There are plethora of challenge/hacking sites where one could find cool challenges any time of the year.
Some of them are ranked and have their own scoreboards while others are there just for learning sake.
This is by no means an updated list, I will need to update it
While one can find running CTFs all year round, CTFs have there own cons
- The challenges/problems are shortlived. The lifetime of a typical CTF is 2 days and server based challenges would be typically running for a week or two.
- The range of challenges in a CTF is not vast given the time constraints, and usually less focussed on a single concept.
Enter the always running challenge sites to practice! While some of them are focussed on a specific topic say SQLi, others are more general. Check out the description of each site to know more.
The order of sites is purely coincidental, it by no means tries to order the awesomeness of sites!!
Various tags shall be mentioned beneath each site to specify the challenge categories.
General
These are the sites which contain a broad range of challenges, usually on various topics.
Wechall
Wechall is an attempt to form a global ranking amongst other challenge sites. It has various challenges, but most importantly it serves as a gateway to other challenge/hacking sites.
all
TryHackMe
Learning cybersecurity on TryHackMe is fun and addictive. Earn points by answering questions, taking on challenges and maintain your hacking streak through short lessons.
HackTheBox
Hack The Box is an online platform allowing you to test your penetration testing skills and exchange ideas and methodologies with thousands of people in the security field.
RingZer0
RingZer0 holds a plethora of challenges on various topics. Plus the site has gold based system giving the ability to unlock hints for challenges in exchange of gold.
RingZer0 Team’s online CTF offers you tons of challenges designed to test and improve your hacking skills through hacking challenges.
w3challs
Our community offers you security challenges to learn and practice hacking. Our goal is to provide fun and unique challenges running in a real world environment, with no guessing and no simulation! Our challenges address several subsets of hacking, mostly oriented on the offensive. A multitude of technologies and architectures are waiting for you. Show us your mad skillz and pop some shells (or calcs)!
W3Challs contains a wide variety of challenges which are good in quality with no guessing involved.
ctflearn
CTFlearn is an ethical hacking platform that enables tens of thousands to learn, practice, and compete. We host an ever-changing array of user-submitted and community-verified challenges in a wide range of topics.
CTFlearn has an open community and a wide variety of community submitted challenges. Most of the challenges are on easier guessy side but good to get someone started.
netforce
Net-Force.nl is a website where people interested in (internet) security can play so-called ‘hack challenges’, read interesting articles about security and hacking and communicate with each other about these subjects via the forums or IRC. Visitors can register and participate in these hack-challenges, increase their skills and climb the ranks.
Net-Force.nl is an older sites, covering wide range of categories about
all
ModX
ModX is ARG style site, where you play an agent. Account creation requires solving a challenge. Mostly based on javascript, encryptions, encodings and general commonsense stuff
It is parent of three projects/pathways
ModX
Omega Project
Disvowed
Root-Me
Rootme is a well reputed french challenge site with challenges on almost any category. Although its present in various languages, some challenges may be in french.
Root-Me is a non-profit organization which goal is to promote the spread of knowledge related to hacking and information security.
Hax tor
Hax tor is an old website having a set of 50 cool challenges. WARNING! This site was created in 2006. It is here for historical purposes. Many of the levels are deprecated because they rely on old PHP flaws or involve third parties.
viblo ctf
hellbound hackers
Welcome to HellBound Hackers. The hands-on approach to computer security. Learn how hackers break in, and how to keep them out.
Defend the web
Defend the Web is an interactive security platform where you can learn and challenge your skills. Try and complete all of our 60+ hacking levels. Learn from our series of articles covering all aspects of security. Articles will guide you through the essentials to get started. As you progress more complex topics will be introduced to build up your knowledge.
Enigma Group
Since 2003, Enigma Group has been providing its members a legal and safe security resource where they can develop their pen-testing skills on various challenges provided by this site.These challenges cover the exploits listed in the OWASP Top 10 Project and teach members the many other types of exploits that are found in today’s applications; thus, helping them to become better programmers in the mean time.
komodosec
This is a game designed to challenge your application hacking skills. There are several challenges that stand before you. Each challenge contains a section of code that has vulnerable weak points. Your mission, should you choose to accept it, is to identify the vulnerability that exists in each challenge.
Bright Shadows
bright-shadows.net was a website that offered you hundreds of challenges in the fields of programming, JavaScript, PHP, Java, steganography, cryptography and others.
Use wayback machine to navigate the challenges 
ctf 101
Capture The Flags, or CTFs, are a kind of computer security competition. Teams of competitors (or just individuals) are pitted against each other in a test of computer security skill. Very often CTFs are the beginning of one’s cyber security career due to their team building nature and competetive aspect. In addition, there isn’t a lot of commitment required beyond a weekend. In this guide/wiki/handbook you’ll learn the techniques, thought processes, and methodologies you need to succeed in Capture the Flag competitions.
hackcenter
Learn cybersecurity skills by playing Capture the Flag. Compete with other players and become a hacker today. Changed to forallsecure
hack this site
Hack This Site is a free, safe and legal training ground for hackers to test and expand their hacking skills. More than just another hacker wargames site, we are a living, breathing community with many active projects in development, with a vast selection of hacking articles and a huge forum where users can discuss hacking, network security, and just about everything. Tune in to the hacker underground and get involved with the project.
rankk
Rankk is about solving challenges, discovering and learning new knowledge. It’s a journey, a sacred, personal experience. The site is a reincarnation of The Pyramid, an earlier attempt at assembling a set of challenges for those who enjoy solving problems. You start with the easy levels and progress to the intermediate and hard levels by solving the minimum number of required challenges at each level.
lost chall
This site is a tribute for all fans of the show with some skills in Cryptography, Steganography, Programming, Reversing, Logic, Web-Security, Mathematical knowledge. There are 6 different levels and one master challenge. The first challenges, those where you have access at the beginning are easy. Then it gets more and more difficult up the level-tree.
brain quest
Welcome to the portal with the highest number of logic riddles and rebuses. Beside riddles targeted as logical puzzles you are going to learn how to decrypt encrypted messages. Finds secret messages hidden in pictures, music or in simple poems or rhymes. A popular puzzle category with purely logical character are undoubtedly Zebra puzzles. And the most popular puzzles are of Orbis Pictus category, where I all have equal chances, where you have to find just what you see in the picture. Try how you stand with general knowledge. Please login and certainly you will find something new to learn.
can hack me
This website offers the opportunity for to test your hack skills. To solve the challenge, capture the flag.
try wayback machine to access the challenges
hackburger
The site has been closed
Again wayback machine for help
hacker gateway
General CTF
wikkerd
General CTF
challengeland
Yet another challenge site which tries to gamify the challenges
revolution elite
Revolution Elite is a computer security, math-based and programming-based challenge site. Categories include Android, Cryptography, Javascript, Java, Logic, Steganography, Exploitation, Programming, and other miscellaneous categories. Sometimes it will be obvious what to do, while sometimes you may have to poke around or do some research.
security traps
Welcome to Security Traps. Here you can try challenges from different security domains. The website is not for educational purposes, it aims to help you check your skill level. In order to register, you must complete 5 pre-levels. I’ve hidden some Easter Eggs on the site,so feel encouraged to audit ;)
hackerfire
Welcome to HackerFire! A learning CTF from the developers of CTFd. Play around, don’t be mean, and have fun.
list brain
Hacking-Lab
Hacking-Lab is a service by Security Competence GmbH, a Swiss subsidiary of Compass Security AG. Compass Security is a well renowned European company specializing in penetration testing, incident response, digital forensics, and security trainings. Our research and community contributions regularly gain international recognition. Our employees have presented at the highly regarded security conferences, such as Black Hat Las Vegas and Microsoft’s invite only conference, called Blue Hat, in Redmond. With Hacking-Lab, the flagship project of Compass Security, a comprehensive attack/defense CTF system is provided to run the European Cyber Security Challenge. Hacking-Lab is licensed to numerous universities worldwide for educational purposes, with its aims of building young cyber talents as well as encouraging them to pursue a career in cyber security. Build your skills and join us for exciting challenges. www.compass-security.com
Hacker101
Hacker101 is a free class for web security. Whether you’re a programmer with an interest in bug bounties or a seasoned security professional, Hacker101 has something to teach you.
cyberseclabs
At CyberSecLabs, we aim to provide secure, high-quality training services that allow information security students the opportunity to safely learn and practice penetration testing skills.
Evilzone
Evilzone used to have a forum, file hosting, multiple IRC servers and more. But due to lack of people, time and resources we are now focusing more on delivering services. For now Evilzone will mostly provide fun and educational hacking and security related challenges, with more services coming later.
try2hack
This site provides several security-oriented challenges for your entertainment. It is actually one of the oldest challenge sites still around :) The challenges are diverse and get progressively harder.
Hack me
Hack.me is a FREE, community based project powered by eLearnSecurity. You can think of it as a platform where the community can build, host and share vulnerable web application code for educational and research purposes. It aims to be the largest collection of “runnable” vulnerable web applications, code samples and CMS’s online. The platform is available without any restriction to any party interested in Web Application Security.
Game of Hacks
This game was designed to test your application hacking skills. You will be presented with vulnerable pieces of code and your mission if you choose to accept it is to find which vulnerability exists in that code as quickly as possible
ESET
You might have years of experience, or you might be just starting out, for us you are equally important and desirable. What we need are your skills, talent and initiative. If you’re interested in any of these positions and you think you have what it takes to do this job, we would like to talk to you. Send us the best examples of your previous work, or join the fun and solve the problem next to the position you would like to apply for.
thisislegal
The aim of the site is to help you learn and improve as much as we can and also provide a community with a chance to chat. The site is always up for suggestions for improvement and any challenge submissions or tutorial content are also welcome so please help to improve our community.
Hacking allowed
Valhalla
microcontest
µContest is a site proposing lots of programming challenges. This means you will find challenges you have to solve by creating programs in the language you want. You win a number of points when you validate a chall, depending on its difficulty. There are challenges for all levels so do not hesitate to register ;)
Stereotyped challenges
Hackers tend to have stereotypes about wargames; Many consider wargames as basic learning materials for new-comers of cyber security. Well, it’s not completely true. I personally think wargames are supposed to be and meant to be very challenging, regardless of how they’re good at it. So, here it is. This wargame is a little bit different to break your typical stereotypes. This wargame is intended for offensive security experts who are willing to overcome situations of getting stuck in breaking into web services or web-based solutions.
gameofhacks
This game was designed to test your application hacking skills. You will be presented with vulnerable pieces of code and your mission if you choose to accept it is to find which vulnerability exists in that code as quickly as possible.
Vulnhub
To provide materials that allows anyone to gain practical ‘hands-on’ experience in digital security, computer software & network administration.
Pentestit
Penetration testing laboratories “Test lab” emulate an IT infrastructure of real companies and are created for a legal pen testing and improving penetration testing skills.
ESET
If you want to join the team that every day faces global cyber-threats, uncover a hidden puzzle in the crackme program and prove us your potential.
Pentest practice
“Practice makes Pwnage”
netgarage IO
This is the frontpage of the IO wargame. IO is our most mature game, but is never the less in continually updated as technology develops. We provide recent radare2 and gdb builds.
Overthewire
The wargames offered by the OverTheWire community can help you to learn and practice security concepts in the form of fun-filled games. To find out more about a certain wargame, just visit its page linked from the menu on the left.
bandit
The Bandit wargame is aimed at absolute beginners. It will teach the basics needed to be able to play other wargames. If you notice something essential is missing or have ideas for new levels, please let us know!
natas
Natas teaches the basics of serverside web-security.
leviathan
Leviathan is a wargame that has been rescued from the demise of intruded.net, previously hosted on leviathan.intruded.net. Big thanks to adc, morla and reth for their help in resurrecting this game!
krypton
The Krypton wargame.
narnia
Narnia is a wargame that has been rescued from the demise of intruded.net, previously hosted on narnia.intruded.net. Big thanks to adc, morla and reth for their help in resurrecting this game!
behemoth
Behemoth is a wargame that has been rescued from the demise of intruded.net, previously hosted on behemoth.intruded.net. Big thanks to adc, morla and reth for their help in resurrecting this game!
utumno
Utumno is a wargame that has been rescued from the demise of intruded.net, previously hosted on utumno.intruded.net. Big thanks to adc, morla and reth for their help in resurrecting this game!
maze
Maze is a wargame that has been rescued from the demise of intruded.net, previously hosted on maze.intruded.net. Big thanks to adc, morla and reth for their help in resurrecting this game!
vortex
semtex
This network is a legal environment where you can learn coding/hacking techniques without destroying anything. You have to solve Semtex 0 to get a username/password for login. Once logged in, you have to make your way from one level to the next, each one containing a small security hole/feature that has been installed for you. Your mission is to find out how to exploit the weakness and to cause interesting behavior :)
manpage
Manpage is a wargame that has been rescued from the demise of intruded.net, previously hosted on manpage.intruded.net. Big thanks to adc, morla and reth for their help in resurrecting this game!
drifter
Drifter is a wargame along the lines of Vortex.
Underthewire
Under the Wire trains experienced, developing, and novice Information Technologists to use Windows PowerShell in a variety of situations through innovative and fun wargames.
ATNEA
ATENEA is a cyber security platform that presents a number of challenges which cover a wide array of topics: Cryptography and Steganography , Exploiting, Forensics , Networking and Reversing , etc.
CTFs with servers up
Picoctf
picoCTF is a free computer security game targeted at middle and high school students, created by security experts at Carnegie Mellon University. The game consists of a series of challenges centered around a unique storyline where participants must reverse engineer, break, hack, decrypt, or do whatever it takes to solve the challenge.
Picoctf is a high school level annual 14 day ctf by CMU. It is one of the most popular CTFs with low entry barrier and servers running all year round!
Backdoor
Backdoor is a platform for hackers to show their talent in a competitive environment. Earlier it was launched only within the IIT Roorkee campus, but now it has been made available for anyone over the internet.
It is a good archive of past backdoorctf challenges and other internal challenges of IITR.
ctf365
CTF365 (Capture the flag 365) is a “security training platform for it industry” with a focus on security professionals, system administrators and web developers.
angstrom
Welcome to ångstromCTF, a capture-the-flag (CTF) competition hosted and organized entirely by students at Montgomery Blair High School! CTF cybersecurity competitions have become an increasingly popular way for students to learn more about cybersecurity and develop and refine their hacking skills. These competitions are designed to educate and inspire high school students through interactive hacking challenges.
pactf
PACTF is an annual online computer security competition for middle and high school students.
SANS holiday hack
The SANS holiday hack previous challenges
247ctf
Most CTF competitions are only online for a few days, limiting the ability of players to access, solve and learn from the interesting problems created. The 247/CTF is an online, year-round, continuous learning environment.
Cryptography
CryptoHack
A fun platform for learning modern cryptography
One of the most amazing cryptography sites with amazing UI and non-guessy amazing challenges.
It has the best discord community I have ever been into
Cryptopals
This site will host all eight sets of our crypto challenges, with solutions in most mainstream languages.
id0 rsa
Below are some problems related to computer security (specifically poorly implemented security). Do Them. You are free to use any language and environment you like to complete them. The problems require familiarity with programming, but not necessarily with applied cryptography or computer security in general.
Electrica
Electrica is a puzzle/challenge site which has grown from two previous sites - C&C and the Cronos Crypto Challenge.
try to decrypt
A nice short set of bootleg crypto
Cryptoclub
Crack mysterious messages, submit jokes for others to decrypt, and access secret messages within your private groups.
mystery twister
You like riddles? You always loved to solve the crosswords in your newspaper? Or maybe you are just curious and want to find out about some of the ways to hide a secret (and possibily even to uncover it)? This is your place! Here at MysteryTwister C3 you can solve crypto challenges, starting from the simple Caesar cipher all the way to modern AES we have challenges for everyone. Our challenges range from level I to III, and an additional level X for “mystery” challenges (they may have been unsolved for a long time, mostly we don’t know their solution or have no idea whether there is a solution at all). If you are a beginner its probably best if you start trying those challenges that have been solved mostly (see table below). Additional information regarding MTC3 can be found on our about page.
Reverse Engineering
reversing.kr
This site tests your ability to Cracking & Reverse Code Engineering.
malwareTech
The purpose of these challenges is to familiarize beginners with common malware techniques.
Crackmes.one
This is a simple place where you can download crackmes to improve your reverse engineering skills.
Challenges.re
Well, “challenges” is a loud word, these are rather just exercises for RE.
Beginners.re
Reverseput as
A collection of crackmes for OS X. Send them to me if you have new ones to add!
Flare-On
FireEye’s challenge RE.
AndroidAppRE
Welcome to AndroidTM App Reverse Engineering 101! This workshop’s goal is to give you the foundations to begin reverse engineering Android applications. While this workshop won’t teach you the details of Android app development, Android malware analysis, Android vulnerability hunting, etc., I hope to give you all the necessary foundations through this workshop such that you can apply your new Android reversing skills to doing those things.
Binary Exploitation
microcorruption
Given a debugger and a device, find an input that unlocks it. Solve the level with that input.
Ropemporium
Learn return-oriented programming through a series of challenges designed to teach ROP techniques in isolation, with minimal reverse-engineering and bug-hunting.
pwn adventure
Pwn Adventure 3: Pwnie Island is a limited-release, first-person, true open-world MMORPG set on a beautiful island where anything could happen. That’s because this game is intentionally vulnerable to all kinds of silly hacks! Flying, endless cash, and more are all one client change or network proxy away. Are you ready for the mayhem?!
Exploit education
exploit.education provides a variety of resources that can be used to learn about vulnerability analysis, exploit development, software debugging, binary analysis, and general cyber security issues.
pwnable.kr
‘pwnable.kr’ is a non-commercial wargame site which provides various pwn challenges regarding system exploitation. the main purpose of pwnable.kr is ‘fun’.please consider each of the challenges as a game. while playing pwnable.kr, you could learn/improve system hacking skills but that shouldn’t be your only purpose.
Pwnable.xyz
Here you will find pwnables for beginners. Most of the challenges were created for an internal event at our ctf team OpenToAll. Eventually I grew fond of the idea of hosting them publicly, so this website was born. Some challenges will have multiple variations with progressive difficulty, I hope you enjoy them all.
Smash the stack
Smash the stack Wargaming network
Pwnable.tw
Pwnable.tw is a wargame site for hackers to test and expand their binary exploiting skills.
Web
websec.fr
because you can’t resist a good: .php?id=
owasp juice shop
OWASP Juice Shop is probably the most modern and sophisticated insecure web application! It can be used in security trainings, awareness demos, CTFs and as a guinea pig for security tools! Juice Shop encompasses vulnerabilities from the entire OWASP Top Ten along with many other security flaws found in real-world applications!
xss payloads
All about XSS attacks and payloads
portswigger
Free, online web security training from the creators of Burp Suite
google xss game
At Google, we know very well how important these bugs are. In fact, Google is so serious about finding and fixing XSS issues that we are paying mercenaries up to $7,500 for dangerous XSS bugs discovered in our most sensitive products. In this training program, you will learn to find and exploit XSS bugs. You’ll use this knowledge to confuse and infuriate your adversaries by preventing such bugs from happening in your applications.
bWAPP
bWAPP, or a buggy web application, is a free and open source deliberately insecure web application. It helps security enthusiasts, developers and students to discover and to prevent web vulnerabilities. bWAPP prepares one to conduct successful penetration testing and ethical hacking projects. What makes bWAPP so unique? Well, it has over 100 web vulnerabilities!
Tasteless challenges
I have prepared several levels here that will test your knowledge in diffrent ways. Also you will be tested in some ways of logical thinking and exploiting not so obvious security holes. Apart from those well known sql injection vulnerabilities I prepared some level where you wont be able just to put some sql commands. I hope this will be, at least for some of you, fun and you will enjoy all.
gruyere
This codelab shows how web application vulnerabilities can be exploited and how to defend against these attacks.
Redtiger hackit
It has some similarities to h0yt3r’s and shadowleet’s sql-injection hackits but it will also test you in some logical ways of thinking. All levels are based on real vulnerabilitys I found in the wild.
flAWS
Through a series of levels you’ll learn about common mistakes and gotchas when using Amazon Web Services (AWS). There are no SQL injection, XSS, buffer overflows, or many of the other vulnerabilities you might have seen before. As much as possible, these are AWS specific issues.
flAWS2
Similar to the original flAWS.cloud (also created by Summit Route), this game/tutorial teaches you AWS (Amazon Web Services) security concepts. The challenges are focused on AWS specific issues, so no buffer overflows, XSS, etc. You can play by getting hands-on-keyboard or just click through the hints to learn the concepts and go from one level to the next without playing.
WebGoat
WebGoat is a deliberately insecure application that allows interested developers just like you to test vulnerabilities commonly found in Java-based applications that use common and popular open source components.
Lord Of SQLi
A site specifically focussed on SQL Injections
DVWA
Damn Vulnerable Web App (DVWA) is a PHP/MySQL web application that is damn vulnerable. Its main goals are to be an aid for security professionals to test their skills and tools in a legal environment, help web developers better understand the processes of securing web applications and aid teachers/students to teach/learn web application security in a class room environment.
Hacker test
HackerTest.net is your own online hacker simulation. With 20 levels that require different skills to get to another step of the game, this new real-life imitation will help you advance your security knowledge. HackerTest.net will help you improve your JavaScript, PHP, HTML and graphic thinking in a fun way that will entertain any visitor!
NoobInfoseclabs
The Infosec Instite n00bs CTF Labs is a web application that hosts 15 mini Capture the Flag (CTF) challenges intended for beginners. The levels can be navigated in the navbar. There is no scoring or leaderboard, but to claim the bounty for each level (bounties range from $10 to $150) you’ll need to write up the solution and any other helpful instructions or information and post that in a public place (blog, forum, etc.). If you don’t have a place to post it…ask a friend!
Forensics
forensics contest
PCAP forensics
amanhardikar
For various forensics challenges and mindmap
ARG
ae37ff
Since April 2015, this website has served as a set of levels that simulate challenges and puzzles that one may encounter during an ARG (Alternate Reality Game) including simple ciphers, steganography, different types of encodings, and familiarity with internet resources. Each level consists of some text, images, data, or files that is intended to lead you to the next page with some amount of investigation.