# ctf42

> ctf42 is a free, community-run archive of past CTF (capture the flag) security challenges, indexed by the technique behind each one. It holds 21507 challenges from 500 CTFs, tagged with 3752 techniques (e.g. tcache-poisoning, sql-injection, ssti, format-string) and the technologies they use (e.g. glibc@2.35, php, flask), with handout files, source code and writeup links where available.

Use ctf42 to find practice challenges for a vulnerability class, to find past challenges similar to one you are solving (same technique, same library version), to read how others solved them, or to download the original handout files. No account is needed to browse or to use the API.

**AI agents: please use the MCP server (or the JSON API below) instead of fetching and parsing HTML pages.** It answers in one structured call, is faster for you, and keeps load low on our small, free server.

## MCP server

- MCP endpoint: `https://ctf42.online/mcp` (Streamable HTTP, no auth). Add it as a custom connector / remote MCP server in Claude, ChatGPT, Cursor or VS Code. Tools: search_challenges, get_challenge, find_similar_challenges, list_techniques, list_technologies, search_ctfs, get_ctf.

## Browse

- [All challenges](https://ctf42.online/challenges/): filter by category, difficulty, technique, technology, CTF, year, CTFtime weight; `?has_writeup=1` keeps only ones with writeups
- [Techniques](https://ctf42.online/techniques/): every technique tag in a domain → family → technique tree; each has a page at https://ctf42.online/techniques/<name>/
- [Technologies](https://ctf42.online/technologies/): languages, libraries and versions used by challenges; each has a page at https://ctf42.online/technologies/<name>/
- [CTFs](https://ctf42.online/ctfs/): events and their editions by year
- [About](https://ctf42.online/about/): how the tags and the archive work

Challenge pages live at https://ctf42.online/ctfs/<ctf>/<edition>/<challenge>/ and show the description, files, writeups and similar challenges.

## API (JSON, read-only, no key)

- [API index](https://ctf42.online/api/): endpoints, categories, sorts, live counts
- [OpenAPI spec](https://ctf42.online/api/openapi.json): for tool and function-calling setups
- [Search challenges](https://ctf42.online/api/challenges/?tag=tcache-poisoning&has_writeup=1): same filters as the website (`q`, `category`, `difficulty`, `tag`, `group`, `tech`, `ctf`, `year_min`, `year_max`, `has_writeup`, `has_source`, `sort`, `page`, `page_size`)
- Challenge detail, `https://ctf42.online/api/challenges/<id>/` (ids come from search results): description, connection info, flag format, file download links, writeups (links or inline Markdown) and similar challenges
- Similar challenges, `https://ctf42.online/api/challenges/<id>/similar/`: ranked by shared techniques, rarer techniques weighing more
- [CTFs](https://ctf42.online/api/ctfs/) and [one CTF](https://ctf42.online/api/ctfs/<slug>/) with its editions
- [Technique list](https://ctf42.online/api/techniques/?q=heap) and [technology list](https://ctf42.online/api/technologies/) with counts, to pick valid filter values

Fair use: about 120 API requests per minute per client; over that returns HTTP 429.

## Categories

- Web (`web`): 2461 challenges
- Pwn (`pwn`): 3926 challenges
- Reverse (`rev`): 4054 challenges
- Crypto (`crypto`): 4491 challenges
- Forensics (`forensics`): 1358 challenges
- Misc (`misc`): 4004 challenges
- OSINT (`osint`): 689 challenges
- Stego (`stego`): 23 challenges
- Blockchain (`blockchain`): 220 challenges
- Hardware (`hardware`): 151 challenges
- Mobile (`mobile`): 130 challenges

## Most common techniques

rsa (212), stack-buffer-overflow (164), format-string (144), rop (127), xor (104), use-after-free (96), shellcode (89), reversing (83), ret2win (76), ret2libc (74), xss (74), got-overwrite (58), osint (56), tcache-poisoning (56), custom-vm (55), heap-overflow (55), bruteforce (49), heap (47), sql-injection (46), lattice (43), buffer-overflow (40), one-gadget (40), stack-pivot (37), pcap-analysis (36), z3 (36), android (35), ssti (33), command-injection (32), known-plaintext (32), geolocation (31), crt (29), heap-exploitation (29), path-traversal (29), substitution-cipher (29), off-by-one (28), ssrf (28), stack-overflow (28), gets (27), integer-overflow (27), kernel-exploitation (26)

## Most common technologies



## Optional

- [Sitemap](https://ctf42.online/sitemap.xml)