Secure Development CTF
CTF opens
Break real vulnerabilities in six OWASP training apps, patch them for real, and ship the fix as a GitHub pull request. CI validates your patch and scores it automatically — practice the full secure development lifecycle, not just flag-hunting.
What to expect
Every challenge maps to a real, disclosed vulnerability class from the OWASP Top 10. You find it, patch it, and prove the fix with a passing regression test — the same loop a security engineer runs against a live codebase.
Choose from six real, deliberately vulnerable OWASP apps — Juice Shop, DVWA, WebGoat, Security Shepherd, VulnerableApp, and VAmPI.
Work through the OWASP Top 10 (Web and API) to identify a real flaw in the target's source — use AI tooling to speed up analysis if you like.
Fix the vulnerability in your fork, then submit a pull request against the repo's dc34-ctf branch. This is secure development, not flag hunting.
A GitHub Action runs that challenge's regression test against your patched app. A passing test scores points immediately — no manual grading.
Six real targets
Each app is a well-known, deliberately vulnerable OWASP project. Points scale with difficulty — the deeper flaws in VulnerableApp and WebGoat pay out the most.
Damn Vulnerable Web Application — PHP classics at three security levels.
The classic deliberately-insecure web shop. OWASP Web Top 10.
Web and mobile security training platform with layered challenge levels.
Vulnerable REST API — the OWASP API Security Top 10 track.
OWASP's extensible vulnerability playground — the deepest challenge pool.
OWASP's guided insecure Java app — lesson-driven exploitation and fixes.
Sign in with GitHub to claim your row on the leaderboard, follow your patched and non-patched count per app on your profile, and team up with other contestants.