challenges_and_CTF_sites.md

Challenge sites for CTF Practice:

1. picoCTF
2. OverTheWire
3. UnderTheWire
4. Hack This Site
5. Microcorruption
6. Smash The Stack
7. https://defendtheweb.net/?hackthis (an interactive Cyber security platform)<== registration required. many articles and a playground with challenges
8. https://www.root-me.org/?lang=en (free and paid accounts)
9. Sans Holiday Hack Challenges
10. https://ringzer0ctf.com/challenges/
11. HackTheBox has a free membership level.

Other CTF and Security Challenge Sites:

1. http://www.gameofhacks.com/game
2. http://www.try2hack.nl/ warned away by Google safe surfing. Site seems to be up, though and has challenges
3. https://www.hellboundhackers.org/ <== this is a forum as well as hosting "simulated security challenges"
4. https://www.tracelabs.org/getinvolved/ctf/ == finding missing people thru OS INT

Video Games:

1. http://elseheartbreak.com/ is a hacking challenge of a game in which you win by hacking into the computers in-universe.
2. https://store.steampowered.com/app/469920/hackmud/
3. https://tomorrowcorporation.com/humanresourcemachine is a coding game that simulates coding in Assembly

Puzzle Sites:

1. http://notpron.org/notpron/ Series of web page puzzles

List: https://blog.infosec.business/hands-on-learning-resources-cybersecurity/

Forensic Challenges

1. https://blog.webernetz.net/wireshark-layer-2-3-pcap-analysis-w-challenges-ccnp-switch/

2. https://www.netresec.com/?page=PcapFiles

3. https://forensicscontest.com/puzzles

4. https://www.malware-traffic-analysis.net/2019/12/03/index.html

5. FROM DFIR (https://www.dfir.training/resources/downloads/ctf-forensic-test-images)

• http://ae27ff.meme.tips/about.php
• https://www.ashemery.com/dfir.html
• https://www.binary-zone.com/2015/09/16/digital-forensic-challenge-4/ (instructions unclear but site seems up)
• https://attackdefense.com/
• https://github.com/ctfs/write-ups-2017/tree/master/bsidessf-ctf-2017/forensics/ximage-300
• https://github.com/cyphernix/challenges
• https://betweentwodfirns.blogspot.com/2016/06/forensic-ctf-bobs-chili-burgers-website.html

Memory Forensics:

1. https://github.com/stuxnet999/MemLabs

ShellCode Challenges:

1. https://azeria-labs.com/part-3-stack-overflow-challenges/
2. https://0xrick.github.io/binary-exploitation/bof5/
3. https://www.xoru.net/bas-groothedde/article/picoctf-2018-writeup-shellcode-extended.html
4. https://github.com/VulnHub/ctf-writeups/blob/master/2015/ringzer0/shellcoding.md
5. https://medium.com/syscall59/solving-malwaretech-shellcode-challenges-with-some-radare2-magic-b91c85babe4b
6. https://samsclass.info/127/proj/p3-lbuf1.htm
7. http://security.cs.pub.ro/hexcellents/wiki/kb/exploiting/shellcode-walkthrough

Coding Challenges:

1. http://www.pythonchallenge.com/
2. https://projecteuler.net/
3. https://www.reddit.com/r/dailyprogrammer/
4. https://alexnisnevich.github.io/untrusted/ (Javascript)

Web Challenges:

1. https://www2.owasp.org/www-project-juice-shop/
2. WebGoat
3. NetGoat
4. https://github.com/stripe-ctf/stripe-ctf-2.0 <-- Source Code for a Series of web challenges used in a CTF in 2012
5. http://google-gruyere.appspot.com/
6. https://github.com/webpwnized/mutillidae mutillidae is an open source PHP Application made deliberately vulnerable.
7. https://portswigger.net/web-security
8. https://community.securityinnovation.com/access-the-cyber-range/ has a three day three trial for one of their cyber -ranges which is a social media site with lots of vulnerabilities. It scores you as you uncover each vulnerability.

Reverse Engineering (crackmes)

1. https://crackmes.one/
2. https://wiki.bytecode.club/CrackMes
3. https://challenges.re/
4. http://www.flare-on.com/ (fire-eye)
5. reversing.kr (registration required)
6. Copied from https://reverseengineering.stackexchange.com/questions/15774/crack-me-material and validated to make sure links were still alive

• https://pwnable.xyz/

• https://crackmes.one

• https://tuts4you.com/download.php?list.17

• https://github.com/fdivrp/awesome-reversing/ (this is a very complete list of resources)

• https://github.com/michalmalik/linux-re-101 (this is a list of articles and tutorials)

• https://tuts4you.com/download.php -- duplicate

• http://jackson.thuraisamy.me/re-resources.html blog. Not actual challenges

• https://github.com/RPISEC/MBE Course materials including reversing challenges

• https://github.com/Maijin/Workshop2015/tree/master/IOLI-crackme (10 crackmes for windows, linux, PocketPC)

• https://hackcenter.com/sign-in (hmmmm. not sure if this one is being updated?)

• https://www.root-me.org/en/Challenges/Cracking/ is alive but need to register and login

• https://www.wechall.net/active_sites (clearinghouse for listing challenge sites)

• http://www.wechall.net/challs/ (clearinghouse)

• https://challenges.re/ yes it is alive

• https://github.com/s7ephen/CSAW_2009 Source code to the Reverse Engineering Challenges for the CSAW 2009 competition

• https://github.com/isislab/Hack-Night/ large course that includes RE slides and challenges

• http://pwnable.kr/ wargames starting with "Toddler's Bottle". registration required.

• https://w3challs.com/ Registration Required. Cracking challenges plus other categories.

• http://io.netgarage.org/ wargames basic, Special, Reversing, misc

• http://rogerfm.net/challenge/crackme/index.htm

• https://gironsec.com/cactuscon_re_challenges/index.php

• https://cryptocult.wordpress.com/cyber-challenges/

• http://www.reteam.org/challenges.html mostly D34D no challenges found

• https://github.com/rshipp/awesome-malware-analysis Massive List of Malware analysis and security resources

• http://crackmes.cf (mirror of crackmes.de and so mostly duplicates of crackmes.one)

• https://0x00sec.org/t/challenge-collection-reverse-engineering-and-crackme/3027 Nice Collection

• https://github.com/holbertonschool/dont_hate_the_hacker_hate_the_code (set of three crackmes that have a writeup

Crypto Challenges

1. https://cryptopals.com/
2. http://overthewire.org/wargames/krypton/
3. https://www.root-me.org/en/Challenges/Cryptanalysis/
4. https://www.mysterytwisterc3.org/en/
5. https://cryptohack.org/ <-- Very applicable to CTF Crypto Challenges.

Hardware Hacking Challenges

1. https://www.wired.com/2014/08/defcon-2014-badges-revealed/ Article about LostBoy, designer of DefCon's hackable badges

Other

1. enigmagroup.org (untested) Site is up. unclear if it is free or paid)

Paid Resources:

Pentest Academy https://ctf365.com/ (limited access for one free user. unlimited access = $46.00 per month for one user) https://www.hacking-lab.com/ 49 EUR for one year.
https://www.hackthebox.eu/individuals premium = 10 pounds per month https://www.tryhackme.com = $10.00 per month