Are "Practice CTFs" a "pentest tool"?

[0xACAB]

No doubt that practicing our skills is important and CTFs provide a lot of opportunity for doing that. My question is twofold:

• Given that there are numerous lists of wargaming/hacking challenge sites (like Zapya's list and the AnarchoTechNYC Meta Wiki's Infosec § Hacking challenges list), is including them here useful? If so, cool, I have a lot of suggestions. ;)
• I'm not sure these are "practice CTFs" because "CTF" has a specific meaning; these are probably better termed "challenge sites" or "wargames."

CC: @techgaun, who I've asked questions like this before (in pull requests).

[Samar Dhwoj Acharya]

@meitar I agree that Practice CTFs are not pentest tool. However, I think they can be quite useful.. Also, its true that there are way too many wargaming/hack challenge sites. Maybe a better strategy is to extract all the such wawrgames/sites into a new markdown file (or even the repo like awesome-hack-challenges?). If there's some good resource, I believe its just better to just put a link on the https://github.com/enaqx/awesome-pentest#awesome-lists section.

[0xACAB]

@techgaun I'm not aware of a current/existing awesome-hacking-challenges Awesome List, but I do know of this list of hacking challenge sites, which is not Awesome-List style but is relatively comprehensive and growing. Alternatively, I'd support making an Awesome List.

Either way, I do think a second list that this list links to is probably better (and more maintainable) than including that kind of list in this resource, simply because the nature of the thing is markedly different from listing awesome tools, which is what awesome-pentest purports to be.

[Samar Dhwoj Acharya]

@meitar Sorry for not getting back earlier. I agree with you 100%. If you wanna go ahead and build such awesome list, I would be happy to contribute on that. I see that you are also part of the repo/wiki you linked above so maybe its better if you take lead here and we all as a community help grow it.

[0xACAB]

@techgaun Thanks, although I'm not sure I know what to do. Most "Awesome" lists seem focused on tools, including @apsdehal's awesome-ctf, so I don't know if those lists would want to become a place to list challenge sites. There's also no place in the current awesome-pentest guide that I can see where it really makes sense to link to the repo/wiki I pointed out, above.

That being said, I do think the person who added the "practice CTFs" section has a good idea: there should be an easy way to find challenge sites where we can practice using the tools listed in awesome-pentest and elsewhere. This is what the InfoSec § Hacking challenges page is for but, again, it's not an "Awesome" list and probably won't be.

So my suggestions, in order of preference, are:

1. If it's okay to add a link to that section in awesome-pentest, even though it's not an Awesome list, I propose we remove the "Practice CTFs" section and instead add a line-item to either the "Online resources" or, better, the "Awesome Lists" section linking to that repo's InfoSec § Hacking challenges page.
2. Find another Awesome List that already exists, such as awesome-ctf and ask if they are interested in housing that kind of information.
3. Start a new Awesome-formatted list specifically for online resources such as hacking challenges. This last item, if it's what we choose to do, could be hosted on the same repository as the wiki page that I linked above, since I am one of the maintainers with enough access to make that happen.

I've submitted PR #126 implementing my first choice, described in the list above, to get the ball rolling.

[Samar Dhwoj Acharya]

@meitar I agree with your proposition and thanks for the PR. This is awesome. And, thanks for the continued contribution.