一、在线做题:
推荐的:
- http://pwnable.tw/ (一组较新的高质量可挑战)
- http://pwnable.kr/ (最近流行的一系列挑战之一)
- https://picoctf.com/ (专为高中生而设计,虽然该活动通常每年都是新活动,但仍留在网上并且难度很大)
- https://microcorruption.com/login (最佳界面之一,良好的难度曲线以及低级逆向工程的介绍,特别是在MSP430上)
- http://ctflearn.com/ (一个新的基于CTF的学习平台,面临用户带来的挑战)
- https://cherryblog.in/
- http://reversing.kr/
- http://hax.tor.hu/
- https://w3challs.com/
- https://pwn0.com/
- https://io.netgarage.org/
- http://ringzer0team.com/
- http://www.hellboundhackers.org/
- http://www.overthewire.org/wargames/
- http://counterhack.net/Counter_Hack/Challenges.html
- http://www.hackthissite.org/
- http://vulnhub.com/
- http://ctf.komodosec.com
其他
- https://backdoor.sdslabs.co/
- http://smashthestack.org/wargames.html
- http://www.mod-x.co.uk/main.php
- http://scanme.nmap.org/
- http://www.hackertest.net/
- http://net-force.nl/
标签
- http://www.wechall.net/sites.php (挑战站点的优秀列表)
- http://ctf.forgottensec.com/wiki/ (良好的CTF Wiki,尽管专注于CCDC)
- http://repo.shell-storm.org/CTF/ (CTF的大型存档)
特定于Webapp
- http://demo.testfire.net/
- http://wocares.com/xsstester.php
- http://crackme.cenzic.com/
- http://test.acunetix.com/
- http://zero.webappsecurity.com/
特定取证
- http://computer-forensics.sans.org/community/challenges
- http://computer-forensics.sans.org/community/challenges
- http://forensicscontest.com/
招募
商业/免费/有偿培训
- https://www.root-me.org/ (已完成的一系列挑战,可供公众免费使用,以及可选的付费商业版本)
- https://avatao.com (来自CTF团队的付费商业培训平台,尽管重点关注安全应用程序开发)
- http://heorot.net/
二、可下载的离线游戏
- http://www.badstore.net/
- http://www.owasp.org/index.php/Category:OWASP_WebGoat_Project
- http://www.owasp.org/index.php/Owasp_SiteGenerator
- Damn Vulnerable Web App
- Stanford SecureBench
- Stanford SecureBench Micro
- http://www.irongeek.com/i.php?page=security/mutillidae-deliberately-vulnerable-php-owasp-top-10
三、虚拟机
- https://pentesterlab.com/exercises/
- http://sourceforge.net/projects/metasploitable/files/Metasploitable2/
- Damn Vulnerable Linux (not currently live? local mirror)
无效或消失
只是出于历史的缘故,或者是偶然的时候,它们又回来了。
- http://rootcontest.com/
- http://intruded.net/
- https://how2hack.net
- WebMaven (Buggy Bank)
- http://www.foundstone.com/us/resources/proddesc/hacmetravel.htm
- http://www.foundstone.com/us/resources/proddesc/hacmebooks.htm
- http://www.foundstone.com/us/resources/proddesc/hacmecasino.htm
- http://www.foundstone.com/us/resources/proddesc/hacmeshipping.htm
- http://hackme.ntobjectives.com/
- http://testphp.acunetix.com/
- http://testasp.acunetix.com/Default.asp
- http://prequals.nuitduhack.com
- http://www.gat3way.eu/index.php (Russian)
- http://exploit-exercises.com/ (挑战反映在vulnhub上)
- http://damo.clanteam.com/
- http://p6drad-teel.net/~windo/wargame/
- http://roothack.org/
- http://ha.ckers.org/challenge/
- http://ha.ckers.org/challenge2/
- http://www.dc3.mil/challenge/
参考:http://captf.com/practice-ctf/
补充自己练习下来觉得比较好的网站:
1、CTFHub:https://www.ctfhub.com/#/calendar
优势:结构清晰、有各个方向的基础练习题,还有各大赛事真题。(免费)
2、justCTF 2019:https://2019.justctf.team/challenges
自己去体会,不多说