS Holiday Hack Challenge |
| ✅ | hackthissite.org | Active |
| ✅ | .com | Boot2root , still the standard |
| ❌ | ~~ctf.komodosec.com~~ | Gone |

3.2 Others

| Status | Site | Notes |
| :---: | --- | --- |
| ❌ | ~~backdoor.sdslabs.co~~ | SDSLabs retired the platform |
| ✅ | smashthestack.org/wargames.html | Active |
| ❌ | ~~mod-x.co.uk~~ | Dead |
| ✅ | scanme.nmap.org | Nmap's sanctioned scan target, still up |
| ❌ | ~~hackertest.net~~ | Dead |
| ❌ | ~~net-force.nl~~ | Dead |
| ❌ | ~~hackthecause.info~~ | Dead (was already commented out) |
| ❌ | ~~onlinectf.com~~ | Dead (was already commented out) |
| ❌ | ~~bright-shadows.net~~ | Dead (was already commented out) |
| ❌ | ~~securityo.org~~ | Dead (was already commented out) |

3.3 Webapp Specific

| Status | Site | Notes |
| :---: | --- | --- |
| ✅ | demo.testfire.net | HCL AppScan's Altoro Mutual demo bank, still hosted |
| ❌ | ~~wocares.com/xsstester.php~~ | Dead |
| ❌ | ~~crackme.cenzic.com~~ | Cenzic acquired by Trustwave, demo retired |
| ✅ | test.acunetix.com | Invicti keeps the deliberately demos up |
| ✅ | testphp..com | Current home of the old testphp.acunetix.com |
| ✅ | testasp..com | Current home of the old testasp.acunetix.com |
| ✅ | zero.webappsecurity.com | Micro Focus / OpenText demo bank |

3.4 Forensics Specific

| Status | Site | Notes |
| :---: | --- | --- |
| 🔁 | ~~computer-forensics.sans.org/community/challenges~~ → sans.org/mlp/dfir-challenges | Subdomain retired, content folded into the main SANS DFIR pages |
| ⚠️ | forensicscontest.com | Puzzles still readable, no new content since ~2012 |

3.5 Recruiting

| Status | Site | Notes |
| :---: | --- | --- |
| 🔁 | ~~praetorian.com/challenges/pwnable~~ → praetorian.com | Old challenge path retired, occasional new campaigns |
| ❌ | ~~rtncyberjobs.com~~ | Raytheon recruiting site retired |
| ❌ | ~~0x41414141.com~~ | Dead |

3.6 Commercial / Freemium / Paid

| Status | Site | Notes |
| :---: | --- | --- |
| ✅ | root-me.org | Free for public use, paid commercial tier |
| ✅ | avatao.com | Secure-de, commercial |
| ❌ | ~~heorot.net~~ | Dead, De-ICE ISOs survive on |

---

4. Downloadable / Offline Targets

| Status | Project | URL | Notes |
| :---: | --- | --- | --- |
| ❌ | ~~BadStore~~ | ~~badstore.net~~ | Domain gone, ISO mirrored on |
| 🔁 | OWASP WebGoat | ~~owasp.org/index.php/...~~ → owasp.org/www-project-webgoat | Docker image is the current install path |
| ❌ | ~~OWASP SiteGenerator~~ | ~~owasp.org/index.php/Owasp_SiteGenerator~~ | Project archived by OWASP |
| 🔁 | Damn Web App | ~~ethicalhack3r.co.uk/damn-~~ → github.com/digininja/DVWA | Actively maintained by the original author |
| ❌ | ~~Stanford SecuriBench~~ | ~~suif.stanford.edu/~li/securibench~~ | Research page retired |
| ❌ | ~~SecuriBench Micro~~ | ~~suif.stanford.edu/~li/work/securibench-micro~~ | Retired |
| 🔁 | Mutillidae II | ~~irongeek.com/i.php?page=security/mutillidae...~~ → github.com/webpwnized/mutillidae | Irongeek page still loads, but the repo is where de happens |

5. Machines

| Status | Project | URL | Notes |
| :---: | --- | --- | --- |
| ✅ | PentesterLab | pentesterlab.com/exercises | Freemium |
| ✅ | Metasploitable 2 | sourceforge.net/projects/metasploitable | Still downloadable |
| ✅ | Metasploitable 3 | github.com/rapid7/metasploitable3 | Successor, build-your-own |
| ❌ | ~~Damn Linux~~ | ~~damn.org~~ | Abandoned, ISOs only |
| ✅ | | .com | Where most orphaned now live |

---

6. Inactive or Gone

All confirmed dead. Kept for historical reference.

| Site | Notes |
| --- | --- |
| ~~rootcontest.com~~ | Gone |
| ~~intruded.net~~ | Gone |
| ~~how2hack.net~~ | Gone |
| ~~ma.com/WebMaven.php~~ | WebMaven / Buggy Bank retired |
| ~~foundstone.com Hacme Travel~~ | Foundstone absorbed into McAfee, tools pulled |
| ~~foundstone.com Hacme Books~~ | Same |
| ~~foundstone.com Hacme Casino~~ | Same |
| ~~foundstone.com Hacme Shipping~~ | Same |
| ~~hackme.ntobjectives.com~~ | NT OBJECTi, demo retired |
| ~~prequals.nuitduhack.com~~ | Event archived, see ctftime.org |
| ~~gat3way.eu~~ | Gone |
| ~~damo.clanteam.com~~ | Gone |
| ~~p6drad-teel.net/~windo/wargame~~ | Gone |
| ~~roothack.org~~ | Gone |
| ~~ha.ckers.org/challenge~~ | RSnake retired the site |
| ~~ha.ckers.org/challenge2~~ | Same |
| ~~dc3.mil/challenge~~ | DC3 Digital Forensics Challenge discontinued |
| ~~exploit-exercises.com~~ → exploit.education | Rebranded, Nebula/Protostar/Fusion live on |

---

7. Worth Adding

Platforms that did not exist or were minor when this list was written, and now carry most of the traffic.

| Platform | URL | Focus |
| --- | --- | --- |
| TryHackMe | tryhackme.com | Guided rooms, beginner to intermediate |
| Hack The Box | hackthebox.com | Machines, Pro Labs, Academy |
| Hacker101 | hacker101.com | HackerOne's free CTF and video course |
| picoGym | picoctf.org/practice | Persistent picoCTF challenge bank |
| crackmes.one | crackmes.one | Reverse engineering exercises |
| webhacking.kr | webhacking.kr | Korean web challenge classic |
| Websec.fr | websec.fr | Web-only, hard |
| Defend the Web | defendtheweb.net | Successor community to several dead sites |
| Hacksplaining | hacksplaining.com | Defensi lessons |
| O Advent | o.org | Seasonal |
| pwn.college | pwn.college | ASU's full binary exploitation curriculum |
| GTFOBins | gtfobins.github.io | Reference, not a CTF, but constantly needed |

---

Notes

项目信息

开发语言：未知

Star 数：417

技术要点

该项目属于CTF思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Practice your hacking skills with these CTFs展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。