CTF & Hands-on Labs

A study plan split across ninety days — networking, Linux, Python, then offence and defence. Unlike scattered resource lists it offers a dated, ordered programme.

A list of tools, wargames and tutorials for Capture The Flag. Unlike a single contest it gives the whole toolchain needed to prepare, category by category.

A downloadable, deliberately vulnerable app containing 100+ web vulnerabilities. Unlike online targets it lets you practise on your own machine, isolated and without limits.

A step-by-step solution of the internet’s best-known puzzle, chaining steganography, book ciphers and Tor hidden services. Unlike single-topic tutorials it shows how the techniques link together on a real problem.

A user-submitted archive of reverse engineering challenges (crackmes), filterable by difficulty, language and platform. Unlike CTF platforms these are standalone local binaries with user-written solutions. They are unvetted executables, so run them in a VM.

A set of 48 programming exercises in 8 sets that teach cryptography by attacking real constructions; you write the attacks yourself. Unlike textbooks, each break builds on the previous one. Requires writing code in a language of your choice.

A site scheduling Capture The Flag competitions worldwide and keeping team rankings. Unlike scattered announcements it gathers which contest is when in one place.

A deliberately vulnerable iOS app for learning mobile security. Unlike web-based vulnerability labs it targets mobile-specific issues — insecure data storage, binary patching.

A Google-built test target hosting many application-security issues. Unlike instructional vulnerability labs it is designed for testing scanners and automated tools — not scenarios, but a raw catalogue of bug types.

A modern, vulnerability-filled web app practice target built by PortSwigger. Unlike older practice sites it carries a realistic single-page-app and API architecture, reflecting today’s web.

Every challenge from Google’s CTF competitions, with source code and solutions. Unlike other archives the challenge infrastructure is published too, so you can stand the whole thing up locally and work through it.

Google’s “full of holes” codelab teaching web application flaws. Unlike pure theory it has you find each flaw and both exploit and patch it.

Realistic machines with no hints — reconnaissance and research are entirely on you. Unlike TryHackMe it does not guide you, which is why it turns up so often in OSCP preparation.

Module-based learning with practical certifications such as CPTS and CBBH. Against OSCP the learning path lives on the same platform as the exam and costs markedly less; in exchange, employer recognition is not yet at OSCP’s level.

A long-running site with basic hacking missions (basic, realistic, programming, stego) in a legal, safe setting. It also has forums and articles; often named as a first step for beginners, though the interface is dated next to newer platforms. Compared with newer platforms its interface is dated, but it is not tied to a CTF calendar.

HackerOne's free video lessons and CTF on finding web vulnerabilities; flags earned can bring invitations to private bug bounty programs. Unlike general training sites it links straight into the bug bounty path.

A developer-oriented site that explains common web vulnerabilities (XSS, SQL injection, CSRF) in short interactive lessons. Unlike pentest platforms it focuses on teaching defence rather than attack.

Hands-on, in-browser labs covering penetration testing and web security. Unlike building your own lab the environment is ready in the browser — no setup, you start practising straight away.

An embedded-systems CTF where you break electronic locks using an in-browser MSP430 debugger. Nothing to install, which makes it a practical entry to embedded reverse engineering and assembly. Originally built by Matasano.

Classic wargames you play over SSH, level by level. Unlike browser-based labs you work in a real shell; the Bandit series is the harshest and most durable way to learn the Linux command line.

A modern web app deliberately full of vulnerabilities — a target for learning security. Unlike dry material it lets you exploit dozens of flaws by hand in a real application.

OWASP’s directory of deliberately vulnerable web apps for training. Unlike a single app such as DVWA or Juice Shop, it classifies dozens of them as online, offline and VM/container.

OWASP's web application penetration testing methodology and checklist, from information gathering to business logic flaws. Unlike vulnerability lists such as the Top 10 it spells out how each issue is tested.

Web and application security exercises where each one explains a vulnerability and gives you a running environment to exploit it. Unlike plain CTF sites the exercises are sequenced by topic and difficulty like a curriculum. The free tier is limited; full access is paid.

Carnegie Mellon's free CTF platform with web, crypto, reverse engineering and forensics tasks. Unlike competition-first sites, difficulty starts at high-school level and past contest challenges stay open for practice. Needs an account.

Arizona State University's free cybersecurity education platform; beginner-friendly modules with in-browser practice environments teach binary exploitation, web and reverse engineering. Unlike plain CTF sites it follows an ordered curriculum.

A non-profit wargame site for binary exploitation (pwn), starting at the Toddler's Bottle tier and getting harder. Tasks run on a remote SSH server with source provided, which suits learning memory corruption in order. Unlike browser-based exercises, tasks run on a real SSH server.

Harder binary exploitation tasks aimed at building pwn skills on near-real vulnerabilities. It sits above pwnable.kr in difficulty; challenges are scored and you work through earlier ones to progress.

A community-run French platform with hundreds of challenges and virtual environments across web, cryptography, reverse engineering and forensics. Unlike large commercial labs it comes with community write-ups and a rich document repository.

A list of solved and unsolved historical ciphertexts — real material for cryptanalysis practice instead of synthetic exercises.

The CTF guide from the security firm Trail of Bits, laying out which skill each category needs and how to build it. Deeper than CTF101, and it bridges toward professional security work rather than stopping at the competition.

Guided labs that explain which tool you are using and why in each room. It holds your hand more than Hack The Box, which makes it the better first exposure to penetration testing.

Docker-compose environments for known CVEs that come up with one command. Unlike VM archives, each one targets a single piece of software and a single CVE, which makes studying a root cause locally straightforward. Run only in an isolated environment.

An archive of community-built vulnerable VMs you download and run locally. Unlike online lab platforms they work offline, which is why they are popular for OSCP-style practice. Downloaded VMs are untrusted code, so run them isolated.

PortSwigger’s free, hands-on web-security course — a live lab for each vulnerability. Unlike theory courses it has you perform the attack on a real target.

A technical account of how a homophonic substitution cipher unsolved for fifty-one years was broken — a real worked example of hypothesis and elimination.

The category of ciphers still unbroken, the Voynich manuscript and Beale ciphers among them. Unlike solved-cipher tutorials, each here stands as an open problem.