zardus / wargame-nexus

A sorted and updated list of security wargame sites.

Welcome to the Wargame Nexus

This is an organized, PR-able list of wargame sites. If you know of a (reasonable) wargame site not on this list (and there are definitely some), shoot me a PR.

You can aggregate your score across many of these sites by registering on WeChall.

Wargames Listing

Legend

• recommended wargame
• beginner difficulty
• downloadable challenges
• no scoreboard
• bitrotted
• dead
• only playable in language X
• fails to work with the daily heartbeat check, so no promises about being up (but was up last time I checked)

The chals below are listed with recommended ones first, then the rest in alphabetical order.

Beginner

• OverTheWire Bandit
• OverTheWire Leviathan
• SmashTheStack Blowfish

General

• pwn.college
• TryHackMe
• PicoCTF
• root-me
• W3Challs
• WeChall
• archive.ooo
• 247CTF
• 0x539
• CTFLearn
• CpawCTF2
• CpawCTF
• Defend the Web
• Dreamhack
• Electrica
• elhacker
• ExploitExercises Main Sequence
• ExploitExercises Nebula
• Flagyard
• HackBBS
• Hacking-Challenges
• Hackropole
• HackTheBox
• HackThisSite
• HellBound Hackers
• Komodo CTF
• MAGURO β
• MNCTF
• Ma's Reversing
• Net-Force
• NewbieContest
• Open Security Training
• Open Security Training 2
• OverTheWire Semtex
• PWN.TN
• Rankk.org
• Revolution Elite
• RingZer0Team Online CTF
• SmashTheStack Logic
• SuNiNaTaS
• ThisisLegal.com
• TryThis0ne.com
• VulnHub
• YEHD 2015 CTF
• akictf
• hacker.org
• ksnctf
• World of Wargame
• 柚子胡椒CTF

Binary Pwning

• pwnable.kr
• pwnable.tw
• ExploitExercises Fusion
• ExploitExercises Phoenix
• HackSys Extreme Vulnerable Driver
• IO64
• IO
• Microcorruption
• Nightmare
• OverTheWire Behemoth
• OverTheWire Drifter
• OverTheWire Manpage
• OverTheWire Maze
• OverTheWire Narnia
• OverTheWire Unomo
• OverTheWire Vortex
• ROP Emporium
• ROP.sh
• pwnable.xyz

Binary Reversing

• reversing.kr
• challenges.re
• crackmes.one
• IOLI64

Prompt Injection

• Gandalf
• GPT Prompt Attack

Mobile

• reyammer.io

Web

• alert(1) to win
• websec.fr
• webhacking.kr
• 0xf.at
• Google Gruyere
• HackerTest
• HackingHub
• Lords of SQLInjection
• OverTheWire Natas
• PortSwigger Web Security Academy
• RedTiger's Hackit
• Stereotyped Challenges
• Wizer CTF
• XSS Game
• XSS PwnFunction
• XSS game area

Crypto

• Crypto Hack
• id0-rsa
• Matasano Cryptopals
• OverTheWire Krypton
• Brain Quest
• Énigmes À Thématiques
• Ethernaut (Solidity)
• Gekkó
• MysteryTwister
• try to decrypt

Forensics

• Digital Forensics Lab

Cloud

• flAWS
• flAWS 2

Unsorted

• CTF 101
• InterruptLabs Challenges
• IO07
• SANS Holiday Hack Challenge 2023
• SmashTheStack Amateria
• SmashTheStack Tux
• Viblo
• runZero Coin Challenge

Recon

• ae27ff

Not Security

Developing some core CS skills can be useful for security as well!

• Tensor Puzzles
• SadServers
• PyDéfis
• Prompt Riddle

Gone, but not forgotten

These sites have gone offline (or taken their challenges offline). I track them here to periodically check for their return (which does happen sometimes!).

• Backdoor
• Bright Shadows
• CHALLENGE LAND
• crackmes.de (mirror)
• ctfs.me
• HackBurger
• HackMe
• HallsOfValhalla
• hax.tor
• IOarm
• The Enigma Group
• WTHack
• MMA CTF
• CodeEngn
• HackerGateway
• Mod-X

Credit

I acquired the links here over a very long career. At some point, I started noting down resources that led me to these links. They are:

• https://medium.com/@a.hilton83/learning-resources-a0a859bf9dbd
• http://captf.com/practice-ctf/
• http://www.wechall.net/sites.php
• http://ctf.forgottensec.com/wiki/index.php?title=Main_Page
• https://github.com/carpedm20/awesome-hacking
• https://csea-iitb.github.io/IITBreachers-wiki/2020/08/01/Hacking-Sites.html

wargame-nexus's Issues

SmashTheStack Blowfish isn't cryptography-related

I've played the first few levels of that wargame out of interest and beside the initial password there is no reason to call it a cryptography wargame. I've then contacted the organizers and they've confirmed it's a beginner-friendly game to learn reverse engineering and binary exploitation. Not sure what placement that would warrant, hence I haven't made a pull request.