In the context of an IT event, my team would organize a CTF (Capture The Flag). About the challenges (we’re working on them). I want to have some references on the types and levels of difficulty that we find on CTF generally. (The target audience varies from students (beginner) to security experts and regulars participant in CTF). Then for the deployment, do we should use a local server? Or a VPN? In fact, we lack experience, and I need some advices/suggestions on all organizational aspects. Thank you in advance. D3_4dl1n3
You can find a lot of CTF event in this website as a reference about how they organize it, their CTF's type, and what kind of challenges offered. For a more detailed and technical stuff about CTF challenges, I recommend you to read some CTF writeup by active CTF teams. As an example, Dragon Sector is an active team and usually make some writeup after finishing a CTF event, their blog is a good start to explore.
I have participated in Live and online CTF competitions. It depends what sort of CTF you would like to organize, and what sort of challenges there will be, I mainly categorize them into two categories.
Now if you want to organize a CTF involving web applications only that has vulnerabilities and users are required to exploit them and get the flag, you dont need to have a VPN setup. All you need to to use WAMP server and get it live.
If the CTF requires to have network access, then yes, you would need to setup a VPN , in order to let the participants, get access to your local network and do their deeds.
From resources point of view, you dont need to have large resources, if you are not expecting large number of participants, you can use multiple virtual machines on the same box and have multiple vulnerable apps running.