Starred by over 6,500 users on GitHub and trusted by organizations including Toyota, CTFd has been the leading open-source platform for hosting cybersecurity competitions since 2015, providing everything needed to run professional Capture The Flag events through a clean web-based administration panel without touching a database query. The framework supports both individual and team-based competitions with automatic tie resolution, configurable score freezing, and scoregraphs comparing the top teams with detailed progress tracking. Challenge creation offers static and regex-based flags, dynamic scoring that adjusts point values based on solve count, unlockable hints purchasable with points, file attachments uploaded to local storage or Amazon S3-compatible backends, and challenge attempt limits with automatic bruteforce protection. Version 3.8 introduced challenge logic fields controlling flag submission behavior with any, all, and team modes, integrated dynamic scoring into the standard challenge type, participant ratings and reviews on challenges, and admin-stored challenge solutions viewable after competition. The Markdown-based content management system enables custom pages for rules, FAQs, and resources, while SMTP and Mailgun integration handles email confirmation and password recovery. The plugin architecture supports custom challenge types, flag validators, and scoring algorithms, while the theme system provides complete visual customization. Import and export functionality preserves entire competition configurations for archival and reuse across events. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

When cybersecurity instructors and competition organizers host Capture The Flag tournaments, GZCTF orchestrates isolated per-team challenge containers, dynamic anti-cheat flags, and live exponential scoreboards from a single web platform. Event administrators can configure four distinct challenge modes covering static attachments, team-specific dynamic attachments, shared static containers, and isolated dynamic containers where unique flags are injected into each team's environment at launch. A customizable exponential scoring engine adjusts point values automatically as more teams solve a problem while awarding first, second, and third blood bonuses to top contenders. Built-in flag-sharing detection monitors every submission in real time, flagging suspicious cross-team flag reuse alongside live event streams and container logs. Participants can group into divisions, track their ranking trajectory on interactive score timelines, and upload post-game writeups directly into the portal for organizer review and batch archiving. Built-in network proxying forwards challenge traffic over WebSocket tunnels with optional packet capture so referees can audit exploit payloads during active matches. Multi-language localization, customizable branding, invitation gates, and email domain restrictions adapt the portal to university courses, corporate security drills, or international tournaments. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

A hacking gym for AI apps: every lab is a chatbot or agent with a planted weakness, and your job is to exploit it and capture the flag. The dashboard tracks score, rank, badges, and a live activity feed across three tiers. Ten core labs map to the OWASP Top 10 for LLM Applications, ten advanced labs need multi-turn tactics like persona escalation, stored injection, and tool chaining, and an encrypted expert tier unlocks last. Each lab opens with a short reference panel on the weakness, offers hints, and ends with the defense that would have stopped you. Play mode uses scripted assistants so flags reproduce every time and the whole range runs offline without API keys. Live mode points attacks at a real local model through Ollama, mints a fresh secret per session, streams replies token by token, and checks the output instead of a flag box. Scenarios cover direct prompt injection, a hidden payload in an uploaded image, and unsafe rendering of model output. A RAG lab accepts text and markdown uploads, so poisoning a knowledge base is hands-on. Two themes, Neon and Phosphor green-CRT, change the look. Security teams run workshops with it, red teamers sharpen prompt injection skills, and developers see why their guardrails fail. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.