52 resourcesCTF Platforms (20) Avatao Beginner
Practical, scenario-based challenges for building cybersecurity skills. Bugcrowd University Beginner
Bugcrowd's free, open-source training modules — open to anyone, not just Bugcrowd researchers. CTFlearn Beginner
Free platform with challenges for beginners through advanced CTF players. CTFtime All Levels
The public calendar/directory of CTF competitions happening (or archived) worldwide. CyberSecLabs Intermediate
Hands-on cybersecurity challenges and labs for practical skill-building. Hack The Box Advanced
Community-driven platform with retired/active vulnerable machines, from beginner to advanced. Hack The Box Academy Beginner
HTB's structured, guided courses — the on-ramp before jumping into HTB's sink-or-swim main labs. hack.me Beginner
Build, host, and share vulnerable web apps in a free sandboxed environment. Hacker101 CTF Beginner
Free CTF from HackerOne, paired with the Hacker101 web security video course. HackingHub Intermediate
Isolated, real-world web app/API labs and courses built from actual bug bounty and pentest findings. HackThisSite Beginner
Long-running free training ground focused primarily on web exploitation challenges. OverTheWire Beginner
Classic wargames teaching security concepts through SSH-accessible challenge levels. PicoCTF Beginner
Beginner-oriented computer security education program with a large always-available challenge set. pwn.college Advanced
University-grade binary exploitation and systems security curriculum, organized into "dojos." Pwn.tn Intermediate
IT security challenges for fun and learning. Root-Me Intermediate
Large, long-established library of hacking challenges across many categories. TryHackMe Beginner
Beginner-friendly, browser-based hacking rooms with guided walkthroughs across most security topics. VulnHub Intermediate
Free, downloadable vulnerable virtual machines to practice offline in your own lab. WebSec Intermediate
Web-based CTF challenges focused on application security. YesWeHack Dojo Intermediate
YesWeHack's free CTF training platform, with a new real-world-style challenge each month. Web Application Security (7) Code Review Lab Intermediate
Challenges specifically for practicing secure code review. DVWA (Damn Vulnerable Web App) Beginner
PHP/MySQL app with adjustable difficulty for practicing classic web vulnerabilities. Hacksplaining Beginner
Short, plain-language lessons explaining common web vulnerabilities one at a time. OWASP Juice Shop Beginner
OWASP's intentionally insecure modern web app — probably the most complete vulnerable app around. OWASP WebGoat Beginner
Deliberately insecure Java web app maintained by OWASP for teaching common vulnerabilities. PortSwigger Web Security Academy All Levels
Free web security training with hands-on labs explicitly tiered Apprentice → Practitioner → Expert. WebScanTest Beginner
A test site for practicing web app vulnerability assessment and scanning. Cloud Security (9) AWSGoat Intermediate
A damn-vulnerable AWS infrastructure with attack and defense manuals. AzureGoat Intermediate
A deliberately vulnerable Azure infrastructure for attack/defense practice. CloudGoat Intermediate
Rhino Security Labs' "vulnerable-by-design" deployable AWS environment with CTF-style scenarios. flaws.cloud Beginner
A self-paced AWS security challenge, level by level, with clues along the way. flaws2.cloud Intermediate
flaws.cloud's sequel, with both attacker and defender learning paths. GCPGoat Intermediate
A deliberately vulnerable Google Cloud Platform infrastructure for hands-on practice. IAM Vulnerable Advanced
Terraform-built AWS IAM privilege-escalation playground covering 31 attack paths. Pwned Labs Intermediate
Hands-on cloud/AI security labs and cyber ranges across AWS, Azure, GCP, and M365 — free tier available. Sadcloud Advanced
Spins up intentionally vulnerable AWS resources for you to find, unguided. Android Security (5) AndroGoat Intermediate
Kotlin-based vulnerable Android app with guided walkthroughs, covering OWASP Mobile Top 10 issues. DIVA Android Beginner
"Damn Insecure and Vulnerable App for Android" — the classic starting point for Android pentesting. InjuredAndroid Beginner
CTF-style vulnerable Android app with flags based on real bug bounty findings. InsecureBankv2 Intermediate
A vulnerable banking-themed Android app for practicing mobile app security testing. InsecureShop Intermediate
An intentionally vulnerable Android shopping app, built in Kotlin. Reverse Engineering & Binary Exploitation (2) Crackmes.one All Levels
A large library of reverse-engineering challenges ('crackmes') at every difficulty level. exploit.education Advanced
VMs and challenges for learning memory corruption and binary exploitation (formerly exploit-exercises.com). Blue Team / Defensive Security (4) Blue Team Labs Online Intermediate
Gamified investigation challenges for defenders: DFIR, security operations, threat hunting. CyberDefenders Intermediate
Blue-team-focused labs covering DFIR, threat hunting, and SOC scenarios with real artifacts. LetsDefend Beginner
Simulated SOC alert inbox — triage, investigate, and respond to realistic incidents. RangeForce Beginner
Team-oriented cyber readiness platform with a free Community Edition for defensive practice. Open Source Frameworks (5) CTFd All Levels
The open-source platform most CTF organizers actually use to host their own competitions. GOAD (Game of Active Directory) Advanced
Open-source, self-hostable, intentionally vulnerable Active Directory environment for AD attack practice. MITRE ATT&CK All Levels
The open, globally-used knowledge base of real-world adversary tactics and techniques. OWASP Foundation All Levels
The nonprofit behind the Top 10, ASVS, Testing Guide, and most open web-security standards in use today. OWASP MASTG All Levels
OWASP's Mobile Application Security Testing Guide — the open standard for mobile app security testing.