// 01
Accept the boundary
Only test systems you own or have explicit permission to test. The exercises here are demonstrations and intentionally vulnerable scenarios—not permission to poke somebody else's server.
// first run · about five minutes
Start without stepping on a rake
The current product is browser-based training with downloadable evidence files. You do not need Kali Linux, a VM, payment, or an account for your first challenge.
// 02
Open a beginner challenge
Choose an easy challenge, read the objective, inspect the supplied target or evidence, and use hints when you need them. Hints are instruction, not a moral failure.
// 03
Submit the flag
A flag looks like THTB{your_answer}. Static exercises ask the Worker to validate it. Browser-generated engine exercises are local and unranked until signed solve receipts exist.
// 04
Understand progress
Your grind is stored in this browser by default. An optional account can copy it to the cloud, but current ranks and badges are not proof of independently verified skill.
// 05 · follow the signal
The first run has a second layer
After your first clean solve, open the dashboard and hover or focus a locked badge. Its clue points toward the next move; earned badges explain what you actually did.
01solve cleanWake the first badge.
02read the locked clueBadges are breadcrumbs, not spoilers.
03inspect before sudoThe homepage terminal has rooms the nav never mentions.
$ clues
Keyboard users can focus every card and badge. Reduced-motion settings keep the signal still.
// what is live today
No fake cyber-range fog machine
Live: free browser exercises, daily challenges, downloadable artifacts, local badges and ranks, optional account sync, and the community forum. Not live: hosted vulnerable VMs, paid subscriptions, team billing, verified competitive rankings, or certifications.
Ready?
Start with the firewall exercise, then use the dashboard to choose the next weakest track.
begin challenge one read the faq