CTF & Practice Labs
Practice environments for offensive and defensive security skills: capture-the-flag platforms, deliberately vulnerable applications, and wargames where techniques can be exercised without touching systems the learner does not own.
Software in CTF & Practice Labs
16 toolsNo tools in this category match the selected filters.
| Tool | License | Platforms | Pricing |
|---|---|---|---|
| Blue Team Labs Online Gamified defender practice covering incident response, digital forensics, security operations, and threat hunting. | Proprietary | Web | Freemium |
| CTFd Open source platform for hosting capture-the-flag competitions with plugins and dynamic scoring. | Apache-2.0 | Linux, macOS, Windows | Free / Commercial |
| CyberDefenders Blue team and DFIR labs built from real forensic artifacts such as memory dumps and PCAPs. | Proprietary | Web | Freemium |
| DVWA Damn Vulnerable Web Application, a PHP web app with deliberately insecure code for practice. | GPL-3.0-or-later | Linux, macOS, Windows | Open Source |
| Hack The Box Hands-on hacking labs, machines, and CTF competitions with academy courses and enterprise ranges. | Proprietary | Web | Freemium |
| Hackviser Hands-on training platform with labs, scenario machines, and browser-based tooling plus certifications. | Proprietary | Web | Freemium |
| LetsDefend Blue team training platform where learners investigate cyber attacks inside a simulated SOC. | Proprietary | Web | Freemium |
| Metasploitable 3 Deliberately vulnerable Windows and Ubuntu VMs built with Packer and Vagrant for exploit practice. | BSD-3-Clause | Linux, macOS, Windows | Open Source |
| OverTheWire Free SSH-based wargames teaching Linux, networking, and security fundamentals level by level. | Proprietary (free service) | Web | Free |
| OWASP Juice Shop Intentionally insecure Node.js web application covering the OWASP Top 10 and beyond, with built-in score board. | MIT | Linux, macOS, Windows | Open Source |
| picoCTF Free Carnegie Mellon CTF learning platform, now the CyLab Security Academy, for students and educators. | Proprietary (free service) | Web | Free |
| PortSwigger Web Security Academy Free online web security training with interactive labs from the creators of Burp Suite. | Proprietary (free service) | Web | Free |
| TryHackMe Guided, beginner-friendly security training rooms with browser-based attack machines. | Proprietary | Web | Freemium |
| Vulhub Pre-built vulnerable Docker Compose environments reproducing CVEs across common products. | MIT | Linux, macOS | Open Source |
| VulnHub Repository of downloadable vulnerable-by-design virtual machines for offline practice. | Proprietary (free service) | Web | Free |
| VulNyx Free downloadable vulnerable Linux and Windows machines with difficulty tiers and a leaderboard. | Proprietary (free service) | Web | Free |
About CTF & Practice Labs
CTF and practice lab platforms provide targets that exist to be attacked, which lets learners and professionals practice techniques without legal exposure. The category includes commercial and community lab platforms with guided learning paths and vulnerable machines, free wargames served over SSH, and intentionally vulnerable applications that can be run locally in Docker or a VM to practice web exploitation against the OWASP Top 10 and beyond. It also covers CTF competition platforms, which teams use to host their own events. Practice targets differ from the tools in the penetration testing category: the lab is the environment, not the weapon. Blue team practice has its own platforms with alert triage, forensics, and log analysis challenges built from real artifacts. Skill progression in this category maps well onto the rest of the directory, since labs usually require the same recon, exploitation, and forensics tools used in professional work.
Covered Topics
In This Catalog
- This category lists 16 tools: 6 freemium, 5 free, 4 open source, and 1 free / commercial.
- By platform, 5 run on Linux, 4 on Windows, 5 on macOS, and 11 on the web.
- The most common license among the open-source tools is MIT (2 tools).
Frequently Asked Questions
What is CTF & Practice Labs?→
Practice environments for offensive and defensive security skills: capture-the-flag platforms, deliberately vulnerable applications, and wargames where techniques can be exercised without touching systems the learner does not own.
What topics does the CTF & Practice Labs category cover?→
Capture The Flag (CTF) Platforms, Vulnerable-by-Design Applications, Wargames, Blue Team Practice, Skill Assessment
Which CTF & Practice Labs tools are open source?→
4 of the 16 tools in this category are open source: DVWA, Metasploitable 3, OWASP Juice Shop, and Vulhub.