Attack it. Defend it. Not flags.
Break into realistic company systems, or defend them and hunt the intruder, on your machine, your server or your cloud, and bring back the analyst's credentials.
macOS · Windows · Linux
Invoice portal API
Running·docker · 3 containers·commit 7f3a9c2
- 12labs
- 0flags to guess
- 9hypervisors supported
- 100%free, open source
From target to evidence.
Every lab is pinned, open source and yours to run. The evidence is unique to you.
- Launchercyberctf start
- Your labContainers · VMs
- Evidenceunique to you
- Completedverified by the API
Pick a target.
Real companies, one real vulnerability each, and evidence to bring back. Launched in one click.
- Not started: Caterpillar: public fork-based poisoned pipeline executioncicd-goat-caterpillarCicdHardDockerSecret
- Not started: Cheshire Cat: pipeline escape to the Jenkins controllercicd-goat-cheshire-catCicdMediumDockerSecret
- Not started: Dodo: insufficient flow control (security-scan gate bypass)cicd-goat-dodoCicdMediumDockerSecret
- Not started: Dormouse: improper artifact integrity validationcicd-goat-dormouseCicdHardDockerSecret
- Not started: Duchess: a leaked PyPI tokencicd-goat-duchessCicdEasyDockerSecret
- Not started: Gryphon: dependency chain abuse via a package registrycicd-goat-gryphonCicdHardDockerSecret
Everything a real engagement needs.
Built around a map of cybersecurity skills, so every lab you complete says something precise about what you can do.
Evidence, unique to you
Same lab, different secret. A leaked writeup completes nothing.
Run it where you want
Labs never run on our servers. Your laptop, a Proxmox or ESXi box at home, or throwaway instances in your own cloud account with a budget guard.
Mapped to a skills graph
Each lab trains specific skills, from detecting an injection to exploiting it. Your progress builds a picture of what you actually master.
Open source, pinned
Every lab is a public repository, downloaded at an exact commit.
- repo
- CyberCTF/invoice-portal-api
- commit
- 7f3a9c2 · signed
- license
- MIT
- checks
- 5 passed
Want a guided path?
Cyber CTF is free forever. Cyber Courses turns the same skills into adaptive lessons that end in these labs.
Your first target is waiting.
Free, forever. Install the launcher and bring back your first evidence tonight.