Open-source alternatives to Google Ctf

Juice Shop is a self-contained web application designed as a platform for cybersecurity education and security training. It functions as a controlled environment containing intentional security flaws, allowing users to practice offensive security techniques and defensive coding practices while tracking their progress through a live scoreboard. The platform serves as an industry-standard benchmark for evaluating the effectiveness and detection accuracy of automated security scanning tools. By hosting a standardized set of known vulnerabilities and common attack patterns, it provides a reliable

Hacker Roadmap is a community-driven repository that functions as a structured learning path and resource directory for cybersecurity and ethical hacking. It organizes complex security concepts into sequential modules, guiding users from fundamental knowledge to advanced technical exploitation skills through a curated collection of educational materials and professional development resources. The project distinguishes itself by acting as a centralized index that maps specialized third-party security software and isolated training environments to specific operational use cases. By aggregating

This repository serves as a structured archive of cybersecurity training exercises designed for hands-on practice across multiple technical domains. It functions as a collection of intentionally vulnerable challenges that provide users with the source files and documentation necessary to develop proficiency in security analysis and software vulnerability research. The project distinguishes itself by organizing these exercises into a hierarchical directory structure, ensuring that security scenarios remain consistent and reproducible through version-controlled static assets. Each challenge is

This project is a comprehensive directory of software utilities, frameworks, and educational resources designed for cybersecurity competitions and offensive security research. It serves as a centralized index for tools used in cryptography, forensics, reverse engineering, and web exploitation, while providing structured materials for training and skill development. The repository distinguishes itself through a community-driven maintenance model that aggregates and organizes technical resources into a searchable, hierarchical structure. It facilitates knowledge transfer by cataloging expert pr

fbctf is a Capture The Flag platform designed for hosting cybersecurity competitions. It provides a scoring engine to track participant progress and an orchestration tool to manage the transition from event configuration to an active state. The system utilizes a containerized deployment framework to launch the infrastructure and environments required for live events. It includes an identity integration that authenticates participants via external directory servers to provide organization-wide access control. The platform covers the administration of competition content and security goals, te

hustoj is a web-based online judge platform built with PHP and MySQL for hosting programming contests and training. It features an automated code grading engine that executes submissions in multiple languages and validates them against test cases to provide rankings and scores. The system is designed as a competitive programming contest manager, supporting ACM-ICPC and NOIP style events with weighted scoring and penalty calculations. It distinguishes itself with a built-in plagiarism detection system that compares source code similarity between users to identify potential cheating. The platf

upload-labs is a file upload vulnerability lab and penetration testing sandbox. It consists of a collection of intentionally vulnerable web applications designed for practicing the discovery and exploitation of file upload security flaws. The project serves as a web security training ground and cybersecurity education lab. It provides a simulated environment for learning how to bypass upload restrictions and achieve remote code execution on servers through controlled laboratory exercises. The system includes capabilities for vulnerability research simulation and penetration testing practice.

sqli-labs is a collection of intentionally vulnerable web applications and sandbox environments designed for practicing the identification and exploitation of SQL injection vulnerabilities. It serves as a cybersecurity education lab where users can experiment with database exploits in a controlled setting. The environment provides specialized modules for testing a wide range of attack vectors, including error-based, boolean-blind, and time-based injections. It specifically covers advanced techniques such as second-order injections, stacked queries, and attacks targeting HTTP headers. The pro

DVWA is a vulnerable web application lab and penetration testing sandbox designed to simulate common security flaws. It serves as a training platform for the OWASP Top 10 security risks and functions as a PHP and MySQL security lab for practicing the identification and exploitation of web vulnerabilities. The project provides a graduated learning experience through configurable security levels that adjust the difficulty of the vulnerabilities. It also supports switching between different database engines to research how various storage systems respond to injection attacks. The application is

Ethical-Hacking-Labs is a comprehensive cybersecurity training curriculum and lab suite designed for learning penetration testing, network analysis, and offensive security techniques. It provides a structured environment for practicing the full attack lifecycle, from initial reconnaissance and scanning to exploitation and post-compromise analysis. The project provides instructional materials and guided exercises that cover specific technical domains, including open source intelligence research and network security courseware. It includes a practical workbook for identifying system vulnerabili

This project is a comprehensive, community-curated directory of cybersecurity resources, tools, and educational materials. It functions as a centralized index for researchers and students to discover frameworks and utilities across the entire security lifecycle, ranging from initial vulnerability assessment to post-exploitation analysis. The repository distinguishes itself through a hierarchical taxonomy that organizes diverse security disciplines into a searchable, version-controlled knowledge base. Rather than hosting software directly, it utilizes a decentralized aggregation model that lin

This project serves as a centralized, community-driven repository of technical knowledge and administrative resources. It provides a structured taxonomy that aggregates disparate information into a searchable framework, supporting continuous learning and rapid problem-solving for system administrators and cybersecurity practitioners. By mapping resources across offensive security, infrastructure management, and software development, it offers a unified path for skill acquisition and professional reference. The project is defined by a command-line-first design philosophy, prioritizing terminal

This project is a curated, version-controlled directory of software and resources designed for cybersecurity professionals and researchers. It functions as a centralized knowledge base that aggregates and organizes external security utilities into a structured taxonomy to facilitate discovery and access for specialized research and testing tasks. The repository distinguishes itself through a community-driven model where external resource locations are verified and maintained by contributors. By leveraging a distributed version control system, the project ensures the historical integrity and c

90DaysOfCyberSecurity is an open-source educational repository that provides a structured ninety-day learning roadmap for individuals pursuing a career in the security industry. The project organizes foundational security concepts, technical skills, and professional development tasks into a sequential, day-by-day curriculum designed for self-paced study. The repository functions as a community-driven knowledge base, leveraging version control to allow contributors to expand the curriculum with new tutorials, case studies, and study materials. It distinguishes itself by integrating a professio

This project is a comprehensive cybersecurity knowledge repository that provides a structured collection of technical documentation, training materials, and professional development roadmaps. It serves as a centralized resource for practitioners to navigate complex security disciplines, ranging from offensive and defensive fundamentals to specialized infrastructure and application security. The repository distinguishes itself through a modular resource framework that enables users to construct isolated cyber range environments for hands-on practice. It also features a specialized reference gu

RsaCtfTool is a specialized cryptography suite designed for solving capture-the-flag challenges. It serves as a cryptanalysis and key recovery tool used to derive private keys and decrypt data from weak RSA public key implementations. The tool functions as an integer factorization toolkit, employing a variety of mathematical attacks and algorithms to decompose large composite numbers into their prime factors. It integrates with external prime number databases to accelerate the factorization process and identifies specific mathematical vulnerabilities in key generation. Its capabilities cover

Attack Range is a cybersecurity breach simulation framework designed to orchestrate the lifecycle of security labs and execute controlled attack scenarios. It functions as a security simulation infrastructure orchestrator, enabling the deployment of instrumented cloud and local environments to validate defensive capabilities and generate security telemetry. The platform distinguishes itself through configuration-driven automation and infrastructure-as-code orchestration, which allow for the repeatable provisioning of vulnerable environments. It manages the entire simulation lifecycle, from th

This project is a security training wiki and markdown knowledge base that provides technical guides, categorized exercises, and tool directories for participants in competitive security challenges. It serves as a comprehensive resource for capture the flag training, organizing learning materials into a searchable website. The knowledge base covers specialized security domains including cryptography, web security, and reverse engineering. It includes a curated directory of research tools and software used for vulnerability research and exploitation, alongside a repository of practical challeng

Hello-CTF is a comprehensive educational platform and toolset designed for individuals learning to participate in capture the flag competitions. It provides a structured cybersecurity learning path, including beginner tutorials, foundational training, and a curated directory of software tools for web security and cryptography. The project features a competition tracker and calendar for discovering and submitting upcoming security events, alongside a searchable archive of historical competition files for study and practice. It also includes interactive web security practice labs and flag disco

Hacker101 is a cybersecurity education platform and web security training portal. It serves as a structured collection of lessons and resources designed to teach students about vulnerability research and penetration testing through guided modules. The platform operates as a static site generator and markdown-based content manager. It uses plain text files with structured metadata to define the hierarchy and properties of educational lessons, transforming this content into pre-rendered HTML files for delivery. The curriculum covers a broad domain of security education, including specialized c

Pwntools is a Python-based framework designed for rapid prototyping and automation in binary exploitation, reverse engineering, and security research. It serves as a comprehensive toolkit for interacting with local and remote processes, providing the primitives necessary to manage complex exploit workflows and streamline security analysis tasks. The framework distinguishes itself through its specialized capabilities for binary manipulation and automated exploit construction. It includes dedicated utilities for parsing executable file formats, assembling and disassembling machine code, and gen

Pikachu is a web security training platform and vulnerable web application sandbox. It provides a containerized lab environment designed for practicing penetration testing and identifying common security flaws. The project serves as an OWASP Top 10 practice lab, offering a simulation suite for critical risks. It includes specific scenarios for practicing the exploitation of SQL injection, cross-site scripting, remote code execution, and broken access control. The environment covers a broad range of security testing simulations, including directory traversal, server-side request forgery, unsa

This project is an interactive programming curriculum and educational system designed to teach computer science and software engineering. It provides a structured set of courses and professional roadmaps focused on backend engineering, DevOps, and systems fundamentals. The platform is distinguished by an AI-powered coding tutor that provides Socratic guidance and contextual hints to help students find solutions independently. It features a browser-based code sandbox using WebAssembly to eliminate local environment setup, alongside automated test-based grading and spaced-repetition logic to re

Earthworm is an AI-powered language learning platform centered on sentence construction, translation exercises, and grammar tutoring. It integrates a spaced repetition system to schedule reviews based on individual performance and a multimedia practice tool that converts audio, video, and text into interactive sentence-level exercises. The platform features a real-time competitive quiz system where users can challenge each other in live matches based on speed and accuracy. It also includes an AI tutor that provides contextual grammar and usage explanations for specific sentences, and a set of

AzureGoat : A Damn Vulnerable Azure Infrastructure