Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've attended several CTF contests and I'd like to implement a CTF system for my students. I asked Google about designing such system but it's fruitless. Any ideas?

share|improve this question
Are you refering to Capture the Flag? I assume you mean in relation to social engineering. What do you teach and at what level (elementry, intermediate, high school, university)? – this.josh Oct 4 '11 at 8:30
Oh, I'm teaching cyber security at a university. I want to build a CTF system for students to practice simple hacking techniques. – anhldbk Oct 4 '11 at 8:56
Do you want a computer system with intentional flaws to allow students to discover and exploit vulnerabilites? – this.josh Oct 4 '11 at 9:06
Yep, that's the system I want. :( – anhldbk Oct 5 '11 at 2:02
Did you see this question: – this.josh Oct 5 '11 at 7:57
up vote 6 down vote accepted

I once stumbled upon a OS VM machine which is called Metasploitable, it is made by the creators of Metasploit and is used as a target machine for practicing.

It is, and this is a quote from the page:

Ubuntu 8.04 server install on a VMWare 6.5 image. A number of vulnerable packages are >included, including an install of tomcat 5.5 (with weak credentials), distcc, tikiwiki, >twiki, and an older mysql.

If you go through some exploits yourself, you can assign these tasks to your students and give them some guidelines.

Here is the link:


And a link for the metasploit framework


And last but not least, Backtrack 5, if you havnt already introduced your students to this OS and compilation of pentest software:


share|improve this answer

As mentioned by this.josh, you can look at multiple already existing vulnerable applications in this question or you might try to find existing CTF source codes - for example, look at the OWASP hackademic challenges. You might just take one of these and modify them slightly for your students. Also, try to contact authors of past CTF's - they might help you by giving their source codes. Here's a handy calendar of various CTF challenges with appropriate links.

share|improve this answer

Instead of creating a new demo system with intentional vulnerabilities from scratch, take a look first at the existing ones:

Google's Gruyere codelab, "Web Application Exploits and Defenses"

OWASP's WebGoat:

share|improve this answer

organizer of previous CTF events here.

First thing, write down a simple score board system, then decide how many and which categories you would like to have on ur event. If you look at this photo < its the last CTF I organized at it was an event for 10 teams with 4 elements each.

It had 4 categories:

  • Web apps
  • Forensics
  • Pwnables
  • Trivia

If you want to have a look at some sample CTF challenges I have a list of websites I can provide you with:

- << (My Website)







Hope its helpeful, feel free to ask more question if u need some help!

share|improve this answer
:) Thank you very much! – anhldbk Dec 2 '11 at 7:26

You might take a look at the International Capture The Flag run by folks at UCSB.

share|improve this answer

If case anyone still needs an ingame management system for CTF's my research team wrote our own scoreboard which we have now made available to the world at:

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.