CTF Platforms
Where to find competitions and practice challenges — live CTFs, year-round wargames, and skill-building platforms across every category.
CTF Platforms
There are two ways to get better at CTF: compete in live events for time-pressured, novel challenges, and grind year-round practice platforms to build fundamentals. Do both. This page maps out where to spend your time at each skill level.
Finding Live Competitions
CTFtime.org is the hub for the global CTF scene. It lists upcoming events, archives past challenges and write-ups, and ranks teams by a weighted points system.
- Filter by format — stick to Jeopardy events when starting out; Attack-Defense is a different, infrastructure-heavy game.
- Read the weight — higher-weight events are harder and draw stronger teams.
- Mine the write-ups — after an event, CTFtime links community solutions. Reading write-ups for challenges you didn't solve is one of the fastest ways to improve.
Register a team early
Most events want a team name and a CTFtime team ID. Create one now so your points accumulate on the global leaderboard across events.
Practice Platforms by Skill Level
Start here if CTF concepts are new. These platforms explain as they go.
| Platform | Focus | Notes |
|---|---|---|
| picoCTF | All categories | Built for students; gentle ramp, permanent practice gym |
| OverTheWire — Bandit | Linux / shell | The canonical "learn the terminal" wargame |
| PortSwigger Web Security Academy | Web | Free, world-class, with interactive labs |
| CryptoHack | Crypto | Gamified modern cryptography |
| TryHackMe | Guided rooms | Hand-holding walkthroughs across topics |
Category-Focused Training
When you want to drill one discipline:
| Category | Recommended platforms |
|---|---|
| Web | PortSwigger Web Security Academy, Hack The Box |
| Pwn (binary exploitation) | pwn.college, pwnable.kr/tw, ROP Emporium |
| Reverse engineering | crackmes.one, Flare-On, Malware Unicorn workshops |
| Crypto | CryptoHack, Cryptopals |
| Forensics | DFIR challenge sites, Volatility sample images, Magnet/DFRWS challenges |
| OSINT | TraceLabs CTFs, GeoGuessr-style geolocation drills |
| Cloud | flaws.cloud / flaws2.cloud, CloudGoat, IAM Vulnerable, Kubernetes Goat |
Cloud practice is intentionally vulnerable
flaws.cloud, CloudGoat, and Kubernetes Goat deploy deliberately misconfigured environments you own. Use them instead of probing real cloud accounts — see Cloud Security for the techniques they teach.
How to Practice Effectively
Solving isn't learning — reviewing is
The skill jump comes from reviewing. After every challenge — solved or not — read at least one other write-up, note the technique, and add the payload or script to your personal cheat-sheet.
- Pick events at the edge of your ability. Too easy is boring; too hard burns morale. Use CTFtime weights as a guide.
- Time-box. If you are stuck for 30–45 minutes with no new idea, note it and move on. Come back with fresh eyes.
- Build a notes repo. Save working scripts, payloads, and "things I always forget." This compounds over a season.
- Specialize, then broaden. Get strong in one category to feel real progress, then round out the others.
- Compete as a team. Splitting categories across teammates is how serious points are scored — see Team Strategy.
Checklist
- Created a CTFtime account and team
- Bookmarked one beginner platform and started a track
- Picked a primary category to specialize in
- Set up a personal write-up / cheat-sheet repository
- Identified an upcoming live Jeopardy event to enter
See Also
- What is a CTF? — formats and categories
- Jeopardy Format — how scoring and dynamic points work
- Team Strategy — dividing work and maximizing score
Last updated on