CTF & Hands-on Labs — Useful Sites

Crackmes.one

2026-10-18T00:00:00Z

A user-submitted archive of reverse engineering challenges (crackmes), filterable by difficulty, language and platform. Unlike CTF platforms these are standalone local binaries with user-written solutions. They are unvetted executables, so run them in a VM.

https://crackmes.one/

Cryptopals

2026-10-18T00:00:00Z

A set of 48 programming exercises in 8 sets that teach cryptography by attacking real constructions; you write the attacks yourself. Unlike textbooks, each break builds on the previous one. Requires writing code in a language of your choice.

https://cryptopals.com/

Hack This Site

2026-10-18T00:00:00Z

A long-running site with basic hacking missions (basic, realistic, programming, stego) in a legal, safe setting. It also has forums and articles; often named as a first step for beginners, though the interface is dated next to newer platforms. Compared with newer platforms its interface is dated, but it is not tied to a CTF calendar.

https://www.hackthissite.org/

Hacker101

2026-10-18T00:00:00Z

HackerOne's free video lessons and CTF on finding web vulnerabilities; flags earned can bring invitations to private bug bounty programs. Unlike general training sites it links straight into the bug bounty path.

https://www.hacker101.com/

Hacksplaining

2026-10-18T00:00:00Z

A developer-oriented site that explains common web vulnerabilities (XSS, SQL injection, CSRF) in short interactive lessons. Unlike pentest platforms it focuses on teaching defence rather than attack.

https://www.hacksplaining.com/

Microcorruption

2026-10-18T00:00:00Z

An embedded-systems CTF where you break electronic locks using an in-browser MSP430 debugger. Nothing to install, which makes it a practical entry to embedded reverse engineering and assembly. Originally built by Matasano.

https://microcorruption.com/

OWASP Web Security Testing Guide

2026-10-18T00:00:00Z

OWASP's web application penetration testing methodology and checklist, from information gathering to business logic flaws. Unlike vulnerability lists such as the Top 10 it spells out how each issue is tested.

https://github.com/OWASP/wstg

PentesterLab

2026-10-18T00:00:00Z

Web and application security exercises where each one explains a vulnerability and gives you a running environment to exploit it. Unlike plain CTF sites the exercises are sequenced by topic and difficulty like a curriculum. The free tier is limited; full access is paid.

https://pentesterlab.com/

picoCTF

2026-10-18T00:00:00Z

Carnegie Mellon's free CTF platform with web, crypto, reverse engineering and forensics tasks. Unlike competition-first sites, difficulty starts at high-school level and past contest challenges stay open for practice. Needs an account.

https://picoctf.org/

pwn.college

2026-10-18T00:00:00Z

Arizona State University's free cybersecurity education platform; beginner-friendly modules with in-browser practice environments teach binary exploitation, web and reverse engineering. Unlike plain CTF sites it follows an ordered curriculum.

https://pwn.college/

pwnable.kr

2026-10-18T00:00:00Z

A non-profit wargame site for binary exploitation (pwn), starting at the Toddler's Bottle tier and getting harder. Tasks run on a remote SSH server with source provided, which suits learning memory corruption in order. Unlike browser-based exercises, tasks run on a real SSH server.

https://pwnable.kr/

pwnable.tw

2026-10-18T00:00:00Z

Harder binary exploitation tasks aimed at building pwn skills on near-real vulnerabilities. It sits above pwnable.kr in difficulty; challenges are scored and you work through earlier ones to progress.

https://pwnable.tw/

Root Me

2026-10-18T00:00:00Z

A community-run French platform with hundreds of challenges and virtual environments across web, cryptography, reverse engineering and forensics. Unlike large commercial labs it comes with community write-ups and a rich document repository.

https://www.root-me.org/

Vulhub

2026-10-18T00:00:00Z

Docker-compose environments for known CVEs that come up with one command. Unlike VM archives, each one targets a single piece of software and a single CVE, which makes studying a root cause locally straightforward. Run only in an isolated environment.

https://github.com/vulhub/vulhub

VulnHub

2026-10-18T00:00:00Z

An archive of community-built vulnerable VMs you download and run locally. Unlike online lab platforms they work offline, which is why they are popular for OSCP-style practice. Downloaded VMs are untrusted code, so run them isolated.

https://www.vulnhub.com/

Awesome CTF

2026-09-18T00:00:00Z

A list of tools, wargames and tutorials for Capture The Flag. Unlike a single contest it gives the whole toolchain needed to prepare, category by category.

https://github.com/apsdehal/awesome-ctf

bWAPP

2026-09-18T00:00:00Z

A downloadable, deliberately vulnerable app containing 100+ web vulnerabilities. Unlike online targets it lets you practise on your own machine, isolated and without limits.

https://www.itsecgames.com/

Damn Vulnerable iOS App

2026-09-18T00:00:00Z

A deliberately vulnerable iOS app for learning mobile security. Unlike web-based vulnerability labs it targets mobile-specific issues — insecure data storage, binary patching.

https://damnvulnerableiosapp.com/

Firing Range

2026-09-18T00:00:00Z

A Google-built test target hosting many application-security issues. Unlike instructional vulnerability labs it is designed for testing scanners and automated tools — not scenarios, but a raw catalogue of bug types.

https://public-firing-range.appspot.com/

Gin & Juice Shop

2026-09-18T00:00:00Z

A modern, vulnerability-filled web app practice target built by PortSwigger. Unlike older practice sites it carries a realistic single-page-app and API architecture, reflecting today’s web.

https://ginandjuice.shop/

Google Gruyere

2026-09-18T00:00:00Z

Google’s “full of holes” codelab teaching web application flaws. Unlike pure theory it has you find each flaw and both exploit and patch it.

https://google-gruyere.appspot.com/

LabEx Cybersecurity Labs

2026-09-18T00:00:00Z

Hands-on, in-browser labs covering penetration testing and web security. Unlike building your own lab the environment is ready in the browser — no setup, you start practising straight away.

https://labex.io/learn/cybersecurity

OWASP Juice Shop

2026-09-18T00:00:00Z

A modern web app deliberately full of vulnerabilities — a target for learning security. Unlike dry material it lets you exploit dozens of flaws by hand in a real application.

https://owasp.org/www-project-juice-shop/

OWASP Vulnerable Web Apps Directory

2026-09-18T00:00:00Z

OWASP’s directory of deliberately vulnerable web apps for training. Unlike a single app such as DVWA or Juice Shop, it classifies dozens of them as online, offline and VM/container.

https://owasp.org/www-project-vulnerable-web-applications-directory/

Hack The Box Academy

2026-08-26T20:53:20Z

Module-based learning with practical certifications such as CPTS and CBBH. Against OSCP the learning path lives on the same platform as the exam and costs markedly less; in exchange, employer recognition is not yet at OSCP’s level.

https://academy.hackthebox.com/

Google CTF

2026-08-21T20:53:20Z

Every challenge from Google’s CTF competitions, with source code and solutions. Unlike other archives the challenge infrastructure is published too, so you can stand the whole thing up locally and work through it.

https://github.com/google/google-ctf

Trail of Bits CTF Field Guide

2026-08-21T20:53:20Z

The CTF guide from the security firm Trail of Bits, laying out which skill each category needs and how to build it. Deeper than CTF101, and it bridges toward professional security work rather than stopping at the competition.

https://trailofbits.github.io/ctf/

CTFtime

2026-08-17T20:53:20Z

A site scheduling Capture The Flag competitions worldwide and keeping team rankings. Unlike scattered announcements it gathers which contest is when in one place.

https://ctftime.org/

Web Security Academy

2026-08-17T20:53:20Z

PortSwigger’s free, hands-on web-security course — a live lab for each vulnerability. Unlike theory courses it has you perform the attack on a real target.

https://portswigger.net/web-security

Cicada 3301 Çözüm Rehberi

2026-07-29T06:34:40Z

A step-by-step solution of the internet’s best-known puzzle, chaining steganography, book ciphers and Tor hidden services. Unlike single-topic tutorials it shows how the techniques link together on a real problem.

https://www.boxentriq.com/guides/cicada-3301-first-puzzle-walkthrough

Çözülmemiş Tarihî Şifreler

2026-07-29T06:33:44Z

The category of ciphers still unbroken, the Voynich manuscript and Beale ciphers among them. Unlike solved-cipher tutorials, each here stands as an open problem.

https://en.wikipedia.org/wiki/Category:Undeciphered_historical_codes_and_ciphers

Tarihî Şifreli Metinler

2026-07-29T06:16:44Z

A list of solved and unsolved historical ciphertexts — real material for cryptanalysis practice instead of synthetic exercises.

https://en.wikipedia.org/wiki/List_of_ciphertexts

90 Days of Cyber Security

2026-04-05T20:38:10Z

A study plan split across ninety days — networking, Linux, Python, then offence and defence. Unlike scattered resource lists it offers a dated, ordered programme.

https://github.com/farhanashrafdev/90DaysOfCyberSecurity

OverTheWire Wargames

2025-12-25T06:07:24Z

Classic wargames you play over SSH, level by level. Unlike browser-based labs you work in a real shell; the Bandit series is the harshest and most durable way to learn the Linux command line.

https://overthewire.org/wargames/

Zodiac 340 Şifresinin Çözümü

2025-10-25T20:15:41Z

A technical account of how a homophonic substitution cipher unsolved for fifty-one years was broken — a real worked example of hypothesis and elimination.

https://blog.wolfram.com/2021/03/24/the-solution-of-the-zodiac-killers-340-character-cipher/

TryHackMe

2025-07-30T01:25:19Z

Guided labs that explain which tool you are using and why in each room. It holds your hand more than Hack The Box, which makes it the better first exposure to penetration testing.

https://tryhackme.com/

Hack The Box

2025-07-30T01:25:07Z

Realistic machines with no hints — reconnaissance and research are entirely on you. Unlike TryHackMe it does not guide you, which is why it turns up so often in OSCP preparation.

https://www.hackthebox.com/