Parrot CTFs: #1 Cyber Security Education & Upskilling Labs

ArshaSpector

Arsha is a website development firm, they however are not too great at backend work yet. Can you find the misconfiguarations that lead to full server compromise?

Easy Lab Difficulty

parrotassassin15 Creator

Security Misconfiguration Category

Explore

Archive Hunter

ArchiveHunter is a high-energy sandbox where zip files become grappling hooks. Upload, slip, shell, and rewrite history, then drop the mic with root access.

Easy Lab Difficulty

archtrmntor Creator

Security Misconfiguration Category

Explore

Share Me

Leaked credentials have surfaced, giving you potential access to an S3 bucket. But broken authentication mechanisms stand in your way. Use the creds, bypass the flaws, and see what secrets you can uncover. Can you find the flag hidden deep within?

Easy Lab Difficulty

parrotassassin15 Creator

Broken Authentication Category

Explore

Doom

An internal CI server was hastily exposed with default configurations.

Medium Lab Difficulty

archtrmntor Creator

CVE Category

Explore

Happi

This API was made with developers who thought they were funny. Little did they know this tom foolery is what makes this API vulnerable.

Easy Lab Difficulty

parrotassassin15 Creator

IDOR Category

Explore

Staging

Staging is a medium-difficulty Linux CTF where you brute-force hidden vhosts, spin up a remote database to configure an uninitialized WordPress, then exploit misconfigurations for initial access. From there, you reuse credentials and abuse sudo misconfigs to gain root. It mimics real-world staging pitfalls in poorly managed environments.

Medium Lab Difficulty

osmsec Creator

Security Misconfiguration Category

Explore

Target

An ordinary service hides behind a quiet web shell, but deeper inspection reveals a misstep in trust. What seems like a harmless utility turns out to be a direct line to ultimate power. Can you spot the subtle crack in the system's armor?

Medium Lab Difficulty

archtrmntor Creator

Security Misconfiguration Category

Explore

Marketer

Ever come across a marketing provider like mailgun? This is that without the APIs can you attack this machine using your file upload and cryptography skills?

Medium Lab Difficulty

parrotassassin15 Creator

RCE Category

Explore

Logger

Logger is a medium-difficulty Linux CTF challenge that revolves around a misconfigured internal log management system. Participants begin by authenticating to a web interface, where they must identify and exploit a Remote Code Execution (RCE) vulnerability.

Easy Lab Difficulty

osmsec Creator

Code Execution Category

Explore

PwnDoc

PwnDoc is an easy-level Linux machine that focuses on web exploitation techniques and Docker-based privilege escalation.

Easy Lab Difficulty

osmsec Creator

CVE Category

Explore

QuickScan

Your task is to upload a file that triggers an unexpected behavior on the server. Explore different file types, bypass restrictions, and see if you can gain unauthorized access or leak sensitive information. Be creative and think like an attacker!

Easy Lab Difficulty

smog Creator

Server Side Request Forgery Category

Explore

Graph

Harness the hidden Thread Weaving Protocol in Graph’s Gremlin engine: hijack traversal streams, override Java scheduler tokens, and slip past concurrency guards. Only those who master dynamic graph flows will unearth the buried flags.

Medium Lab Difficulty

archtrmntor Creator

CVE Category

Explore

Bluerock

Unlock the power of BlueRock’s Model Context Protocol: manipulate streaming transaction insights, override dynamic risk thresholds, and slip past adaptive fraud defenses. Each challenge reshapes the analytics pipeline in real time only the sharpest operators will bend the MCP to their will and emerge unflagged.

Medium Lab Difficulty

Kaizen226 Creator

Artificial Intelligence Category

Explore

Veriface

AI-powered facial recognition, where your face might just be the key! Train, spoof, and outsmart the system in this bizarre biometric circus of challenge and deception. Can you beat the machine at its own game?

Medium Lab Difficulty

Kaizen226 Creator

Artificial Intelligence Category

Explore

Issabella

Infiltrate Issabella’s fortress: bypass deceptive interfaces, crack hidden protocols, and outsmart adaptive defenses at every turn. Will you seize the hidden prize before the system strikes back?

Easy Lab Difficulty

osmsec Creator

CVE Category

Explore

Erebus

Step into the shadows of a forgotten helpdesk where routine maintenance hides deeper secrets. What begins as a simple misconfiguration unravels into something far more deceptive. Are you paying close enough attention?

Hard Lab Difficulty

archtrmntor Creator

Log Poisoning Category

Explore

Sense

A system built to serve… yet something whispers beneath its surface. Can you hear what others ignore ?

Easy Lab Difficulty

archtrmntor Creator

Security Misconfiguration Category

Explore

Mdbraid

Dive into mdbraid where you'll uncover hidden programs, manipulate access files, and crack SMB configurations. Challenge your skills as you navigate through secret pathways, decrypting clues, and exploiting vulnerabilities to conquer the system!

Easy Lab Difficulty

parrotassassin15 Creator

Insecure Network Services Category

Explore

Ivanti

A routine system in a secure environment hides more than it reveals.Can you navigate through layers of misconfiguration and uncover the quietly exposed doors? Every request counts especially the ones you’re not meant to make.

Easy Lab Difficulty

archtrmntor Creator

Security Misconfiguration Category

Explore

Zorlang

Zorlang is a Linux-based CTF machine designed to challenge a player’s skills in exploiting modern vulnerabilities and navigating post-exploitation scenarios. Players must gain an initial foothold by targeting an exposed service and then proceed to enumerate internal services to pivot deeper into the network. Success requires effective use of SSH tunneling techniques and a final privilege escalation through a misconfigured or vulnerable internal component, ultimately leading to full system compromise.

Medium Lab Difficulty

osmsec Creator

CVE Category

Explore

Devguru

He's taught you his ways, can you show him how much you've learned and hack into this website?

Medium Lab Difficulty

y2ksecurity Creator

Security Misconfiguration Category

Explore

Merch Metrics

Dive deeper into the void of APIs, check metrics and find hidden flaws, can you hack this vulnerable API?

Hard Lab Difficulty

Kaizen226 Creator

IDOR Category

Explore

Vape Shop

This shop has given you a UAT environment to start testing its application can you find the flaws in this app?

Medium Lab Difficulty

parrotassassin15 Creator

SQL Injection Category

Explore

Blogger

A company has hired you to perform a penetration test against this blog. Can you bring back good results?

Medium Lab Difficulty

cypress Creator

XXE Category

Explore

Code Engine

Unleash the power of Node.js in Code Engine! Dive into a hands-on lab where participants will explore a Node.js web app running in a Docker container. They will face exciting challenges that require them to interact with the application through the browser, execute code, and navigate the intricacies of containerized environments.

Easy Lab Difficulty

Kaizen226 Creator

Insecure Docker Config Category

Explore

Kurby DC

Unravel Active Directory secrets in Kurby DC! Face fun and engaging tasks designed to test their skills in navigating complex AD environments. Participants will tackle challenges involving user authentication, group policies, and domain controllers to conquer the AD security landscape.

Easy Lab Difficulty

parrotassassin15 Creator

Active Directory Category

Explore

Mr Robot V2

FSociety has assigned you a task: Hack Ecorp and Their Employees. Can you do it?

Medium Lab Difficulty

parrotassassin15 Creator

Multiple Injections Category

Explore

TimeKeeper

TimeKeeper is a compact Linux CTF machine modeled as a time-tracking web service. Players will need to investigate the application and host to progress through layered challenges that exercise web application analysis and local privilege escalation.

Hard Lab Difficulty

archtrmntor Creator

File Upload Category

Explore

Pet Shop

This old school pet shop owner has an old website. It's not even set up yet! Can you find your way into this poor man's website and show him where the flaws are?

Easy Lab Difficulty

parrotassassin15 Creator

Legacy Systems Category

Explore

Society

Welcome society, a virtual world where the only currency is words, and the conversations never stop. Our servers are like a bustling cafe where people come to chat, share stories, and connect with others from all over the world.

Easy Lab Difficulty

parrotassassin15 Creator

Buffer Overflow Category

Explore

Elemental Express

Content Managment Systems are powerful, but they are also often time out of data and vulnerable. Can you prove that this is the case?

Medium Lab Difficulty

parrotassassin15 Creator

Security Misconfiguration Category

Explore

Texas Ranger

Yee haw! Can you show the Texas Rangers who is boss?

Easy Lab Difficulty

cypress Creator

Cryptography Category

Explore

Habitual

More vulnerable than your diet on cheat day! This easy lab machine invites you to dive into the world of common CVEs and SQLi exploits.

Easy Lab Difficulty

smog Creator

Sql Injection Category

Explore

Splinter

Unemployable INC, a shady corporation, needs your penetration testing skills. Suspecting server-side template injection vulnerabilities, they've hired you to infiltrate their systems. Like Splinter, exploit weaknesses and demonstrate the impact. Uncover hidden vulnerabilities, prove your worth, and expose the true extent of their security flaws. The fate of Unemployable INC rests in your hands.

Easy Lab Difficulty

parrotassassin15 Creator

Server Side Template Injection Category

Explore

Itty Bitty

This Bit Bucket instance has not been updated in a long time. The big data firm that uses this server must not care about CVEs. Show off your exploitation skills!

Medium Lab Difficulty

parrotassassin15 Creator

RCE Category

Explore

Operation Securenet

Infiltrate the heart of SecureNet, a tech startup where shadows hide secrets and every service is a potential trap. Your mission: unravel the mysteries concealed within layers of encryption, misdirection, and subtle clues. Trust your instincts, question everything, and stay sharp—only the cleverest will uncover the truth behind the breach. Can you piece together the puzzle before time runs out?

Medium Lab Difficulty

archtrmntor Creator

Command Injection Category

Explore

Hijack

The MySQL database on the machine 'Hijack' seems ripe for exploitation. Weak authentication and a lack of proper security controls give you a potential opening. Use your brute-forcing skills to break into the MySQL database, bypass the broken authentication mechanisms, and see what secrets lie within.

Easy Lab Difficulty

smog Creator

Broken Authentication Category

Explore

Middleman

This lab demonstrates middleware authentication bypass vulnerability in Next.js, allowing unauthorized access to protected routes.

Medium Lab Difficulty

archtrmntor Creator

CVE Category

Explore

Rejetto

A classic file-sharing service hums along, offering simple access to a few public resources. It looks stable, even nostalgic, perhaps a relic from another era. But age often brings oversight. Explore its behavior, peek into its features, and you might just find something that wasn’t meant to be shared

Easy Lab Difficulty

archtrmntor Creator

Server Side Template Injection Category

Explore

Poultry

Test your enumeration skills and hack this server that seems to be under development by a poultry farm? I wonder what they are going to sell.

Medium Lab Difficulty

smog Creator

RCE Category

Explore

Shuttle Booking

Welcome to the Shuttle Booking system, where only the bravest hackers thrive. Before you is a seemingly simple website, but every input field hides potential danger. Your mission? Unleash the full power of XSS before anyone else does! Can you manipulate the browser's inner workings, hijack sessions like a pro, and seize total control?

Medium Lab Difficulty

parrotassassin15 Creator

Cross Site Scripting Category

Explore

One Click

An end user has installed some software that was not approved on the ITs list. This resulted in a vulnerability being exposed, can you exploit this windows machine?

Easy Lab Difficulty

parrotassassin15 Creator

Authentication Bypass Category

Explore

RootQL

Welcome to GraQLand, the magical realm of GraphQL APIs. A mischievous fairy has hidden the flag amidst its API tree. Traverse the mystical endpoints, decipher riddles, and unearth the hidden flag. But beware of the GraphQL challenges. Do you have the charm to outwit the fairy and capture the flag?

Easy Lab Difficulty

smog Creator

Weak Authentication Category

Explore

Defcon 32

Attack a Parrot CTFs Defcon Village website, escalate your privileges within the application, compromise the server, and gain root access.

Medium Lab Difficulty

Kaizen226 Creator

XXE Category

Explore

Harvest

They've harvested all the vegetables they need, but can you harvest the flags?

Easy Lab Difficulty

smog Creator

Insecure Authentication Category

Explore

Commander

Step into the role of a daring investigator, tasked with uncovering a web vulnerability on the "Commander" machine. Each step takes you closer to the treasure — root access. Will you solve the puzzle?

Easy Lab Difficulty

archtrmntor Creator

Command Injection Category

Explore

Photography

Photos are fun but so is hacking into this website. Can you find the vulnerability?

Easy Lab Difficulty

smog Creator

Insecure Deserialization Category

Explore

Air Port

This airports information server is due for a penetration test can you find everything wrong with this server?

Hard Lab Difficulty

parrotassassin15 Creator

Weak Authentication Category

Explore

Cloud Admin

Dive into the world of cloud security with Cloud Admin. Face various challenges in cloud and server environments designed to test your ability to uncover vulnerabilities and exploit weaknesses. Do you have what it takes to compromise the infrastructure and reveal its secrets?

Medium Lab Difficulty

parrotassassin15 Creator

Cloud Misconfigurations Category

Explore

Staff Connect

Dive into the zany world of a staffing agency's API, where your mission is to exploit IDOR vulnerabilities and uncover SQLi flaws while dodging our cheeky digital recruiter’s pranks.

Hard Lab Difficulty

Kaizen226 Creator

SQL Injection Category

Explore

File Ception

Welcome to the ultimate cybersecurity carnival, where Local File Inclusion meets Remote Code Execution! This quirky machine invites you to don your hacker hat and take a roller coaster ride through the twisted paths of misconfigured web applications.

Easy Lab Difficulty

malwarekid Creator

Local File Inclusion Category

Explore

Jigsaw 2

Can you crack the puzzle and find your way inside this more confusing and more puzzling machine? We dare you to give it a shot!

Medium Lab Difficulty

y2ksecurity Creator

Insecure Network Services Category

Explore

Middle Ground

Step into a digital battlefield where the stakes are high and the secrets are buried deep. Your mission? Exploit an exposed FTP server, sniff out what's hidden on port 80, and decode the mysteries of the network. Every corner holds a clue, every service a potential breakthrough.

Medium Lab Difficulty

parrotassassin15 Creator

MitM Attacks Category

Explore

Echo Chamber

EchoChamber is a lightweight web-driven challenge where commands echo louder than expected. Careful observation and creative thinking will help you uncover the hidden layers of control, but not everything is as it first appears.

Medium Lab Difficulty

archtrmntor Creator

Command Injection Category

Explore

Filter

Your mission is to bypass restrictive filters and exploit Local File Inclusion (LFI) vulnerabilities. But that's not all—use your skills to escalate into Command Injection. Can you manipulate the input and take full control?

Easy Lab Difficulty

smog Creator

Local File Inclusion Category

Explore

Chad

A seemingly simple web monitoring tool has been deployed on the server. Something feels off—dig deeper, explore its features, and see where curiosity takes you.

Easy Lab Difficulty

archtrmntor Creator

CVE Category

Explore

Chatter

Play around with websockets, intercept messages, enumerate API endpoints and more with this awesome vulnerable chat API. Do you have what it takes to hack this API?

Medium Lab Difficulty

Kaizen226 Creator

Insecure Sockets Category

Explore

Git Hit

Gitlab is a great way to host code but hosting a self-managed instance can be dangerous can you show the owner of this server why this is the case?

Hard Lab Difficulty

parrotassassin15 Creator

Information Disclosure Category

Explore

SystemSpoils

Welcome to SystemSpoils, where you outsmart a tricky IIS server and a sneaky SMB share. Dive in, hack away, and uncover digital treasures!

Medium Lab Difficulty

parrotassassin15 Creator

Security Misconfiguration Category

Explore

NoteVault

NoteVault is a Linux CTF machine where persistence meets curiosity. A seemingly simple note-keeping service hides unexpected behaviors, and careful exploration of the system may reveal unconventional ways to turn small wins into full control.

Easy Lab Difficulty

archtrmntor Creator

File Upload Category

Explore

Simple

Step into this Windows 10 labyrinth with RDP and a few surprise services open. Navigate the quirky challenges, uncover hidden secrets, and see if you can outsmart the simplicity to capture the flag!

Easy Lab Difficulty

smog Creator

Insecure Network Services Category

Explore

Jigsaw

Can you crack the puzzle and find your way inside this confusing and puzzling machine? We dare you to give it a shot!

Hard Lab Difficulty

y2ksecurity Creator

Insecure Network Services Category

Explore

Aero Space

Can you find the vulnerabilities in this CMS? If so, be sure to report them to their GitHub : ).

Medium Lab Difficulty

parrotassassin15 Creator

SQL Injection Category

Explore

Forward

In the land of intranets and login screens there are often bypasses that go unnoticed, can you break through the security, bypass the login page, and gain access to the underlying operating system?

Easy Lab Difficulty

malwarekid Creator

Sql Injection Category

Explore

NonSense

Welcome to Nonsense, a CTF where your mission is to outwit a pfSense router box that thinks it's impenetrable. Can you find the hidden flag in this labyrinth of digital defenses, or will you be caught in a web of nonsense?

Easy Lab Difficulty

parrotassassin15 Creator

Security Misconfiguration Category

Explore

Ticket

Ticketing Systems are very common in day-to-day operations with IT. However, the infrastructure for these systems is often left un-secured because they are used internally and often made from scratch. Find the flaw in this application.

Easy Lab Difficulty

parrotassassin15 Creator

SQL Injection Category

Explore

Backdrop

Dive into the Backdrop CMS challenge! Unravel hidden secrets, tackle engaging tasks, and master the quirks of this unique CMS. Ready to crack the code?

Easy Lab Difficulty

smog Creator

RCE Category

Explore

Cyber Heist

Unravel GRPC secrets in Cyber Heist! Face fun and engaging tasks designed to test your skills in navigating complex GRPC environments. Participants will tackle challenges involving remote procedure calls, service definitions, and exploiting GRPC vulnerabilities to conquer the GRPC security landscape.

Medium Lab Difficulty

Kaizen226 Creator

Replay Attacks Category

Explore

Wallstreet Hijack

The gRPC stock trading service lacks robust protections against replay attacks. Exploit the weak security mechanisms to replay valid trade requests and manipulate stock values. Can you gain unauthorized profits by intercepting and replaying gRPC messages?

Hard Lab Difficulty

Kaizen226 Creator

Replay Attacks Category

Explore

Tiki 2

Embark on a thrilling CTF journey in the virtual Tiki world! Unravel the 'Insecure Deserialization' enigma, showcase your prowess, and emerge victorious in this cyber quest. Triumph awaits!

Hard Lab Difficulty

silky Creator

Insecure Deseralization Category

Explore

Dentist Office

Sharpen up your skills like under this under the bridge dentist sharpens teeth show us can you hack this website?

Easy Lab Difficulty

parrotassassin15 Creator

Weak Authentication Category

Explore

Abby's Lab - NCIS

No way! I'm getting hacked! Break through Abby's IPS in order to breach her system.

Hard Lab Difficulty

cypress Creator

IDOR Category

Explore

Wiki

Step into Sofia's Wiki, a Linux hosted wiki filled with intricate details and hidden treasures. uncover secrets buried within the pages, exploit upload functions, find hidden files and explore the Linux environment.

Medium Lab Difficulty

parrotassassin15 Creator

RCE Category

Explore

Convergence

This Information Security Influencer Has a Documentation Server. Clearly, they did not stay up to date with the cyber security news.

Easy Lab Difficulty

parrotassassin15 Creator

CVE Category

Explore

Header

Headers: the unsung heroes of the digital realm. Dive deep into the fascinating world of headers, where every line tells a tale, and every request holds a secret. From guiding data's dance to whispering web wishes, headers are the cool conductors of the cyber symphony. Join the header hullabaloo and discover the magic behind the scenes!

Medium Lab Difficulty

parrotassassin15 Creator

Multiple Injections Category

Explore

Solutions for

Products we offer

Products we offer

Products we offer

Products we offer

Parrot CTFs for Teams

Build cybersecurity talent.

Parrot CTFs for Education

Empower the next generation.

Parrot CTFs for Students

Start your cybersecurity journey.

Compliance-Focused Penetration Testing

NIS2 Compliance - Penetration Testing & Auditing

Parrot CTFs helps companies across Europe meet and maintain NIS2 compliance through trusted, transparent, and repeatable penetration testing. Get detailed audit-ready reports, real-world risk insights, and full lifecycle support.

Job Roles

Industries

Parrot CTFs Use Cases

Customer Stories

Hacking Glossary

Hacking Cheat Sheets

Help Center

Introduction to Parrot CTFs

Community

Get Help

From the Blog

New release: The latest on CVE-2025-29927 – NextJS Vulnerability

Company

Contact us

Connect

Why Parrot CTFs?

Featured News

Level Up Your Active Directory Hacking: Parrot CTFs Now Hosts GOAD by Orange Cyberdefense

Store

Start a free trial

Book a demo

Products we offer

Products we offer

Products we offer

NIS2 Compliance

Products we offer

Parrot CTFs Use Cases

Customer Stories

Hacking Glossary

Hacking Cheat Sheets

Help Center

Introduction to Parrot CTFs

From the Blog

New release: The latest on CVE-2025-29927 – NextJS Vulnerability

Why Parrot CTFs?

Featured News

Level Up Your Active Directory Hacking: Parrot CTFs Now Hosts GOAD by Orange Cyberdefense

Store

Engage with unique and diverse CTF machines

Step into a variety of specialized Pro Labs CTF machines meticulously designed to simulate authentic environments. Encounter diverse challenges that provide practical, hands-on learning experiences to enhance your skills in cybersecurity.

AUTHENTIC

HACKING

LAB MACHINES

Realistic Hacking Labs

Beginner & Intermediate Friendly

Capture The Flag Labs

Pro Labs For Real-world Security Challenges

Enhancing Cybersecurity Beyond Penetration Testing

Real-World Simulation in Cybersecurity: Evaluate, Adapt, Enhance

Preparation is the key for mastering Red Team

Complete Labs and Gain Practical Skills

Enhancing Security with Red Team Tactics

Fortifying Cyber Defenses

Parrot CTFs Labs Machines: Mastering Cybersecurity Skills Through Realistic CTF Challenges

Professional Labs

ArshaSpector

Archive Hunter

Share Me

Doom

Happi

Staging

Target

Marketer

Logger

PwnDoc

QuickScan