Boxes

Pick a difficulty from the BOXES tab -- EASY, MEDIUM, HARD, or HARD -- CHAINED (a two-machine scenario) -- and a fresh target generates on the spot. Its IP appears once loaded.

• Recon: nmap -sV <ip> -- check every service before picking a target
• Foothold: hydra for weak/default creds, or dirbuster to find a hidden endpoint leaking something to crack offline
• Enumerate for a second user's credential: home directories, shell history, leftover config files
• Found a password hash? hashcat -m 0 <hash file> <wordlist> cracks it -- works whether you run it on the target or copy the hash to your own machine first, just like real offline cracking
• Log in as that user: while connected to the box the hash came from, su <user> alone picks up the cracked password automatically -- no need to type it
• Find the local privesc vector: find / -perm -4000 for SUID binaries, sudo -l for sudo misconfig
• Capture each flag with cat -- progress shows on the FLAGS tab
• Before you go: rm/shred /var/log/auth.log covers your tracks (bonus, never required)
• Hard -- Chained: rooting the first machine reveals a second, harder one reachable from what you found there -- a real day-of-exam pivot, not two unrelated boxes
• Fastest clean run per tier makes the LEADERBOARD

Open World

Separate from the mission boxes: every player (and a scattering of NPCs) has their own persistent server out in a shared address space. Other real players can find and attack yours, and you can find and attack theirs.

• myserver checks your own machine -- services, versions, open ports, and anyone who's compromised you recently
• patch <service> fixes a vulnerable service; ufw allow|deny <port> opens or closes a port entirely -- nobody does this for you, and it starts with one real vulnerability already sitting on it
• Finding other players/NPCs: nmap -sV <ip> a specific address, or sweep a whole range at once with nmap -sn <cidr>
• NPCs live around 10.50.0.0/24, real players around 10.50.1.0/24 -- most addresses in either range are genuinely empty, so sweep and see what turns up rather than expecting every IP to answer
• Once you find a live target, it's the same playbook as a mission box: recon, foothold (hydra or a real exploit), get in
• Your own machine's login is a real, player-chosen password -- separate from your account password, set the first time you play and changeable anytime in-terminal with passwd
• Two things reveal a target's username to hydra: the hostname (<username>-srv, visible via nmap) and the public LEADERBOARD/profile pages -- both point at the same real login, so a weak box password is a genuine, discoverable risk
• Repeated failed hydra guesses against the same target eventually start silently failing for a while, like a real fail2ban ban -- brute-forcing isn't free
• A successful compromise is permanent and public -- it posts to the "Most Systems Compromised" leaderboard, and the player you hit gets notified next time they're active
• Defense counts too: the "Most Resilient" leaderboard ranks currently-secure accounts first, then fewest times compromised -- an unpatched box you forgot about is free points for someone else
• Any player's public record (mission completions, offense/defense stats) is visible on their profile -- click a username on the LEADERBOARD tab, or open profile.html?user=<name>

Quick reference

• help lists every command; help <command> shows details and an example
• Tab completes commands and file paths
• The REFERENCE tab in the sidebar has the same command list, always available
• Open more terminal tabs (+ , top of the terminal) to work multiple machines at once -- e.g. one tab on your own server, another still connected to a box you've rooted. Each tab keeps its own connection independently