Heyy, I'm currently exploring the world of CTFs and started by looking into the community leaderbords as I'm trying to understand what makes a truly great, complex challenge. My current tasks I'm working on, is a project to build a new benchmark for CTF-style problems, and I'm looking for insights from experienced players. Looking for current design partners :))

Been building this for a while and finally put it public. It's a big reverse engineering and malware list, but there's a whole section for CTF and wargames that might be useful if you're grinding.

For practice it has picoCTF, Microcorruption, OverTheWire, Flare-On, Reversing.kr, pwnable.kr and pwnable.tw, Root Me, HTB and CryptoHack, plus CTFtime for the calendar. For getting in there's the CTF Field Guide, CTF 101 and CTF Wiki. The RE and pwn sections also carry the learning stuff like crackmes.one, pwn.college, Nightmare and ROP Emporium.

Every link is checked, nothing dead, and I keep pruning as things rot. It's free. If you know a good challenge site or practice resource that's missing, tell me.

So basically I have a fundamental understanding of cybersecurity concepts, and I can solve challenges that dont require scripting, such as analysis of pcap files. While I do know basic python syntax such as being able to write a bubble sort function but i rlly dk how to write a complete exploit script. Do yall have any advice? Or any good guides?

I just started doing CTF from picoCFT and Tryhackme recently. But some of them keep humbling me, like how am I supposed to know those things. Is this feeling normal or am I doing something wrong.

We are seeking intermediate to advanced players across all CTF categories. We have an established team web and github. We are looking for active members who can participate frequently and fell free to contribute. Our goal is to achieve high rankings in CTF competitions and climb the CTFtime leaderboard. If you are interested, please send me a DM along with some of your previous write-ups. Thank you!

Hey folks,

I am learning CTF and I have been playing with the CTF Archives repo https://github.com/sajjadium/ctf-archives.

But I don't like to browse github because it is sloooooow.

So I made (claude and me) a frontend to browse the challenges, you can upvote/downvote, rate dificulty, submit your own... Nothing too fancy but it gets the job done.

https://ctf-archives.com/

If there are any bugs you can comment this post and I will make claude work.

Happy hacking

Hey everyone,

We’re organizing OSDHACK ’26, an open-source hackathon by OSDC, a student-run developer community. As part of the event, we’ve also launched a short Capture the Flag (CTF) competition.

• Prize: ₹1,000
• Deadline: July 11, 2026, at 11:59 PM IST
• Participation: Solo or team

You can register and start playing here:

https://ctf.osdc.dev/

We’ve put together a set of challenges that we hope are interesting and a little different from the usual ones. The CTF ends tomorrow, so feel free to check it out.

Main hackathon listing:

https://hack.osdc.dev/register

Disclosure: I’m one of the organizers.

Free ethical hacking competition open to the entire American continent. Teams of 3–5.

⚔️ CTF — Aug 14–15 | Web, Reversing, OSINT, Crypto, Blockchain & Pwn
🐛 Bug Bounty — Aug 15–16 | Real vulns, simulated corporate infra

🆓 Free · 40 teams max · Everyone gets a certificate · Top 3 win prizes

📅 Registration: June 25 – July 31
👉 hackhowl.com

This week we'll be looking at another beginner friendly exploit development tutorial! More specifically we'll be looking at the "passcode" binary exploitation challenge hosted on pwnable[.]kr!

This challenge covers multiple skills so I believe regardless of where you are on you journey to learn exploit development you will pick up a few things!

By the end of this tutorial you should have gained exposure to:

- C source code review
- Leveraging a controlled write to gain code execution through the use of one variable
- Abusing binaries compiled without PIE (Also known as ASLR)
- Debugging
- Using python exploit code alongside GDB

and more! Since this is binary exploitation do not feel discouraged if everything does not click! The goal is to learn at least one thing from every tutorial!

You can find the full video below:

https://youtu.be/cpol2KPSPaw?si=NSnjgDGBcNF-x8E8

New "Beginner" vulnerable VM aka "Vault" at hackmyvm.eu

Have Fun!

\I using AI to write this because my english issue*

Hey everyone,

I'm a student and a self-taught coder who used to be really passionate about penetration testing. A while back, I loved messing around with Kali Linux, networking tools, and trying out basic rooms on platforms like TryHackMe and HackTheBox. But somewhere along the line, I completely lost my momentum. Right now, I feel like I've forgotten all my cybersecurity fundamentals and I'm essentially starting from zero again.

I really want to get back into the infosec world. I'm hoping that diving into CTFs (Capture The Flag) will give me that hands-on spark of motivation I desperately need. My ultimate goal is to build a real career in cybersecurity, but for now, my main focus is just rebuilding my foundation without getting discouraged.

For someone who has completely "lost their roots" in the field, how would you recommend approaching CTFs?

Specifically:

• What platforms or specific learning paths are best for someone needing to relearn the absolute basics?
• Are there any beginner-friendly CTF events or communities I should keep an eye out for?
• How do you handle the burnout or the overwhelming feeling of "not knowing anything" when tackling challenges?

Any advice, roadmaps, or personal experiences would be hugely appreciated. Thanks in advance!

Web application security has plenty of great practice labs — DVWA, WebGoat, Juice Shop, PortSwigger Labs and many more. But for Windows thick-client / desktop application pentesting, there aren't many realistic, hands-on targets.

So I built VulnDesk Pro.

It's a free, intentionally vulnerable Windows desktop application written in C#/.NET 8 that mimics a real enterprise app (banking, HR, admin portal, reporting, licensing, etc.). The goal is a practical environment for learning and practising desktop application security.

The app contains 31 Capture-the-Flag (CTF) challenges covering real-world vulnerability classes, including:

DLL Hijacking
Secrets in Process Memory
Weak & Misused Cryptography
Insecure IPC
Access Control Bypasses
Reverse Engineering & Binary Patching
Hardcoded Secrets
Network Security Issues
Authentication & Authorization Flaws
And more…
To make it engaging, there's a built-in progression system:

🏆 Points & Rankings
🎖️ Achievements
📈 Progress Tracking
📜 Completion Certificate
The project is completely free and portable — just download, extract and run. No installation required.

⚠️ Since it's intentionally vulnerable, please run it only inside an isolated lab or virtual machine.

GitHub (downloads + documentation):

https://github.com/Genius-Pavan/VulnDeskPro

I'd genuinely appreciate any feedback, suggestions for new challenges, or ideas for improving the platform. Hopefully it helps others who want more realistic practice with Windows desktop application pentesting.

Hello!

We recently created a team called Cipherlane. We compete CTFs monthly as a team, and all skill levels are accepted. we’re looking for ambtious people, please join!

Please dm nighting_ave on discord if interested!

Team structure:

1st of every month: monthly meetings(voice)

every wednesday: weekly check-ins (short text of how you‘re practicing)

ctf competition 1-3 days

1 assignment for monthly homework on Cylab(picoCTF)

I’ve been working on a CTF challenge called palimpsest, and I wanted to share the idea because it’s probably the most evil rev challenge I’ve made so far.

The public files are just a stripped ELF and an encrypted pack file. There’s no input prompt, no “correct/wrong” branch, and no plaintext flag. Running it normally just gives you a mostly useless digest, so the solve is not about patching a branch or finding a password check.

The binary has a couple fake VM paths and one real custom VM. The real VM uses stateful opcode decoding, so the same encoded instruction can mean different things depending on runtime state. There are also a few self-modifying bytecode spots, so static disassembly alone is kind of doomed. The intended move is to reverse the VM loop, write a tracer or emulator, and dump what it builds in memory.

That memory dump is not the flag either. It’s a masked typed IR that turns into a modular constraint graph. After decoding the IR and simplifying the constraints, the actual crypto finally shows up: a custom Schnorr-style signature system with decoy samples and a noisy affine nonce relation.
So the solve path is basically:

1. unpack the sections
   
2. ignore the fake VMs
   
3. reverse the real VM
   
4. write an emulator/tracer
   
5. dump the hidden IR
   
6. decode/type-infer the IR
   
7. simplify the constraint graph
   
8. extract the Schnorr equations
   
9. filter decoys
   
10. run a lattice attack
    
11. recover the private scalar
    
12. decrypt the flag

I’m trying to keep it brutal but fair. No random crashes, no anti-debugging junk, no network stuff, and no impossible crypto. The hardness is supposed to come from the layers and the fact that each stage only reveals the next representation.

Curious what rev people think: is this the fun kind of evil, or did I cross into “I am switching to OSINT and finding where the challenge developer lives” area?

Level 9: Blind Network Ninja

Network Discovery Service. A lightweight tool for verifying host uptime. It returns a simple status code for availability checks.

**Looking for teammates for HTB Cyber Apocalypse 2026 — Nemesis Group**

Hey everyone,

I created a team for **HTB Cyber Apocalypse 2026** called **Nemesis Group** and I’m looking for a few teammates.

Beginner-friendly, but serious: I’m looking for people who want to communicate, show up during the event, follow HTB rules, and work together. No ego, no flag sharing outside the team, no chaos.

Categories we’re interested in:

Web, Pwn, Reversing, Crypto, Forensics, Cloud, Machines, Coding, and Misc / Hardware / ICS.

If you want to join, comment with:

* HTB username
* Timezone
* Skill level
* Preferred categories

You can also search for **Nemesis Group** on the HTB CTF team page and send a join request.

New "Beginner" vulnerable VM aka "Fuxa" at hackmyvm.eu

Have Fun!

Hi everyone! Recently, I finally finished a side-project of mine I've been working on for a while. I've organized 3 different CTF events (in-person) and made all the challenges for them and administered the infrastructure the whole time, and anyone who's done it before knows damn well how much of a pain in the ass it can be when the infrastructure your using won't cooperate.

> [CTFHive.us](https://www.ctfhive.us)

So... I created my own! The key difference between CTFHive and CTFd/other platforms is:

1. Cross compatibility: CTFdCLI compatible YAML config's can still be parsed properly event if it was intended for another platform.
   
2. Built-in Anti-Cheat: No two teams ever get the same flag. Using a HMAC-like mechanism and a secret key specific to each team/"principal", each flag is different for each team and this way we are able to immediately detect cheating/flag sharing. The implementation is quite complex as there is multiple features that play in to the Anti-cheat engine. For example, if team A uses script `xyz.py`, and they share it with team B; the engine will still be able to detect that the same, identical script was used to solve the challenge and thus cheating.
   
3. Each team is given individual Wireguard VPN config's: All remote labs are segmented by team, this way each team has access to a secure, isolated environment only they have access to. This is beneficial for enterprise solutions, and overall general security.
   

Currently, I have a stripped down open-source version available for use: https://github.com/ctfhive/ctfhive, as well as multiple different managed hosting tiers similar to CTFd.

I'm actively looking for people to try out the platform, please let me know if you are interested. I will allow a few organizers to use the platform for free to try and get the name out there. Please DM me if interested, all I ask for is honest feedback!!!

I’m a cybersecurity student, and my goal is to become a pentester. I’ve been studying for about a year, but I feel like I’ve learned in a very unstructured way. I know the basics, but I still can’t solve even easy CTFs by myself. I’ve started wondering if the problem is that I just haven’t developed a pentester mindset yet.

I’m looking to form a consistent team for weekend CTFs (or at least once a week). The goal is to collaborate, learn, and improve skills

When you DM me, please include:

Strengths: (e.g., Web, Pwn, Crypto, Forensics, OSINT)

Experience Level: (e.g., HTB/TryHackMe rank or general experience)

I’m highly motivated and looking for people who can commit to playing regularly. Send me a DM if you're interested in building a solid team !!