Attack it. Defend it. Not flags.
Break into realistic company systems, or defend them and hunt the intruder, on your machine, your server or your cloud, and bring back the analyst's credentials.
macOS · Windows · Linux
Invoice portal API
Running·docker · 3 containers·commit 7f3a9c2
- 354labs
- 0flags to guess
- 9hypervisors supported
- 100%free, open source
From target to evidence.
Every lab is pinned, open source and yours to run. The evidence is unique to you.
- Launchercyberctf start
- Your labContainers · VMs
- Evidenceunique to you
- Completedverified by the API
Pick a target.
Real companies, one real vulnerability each, and evidence to bring back. Launched in one click.
- Not started: ADLab (xbufu)adlab-xbufuNetworkMediumVMSecret
- Not started: ActiveMQ Fileserver Arbitrary File Write (CVE-2016-3088)vulhub-activemq-cve-2016-3088WebHardDockerSecret
- Not started: Apache APISIX Default Admin Token RCE (CVE-2020-13945)vulhub-apisix-cve-2020-13945WebMediumDockerSecret
- Not started: Apache CXF Aegis DataBinding SSRF (CVE-2024-28752)vulhub-apache-cxf-cve-2024-28752WebHardDockerSecret
- Not started: Apache CouchDB Privilege Escalation (CVE-2017-12635)vulhub-couchdb-cve-2017-12635WebMediumDockerSecret
- Not started: Apache Druid Embedded JavaScript RCE (CVE-2021-25646)vulhub-apache-druid-cve-2021-25646WebHardDockerSecret
Everything a real engagement needs.
Built around a map of cybersecurity skills, so every lab you complete says something precise about what you can do.
Evidence, unique to you
Same lab, different secret. A leaked writeup completes nothing.
Run it where you want
Labs never run on our servers. Your laptop, a Proxmox or ESXi box at home, or throwaway instances in your own cloud account with a budget guard.
Mapped to a skills graph
Each lab trains specific skills, from detecting an injection to exploiting it. Your progress builds a picture of what you actually master.
Open source, pinned
Every lab is a public repository, downloaded at an exact commit.
- repo
- CyberCTF/invoice-portal-api
- commit
- 7f3a9c2 · signed
- license
- MIT
- checks
- 5 passed
Want a guided path?
Cyber CTF is free forever. Cyber Courses turns the same skills into adaptive lessons that end in these labs.
Your first target is waiting.
Free, forever. Install the launcher and bring back your first evidence tonight.