Hiện nay phong trào nghiên cứu bảo mật và luyện chơi CTF của sinh viên yêu thích công nghệ thông tin và bảo mật đang rất sôi nổi. Đây là bài viết tổng hợp từ rất nguồn khá chi tiết cho bạn nào muốn tìm hiểu và bắt đầu chơi CTF. Bắt đầu thôi nào

1. Tổng hợp của bạn Thiêu Mao
Như các biết thì h thi SV với ATTT rất chú trọng đến thi thực hành theo kiểu CTF (Capture the flag) Khi bạn mới tập tành chơi CTF thì theo mình website này phù hợp với bạn: http://iwast.securitas.com.vn/iwast/
Dưới đây là nội dung của bài chơi CTF ở website đó
1. SQL Injection 2. Cross site scripting 3. File Include 4. Code injection 5. Commands injection 6. Directory traversal 7. XML attacks 8. Cross site request forgery (CSRF) 9. Open redirect 10. Mail Injection

Khi bạn mới tập tành chơi CTF thì theo mình website http://iwast.securitas.com.vn/iwast/ này phù hợp với bạn.

Dưới đây là nội dung của bài chơi CTF ở website đó

1. SQL Injection
2. Cross site scripting
3. File Include
4. Code injection
5. Commands injection
6. Directory traversal
7. XML attacks
8. Cross site request forgery (CSRF)
9. Open redirect
10. Mail Injection




Ngoài ra còn có 1 website Việt Nam nữa cũng khá hay đó là http://ctf.wargame.vn/


Còn sau đây là danh sách các website nước ngoài luyện chơi CTF

https://www.hellboundhackers.org/
http://bright-shadows.net/
http://www.overthewire.org/wargames/
http://www.smashthestack.org/
http://crackmes.de/latest/
http://www.net-force.nl/

2. Tổng hợp của bạn Kevin diễn đàn KMA security

 http://io.smashthestack.org/

  http://www.hackertest.net
 http://hax.tor.hu/welcome/
 http://repo.shell-storm.org/CTF/
 http://www.wechall.net/challs
 http://www.hacking-challenges.de/index.php?page=hackits
http://www.wixxerd.com/challenges/
 http://canyouhack.it/
 http://www.root-me.org/fr/Challenges
 http://www.happy-security.de/
 http://www.newbiecontest.org/index.php?page=challenges
 http://www.dareyourmind.net/menu.php
 http://www.lost-chall.org/index.php
 http://www.infomirmo.fr/cryptographe.ph
 http://www.thisislegal.com/challenges
 http://warzone.elhacker.net/  
http://www.trythis0ne.com/?page=home
 http://www.mibs-challenges.de/
 http://3564020356.org/
 http://sys.warchall.net/
 http://www.hacker.org/
http://www.osix.net/modules/geek/
 http://www.cstutoringcenter.com/problems/ http://hackbbs.org/index.php
 http://www.spoj.com/ranks/users/ https://www.solve.edu.pl/tasks
 http://gekko.csokavar.hu/login.php http://webhacking.kr/
 http://w3challs.com/challenges http://www.enigmagroup.org/
 http://hack-me.org/ http://www.wargame.kr/?page=challenge
 http://halls-of-valhalla.org/challenges/
 http://hacking.allowed.org/cgi-bin/pageview.cgi?page=challenges
 http://suninatas.com/ http://chall.tasteless.se/index.php
 http://damienoreilly.org/ctf/challenges.php
 http://try2hack.nl/levels/
http://www.microcontest.com/contests.php
RE http://reversing.kr/challenge.php
Sqli: http://www.zixem.altervista.org/SQLi/ http://redtiger.dyndns.org/hackit/
Forensic http://www.honeynet.org/ http://forensicscontest.com/tools

3. Tổng hợp từ Blog Phương Nam

Recommended
Whether they're being updated, contain high quality challenges, or just have a lot of depth, these are probably where you want to spend the most time.
http://hax.tor.hu/ https://pwn0.com/ http://www.smashthestack.org/ http://www.hellboundhackers.org/ http://www.overthewire.org/wargames/ http://counterhack.net/Counter_Hack/Challenges.html http://www.hackthissite.org/ http://exploit-exercises.com/ http://vulnhub.com/
Others
http://damo.clanteam.com/ http://p6drad-teel.net/~windo/wargame/ http://roothack.org/ http://bright-shadows.net/ http://www.mod-x.co.uk/main.php http://scanme.nmap.org/ http://www.hackertest.net/ http://net-force.nl/ http://securityoverride.org/ Some good concepts, but "canned" vulnerabilities (string matching on input) will frustrate knowledgable hackers and teach newbies the wrong lessons
Meta
http://www.wechall.net/sites.php (excellent list of challenge sites) http://ctf.forgottensec.com/wiki/ (good CTF wiki, though focused on CCDC) http://repo.shell-storm.org/CTF/ (great archive of recent CTFs)
Webapp Specific
http://demo.testfire.net/ http://wocares.com/xsstester.php http://crackme.cenzic.com/ http://test.acunetix.com/ http://zero.webappsecurity.com/ http://ha.ckers.org/challenge/ http://ha.ckers.org/challenge2/
Forensics Specific
http://computer-forensics.sans.org/community/challenges http://www.dc3.mil/challenge/ http://forensicscontest.com/
Recruiting
http://rtncyberjobs.com/ http://0x41414141.com/
Paid Training
http://heorot.net/
Downloadable Offline Games
http://www.badstore.net/ http://www.owasp.org/index.php/Categ...ebGoat_Project http://www.owasp.org/index.php/Owasp_SiteGenerator
Damn Vulnerable Web App
Stanford SecureBench
Stanford SecureBench Micro
Damn Vulnerable Linux (not currently live? local mirror) http://www.irongeek.com/i.php?page=s...p-owasp-top-10
Inactive or Gone
Just around for historical sake, or on the off-chance they come back.
http://rootcontest.com/ http://intruded.net/ https://how2hack.net
WebMaven (Buggy Bank) http://www.foundstone.com/us/resourc...acmetravel.htm http://www.foundstone.com/us/resourc...hacmebooks.htm http://www.foundstone.com/us/resourc...acmecasino.htm http://www.foundstone.com/us/resourc...meshipping.htm http://hackme.ntobjectives.com/ http://testphp.acunetix.com/ http://testasp.acunetix.com/Default.asp http://prequals.nuitduhack.com http://www.gat3way.eu/index.php (Russian)