About This Collection
CTF challenges are one of the best ways to build real cloud security intuition. This page collects free and open-source challenges covering the major cloud providers, Kubernetes, identity, AI/LLM safety, CI/CD, and incident response. Difficulty ranges from beginner-friendly browser challenges to multi-stage vulnerable environments you deploy in your own cloud account.
Know of a CTF we're missing? See how to contribute
or run python3 tools/submit_ctf.py.
🏆 Wiz Cloud Security Championship
A 12-month series of cloud security challenges from Wiz research, running June 2025 – May 2026. Points vary by difficulty; track your score on the Championship leaderboard.
Perimeter Leak
Extract secrets from a hardened AWS data perimeter. 10 points.
Contain Me If You Can
Escape the container and extract the flag from the host filesystem. 20 points.
Breaking The Barriers
Exploit OAuth and Entra ID misconfigurations to reach restricted resources. 10 points.
Needle in a Haystack
Use recon techniques to uncover hidden infrastructure and extract sensitive data. 20 points.
Game of Pods
Escalate privileges in Kubernetes and capture the flag. 30 points.
Malware Busters!
Reverse the malware and extract the flag. 10 points.
State of Affairs
Exploit Terraform automation running inside a container to extract the flag. 20 points.
Confession Booth
A "safe space" for hackers. What could go wrong? 30 points.
Trust Issues
Investigate a breach and uncover how company data was exfiltrated. 20 points.
Happy Birthday
Celebrate S3's 20th birthday by finding the hidden present. 20 points.
Mystery Challenge
Details coming soon. Check the Championship portal for updates.
Mystery Challenge
Details coming soon. Check the Championship portal for updates.
🧩 Wiz Standalone Challenges
Always-available Wiz CTFs outside the monthly Championship.
Wiz CTF Portal
Central hub for all Wiz CTF challenges, with leaderboards and progress tracking.
EKS Cluster Games
Start inside a vulnerable EKS pod; exploit misconfigurations to capture flags.
The Big IAM Challenge
AWS IAM privilege escalation and permission boundaries. Browser-based, no AWS account.
K8s LAN Party
Network misconfigurations and vulnerabilities in a Kubernetes cluster, with leaderboard.
The Cloud Hunting Games
Incident-response CTF: investigate a suspicious breach at a fictional startup.
The Prompt Airlines AI Security Challenge
Exploit prompt injection and AI logic flaws to get a free flight from a chatbot.
☁️ AWS CTFs
flAWS
Original six-level AWS CTF teaching common misconfigurations. Browser-based.
flAWS2
Serverless-focused AWS CTF with both Attacker and Defender tracks.
CloudGoat
Deliberately vulnerable AWS deployment for learning cloud penetration testing.
IAM Vulnerable
31 AWS IAM privilege-escalation attack paths, deployed via Terraform.
CloudFoxable
Vulnerable AWS scenarios designed to be enumerated with the CloudFox tool.
ServerlessGoat
OWASP project with a deliberately vulnerable AWS Lambda app.
Damn Vulnerable Cloud Application
Intentionally vulnerable AWS application for learning privilege-escalation techniques.
🪟 Azure CTFs
🔶 GCP CTFs
⎈ Kubernetes CTFs
OWASP EKS Goat
20+ attack-defense labs on AWS EKS covering RBAC, IAM, and pod breakouts.
Kubernetes Goat
Interactive Kubernetes security learning platform for GKE, EKS, AKS, or local K3S.
Bust a Kube
Offline VMware VMs with vulnerable Kubernetes clusters for local practice.
Kube Security Lab
14 vulnerable Kubernetes cluster configs deployable locally via Docker + Kind.
🌐 Multi-Cloud CTFs
🎯 AI, Secrets, and CI/CD CTFs
Contribute a CTF
Found a cloud CTF we haven't listed? Open a pull request or use our submission tool:
python3 tools/submit_ctf.pySee the CTF contribution guide for details on the card format, sections, tags, and the submission script.