Practice Your Hacking Skills: CTF & Wargame Sites

Verified pass, July 2026. Statuses reflect checks against live pages and current project homes. Where a project relocated, the old URL is shown followed by an arrow to the current one.

Legend

Symbol	Meaning
✅	Available, resolves and serves the intended content
🔁	Moved, old URL is stale or redirects, use the new one
❌	Discontinued, domain dead, parked, or project retired (shown struck through)
⚠️	Reachable but stale, unmaintained, or gated behind a paywall/signup

---

Index

✅ Available (55)

CloudFoxable · bWAPP · Cryptopals · CTFlearn · CTFTime · Google Gruyere · Google XSS Game · Hack This Site · HackThis!! · IO (Netgarage) · OWASP Juice Shop · Microcorruption · OverTheWire · picoCTF · PortSwigger Web Security Academy · pwnable.kr · pwnable.tw · Reversing.kr · Root Me · SmashTheStack · Try2Hack · W3Challs · XSS Challenge Wiki · Pentest-practice · Practice CTF List (captf) · VulnHub · scanme.nmap.org · WeChall · shell-storm CTF archive · Altoro Mutual (testfire) · Acunetix test.php · Acunetix testphp · Acunetix testasp · Zero WebAppSecurity · PentesterLab · Metasploitable 2 · Mutillidae · DVWA · Avatao · Typhoon VM · Counter Hack / Holiday Hack · Hack The Box · TryHackMe · Hacker101 · crackmes.one · webhacking.kr · Websec.fr · Hacksplaining · Defend the Web · Gracker · SANS DFIR challenges · picoGym · OWASP VWAD · exploit.education · Praetorian challenges

🔁 Moved (9)

OWASP WebGoat · Hacking-Lab · RingZer0 · Damn Vulnerable Web App · Mutillidae · Exploit Exercises · SANS Forensics challenges · Praetorian challenges · picoCTF

❌ Discontinued (34)

CTF Challenge · CTF365 · Enigma Group · Game of Hacks · Hack.me · Hellbound Hackers · pwn0 · cherryblog.in · hax.tor.hu · ctf.komodosec.com · Backdoor (SDSLabs) · mod-x.co.uk · hackertest.net · net-force.nl · ForgottenSec CTF wiki · wocares XSS tester · Cenzic CrackMe · forensicscontest.com · rtncyberjobs.com · 0x41414141.com · Heorot · BadStore · OWASP SiteGenerator · Stanford SecuriBench · SecuriBench Micro · Damn Vulnerable Linux · rootcontest · intruded.net · how2hack.net · WebMaven · Foundstone Hacme series · NT OBJECTives hackme · Nuit du Hack prequals · gat3way.eu · damo.clanteam.com · p6drad-teel wargame · roothack.org · ha.ckers.org challenges · DC3 Digital Forensics Challenge

---

1. Core Practice Sites

Status	Site	URL	Notes
✅	CloudFoxable	github.com/BishopFox/cloudfoxable	AWS pentest playground, actively maintained
✅	bWAPP	itsecgames.com	Static page, project itself is frozen but downloadable
✅	Cryptopals	cryptopals.com	8 sets of crypto challenges
❌	CTF Challenge	ctfchallenge.co.uk	Domain no longer serves the platform
❌	CTF365	ctf365.com	Cyber range shut down, no active service
✅	CTFlearn	ctflearn.com	User-contributed challenges, active
✅	CTFTime	ctftime.org	Event calendar and team rankings
❌	Enigma Group	enigmagroup.org	Long unmaintained, site no longer reliably up
❌	Game of Hacks	gameofhacks.com	Checkmarx retired the demo
✅	Google Gruyere	google-gruyere.appspot.com	Still hosted on App Engine
✅	Google XSS Game	xss-game.appspot.com	6 levels, still live
✅	Hack This Site	hackthissite.org	Classic wargame, active community
❌	Hack.me	hack.me	eLearnSecurity folded into INE, sandbox service retired
🔁	Hacking-Lab	www.hacking-lab.com/index.html → hacking-lab.com	Now commercial, free tier at academy.hacking-lab.com
✅	HackThis!!	hackthis.co.uk	50+ levels
❌	Hellbound Hackers	hellboundhackers.org	Offline, community dispersed
✅	IO (Netgarage)	io.netgarage.org	SSH wargame, still updated (2025 entries)
✅	OWASP Juice Shop	github.com/juice-shop/juice-shop	Repo moved from bkimminich to the juice-shop org
✅	Microcorruption	microcorruption.com	MSP430 embedded RE, not ARM (original note was wrong)
✅	OverTheWire	overthewire.org/wargames	Bandit, Natas, Leviathan, etc.
🔁	OWASP WebGoat	owasp.org/index.php/Category:OWASP_WebGoat_Project → owasp.org/www-project-webgoat	OWASP retired the MediaWiki, repo at github.com/WebGoat/WebGoat
🔁	picoCTF	picoctf.com → picoctf.org	picoGym stays open year round
✅	PortSwigger Web Security Academy	portswigger.net/web-security	Free, best-in-class web labs
❌	pwn0	pwn0.com	VPN wargame long dead
✅	pwnable.kr	pwnable.kr	Binary exploitation
✅	pwnable.tw	pwnable.tw	Harder pwn set
✅	Reversing.kr	reversing.kr	RE challenges, slow but up
🔁	RingZer0	ringzer0team.com → ringzer0ctf.com	Rebranded domain
✅	Root Me	root-me.org	500+ challenges, free tier
✅	SmashTheStack	smashthestack.org	IRC-coordinated wargame network
✅	Try2Hack	try2hack.nl	One of the oldest still standing
⚠️	Typhoon Vulnerable VM	prismacsi.com	Download page up, VM not updated in years
✅	W3Challs	w3challs.com	Mixed category platform
✅	XSS Challenge Wiki	github.com/cure53/XSSChallengeWiki	Curated by cure53

2. Aggregators and Lists

Status	Site	URL	Notes
✅	Pentest-practice	github.com/roya0045/Pentest-practice	Repo intact, low activity
✅	Practice CTF List (captf)	captf.com/practice-ctf	Source of the section below
✅	WeChall	wechall.net/sites.php	Still the best cross-site challenge index
❌	ForgottenSec CTF wiki	ctf.forgottensec.com/wiki	Gone
✅	shell-storm CTF archive	shell-storm.org/repo/CTF	Moved off the repo. subdomain
✅	OWASP VWAD	vwad.owasp.org	Modern replacement for most "vulnerable app" lists

---

3. Practice CTF List / Permanent CTF List

Originally compiled at captf.com, credited to RSnake for the original.

3.1 Live Online Games (Recommended)

Status	Site	Notes
✅	pwnable.tw	High quality pwnables
✅	pwnable.kr	Popular wargame set
🔁	picoctf.com → picoctf.org	Great difficulty progression, stays online year round
✅	microcorruption.com/login	Excellent interface, MSP430 low-level RE
✅	ctflearn.com	User-contributed challenges
❌	cherryblog.in	Domain dead
✅	reversing.kr	Reverse engineering
❌	hax.tor.hu	Offline for years
✅	w3challs.com	Mixed categories
❌	pwn0.com	Dead
✅	io.netgarage.org	Still maintained
🔁	ringzer0team.com → ringzer0ctf.com	Rebranded
❌	hellboundhackers.org	Offline
✅	overthewire.org/wargames	Active
🔁	counterhack.net/Counter_Hack/Challenges.html → counterhack.net	Now centered on SANS Holiday Hack Challenge
✅	hackthissite.org	Active
✅	vulnhub.com	Boot2root VM archive, still the standard
❌	ctf.komodosec.com	Gone

3.2 Others

Status	Site	Notes
❌	backdoor.sdslabs.co	SDSLabs retired the platform
✅	smashthestack.org/wargames.html	Active
❌	mod-x.co.uk	Dead
✅	scanme.nmap.org	Nmap's sanctioned scan target, still up
❌	hackertest.net	Dead
❌	net-force.nl	Dead
❌	hackthecause.info	Dead (was already commented out)
❌	onlinectf.com	Dead (was already commented out)
❌	bright-shadows.net	Dead (was already commented out)
❌	securityoverride.org	Dead (was already commented out)

3.3 Webapp Specific

Status	Site	Notes
✅	demo.testfire.net	HCL AppScan's Altoro Mutual demo bank, still hosted
❌	wocares.com/xsstester.php	Dead
❌	crackme.cenzic.com	Cenzic acquired by Trustwave, demo retired
✅	test.acunetix.com	Invicti keeps the deliberately vulnerable demos up
✅	testphp.vulnweb.com	Current home of the old testphp.acunetix.com
✅	testasp.vulnweb.com	Current home of the old testasp.acunetix.com
✅	zero.webappsecurity.com	Micro Focus / OpenText demo bank

3.4 Forensics Specific

Status	Site	Notes
🔁	computer-forensics.sans.org/community/challenges → sans.org/mlp/dfir-challenges	Subdomain retired, content folded into the main SANS DFIR pages
⚠️	forensicscontest.com	Puzzles still readable, no new content since ~2012

3.5 Recruiting

Status	Site	Notes
🔁	praetorian.com/challenges/pwnable → praetorian.com	Old challenge path retired, occasional new campaigns
❌	rtncyberjobs.com	Raytheon recruiting site retired
❌	0x41414141.com	Dead

3.6 Commercial / Freemium / Paid

Status	Site	Notes
✅	root-me.org	Free for public use, paid commercial tier
✅	avatao.com	Secure-dev focused, commercial
❌	heorot.net	Dead, De-ICE ISOs survive on VulnHub

---

4. Downloadable / Offline Targets

Status	Project	URL	Notes
❌	BadStore	badstore.net	Domain gone, ISO mirrored on VulnHub
🔁	OWASP WebGoat	owasp.org/index.php/... → owasp.org/www-project-webgoat	Docker image is the current install path
❌	OWASP SiteGenerator	owasp.org/index.php/Owasp_SiteGenerator	Project archived by OWASP
🔁	Damn Vulnerable Web App	ethicalhack3r.co.uk/damn-vulnerable-web-app → github.com/digininja/DVWA	Actively maintained by the original author
❌	Stanford SecuriBench	~~suif.stanford.edu/~livshits/securibench~~	Research page retired
❌	SecuriBench Micro	~~suif.stanford.edu/~livshits/work/securibench-micro~~	Retired
🔁	Mutillidae II	irongeek.com/i.php?page=security/mutillidae... → github.com/webpwnized/mutillidae	Irongeek page still loads, but the repo is where development happens

5. Virtual Machines

Status	Project	URL	Notes
✅	PentesterLab	pentesterlab.com/exercises	Freemium
✅	Metasploitable 2	sourceforge.net/projects/metasploitable	Still downloadable
✅	Metasploitable 3	github.com/rapid7/metasploitable3	Successor, build-your-own
❌	Damn Vulnerable Linux	damnvulnerablelinux.org	Abandoned, ISOs only via mirrors
✅	VulnHub	vulnhub.com	Where most orphaned VMs above now live

---

6. Inactive or Gone

All confirmed dead. Kept for historical reference.

Site	Notes
rootcontest.com	Gone
intruded.net	Gone
how2hack.net	Gone
mavensecurity.com/WebMaven.php	WebMaven / Buggy Bank retired
foundstone.com Hacme Travel	Foundstone absorbed into McAfee, tools pulled
foundstone.com Hacme Books	Same
foundstone.com Hacme Casino	Same
foundstone.com Hacme Shipping	Same
hackme.ntobjectives.com	NT OBJECTives acquired, demo retired
prequals.nuitduhack.com	Event archived, see ctftime.org
gat3way.eu	Gone
damo.clanteam.com	Gone
~~p6drad-teel.net/~windo/wargame~~	Gone
roothack.org	Gone
ha.ckers.org/challenge	RSnake retired the site
ha.ckers.org/challenge2	Same
dc3.mil/challenge	DC3 Digital Forensics Challenge discontinued
exploit-exercises.com → exploit.education	Rebranded, Nebula/Protostar/Fusion live on

---

7. Worth Adding

Platforms that did not exist or were minor when this list was written, and now carry most of the traffic.

Platform	URL	Focus
TryHackMe	tryhackme.com	Guided rooms, beginner to intermediate
Hack The Box	hackthebox.com	Machines, Pro Labs, Academy
Hacker101	hacker101.com	HackerOne's free CTF and video course
picoGym	picoctf.org/practice	Persistent picoCTF challenge bank
crackmes.one	crackmes.one	Reverse engineering exercises
webhacking.kr	webhacking.kr	Korean web challenge classic
Websec.fr	websec.fr	Web-only, hard
Defend the Web	defendtheweb.net	Successor community to several dead sites
Hacksplaining	hacksplaining.com	Defensive-side lessons
OverTheWire Advent	overthewire.org	Seasonal
pwn.college	pwn.college	ASU's full binary exploitation curriculum
GTFOBins	gtfobins.github.io	Reference, not a CTF, but constantly needed

---

Verification Notes

• Statuses were checked against live pages and current project repositories where retrievable. Sites marked ⚠️ resolve but have not been updated in years.
• Several entries in the original list pointed at OWASP's retired MediaWiki (owasp.org/index.php/...). Every one of those needs the www-project-* path now.
• The Acunetix demo targets migrated from *.acunetix.com to *.vulnweb.com. Both old paths in the original list were already marked dead, and the replacements are live.
• A few sites (Reversing.kr, Try2Hack, bWAPP) are up but serve plain HTTP or expired certs. Expect browser warnings.