Skip to content
NepSec CTF
Sign inStart hacking

Free · safe · legal hacking practice

Capture the flag.
Prove your skills.

Capture-the-flag challenges and in-browser hacking labs: web exploitation, cryptography, forensics, OSINT and Linux privilege escalation. Free, safe and legal practice.

Browse challenges View scoreboard
Challenges
10
Players
2
Flags captured
1

Tracks

Practise every area of offensive security

Web exploitation

SQL injection, XSS, broken authentication, IDOR and command injection against real, deliberately vulnerable apps.

Cryptography

Classical ciphers, XOR, encodings and RSA mistakes that real systems still make.

Forensics

Dig through packet captures, images and logs to reconstruct what happened.

Linux & privilege escalation

Boot a real Linux machine in your browser and escalate from user to root.

Reverse engineering

Take programs apart to understand what they check and how to get past it.

OSINT & misc

Find what's hidden in plain sight using public information and lateral thinking.

Real labs that run in your browser

Labs boot a vulnerable web app or a whole Linux machine inside your own browser tab. Nothing to install, nothing that can touch anyone else's system, and every player gets their own unique flag.

  1. 1

    Pick a challenge

    Start with Easy and work up. Each one tells you what to look for.

  2. 2

    Find the flag

    Flags look like NEPSEC{...}. Labs give you your own personal flag.

  3. 3

    Submit and climb

    Points shrink as more players solve a challenge, so early solves count most.

Create a free account

Want to learn first? Take a course at NepSec Academy.