I've attended several CTF contests and I'd like to implement a CTF system for my students. I asked Google about designing such system but it's fruitless. Any ideas?

  • 1
    Are you refering to Capture the Flag? I assume you mean in relation to social engineering. What do you teach and at what level (elementry, intermediate, high school, university)? – this.josh Oct 4 '11 at 8:30
  • Oh, I'm teaching cyber security at a university. I want to build a CTF system for students to practice simple hacking techniques. – anhldbk Oct 4 '11 at 8:56
  • 1
    Do you want a computer system with intentional flaws to allow students to discover and exploit vulnerabilites? – this.josh Oct 4 '11 at 9:06
  • Yep, that's the system I want. :( – anhldbk Oct 5 '11 at 2:02
  • Did you see this question: security.stackexchange.com/questions/1735 – this.josh Oct 5 '11 at 7:57

As mentioned by this.josh, you can look at multiple already existing vulnerable applications in this question or you might try to find existing CTF source codes - for example, look at the OWASP hackademic challenges. You might just take one of these and modify them slightly for your students. Also, try to contact authors of past CTF's - they might help you by giving their source codes. Here's a handy calendar of various CTF challenges with appropriate links.


I once stumbled upon a OS VM machine which is called Metasploitable, it is made by the creators of Metasploit and is used as a target machine for practicing.

It is, and this is a quote from the page:

Ubuntu 8.04 server install on a VMWare 6.5 image. A number of vulnerable packages are >included, including an install of tomcat 5.5 (with weak credentials), distcc, tikiwiki, >twiki, and an older mysql.

If you go through some exploits yourself, you can assign these tasks to your students and give them some guidelines.

Here is the link:


And a link for the metasploit framework


And last but not least, Backtrack 5, if you havnt already introduced your students to this OS and compilation of pentest software:



Instead of creating a new demo system with intentional vulnerabilities from scratch, take a look first at the existing ones:

Google's Gruyere codelab, "Web Application Exploits and Defenses" http://google-gruyere.appspot.com/

OWASP's WebGoat: https://www.owasp.org/index.php/Category:OWASP_WebGoat_Project


organizer of previous CTF events here.

First thing, write down a simple score board system, then decide how many and which categories you would like to have on ur event. If you look at this photo https://p.twimg.com/Ad_ncp0CAAE7L_I.jpg:large < its the last CTF I organized at codebits.eu it was an event for 10 teams with 4 elements each.

It had 4 categories:

  • Web apps
  • Forensics
  • Pwnables
  • Trivia

If you want to have a look at some sample CTF challenges I have a list of websites I can provide you with:

-http://balgan.eu/?page_id=67 << (My Website)







Hope its helpeful, feel free to ask more question if u need some help!

  • First link is broken. – doughgle Apr 7 '18 at 4:26

You might take a look at the International Capture The Flag run by folks at UCSB.


If case anyone still needs an ingame management system for CTF's my research team wrote our own scoreboard which we have now made available to the world at: http://www.ptcoresec.eu/?p=347

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.